[object Object]

← back to Ticket System

isolate DTD Codex from user MCP config

0dcd721cbcd4e4cb1db553309c8e507d9231799a · 2026-09-03 23:32:24 -0700 · Steve Abrams

Files touched

Diff

commit 0dcd721cbcd4e4cb1db553309c8e507d9231799a
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Thu Sep 3 23:32:24 2026 -0700

    isolate DTD Codex from user MCP config
---
 config/yoloforever-dtd-sha256.tsv       |  6 +++---
 scripts/verify-dtd-codex-isolation.sh   | 24 ++++++++++++++++++++++++
 scripts/verify-zero-cost-dtd.sh         |  1 +
 test/yoloforever-dtd-codex-isolation.sh | 21 +++++++++++++++++++++
 4 files changed, 49 insertions(+), 3 deletions(-)

diff --git a/config/yoloforever-dtd-sha256.tsv b/config/yoloforever-dtd-sha256.tsv
index 3c3dbb14..96908ea8 100644
--- a/config/yoloforever-dtd-sha256.tsv
+++ b/config/yoloforever-dtd-sha256.tsv
@@ -1,3 +1,3 @@
-agents_panel	c62d3ad635af598fb41c029c8d272f079a420cd9812a34a71ff08e776d59c93b
-agents_post	c89d41d74256d739f7bb0756ccd8d8e25228398b026abfb49d5c594fffe7f503
-claude_panel	ba5636f32e338483fdcd2cfd4fd79a0529740408ba3f68b8c5eb78222583e102
+agents_panel	5b88cc7c549abe0940c56a34471a10a5125ce23a58d6608ef98997b61647b823
+agents_post	877f177b8f3bfc9c17c44c4e20ea99df6d721b63c468aa5311e41223d71faeef
+claude_panel	64e97ddc590974764a28b2cec61a41988dcffcfc8f8cc024da60e37234c32d7c
diff --git a/scripts/verify-dtd-codex-isolation.sh b/scripts/verify-dtd-codex-isolation.sh
new file mode 100755
index 00000000..40570de3
--- /dev/null
+++ b/scripts/verify-dtd-codex-isolation.sh
@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+[[ "$#" -gt 0 ]] || {
+  echo "usage: verify-dtd-codex-isolation.sh <DTD script>..." >&2
+  exit 64
+}
+
+CODEX_BIN="${CODEX_BIN:-/Users/macstudio3/.local/bin/codex}"
+"$CODEX_BIN" exec --help | grep -q -- '--ignore-user-config' || {
+  echo "installed Codex does not support --ignore-user-config" >&2
+  exit 1
+}
+
+for script in "$@"; do
+  [[ -f "$script" ]] || { echo "missing DTD script: $script" >&2; exit 1; }
+  exec_count=$(grep -Ec 'codex exec ' "$script" || true)
+  isolated_count=$(grep -Ec 'codex exec .*--ignore-user-config([[:space:]]|$)' "$script" || true)
+  [[ "$exec_count" -gt 0 && "$isolated_count" == "$exec_count" ]] || {
+    echo "unisolated Codex invocation: $script exec=$exec_count isolated=$isolated_count" >&2
+    exit 1
+  }
+  printf 'ISOLATED %s codex_exec=%s\n' "$script" "$exec_count"
+done
diff --git a/scripts/verify-zero-cost-dtd.sh b/scripts/verify-zero-cost-dtd.sh
index 8d82d73a..bd89d419 100755
--- a/scripts/verify-zero-cost-dtd.sh
+++ b/scripts/verify-zero-cost-dtd.sh
@@ -36,6 +36,7 @@ verify_hash() {
 verify_hash agents_panel "$AGENTS_PANEL"
 verify_hash agents_post "$AGENTS_POST"
 verify_hash claude_panel "$CLAUDE_PANEL"
+"$PROJECT_ROOT/scripts/verify-dtd-codex-isolation.sh" "$AGENTS_PANEL" "$AGENTS_POST" "$CLAUDE_PANEL"
 
 mkdir -p "$TMP/bin" "$TMP/home/Projects/secrets-manager" "$TMP/home/.claude/skills/dtd"
 printf '%s\n' \
diff --git a/test/yoloforever-dtd-codex-isolation.sh b/test/yoloforever-dtd-codex-isolation.sh
new file mode 100755
index 00000000..84a1866f
--- /dev/null
+++ b/test/yoloforever-dtd-codex-isolation.sh
@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+CHECK="$ROOT/scripts/verify-dtd-codex-isolation.sh"
+AGENTS_PANEL="/Users/macstudio3/.agents/skills/dtd/scripts/panel.sh"
+AGENTS_POST="/Users/macstudio3/.agents/skills/dtd/scripts/post-decision-codex.sh"
+CLAUDE_PANEL="/Users/macstudio3/.claude/skills/dtd/scripts/panel.sh"
+TEST_DIR=$(mktemp -d /private/tmp/yoloforever-dtd-isolation-test.XXXXXX)
+
+"$CHECK" "$AGENTS_PANEL" "$AGENTS_POST" "$CLAUDE_PANEL"
+
+cp "$AGENTS_PANEL" "$TEST_DIR/panel-with-omission.sh"
+sed -i '' 's/ --ignore-user-config//' "$TEST_DIR/panel-with-omission.sh"
+if "$CHECK" "$TEST_DIR/panel-with-omission.sh" >"$TEST_DIR/negative.out" 2>"$TEST_DIR/negative.err"; then
+  echo "isolation checker accepted an omitted flag" >&2
+  exit 1
+fi
+grep -q 'unisolated Codex invocation' "$TEST_DIR/negative.err"
+
+printf 'PASS DTD Codex invocation isolation; retained=%s\n' "$TEST_DIR"

← cd14757e auto-data-snapshot: 2026-09-03T23:19:59 (1 data files) — dat  ·  back to Ticket System  ·  record DTD Codex isolation proof 79c8e70e →