mirror/codex/docs/limitations.md

Limitations

Execution Fidelity Guard reduces a narrow class of execution drift. It cannot prove that arbitrary Agent behavior is safe or correct.

Coverage gaps

• Hosted WebSearch and other hosted tools do not use the local function-tool Hook path.
• write_stdin transports an existing unified-exec session and does not trigger a second PreToolUse decision.
• Specialized tool paths can opt out of Hooks.
• The Codex IDE extension does not currently support plugins.
• A command can invoke a script whose later behavior is invisible to command-prefix classification.
• Common shell wrappers are inspected, but generated scripts, interpreters, and indirect process launch can still hide later behavior.
• A Hook can observe only the event fields Codex provides.

Decision limits

• Natural-language interpretation is advisory and never a hard-block authority.
• authorization.allowed is not an exhaustive allowlist. Unlisted actions are not denied unless an explicit forbidden, must_not, or requires_user rule matches.
• The classifier intentionally prefers false negatives to broad semantic false positives.
• PermissionRequest fires only when Codex already needs approval. The guard abstains unless it finds an explicit conflict.
• PostToolUse happens after side effects and cannot roll them back.
• Evidence type matching does not prove the artifact satisfies a natural-language requirement. Such requirements need an explicit contract-bound evidence record.
• CLI evidence supplied with --artifact is read and hashed by Guard, but the caller still chooses the status and requirement. Byte observation does not prove the claim is true or the artifact is semantically sufficient.
• CLI evidence supplied as a label plus digest remains caller-attested.
• Objective, primary object, delivery surface, scope, and must fields are bounded Agent context, not deterministic gate inputs in 0.2.2. Cost is not represented in the 0.2.2 contract. Hard decisions use explicit structured action, tool, or command-prefix rules only.
• Stop is a turn boundary. A warning after the two-attempt cap is not a completion verdict.

Operational limits

• Node.js 20 or later must be available to the Codex process.
• Command Hooks start a Node process for each event. The exact 0.2.2 Windows source snapshot measured 134.57 ms p95 over 100 continue-path runs with persistence disabled, while 100 empty Node processes in the same run measured 117.13 ms p95. The latter is diagnostic only and is not subtracted from Guard latency. The full path remains above the provisional 100 ms PRD target. Other hosts can differ.
• State is local to the configured Codex home unless EFG_STATE_DIR changes it.
• With EFG_PERSIST=false, later Hook events cannot use evidence from earlier events.
• Overlapping local Stop processes that share one state root use an exclusive owner-token file lock and one atomic counter. A stale lock is reclaimed only after 30 seconds when its same-host process is known to be dead; release uses an owner check plus atomic rename so an old holder cannot unlink a new lock. The cap is not global across machines, different state roots, erased state, or filesystems that do not preserve the required exclusive-create and rename semantics. A lock failure produces a reminder and no automatic continuation.
• The live Intent Loop adapter and Continuity bridge are not implemented; the provider interface is a local file and the Continuity schema is reserved.
• The separate unofficial DeepSeek Harness adapter is pinned to upstream 0.1.2-alpha.2, stores receipts only in memory, and has no locally installed profile walkthrough in this release process.
• A provider projection hash validates one document but does not prove global contract-version monotonicity across erased state.
• Receipt files are not signed and can be modified by a local process with filesystem access.
• State reads, writes, pruning, and deletion reject link or junction components and oversized records. A hostile local process with concurrent filesystem access is still outside the security boundary.
• Windows ACL inheritance is platform-managed; the runtime requests restrictive file modes where the platform supports them.
• There is no remote dashboard, telemetry service, or cross-machine synchronization.
• The repository can aggregate pseudonymous receipt bundles toward a shadow sample target. Only sessions whose events consistently record guard_mode=shadow count toward that gate. No 100-task real shadow cohort or 800-task controlled online comparison has been completed for this release.

In shadow, pending-tool conflicts are non-blocking reminders and completion gaps are recorded without turn steering. balanced is the only enforcing and completion-continuing mode; off emits no Hook policy or context output.

Use shadow mode first and inspect real would-block receipts before enabling balanced in consequential workflows.