File size: 5,013 Bytes
b2f96bc | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 | # Limitations
Execution Fidelity Guard reduces a narrow class of execution drift. It cannot prove that arbitrary Agent behavior is safe or correct.
## Coverage gaps
- Hosted WebSearch and other hosted tools do not use the local function-tool Hook path.
- `write_stdin` transports an existing unified-exec session and does not trigger a second `PreToolUse` decision.
- Specialized tool paths can opt out of Hooks.
- The Codex IDE extension does not currently support plugins.
- A command can invoke a script whose later behavior is invisible to command-prefix classification.
- Common shell wrappers are inspected, but generated scripts, interpreters, and indirect process launch can still hide later behavior.
- A Hook can observe only the event fields Codex provides.
## Decision limits
- Natural-language interpretation is advisory and never a hard-block authority.
- `authorization.allowed` is not an exhaustive allowlist. Unlisted actions are
not denied unless an explicit `forbidden`, `must_not`, or `requires_user`
rule matches.
- The classifier intentionally prefers false negatives to broad semantic false positives.
- `PermissionRequest` fires only when Codex already needs approval. The guard abstains unless it finds an explicit conflict.
- `PostToolUse` happens after side effects and cannot roll them back.
- Evidence type matching does not prove the artifact satisfies a natural-language requirement. Such requirements need an explicit contract-bound evidence record.
- CLI evidence supplied with `--artifact` is read and hashed by Guard, but
the caller still chooses the status and requirement. Byte observation does
not prove the claim is true or the artifact is semantically sufficient.
- CLI evidence supplied as a label plus digest remains caller-attested.
- Objective, primary object, delivery surface, scope, and must fields are
bounded Agent context, not deterministic gate inputs in 0.2.2. Cost is not
represented in the 0.2.2 contract. Hard decisions use explicit structured
action, tool, or command-prefix rules only.
- Stop is a turn boundary. A warning after the two-attempt cap is not a completion verdict.
## Operational limits
- Node.js 20 or later must be available to the Codex process.
- Command Hooks start a Node process for each event. The exact 0.2.2 Windows
source snapshot measured 134.57 ms p95 over 100 continue-path runs with
persistence disabled, while 100 empty Node processes in the same run measured
117.13 ms p95.
The latter is diagnostic only and is not subtracted from Guard latency. The
full path remains above the provisional 100 ms PRD target. Other hosts can
differ.
- State is local to the configured Codex home unless `EFG_STATE_DIR` changes it.
- With `EFG_PERSIST=false`, later Hook events cannot use evidence from earlier events.
- Overlapping local Stop processes that share one state root use an exclusive
owner-token file lock and one atomic counter. A stale lock is reclaimed only
after 30 seconds when its same-host process is known to be dead; release uses
an owner check plus atomic rename so an old holder cannot unlink a new lock.
The cap is not global across machines, different state roots, erased state,
or filesystems that do not preserve the required exclusive-create and rename
semantics. A lock failure produces a reminder and no automatic continuation.
- The live Intent Loop adapter and Continuity bridge are not implemented; the
provider interface is a local file and the Continuity schema is reserved.
- The separate unofficial DeepSeek Harness adapter is pinned to upstream
`0.1.2-alpha.2`, stores receipts only in memory, and has no locally installed
profile walkthrough in this release process.
- A provider projection hash validates one document but does not prove global
contract-version monotonicity across erased state.
- Receipt files are not signed and can be modified by a local process with filesystem access.
- State reads, writes, pruning, and deletion reject link or junction components
and oversized records. A hostile local process with concurrent filesystem
access is still outside the security boundary.
- Windows ACL inheritance is platform-managed; the runtime requests restrictive file modes where the platform supports them.
- There is no remote dashboard, telemetry service, or cross-machine synchronization.
- The repository can aggregate pseudonymous receipt bundles toward a shadow
sample target. Only sessions whose events consistently record
`guard_mode=shadow` count toward that gate. No 100-task real shadow cohort or
800-task controlled online comparison has been completed for this release.
In `shadow`, pending-tool conflicts are non-blocking reminders and completion
gaps are recorded without turn steering. `balanced` is the only enforcing and
completion-continuing mode; `off` emits no Hook policy or context output.
Use `shadow` mode first and inspect real would-block receipts before enabling `balanced` in consequential workflows.
|