Codex native compatibility — 2026-09-25

These checks use development source after the published SDK 0.1.0 release. The tested installation is Codex CLI 0.157.0 on Linux x64:

• Native executable SHA-256: 1a822376d4634ac32dddc030e5117c63359f7f8cd4b1b64382c68190287d0258.
• Adjacent codex-code-mode-host SHA-256: ae34226adad3fe8acb361a78618e81b5a17638861bb7a689fcccaf8c3ef32aa8.

The adapter accepts this exact CLI version. Other versions fail preflight with CLI_UPGRADE_REQUIRED before application content is submitted. Qualification here is Linux-only; client CI does not certify native execution on other systems.

Correction to the earlier tool check#

The initial codex exec --json fixture inspected only the top-level Responses tools field. GPT-6 Luna uses Responses Lite, which carries its catalog in additional_tools input items. The check missed native patch, image, goal and collaboration tools. The claim that no native tools were advertised is withdrawn; AD-021 was reopened and live app runs were held. Earlier text, cancellation and usage observations remain valid for that source but do not prove tool isolation. Published 0.1.0 retains the older exec route.

Development source now uses the official app-server protocol. Both thread/start and turn/start receive environments: [], disabling environment access. Threads are ephemeral, retain the native read-only sandbox and never grant approvals. Model fallback is disabled. No application tools or capability roots are registered. The SDK disables agents, goals, hooks, plugins, apps and web search, then disables each inherited MCP server before creating the thread. An empty MCP table alone does not remove inherited entries. Ambiguous server names fail before thread creation.

These contracts are pinned in the native app-server protocol and tool planner. The SDK does not patch the native binary or disable account/network policy.

Native fixture evidence#

All 24 checks passed against the complete native installation, using synthetic credentials and a loopback Responses/OAuth service without external connectivity:

• Two selected accounts, explicit gpt-6-luna and medium reasoning, text, progress, reported usage and diagnostic redaction.
• Missing sign-in, successful native managed-session refresh and persistence, and expired/reused/revoked refresh-token failures.
• Authentication, rate-limit, missing-model and unknown provider errors.
• Effective tools in both top-level and Responses Lite catalogs. The tested catalog contains functions.exec, functions.wait and functions.request_user_input_async; the only nested code tool is clock__curr_time.
• Actual attempts to use shell execution, patches, image reads, agent spawning, MCP, goals, nested shell calls, filesystem imports and network fetches are denied. No fixture file is created and no private context/image is returned. Native denial can be returned to the model so it can continue with text; that does not indicate a successful tool operation.
• A probe inside the native code runtime exposes only the clock tool. fetch, process, require and Deno are undefined; importing node:fs is rejected.
• Seeded ambient hooks/MCP processes do not start. Cancellation closes the model stream and leaves no owned native/helper processes alive.

Calculation and clock utilities remain available internally. This is an audited restricted surface, not an empty native tool catalog. tools: false means registered application tools are unsupported. Separate SDK protocol fixtures verify that requests for tools, approvals, permissions, authentication callbacks and user interaction fail without a grant. Unexpected operation items and mismatched thread/turn messages also fail. The adapter emits completed message items and uses native deltas for progress; textStreaming remains false.

Refresh and policy changes#

Successful synthetic refresh made one OAuth call and one model request. In 0.157.0, startup token rotation can invalidate the initial native network-policy generation. The SDK reopens the process once only when that exact startup error occurs before initialization replies. No thread or prompt has been sent. The replacement process loads current native policy; no permission is relaxed. The fixture records two native processes but only one generation request.

This recovery cannot apply after initialization or to a submitted prompt. Repeated startup policy changes fail as CLI_POLICY_CHANGED. Permanent refresh failures return CLI_AUTH_REQUIRED without restarting the process or changing stored credentials. Each expired/reused/revoked fixture recorded two native refresh attempts and two rejected model requests within one process. These are native recovery attempts, not repeated SDK runs.

The fixture wrapper sets CODEX_REFRESH_TOKEN_URL_OVERRIDE to its local OAuth server; the SDK environment allowlist excludes that variable. Real credentials are never read, copied, invalidated or forced to expire by these tests. Native Codex owns sign-in and storage. Synthetic refresh tests do not certify external authorization-server availability.

Context and isolation limits#

Global AGENTS.md and global skill descriptions still enter the prompt, including with host skill discovery disabled. The fixture separately verifies that its account-level developer instruction and parent workspace marker do not enter the request. App-server configuration is read through the native protocol to disable inherited MCP entries; this is not exec's --ignore-user-config mode. Restrictions override relevant settings without claiming to remove all native personalization.

For application-only context, use a dedicated OS user or container with a clean home and sign in normally there. accountDirectory alone does not hide global skills. These controls are not a general OS sandbox or a boundary between mutually untrusted tenants. The SDK does not alter user configuration, remove user files or copy credentials.

Live requalification#

The user selected the existing local sign-in, gpt-6-luna, medium reasoning. At 17:24 UTC the revised adapter returned exactly AGENTICDRIVER_APP_SERVER_OK for run 3cf915a4-17ef-48fd-bdca-06dbde758966. It emitted native progress, text, reported usage and completion. Usage was 10,184 input, 12 output, zero cached input and zero reasoning tokens. These are native measurements, not an inferred subscription charge. Owned processes were reaped.

At 17:26 UTC, run 41ee194f-bd64-4aa9-8797-86e04a2d0a34 was cancelled two seconds after the native turn/start request. The SDK returned CANCELLED without text or usage. A follow-up process check confirmed the owned processes were reaped; they were not all gone at the immediate terminal-event observation. Remote inference stop time and consumed quota remain unknown.

Other models, accounts, versions, operating systems and application workflows require their own evidence. Native application tools remain separate AD-009 work.

Reproduce#

Install Linux bubblewrap, Python 3.10+ and Node.js. Supply the absolute native ELF path, not the npm JavaScript launcher, and retain its adjacent codex-code-mode-host so missing components cannot hide tool behavior.

npm ci
npm run test:codex-native -- \
  --binary /absolute/path/to/native/bin/codex \
  --receipt /tmp/codex-native-receipt.json

The runner hides the real home and /tmp, disables external networking and uses synthetic accounts. The wrapper changes only fixture endpoints, credential-store and telemetry settings; restrictions come from the real SDK. Receipts record native/helper and adapter/process-runner hashes, source revision/dirty state, the effective catalog and individual results. Fixture watchdogs bound test infrastructure only. SDK run and inactivity timeouts remain disabled by default.