engineering-behavior-observatory 0.2.1 → 0.2.2

package/dist/src/codex-run.d.ts

@@ -32,6 +32,8 @@ export type CodexNativeToolPolicyConfiguration = {
     kind: "native-tool-policy";
     approvalPolicy: CodexApprovalPolicy;
     sandbox: CodexSandbox;
+    /** Only for workspace-write; defaults to true. */
+    networkAccess?: boolean;
 };
 export type CodexCaptureProfileConfiguration = {
     schemaVersion: typeof CODEX_CONFIG_SCHEMA_VERSION;

package/dist/src/codex-run.js

@@ -281,6 +281,7 @@ export async function runCodexQueueEntry(options) {
                 effort: model.effort,
                 approvalPolicy: toolPolicy.approvalPolicy,
                 sandbox: toolPolicy.sandbox,
+                ...(toolPolicy.networkAccess === undefined ? {} : { networkAccess: toolPolicy.networkAccess }),
                 ...(captureProfile.telemetrySignals === undefined ? {} : {
                     telemetry: { signals: captureProfile.telemetrySignals },
                 }),
@@ -378,11 +379,14 @@ function validateConfiguration(record, kind, reference) {
             throw configError(reference, "shutdownGraceMs must be positive");
     }
     else if (kind === "native-tool-policy") {
-        keys(record, ["schemaVersion", "kind", "approvalPolicy", "sandbox"], ["approvalPolicy", "sandbox"], reference);
+        keys(record, ["schemaVersion", "kind", "approvalPolicy", "sandbox", "networkAccess"], ["approvalPolicy", "sandbox"], reference);
         if (!["untrusted", "on-request", "never"].includes(String(record.approvalPolicy)))
             throw configError(reference, "approvalPolicy is invalid");
         if (!["read-only", "workspace-write", "danger-full-access"].includes(String(record.sandbox)))
             throw configError(reference, "sandbox is invalid");
+        if (record.networkAccess !== undefined && (typeof record.networkAccess !== "boolean" || record.sandbox !== "workspace-write")) {
+            throw configError(reference, "networkAccess must be a boolean and requires workspace-write");
+        }
     }
     else {
         keys(record, ["schemaVersion", "kind", "telemetrySignals", "workspaceOutcome"], [], reference);

package/dist/src/codex.d.ts

@@ -20,6 +20,8 @@ export type CodexAppServerConfiguration = {
     effort: CodexReasoningEffort;
     approvalPolicy: CodexApprovalPolicy;
     sandbox: CodexSandbox;
+    /** Workspace-write tool network access; defaults to true. Other sandbox modes retain their native policy. */
+    networkAccess?: boolean;
     /** Test-only executable prefix; production uses the pinned executable directly. */
     executableArgs?: readonly string[];
     telemetry?: {

package/dist/src/codex.js

@@ -71,6 +71,9 @@ export async function captureCodexAppServer(request) {
     requireText(request.configuration.executable, "Codex executable");
     if (request.configuration.version !== CODEX_APP_SERVER_VERSION)
         throw new Error(`Codex capture requires pinned runtime ${CODEX_APP_SERVER_VERSION}.`);
+    if (request.configuration.networkAccess !== undefined && (typeof request.configuration.networkAccess !== "boolean" || request.configuration.sandbox !== "workspace-write")) {
+        throw new Error("Codex networkAccess must be a boolean and requires workspace-write.");
+    }
     const shutdownGraceMs = request.shutdownGraceMs ?? CODEX_DEFAULT_SHUTDOWN_GRACE_MS;
     let abortRequested = request.signal?.aborted ?? false;
     let abortDeadline = abortRequested ? performance.now() + shutdownGraceMs : undefined;
@@ -328,7 +331,7 @@ export async function captureCodexAppServer(request) {
             config: { model_instructions_file: instructionsPath, model_reasoning_effort: request.configuration.effort,
                 mcp_servers: {}, hooks: {}, plugins: {},
                 ...(request.configuration.sandbox === "workspace-write" ? { sandbox_workspace_write: {
-                        writable_roots: [request.workspacePath], network_access: false, exclude_tmpdir_env_var: true, exclude_slash_tmp: true,
+                        writable_roots: [request.workspacePath], network_access: request.configuration.networkAccess ?? true, exclude_tmpdir_env_var: true, exclude_slash_tmp: true,
                     } } : {}),
             },
             developerInstructions: "Work only in the supplied workspace. Do not request interactive input or broaden permissions.",
@@ -351,7 +354,7 @@ export async function captureCodexAppServer(request) {
         if (threadStart.approvalPolicy !== request.configuration.approvalPolicy) {
             addGap({ kind: "approval-policy-mismatch", detail: `Requested ${request.configuration.approvalPolicy}; applied ${JSON.stringify(threadStart.approvalPolicy)}.` });
         }
-        if (!sandboxMatches(request.configuration.sandbox, threadStart.sandbox, request.workspacePath, threadStart.cwd)) {
+        if (!sandboxMatches(request.configuration.sandbox, threadStart.sandbox, request.workspacePath, threadStart.cwd, request.configuration.networkAccess ?? true)) {
             addGap({ kind: "sandbox-mismatch", detail: `Requested ${request.configuration.sandbox}; applied ${JSON.stringify(threadStart.sandbox)}.` });
         }
         const started = await sendRequest("turn/start", {
@@ -359,7 +362,7 @@ export async function captureCodexAppServer(request) {
             input: [{ type: "text", text: request.prompt }],
             cwd: request.workspacePath,
             approvalPolicy: request.configuration.approvalPolicy,
-            sandboxPolicy: turnSandboxPolicy(request.configuration.sandbox, request.workspacePath),
+            sandboxPolicy: turnSandboxPolicy(request.configuration.sandbox, request.workspacePath, request.configuration.networkAccess ?? true),
             model: request.configuration.model,
             effort: request.configuration.effort,
         });
@@ -675,7 +678,7 @@ function responseSourceIdentity(method, payload) {
         return text(isRecord(payload.thread) ? payload.thread.id : undefined);
     return undefined;
 }
-function turnSandboxPolicy(sandbox, workspace) {
+function turnSandboxPolicy(sandbox, workspace, networkAccess) {
     if (sandbox === "danger-full-access")
         return { type: "dangerFullAccess" };
     if (sandbox === "read-only")
@@ -683,12 +686,12 @@ function turnSandboxPolicy(sandbox, workspace) {
     return {
         type: "workspaceWrite",
         writableRoots: [workspace],
-        networkAccess: false,
+        networkAccess,
         excludeTmpdirEnvVar: true,
         excludeSlashTmp: true,
     };
 }
-function sandboxMatches(requested, applied, workspace, appliedCwd) {
+function sandboxMatches(requested, applied, workspace, appliedCwd, networkAccess) {
     if (!isRecord(applied) || appliedCwd !== workspace)
         return false;
     if (requested === "danger-full-access")
@@ -696,7 +699,7 @@ function sandboxMatches(requested, applied, workspace, appliedCwd) {
     if (requested === "read-only")
         return applied.type === "readOnly" && applied.networkAccess === false;
     return applied.type === "workspaceWrite"
-        && applied.networkAccess === false
+        && applied.networkAccess === networkAccess
         && Array.isArray(applied.writableRoots)
         // Codex 0.153.4 roots are additional to cwd; it removes redundant cwd entries.
         && applied.writableRoots.length <= 1

package/docs/harnesses/codex-harness.md

@@ -63,7 +63,7 @@ the actual provider model and effort. A minimal observational configuration is:
 { "schemaVersion": "ebo.codex-config/v1", "kind": "model", "provider": "openai", "model": "gpt-5.6-sol", "effort": "high" }
 { "schemaVersion": "ebo.codex-config/v1", "kind": "harness", "adapter": "codex-app-server", "executable": "/opt/homebrew/bin/codex", "version": "0.153.4", "contractDigest": "sha256:e5f798fd1343c539f01fedea0e8a84a43c080fcca4615c80eb04a5edab4f7d0a" }
 { "schemaVersion": "ebo.codex-config/v1", "kind": "native-limits", "shutdownGraceMs": 2000 }
-{ "schemaVersion": "ebo.codex-config/v1", "kind": "native-tool-policy", "approvalPolicy": "never", "sandbox": "workspace-write" }
+{ "schemaVersion": "ebo.codex-config/v1", "kind": "native-tool-policy", "approvalPolicy": "never", "sandbox": "workspace-write", "networkAccess": true }
 { "schemaVersion": "ebo.codex-config/v1", "kind": "capture-profile", "telemetrySignals": ["logs", "traces", "metrics"], "workspaceOutcome": { "excludeDirectoryNames": ["node_modules"] } }
 ```
 
@@ -79,6 +79,24 @@ ebo codex run \
 `runCodexQueueEntry` is the equivalent library API. It does not iterate, retry,
 resume, or overwrite an existing attempt destination.
 
+Workspace-write runs enable outbound tool network access by default, allowing
+dependency installation and documentation retrieval. Set `networkAccess: false`
+in the digest-pinned tool policy for an offline condition. The setting applies
+to both thread and turn policy; EBO verifies the applied thread policy and retains
+the request and response as native evidence. Filesystem writable roots and
+noninteractive approvals are unchanged. Network access permits outbound data
+transfer, so use only the admitted task inputs and permitted destinations.
+
+`networkAccess` is supported only with `workspace-write`. Read-only mode keeps
+tool network access disabled; danger-full-access retains its native unrestricted
+policy. Invalid combinations are rejected rather than silently ignored. This
+setting does not block model-provider traffic or configure the separate Codex
+web-search tool. Context-window and compaction settings remain unspecified.
+
+Before this change, workspace-write runs always disabled tool network access.
+Historical bundles retain their recorded policy. For reproducible re-execution,
+compile a new queue with an explicit boolean; an omitted value now means `true`.
+
 ## Lifecycle and evidence
 
 The client sends `initialize`, `initialized`, `thread/start`, and `turn/start`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "engineering-behavior-observatory",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "Capture engineering-agent trajectories, evaluate behavior, and inspect cited evidence across harnesses.",
   "license": "Apache-2.0",
   "repository": {
@@ -45,6 +45,7 @@
     "release/0.1.0/",
     "release/0.2.0/",
     "release/0.2.1/",
+    "release/0.2.2/",
     "schemas/",
     "scripts/atlas-grafana.sh"
   ],

package/release/0.2.2/KNOWN_LIMITATIONS.md

@@ -0,0 +1,13 @@
+# v0.2.2 known limitations
+
+The [v0.2.1 limitations](../0.2.1/KNOWN_LIMITATIONS.md) continue to apply.
+
+- `networkAccess` configures workspace-write command networking, not the model
+  provider connection or the separate Codex web-search tool.
+- Read-only mode remains offline for tools. Danger-full-access retains its
+  unrestricted native behavior. Supplying `networkAccess` with either mode is
+  rejected.
+- Platform or organization network restrictions can still prevent a request.
+  A configured allowance is not proof that every destination is reachable.
+- The default changed from offline to online for workspace-write runs. Pin the
+  boolean explicitly in new experiment configurations.

package/release/0.2.2/README.md

@@ -0,0 +1,29 @@
+# v0.2.2: Configurable Codex tool network access
+
+Codex workspace-write runs now enable outbound tool network access by default.
+Set `networkAccess: false` in the digest-pinned native tool policy to run offline.
+Both thread and turn receive the selected policy; native evidence retains the
+request and applied policy, and mismatches remain explicit capture gaps.
+
+Filesystem writable roots, temporary-directory restrictions, approval handling,
+credential isolation, and read-only judging are unchanged. Invalid types and
+settings on incompatible sandbox modes are rejected. No dependencies or runtime
+pins changed.
+
+## Reproduction and migration
+
+See the [Codex guide](../../docs/harnesses/codex-harness.md) for the configuration.
+Historical bundles are unchanged. An omitted setting previously meant offline;
+it now means network enabled. Compile a new queue with an explicit boolean when
+reproducing an earlier condition. Network access permits outbound transfer, so
+admit appropriate task data before execution.
+
+Run `npm ci` and `npm run acceptance` with Node 24.19.0. The release checks include
+policy defaults, explicit on/off behavior, invalid settings, mismatch evidence,
+and offline queue-to-runtime propagation, plus the full existing test suite.
+A live ChatGPT-authenticated Astra check also fetched example.com successfully
+through the workspace-write sandbox; this is infrastructure proof, not a scored
+task result.
+
+See [known limitations](KNOWN_LIMITATIONS.md) and the
+[reproducibility manifest](reproducibility.json).

package/release/0.2.2/reproducibility.json

@@ -0,0 +1,73 @@
+{
+  "schemaVersion": "ebo.release-reproducibility/v1",
+  "release": {
+    "name": "engineering-behavior-observatory",
+    "version": "0.2.2"
+  },
+  "runtime": {
+    "node": "24.19.0",
+    "claudeAgentSdk": "0.3.258",
+    "openhandsAgentServer": "1.46.0",
+    "deepseekClient": "0.1.1-rc.2",
+    "deepseekProtocol": "0.1.1-rc.2",
+    "deepseekRuntime": "0.1.1-rc.2",
+    "codexAppServer": "0.153.4",
+    "grafana": "13.2.0",
+    "grafanaInfinity": "4.0.0",
+    "piSdk": "0.85.1",
+    "cursorSdk": "1.0.31"
+  },
+  "commands": [
+    "npm ci",
+    "npm run acceptance"
+  ],
+  "fixtureCoverage": {
+    "agent-sdk": "frozen queue entry through qualified capture, approved export, normalization, configurable judging, review, aggregation, and Atlas",
+    "openhands-agent-server": "pinned REST/WebSocket stream-final reconciliation, workspace/outcome evidence, partial capture, and retained evaluation",
+    "deepseek-harness": "official-client JSON-RPC composition, receipt-to-idle completion, stderr, interruption, shutdown, swaps, and retained evaluation",
+    "codex-app-server": "owned stdio lifecycle, full history, OTLP, interruption/failure, export, and retained evaluation; configurable workspace-write networking with explicit offline queue propagation",
+    "acceptance-cases": "seeded ordering, secret scanning, partial attempts, native references, abstention, disputes, denominators, and unsupported comparisons",
+    "pi-sdk": "frozen queue, passive hooks, durable session, partial cleanup, export, retained normalization and evaluation",
+    "cursor-sdk": "frozen queue, official store, callbacks/history, bounded cancellation, export, retained normalization and evaluation"
+  },
+  "determinism": {
+    "stable": [
+      "task, run, attempt, event, assertion, aggregate, and Atlas case identities",
+      "fixture, native-reference, normalized-dataset, source/cohort, archive, and package digests",
+      "seeded queue and review-sample ordering"
+    ],
+    "excluded": [
+      "native and EBO observation timestamps",
+      "lifecycle start/finish timestamps",
+      "provider timing and usage",
+      "temporary workspace and output paths"
+    ]
+  },
+  "fixtures": {
+    "tests/fixtures/task-packet.valid.v1.json": "ac2ef1043c0cc16bf4c21d05c1dc880ca1b4b8cc2f9ea7653328e91f0b0e2681",
+    "test/fixtures/agent-sdk-normalizer/complete.input.json": "7285dee088517e5de38ceda84fc7c58d9303949c7448ab3b5e10a5a2d2ebdfe3",
+    "test/fixtures/agent-sdk-normalizer/complete.expected.jsonl": "d32fa3a013bc179f1673f7e1a89b8a721bb8ddaf63eba5bc8a3f14f1cc148ed8",
+    "contracts/openhands-agent-server-v1.44.1.json": "e7a07977688a0703b15751a8a1ab17f29be45f9fdf438017e0dbcbc49cca37b0",
+    "contracts/openhands-agent-server-v1.46.0.json": "455cdddd2c206cb2f20245c2189b92e773657ec14d651236baa532b2dbadeb28",
+    "test/fixtures/openhands/v1.44.1/streamed-events.json": "d751083ba2ef94c9865117db481cc2f4933772bbbbb6b9fcf60571563715c1ea",
+    "test/fixtures/openhands/v1.44.1/final-events.json": "551db9904e860004d604c923692b5c5d3aaee966220492214c60003d2df415b6",
+    "test/fixtures/deepseek/golden-success.json": "f3867d38169bf0e28f64aba1dd60553f21cf07f41f81b4bad48261e49fa3ca88",
+    "test/fixtures/deepseek/golden-interrupted.json": "79e1f8404df1ee3b562d0bdbc0b2ee712ffc6d5774992b92970814ea815677b7",
+    "test/fixtures/deepseek/compositions/minimal/composition.json": "72fe4368e105f1bad82b7fdf8380e92c9fa689d8985f6ab91f534f0baf3eda02",
+    "contracts/codex-app-server-0.153.4/manifest.json": "e62281ff5e5d1cc71d07763b85e997ccc9ddbad9aa82a469da4181ee4b1890a8",
+    "test/fixtures/codex/legacy-0.150.1.dataset.json": "f71906b009e546afbf3b4e79396f223181382f3b3d8795e9cfcd032398a9d6bf",
+    "test/fixtures/behavior-assertions/abstained.json": "7f1962864f664c794925a67d93074e7b150af0f57c58041a81e062990d641197",
+    "test/fixtures/behavior-assertions/disputed.review.json": "450d3d9efe7feefaf7500b3ad20ab2803b412c7e53b91763125e15a83be87981",
+    "test/fixtures/comparison/exact.json": "cafa68e94b8d50dc308ddcfc2e73aa139c828b4ecd1e1c762bbc51bf1b44501e",
+    "test/fixtures/structural-observations/golden.json": "bad71a3a93524b76c0a2fdbb58e98e1e65be46cae14acf18ac89d9ba76e03e8a",
+    "test/atlas-fixture.ts": "9f03ce9cbcd0e5d3e3a5916866554ceb1c21f1c8712e58529499c1ea499f048d",
+    "test/pi.test.ts": "a00997c5617ca178e19b25b0d483cbdce8ce7c306d4c871557945b31a2e657cf",
+    "test/cursor-sdk.test.ts": "753094f127b11dc392ec2244c9edddabec27aa94347bb6159a292129ed2a2822",
+    "examples/cursor-sdk/README.md": "a2cf481123e7f3deb1c5a682ba208a775c3f91c35e1a6c1a428c517c79692618",
+    "examples/cursor-sdk/capture-profile.json": "d1a5787875daf5523b3783f259b891c256a904cbb10279d5be214af846305a2d",
+    "examples/cursor-sdk/harness.json": "2f1da6f2b17258d0ee59431f687696901ce3692589175d182f3a4bbe8dd4d689",
+    "examples/cursor-sdk/model.json": "ad8f31ff5d2387c02d79226679022358afafc61ba5dda73040e3f754530a230a",
+    "examples/cursor-sdk/native-limits.json": "40fe451f56b0863e79b42f5c85defbce678e1dc90dd248d15c430db176d71511",
+    "examples/cursor-sdk/native-tool-policy.json": "0fef98b36cd39de82914c5b068022c1335dadda24b7d6e7df398b2430e6a16e0"
+  }
+}

package/release/README.md

@@ -5,6 +5,7 @@ For downloads and published artifacts, see
 
 | Version | Changes and verification | Support boundary |
 | :--- | :--- | :--- |
+| [0.2.2](0.2.2/README.md) | Configurable Codex tool networking, enabled by default for workspace-write | [Known limitations](0.2.2/KNOWN_LIMITATIONS.md) |
 | [0.2.1](0.2.1/README.md) | Documentation redesign, Apache-2.0, and npm distribution setup | [Known limitations](0.2.1/KNOWN_LIMITATIONS.md) |
 | [0.2.0](0.2.0/README.md) | Pi and Cursor SDK integrations; reproducible package | [Known limitations](0.2.0/KNOWN_LIMITATIONS.md) |
 | [0.1.0](0.1.0/README.md) | Initial capture, behavioral evaluation, Atlas, and release gate | [Known limitations](0.1.0/KNOWN_LIMITATIONS.md) |