[shellz-n-stuff]

Protected Codex work must use the policy provider's verified engine and retain its captured policy throughout the session. This connects Codex to the authenticated native protection bridge, isolates protected workers, supplies conversation evidence for Buzz tool checks, and retires native sessions before policy changes.

Codex registers configured models for temporary, tool-free review inference through the provider's contained engine. Adapter, runtime, and command tests accompany these changes. The separate Buzz Security plugin PR owns the protected Codex runtime distribution and its native boundary fixtures.

Code flow

Codex gates prepared model input and final tool arguments. Tool results return through the next input gate. The Security plugin supplies its protected engine.

Illustrative flow; checks shown enabled. Source: runtime.ts, native-bridge.ts.

Review and merge bottom to top:

1. [1/6] Add verified plugin processes and native containment
2. [2/6] Add agent-bound protection policy and plugin API
3. [3/6] Add protection to the Pi harness plugin
4. [4/6] Add protection to the Claude harness plugin
5. [5/6] Add protection to the Codex harness plugin
6. [6/6] Add protection to the Goose harness plugin

Validation

TypeScript and the Codex suite pass (288 passed, 2 skipped). Native protected-engine fixtures remain owned and locally validated by the companion plugin PR.

Draft. Human app acceptance remains pending. The stack preserves the original implementation without functional changes from splitting it.