# Codex native compatibility — 2026-09-25

These checks use development source after the published SDK 0.1.0 release.
The tested installation is **Codex CLI 0.157.0 on Linux x64**:

- Native executable SHA-256:
  `1a822376d4634ac32dddc030e5117c63359f7f8cd4b1b64382c68190287d0258`.
- Adjacent `codex-code-mode-host` SHA-256:
  `ae34226adad3fe8acb361a78618e81b5a17638861bb7a689fcccaf8c3ef32aa8`.

The adapter accepts this exact CLI version. Other versions fail preflight with
`CLI_UPGRADE_REQUIRED` before application content is submitted. Qualification
here is Linux-only; client CI does not certify native execution on other systems.

## Correction to the earlier tool check

The initial `codex exec --json` fixture inspected only the top-level Responses
`tools` field. GPT-6 Luna uses Responses Lite, which carries its catalog in
`additional_tools` input items. The check missed native patch, image, goal and
collaboration tools. The claim that no native tools were advertised is withdrawn;
AD-021 was reopened and live app runs were held. Earlier text, cancellation and
usage observations remain valid for that source but do not prove tool isolation.
Published 0.1.0 retains the older exec route.

Development source now uses the official
[app-server protocol](https://learn.chatgpt.com/docs/app-server). Both
`thread/start` and `turn/start` receive `environments: []`, disabling environment
access. Threads are ephemeral, retain the native read-only sandbox and never
grant approvals. Model fallback is disabled. No application tools or capability
roots are registered. The SDK disables agents, goals, hooks, plugins, apps and
web search, then disables each inherited MCP server before creating the thread.
An empty MCP table alone does not remove inherited entries. Ambiguous server
names fail before thread creation.

These contracts are pinned in the native
[app-server protocol](https://github.com/openai/codex/blob/rust-v0.157.0/codex-rs/app-server-protocol/src/protocol/v2.rs)
and [tool planner](https://github.com/openai/codex/blob/rust-v0.157.0/codex-rs/core/src/tools/spec_plan.rs).
The SDK does not patch the native binary or disable account/network policy.

## Native fixture evidence

All **24 checks** passed against the complete native installation, using
synthetic credentials and a loopback Responses/OAuth service without external
connectivity:

- Two selected accounts, explicit `gpt-6-luna` and medium reasoning, text,
  progress, reported usage and diagnostic redaction.
- Missing sign-in, successful native managed-session refresh and persistence,
  and expired/reused/revoked refresh-token failures.
- Authentication, rate-limit, missing-model and unknown provider errors.
- Effective tools in both top-level and Responses Lite catalogs. The tested
  catalog contains `functions.exec`, `functions.wait` and
  `functions.request_user_input_async`; the only nested code tool is
  `clock__curr_time`.
- Actual attempts to use shell execution, patches, image reads, agent spawning,
  MCP, goals, nested shell calls, filesystem imports and network fetches are
  denied. No fixture file is created and no private context/image is returned.
  Native denial can be returned to the model so it can continue with text;
  that does not indicate a successful tool operation.
- A probe inside the native code runtime exposes only the clock tool. `fetch`,
  `process`, `require` and `Deno` are undefined; importing `node:fs` is rejected.
- Seeded ambient hooks/MCP processes do not start. Cancellation closes the model
  stream and leaves no owned native/helper processes alive.

Calculation and clock utilities remain available internally. This is an audited
restricted surface, **not an empty native tool catalog**. `tools: false` means
registered application tools are unsupported. Separate SDK protocol fixtures
verify that requests for tools, approvals, permissions, authentication callbacks
and user interaction fail without a grant. Unexpected operation items and
mismatched thread/turn messages also fail. The adapter emits completed message
items and uses native deltas for progress; `textStreaming` remains `false`.

## Refresh and policy changes

Successful synthetic refresh made one OAuth call and one model request. In
0.157.0, startup token rotation can invalidate the initial native network-policy
generation. The SDK reopens the process once only when that exact startup error
occurs before initialization replies. No thread or prompt has been sent. The
replacement process loads current native policy; no permission is relaxed.
The fixture records two native processes but only one generation request.

This recovery cannot apply after initialization or to a submitted prompt.
Repeated startup policy changes fail as `CLI_POLICY_CHANGED`. Permanent refresh
failures return `CLI_AUTH_REQUIRED` without restarting the process or changing
stored credentials. Each expired/reused/revoked fixture recorded two native
refresh attempts and two rejected model requests within one process. These are
native recovery attempts, not repeated SDK runs.

The fixture wrapper sets `CODEX_REFRESH_TOKEN_URL_OVERRIDE` to its local OAuth
server; the SDK environment allowlist excludes that variable. Real credentials
are never read, copied, invalidated or forced to expire by these tests. Native
Codex owns sign-in and storage. Synthetic refresh tests do not certify external
authorization-server availability.

## Context and isolation limits

Global `AGENTS.md` and global skill descriptions still enter the prompt,
including with host skill discovery disabled. The fixture separately verifies
that its account-level developer instruction and parent workspace marker do not
enter the request. App-server configuration is read through the native protocol
to disable inherited MCP entries; this is not exec's `--ignore-user-config` mode.
Restrictions override relevant settings without claiming to remove all native
personalization.

For application-only context, use a dedicated OS user or container with a clean
home and sign in normally there. `accountDirectory` alone does not hide global
skills. These controls are not a general OS sandbox or a boundary between
mutually untrusted tenants. The SDK does not alter user configuration, remove
user files or copy credentials.

## Live requalification

The user selected the existing local sign-in, `gpt-6-luna`, medium reasoning.
At 17:24 UTC the revised adapter returned exactly `AGENTICDRIVER_APP_SERVER_OK`
for run `3cf915a4-17ef-48fd-bdca-06dbde758966`. It emitted native progress, text,
reported usage and completion. Usage was 10,184 input, 12 output, zero cached
input and zero reasoning tokens. These are native measurements, not an inferred
subscription charge. Owned processes were reaped.

At 17:26 UTC, run `41ee194f-bd64-4aa9-8797-86e04a2d0a34` was cancelled two
seconds after the native `turn/start` request. The SDK returned `CANCELLED`
without text or usage. A follow-up process check confirmed the owned processes
were reaped; they were not all gone at the immediate terminal-event observation.
Remote inference stop time and consumed quota remain unknown.

Other models, accounts, versions, operating systems and application workflows
require their own evidence. Native application tools remain separate AD-009 work.

## Reproduce

Install Linux bubblewrap, Python 3.10+ and Node.js. Supply the absolute native ELF
path, not the npm JavaScript launcher, and retain its adjacent
`codex-code-mode-host` so missing components cannot hide tool behavior.

```sh
npm ci
npm run test:codex-native -- \
  --binary /absolute/path/to/native/bin/codex \
  --receipt /tmp/codex-native-receipt.json
```

The runner hides the real home and `/tmp`, disables external networking and uses
synthetic accounts. The wrapper changes only fixture endpoints, credential-store
and telemetry settings; restrictions come from the real SDK. Receipts record
native/helper and adapter/process-runner hashes, source revision/dirty state,
the effective catalog and individual results. Fixture watchdogs bound test
infrastructure only. SDK run and inactivity timeouts remain disabled by default.