record DTD Codex isolation proof

79c8e70ef7de4166d06f19c170708c05b1aa3a9b · 2026-09-03 23:33:14 -0700 · Steve Abrams
Files touched

A verification/TK-11213-dtd-codex-isolation-e2e.json
Diff

commit 79c8e70ef7de4166d06f19c170708c05b1aa3a9b
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Thu Sep 3 23:33:14 2026 -0700

    record DTD Codex isolation proof
---
 verification/TK-11213-dtd-codex-isolation-e2e.json | 68 ++++++++++++++++++++++
 1 file changed, 68 insertions(+)

diff --git a/verification/TK-11213-dtd-codex-isolation-e2e.json b/verification/TK-11213-dtd-codex-isolation-e2e.json
new file mode 100644
index 00000000..1cd8a318
--- /dev/null
+++ b/verification/TK-11213-dtd-codex-isolation-e2e.json
@@ -0,0 +1,68 @@
+{
+  "ticket": "TK-11213-yoloforever-cycle-dtd-install-drift-audi",
+  "correlation": "codex-yf-20260904T062020Z-vpops-fix",
+  "timestamp_utc": "2026-09-04T06:32:37Z",
+  "risk_tier": "R1",
+  "intent": "Prevent zero-cost DTD Codex CLI calls from loading user MCP configuration while preserving normal Codex authentication and valid panel output.",
+  "commit": "0dcd721cbcd4e4cb1db553309c8e507d9231799a",
+  "baseline": {
+    "evidence_dir": "/var/folders/rq/j8g1f7nn6jv6_lr1cfmqym6w0000gn/T/tmp.kMQXwIT2eb",
+    "assertion": "FAIL before repair: codex.cli.log and codex-debate.cli.log contain AuthRequired for https://mcp.figma.com.",
+    "status": "PASS"
+  },
+  "checks": [
+    {
+      "name": "canonical zero-cost guard",
+      "status": "PASS",
+      "evidence": "19 bytes ZERO_COST_REQUIRED plus LF; sha256 8cae41cd92c49ab229b26a9061bea48712416efcc6534496a94d69a67f5aa7ed"
+    },
+    {
+      "name": "supported CLI isolation flag",
+      "status": "PASS",
+      "evidence": "codex exec --help documents --ignore-user-config: user config.toml is not loaded; authentication still uses CODEX_HOME"
+    },
+    {
+      "name": "static isolation and omission rejection",
+      "status": "PASS",
+      "command": "test/yoloforever-dtd-codex-isolation.sh",
+      "evidence": "All three installed invocations isolated; copied panel with flag removed rejected; retained /private/tmp/yoloforever-dtd-isolation-test.e8P0di"
+    },
+    {
+      "name": "agents panel and post-decision real flow",
+      "status": "PASS",
+      "environment": "DTD_ZERO_COST absent; canonical filesystem guard active",
+      "evidence_dir": "/private/tmp/dtd-isolated-agents.hYSdqL",
+      "assertions": "codex.txt contains VERDICT: A; codex-debate.txt contains FINAL: OVERTURN; recursive log scan has no figma/mcp/connector/auth signal; no provider raw JSON or Claude error artifact",
+      "hashes": {
+        "codex.cli.log": "7cdc8e3035f42ae60dcfd44b6b4879fe3d980d6d891d6d5c5d68ba4bf3b3ef35",
+        "codex-debate.cli.log": "8684079a56c123ea9def89ca09fd36eb16817c34f9431caa19ae17c89b3edc2a",
+        "codex.txt": "837509b78a12a36a775f9cb0b2a8f8550de0803cc629382eebd6c1e379ad2c2d",
+        "codex-debate.txt": "2a02c8212ed5b24cdce8f04ee4cd2a9ed28638cb5329a5cecd09f8a284e59e85"
+      }
+    },
+    {
+      "name": "legacy panel real flow",
+      "status": "PASS",
+      "environment": "DTD_ZERO_COST absent; canonical filesystem guard active",
+      "evidence_dir": "/private/tmp/dtd-isolated-legacy.o5kuA6",
+      "assertions": "Codex, Qwen, and Heretic contain VERDICT: A; recursive log scan has no figma/mcp/connector/auth signal; no provider raw JSON artifact",
+      "hashes": {
+        "codex.cli.log": "cb99c59f6abe1be9199eec7f49d91e837044bfed802c954df4ba083563e7d664",
+        "codex.txt": "837509b78a12a36a775f9cb0b2a8f8550de0803cc629382eebd6c1e379ad2c2d"
+      }
+    },
+    {
+      "name": "syntax, hashes, and diff",
+      "status": "PASS",
+      "evidence": "bash -n passed; three installed hashes match config/yoloforever-dtd-sha256.tsv; git diff --check passed"
+    }
+  ],
+  "installed_hashes": {
+    "agents_panel": "5b88cc7c549abe0940c56a34471a10a5125ce23a58d6608ef98997b61647b823",
+    "agents_post": "877f177b8f3bfc9c17c44c4e20ea99df6d721b63c468aa5311e41223d71faeef",
+    "claude_panel": "64e97ddc590974764a28b2cec61a41988dcffcfc8f8cc024da60e37234c32d7c"
+  },
+  "side_effects": "Only local installed scripts and ticket-system contract/test/evidence files changed; no normal Codex configuration, provider endpoint, external system, process, scheduler, or remote was changed.",
+  "cleanup": "Retained all unique /private/tmp evidence directories as required; no cleanup command was emitted or executed.",
+  "verdict": "PASS"
+}
← 0dcd721c isolate DTD Codex from user MCP config · back to Ticket System · record TK-11213 zero-cost DTD isolation cycle 09cd311e →