Repository navigation
[6/6] Add protection to the Goose harness plugin - #839
Draft
shellz-n-stuff wants to merge 1 commit into
Draft
shellz-n-stuff wants to merge 1 commit into
shellz-n-stuff wants to merge 1 commit into
Conversation
shellz-n-stuff
force-pushed
the
codex/security-agent-identity
branch
from
October 28, 2026 13:53
72341b2 to
49d337e
Compare
shellz-n-stuff
changed the title
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
shellz-n-stuff
force-pushed
the
codex/security-agent-identity
branch
3 times, most recently
from
October 28, 2026 22:23
445e303 to
25e442d
Compare
shellz-n-stuff
changed the title
Co-authored-by: Codex <codex@openai.com> Signed-off-by: Alex Rosenzweig <arosenzweig@squareup.com>
shellz-n-stuff
force-pushed
the
codex/security-agent-identity
branch
from
October 29, 2026 02:17
5d8eafb to
e595973
Compare
This was referenced Oct 29, 2026
shellz-n-stuff
changed the title
shellz-n-stuff
changed the base branch from
main
to
codex/security-codex-integration
October 29, 2026 02:18
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Protected Goose sessions must run through the policy provider's verified engine and acknowledge retirement before protection changes. This connects Goose to the authenticated native protection bridge, adds strict ACP session retirement, supplies conversation evidence for Buzz tool checks, and registers configured models for temporary, tool-free review inference. Goose coverage and its build-script adjustment stay with the adapter.
This final layer completes the four-runtime host integration and documents the protection contract and refused paths. The separate Buzz Security plugin PR owns policies, reviewer prompts, approvals UI, and the protected Codex/Goose runtime distributions and native boundary fixtures. Buzz owns identity binding, revisions, retirement, shared tool gates, and native containment. The original PR is retained as the stack's top layer.
Code flow
Goose gates native conversation input, including results, and checks tool arguments with history before dispatch. Policy changes require strict ACP retirement.
Illustrative flow; checks shown enabled. Source: runtime.ts, agent-sessions.ts.
Ownership across the stack
Review and merge bottom to top:
Validation
TypeScript and Goose/ACP tests pass (265 passed, 8 skipped). The final stack tree exactly matches the preserved complete feature snapshot rebased onto afac5b5. Mandatory push checks pass. Fresh hosted checks run on each individual PR; earlier monolithic CI results do not validate these new commits.
Draft. A fresh protected action through the Buzz UI and human app acceptance remain pending. The stack preserves the original implementation without functional changes from splitting it. The Claude hook/watchdog redesign remains deferred.
Live Buzz demo
These user-approved clips were recorded before the runtime-distribution refactor in the packaged macOS development app with Security Worker (Codex), with both hooks enabled.
Benign input completes (20 seconds,
7c3dba764). The request returnsReady.demo-ready-success.mp4
Quoted injection pauses for approval (55 seconds,
9ed4ebda2). Buzz identifies the embedded attack, shows the requesting agent and reason, and stops the native worker after Deny. These are continuous trims of live recordings.demo-injection-denied.mp4
Live screenshots