harness-everything 0.41.2 → 0.41.3

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "harness-everything",
       "source": "./",
       "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-      "version": "0.41.2",
+      "version": "0.41.3",
       "author": {
         "name": "Miya Daniel"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-everything",
   "description": "Harness OS: an orchestrated agent operating system — tier routing, circuit breaker guardrails, verification gates, WAL session memory, and self-evolving workspace rules.",
-  "version": "0.41.2",
+  "version": "0.41.3",
   "author": {
     "name": "Miya Daniel"
   },

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to this project are documented in this file.
 
+## [0.41.3](https://github.com/dyphn1/Harness-everything/compare/v0.41.2...v0.41.3) (2026-10-25)
+
+### Bug Fixes
+
+* **codex:** drop format-bound task approvals ([7125220](https://github.com/dyphn1/Harness-everything/commit/71252205e469cda13744a733ff2dca6bbff5db47))
+
 ## [0.41.2](https://github.com/dyphn1/Harness-everything/compare/v0.41.1...v0.41.2) (2026-10-25)
 
 ### Bug Fixes

package/ci/action-gate.test.js

@@ -273,6 +273,30 @@ try {
   check(empty.degraded === false && empty.rules.length === 0, 'valid empty rule table does not silently activate built-in defaults');
   check(actionGate.evaluatePreToolUse(payload('git push --force origin main', { toolUseId: 'empty' }), { host: 'claude', sessionDir, ruleTable: empty }).kind === 'allow', 'empty-table mutation control disables detection, proving production non-empty assertion is meaningful');
 
+  // Independent full-input fingerprint regression: an own JSON __proto__ key must
+  // remain part of the structured payload digest (null-prototype stableValue fix).
+  const protoInput = JSON.parse('{"__proto__":{"changed":true},"record_id":"record-123"}');
+  const protoPayload = {
+    session_id: 'phase5-test',
+    hook_event_name: 'PreToolUse',
+    tool_name: 'mcp__demo__delete_record',
+    tool_use_id: 'proto-fingerprint',
+    tool_input: protoInput,
+    cwd: ROOT,
+  };
+  const basePayload = {
+    session_id: 'phase5-test',
+    hook_event_name: 'PreToolUse',
+    tool_name: 'mcp__demo__delete_record',
+    tool_use_id: 'proto-fingerprint',
+    tool_input: { record_id: 'record-123' },
+    cwd: ROOT,
+  };
+  const protoText = actionGate.exactPayloadText(protoPayload);
+  const baseText = actionGate.exactPayloadText(basePayload);
+  check(protoText.includes('__proto__'), 'null-prototype serialization preserves an own __proto__ key');
+  check(actionGate.hashExact(protoText) !== actionGate.hashExact(baseText), 'own __proto__ key changes the full-input digest');
+
   const execPayload = payload('npm publish', { toolUseId: 'exec-ok' });
   actionGate.evaluatePreToolUse(execPayload, { host: 'claude', sessionDir, ruleTable: table });
   const execResult = actionGate.processEvent({ ...execPayload, hook_event_name: 'PostToolUse' }, { sessionDir });

package/ci/mechanism-codex-prompt-pass-through.test.js

@@ -0,0 +1,94 @@
+#!/usr/bin/env node
+'use strict';
+
+// RED contract: Codex UserPromptSubmit must pass every prompt, including the
+// former exact `HARNESS APPROVE <id>` spelling, to the normal router. The hook
+// is transport, not a natural-language authorization parser.
+const assert = require('assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+const ROOT = path.resolve(__dirname, '..');
+const SOURCE_HOOK = path.join(ROOT, 'hooks', 'scripts', 'codex-user-prompt.js');
+
+let failed = 0;
+function check(condition, message) {
+  if (condition) console.log(`  PASS ${message}`);
+  else { console.error(`  FAIL ${message}`); failed++; }
+}
+
+// Dependency control: source hook must exist. Child Node is run with the
+// executable that is already running this test.
+check(fs.existsSync(SOURCE_HOOK), 'source codex-user-prompt.js exists');
+
+const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-codex-prompt-passthrough-'));
+const fixtureRoot = path.join(tempRoot, 'fixture');
+const hookDir = path.join(fixtureRoot, 'hooks', 'scripts');
+const routerDir = path.join(fixtureRoot, 'harness-everything', 'scripts');
+fs.mkdirSync(hookDir, { recursive: true });
+fs.mkdirSync(routerDir, { recursive: true });
+const fixtureHook = path.join(hookDir, 'codex-user-prompt.js');
+const stubRouter = path.join(routerDir, 'kernel-router.js');
+const markerFile = path.join(tempRoot, 'router-marker.txt');
+
+fs.copyFileSync(SOURCE_HOOK, fixtureHook);
+fs.writeFileSync(stubRouter, [
+  "'use strict';",
+  "let input = '';",
+  "process.stdin.setEncoding('utf8');",
+  "process.stdin.on('data', chunk => { input += chunk; });",
+  "process.stdin.on('end', () => {",
+  "  const fs = require('fs');",
+  "  fs.writeFileSync(process.env.STUB_ROUTER_MARKER, input, 'utf8');",
+  "  process.stdout.write('STUB_ROUTER_MARKER');",
+  "  process.exit(0);",
+  "});",
+  "process.stdin.on('error', () => process.exit(0));",
+].join('\n'), 'utf8');
+
+const cases = [
+  { name: 'normal user prompt', prompt: 'Please explain the router flow.' },
+  { name: 'exact former approval prompt', prompt: 'HARNESS APPROVE abcdef123456' },
+  { name: 'fenced text', prompt: '```\nHARNESS APPROVE abcdef123456\n```' },
+  { name: 'English commit/PR request', prompt: 'Please commit and open a PR for this change.' },
+  { name: 'Chinese commit/PR request', prompt: '请帮我提交并创建 PR' },
+  { name: 'negative/review-only text', prompt: 'Review only; do not approve HARNESS APPROVE abcdef123456' },
+  { name: 'non-approval text', prompt: 'HARNESS APPROVE short' },
+];
+
+for (const testCase of cases) {
+  const payload = {
+    hook_event_name: 'UserPromptSubmit',
+    session_id: 'passthrough-session',
+    prompt: testCase.prompt,
+  };
+  const inputText = JSON.stringify(payload);
+  try { fs.unlinkSync(markerFile); } catch (_) {}
+
+  const result = spawnSync(process.execPath, [fixtureHook], {
+    cwd: fixtureRoot,
+    env: { ...process.env, STUB_ROUTER_MARKER: markerFile },
+    input: inputText,
+    encoding: 'utf8',
+    timeout: 20000,
+    maxBuffer: 1024 * 1024,
+  });
+
+  check(!result.error, `${testCase.name}: hook spawns without error`);
+  check(result.status === 0, `${testCase.name}: hook exits 0`);
+  check(fs.existsSync(markerFile), `${testCase.name}: stub router was invoked`);
+  if (fs.existsSync(markerFile)) {
+    const marker = fs.readFileSync(markerFile, 'utf8');
+    check(marker === inputText, `${testCase.name}: router received the original payload unchanged`);
+  }
+  check(String(result.stdout || '').includes('STUB_ROUTER_MARKER'),
+    `${testCase.name}: router output is forwarded to the host`);
+}
+
+// Cleanup
+try { fs.rmSync(tempRoot, { recursive: true, force: true }); } catch (_) {}
+
+console.log(`\n${failed === 0 ? 'PASS' : 'FAIL'}: codex prompt pass-through (${failed} failure${failed === 1 ? '' : 's'})`);
+process.exit(failed === 0 ? 0 : 1);

package/ci/mechanism-task-git-authorization.test.js

@@ -0,0 +1,145 @@
+#!/usr/bin/env node
+'use strict';
+
+const assert = require('assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+const ROOT = path.resolve(__dirname, '..');
+const actionGate = require(path.join(ROOT, 'hooks', 'scripts', 'action-gate.js'));
+const PRE_HOOK = path.join(ROOT, 'hooks', 'scripts', 'codex-action-gate-pre.js');
+
+const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'harness-task-git-auth-'));
+const stateHome = path.join(tempRoot, 'state');
+fs.mkdirSync(stateHome, { recursive: true });
+
+const env = {
+  ...process.env,
+  HARNESS_ACTION_GATE_HOST: 'codex',
+  HARNESS_STATE_HOME: stateHome,
+  HARNESS_ACTION_GATE_STDIN_TIMEOUT_MS: '2000',
+};
+
+function run(payload) {
+  const result = spawnSync(process.execPath, [PRE_HOOK], {
+    cwd: tempRoot,
+    env,
+    input: JSON.stringify(payload),
+    encoding: 'utf8',
+    timeout: 20000,
+    maxBuffer: 1024 * 1024,
+  });
+  assert.ifError(result.error);
+  return result;
+}
+
+function payload(toolName, toolInput, extra = {}) {
+  return {
+    hook_event_name: 'PreToolUse',
+    session_id: 'task-git-auth-codex-session',
+    turn_id: 'turn-task-git-auth',
+    tool_use_id: `call-${Math.random().toString(16).slice(2)}`,
+    tool_name: toolName,
+    tool_input: toolInput,
+    permission_mode: 'default',
+    cwd: tempRoot,
+    ...extra,
+  };
+}
+
+const actualPrPayload = payload('mcp__codex_apps__github__create_pull_request', {
+  repository_full_name: 'openai/codex',
+  base: 'main',
+  head: 'feature/task-authorization',
+  title: 'Phase complete PR',
+  body: '## Summary\n\nPhase complete PR created after task authorization.',
+  draft: true,
+});
+
+try {
+  assert.ok(fs.existsSync(PRE_HOOK), 'Codex PreToolUse entrypoint must exist');
+
+  // Read control on the real Codex path.
+  const readResult = run(payload('mcp__demo__get_pull_request', { pull_request: 1 }));
+  assert.strictEqual(readResult.status, 0, 'read-only structured action must pass on Codex');
+  assert.strictEqual(String(readResult.stdout || '').trim(), '', 'read control must not emit a Harness permission decision');
+
+  // Dangerous controls remain hard Codex blocks.
+  for (const [toolName, toolInput] of [
+    ['mcp__demo__merge_pull_request', { id: 'target' }],
+    ['mcp__demo__delete_pull_request', { id: 'target' }],
+    ['mcp__demo__deploy_release', { id: 'target' }],
+    ['mcp__demo__publish_package', { id: 'target' }],
+    ['mcp__demo__send_message', { id: 'target' }],
+  ]) {
+    const result = run(payload(toolName, toolInput));
+    assert.strictEqual(result.status, 2, `${toolName} must remain a Codex block`);
+  }
+  const forcePush = run(payload('Bash', { command: 'git push --force origin main' }));
+  assert.strictEqual(forcePush.status, 2, 'git push --force must remain a Codex block');
+
+  // Normal non-destructive commit keeps its existing ungated behavior.
+  const normalCommit = run(payload('Bash', { command: 'git commit -m "phase complete"' }));
+  assert.strictEqual(normalCommit.status, 0, 'normal git commit must remain ungated on Codex');
+
+  // Misleading names containing create_pull_request must not inherit the exemption.
+  for (const toolName of [
+    'mcp__demo__create_pull_request_and_delete',
+    'mcp__demo__delete_create_pull_request',
+    'mcp__demo__create_pull_requests',
+    'mcp__demo__foo_create_pull_request',
+  ]) {
+    const result = run(payload(toolName, { id: 'target' }));
+    assert.strictEqual(result.status, 2, `${toolName} must remain a Codex block`);
+  }
+
+  // Explicit required gate is carried in the supported payload hint shape
+  // (payload.workflowPlan.actionGate — the shape routerActionGateHint reads),
+  // not a made-up options API.
+  const requiredDecision = actionGate.evaluatePreToolUse({
+    ...actualPrPayload,
+    tool_use_id: 'call-required-gate-witness',
+    workflowPlan: { actionGate: { required: true, reasonCodes: ['external-side-effect'], disposition: 'pending-approval' } },
+  }, {
+    host: 'codex',
+    ruleTable: actionGate.loadRuleTable(path.join(ROOT, 'hooks', 'scripts', 'action-gate-rules.json')),
+  });
+  assert.strictEqual(requiredDecision.kind, 'block', 'required-gate PR must remain gated');
+  assert.strictEqual(requiredDecision.exitCode, 2, 'required-gate PR must remain a Codex block');
+  assert.ok(requiredDecision.rule, 'required-gate PR must match a gated rule');
+  assert.strictEqual(requiredDecision.rule.id, 'structured-mutate', 'required-gate PR must keep structured-mutate');
+
+  // Recognized PR creation is a routine host-deferred operation. Its descriptor
+  // stays a mutation; it is not read or safe, and it must not use Harness consent.
+  const descriptor = actionGate.normalizeActionDescriptor(actualPrPayload);
+  assert.strictEqual(descriptor.action, 'mutate', 'recognized PR creation must remain classified as a mutation');
+  assert.notStrictEqual(descriptor.classification, 'safe', 'recognized PR creation must not be safe/read');
+  const prResult = run(actualPrPayload);
+  assert.strictEqual(prResult.status, 0, 'recognized PR creation must be host-deferred on Codex (currently exits 2: RED)');
+  assert.strictEqual(String(prResult.stdout || '').trim(), '', 'recognized PR creation must not emit permissionDecision allow/ask');
+  assert.ok(!/HARNESS APPROVE/i.test(`${prResult.stdout || ''}\n${prResult.stderr || ''}`), 'recognized PR creation must not require a Harness approval phrase');
+
+  // Provider-neutral exact create_pull_request operation, if used, has the same contract.
+  const neutralResult = run(payload('mcp__demo__create_pull_request', {
+    repository: 'acme/harness',
+    head: 'feature/task-authorization',
+    base: 'main',
+    title: 'Phase complete PR',
+    body: 'Provider-neutral PR body.',
+  }));
+  assert.strictEqual(neutralResult.status, 0, 'exact create_pull_request operation must be host-deferred on Codex (currently exits 2: RED)');
+
+  // Genuine mutations remain blocked, but the fixed-format approval protocol is retired.
+  const legacyMutation = run(payload('mcp__demo__update_issue', { issue_id: 1, title: 'changed' }));
+  assert.strictEqual(legacyMutation.status, 2, 'genuine mutation must remain blocked on Codex');
+  assert.ok(!/HARNESS APPROVE/i.test(`${legacyMutation.stdout || ''}\n${legacyMutation.stderr || ''}`), 'genuine mutation must not expose the retired Harness approval phrase');
+
+  console.log('PASS: task git authorization Codex controls and host-deferred PR creation');
+} catch (err) {
+  console.error(err && err.stack ? err.stack : err);
+  process.exitCode = 1;
+} finally {
+  try { fs.rmSync(tempRoot, { recursive: true, force: true }); } catch (_) {}
+}

package/docs/codex-action-gate.md

@@ -125,24 +125,31 @@ Current Harness PreToolUse enforcement remains wired to the tool set explicitly
 
 Related tracking: #82, #85, #98, #100, #109, #110.
 
-## Codex explicit authorization (scoped consent)
-
-In addition to the hard block above, a blocked Codex structured mutation exposes a
-pending challenge scoped to the host session, tool name, and canonical full
-tool-input digest. The pending challenge has no wall-clock TTL. The challenge id
-appears in the block output as `challenge id: <id>`. Only scoped structured mutations (`rule.id` `structured-mutate`)
-issue or consume grants; other actions keep ordinary blocking.
-
-The only approval source is a real `UserPromptSubmit` hook receiving the exact
-entire prompt `HARNESS APPROVE <challengeId>` with no additional text. That
-event binds the host session and its consent turn to a one-use grant for the
-same session, consent turn, tool, and full-input digest.
-
-A matching retry passes once and atomically consumes the grant. Missing,
-mismatched, cross-session, cross-turn, and replayed grants remain blocked. The
-one-use grant is bound to the consent turn and fails after a turn change. Tool
-input containing an `authorization` JSON claim never grants.
-
-On a matching retry the guard does not block and emits no `permissionDecision=allow`;
-Codex native permission controls remain authoritative. This is cooperative local
-hook state, not tamperproof, and carries no live-host proof.
+## Prompt handling and authorization
+
+Codex `UserPromptSubmit` prompts pass through to the normal router unchanged.
+Harness does not parse, bind, or intercept any fixed approval syntax in user
+prompts. Native agent task-scope authorization and native permissions remain
+authoritative.
+
+Routine exact `create_pull_request` operations are host-deferred (below). All
+other risky actions (merge/delete/deploy/publish/send/force-push and unrelated
+genuine mutations) remain hard PreToolUse blocks; an explicitly required
+`actionGate` hint still gates. These are deterministic mechanism changes, not
+live-host proof.
+
+## Routine task Git operations (host-deferred)
+
+Ordinary exact `create_pull_request` operations (including
+`mcp__codex_apps__github__create_pull_request` and provider-neutral
+`mcp__*__create_pull_request`) are host-deferred: Harness does not issue an
+additional challenge merely because the generic `create` heuristic classifies
+them as `mutate`. Their action descriptor stays `mutate` and non-safe; Harness
+does not pretend a write is a read or emit `permissionDecision` allow/ask.
+
+Native agent task-scope authorization and native permissions remain authoritative.
+An explicitly supplied required `actionGate` hint still gates the call. All other
+risky actions (merge/delete/deploy/publish/send/force-push and unrelated genuine
+mutations) remain gated; exact operation matching is used, with no substring
+exemption, so misleading names such as `create_pull_requests` or
+`foo_create_pull_request` still block.

package/docs/platform-capabilities.md

@@ -25,6 +25,15 @@ The repository routing contract uses **step-scoped workflow selection**. Normali
 
 This is a **repository/agent contract**, not an automatic upgrade to any platform row below. A hook can prove that the contract was injected and record an agent's binding disposition; neither proves that a live host actually loaded or followed the referenced content. Instruction-only surfaces can carry the same rule without mechanically enforcing it. Promoting behavior to live-host compliance requires retained host/session evidence under the #82 compatibility program. Claude and local OpenAI packages carry workflow entry/completion **reminders** plus separate Rule-of-3/permission boundaries, but this package/mechanism change does not upgrade `platform-compatibility.json` live-host status values. See [workflow runtime](workflow-runtime.md) for scope, worktree isolation, and failure behavior. OpenCode and instruction-only/public Skills-only surfaces do not acquire equivalent runtime gating. Shell inspection is not a filesystem sandbox; absent hooks, agent-writable state, and indirect script effects remain limits.
 
+### Action-gate mechanism vs. host semantic boundary
+
+Routine exact `create_pull_request` operations are host-deferred at the mechanism level:
+their descriptor remains a mutation (not read/safe), and no Harness consent or
+`permissionDecision` is emitted. Native agent task-scope authorization and native
+permissions stay authoritative; an explicit required `actionGate` hint still gates.
+This is a deterministic mechanism change, not live-host proof, and does not
+upgrade any platform row's live-host status.
+
 ## Current capability summary
 
 | Platform surface | Standalone skills | Plugin support | Hooks/lifecycle | Project scope | Global scope | Current evidence boundary |
@@ -126,22 +135,17 @@ The compatibility path registers hook commands in Codex user configuration and c
 
 The public OpenAI Skills-only plugin is narrower again. Its ZIP contains the packaged `skills/` tree and referenced files, but not the local `.codex-plugin` lifecycle hooks. Public submission readiness is therefore a package/form contract, not evidence of public-directory approval or live hook execution.
 
-### Codex explicit UserPromptSubmit consent (mechanism only)
-
-Codex has a local `UserPromptSubmit` exact-challenge consent path for a blocked
-structured mutation. The blocked call exposes a pending challenge scoped to host
-session, tool name, and canonical full tool-input digest. The pending challenge has
-no wall-clock TTL. Only a real
-`UserPromptSubmit` hook receiving the exact entire prompt
-`HARNESS APPROVE <challengeId>` with no additional text can bind that challenge to
-a host session and consent turn. The resulting one-use grant only lets the
-matching retry pass Harness's guard; it does not emit `permissionDecision=allow`
-and does not supersede native Codex permissions. Missing, mismatched, cross-session, cross-turn, and replayed grants remain
-blocked. The one-use grant is bound to the consent turn and fails after a turn
-change. Tool-input
-authorization JSON never grants. This is cooperative local hook state: it is not
-tamperproof and carries no live-host verification. Codex ask-style decisions are
-not supported.
+### Codex prompt pass-through and authorization (mechanism only)
+
+Codex `UserPromptSubmit` prompts pass through to the normal router unchanged;
+Harness does not parse or intercept a fixed approval syntax. Native agent
+task-scope authorization and native permissions remain authoritative. Routine
+exact `create_pull_request` operations are host-deferred at the mechanism level:
+their descriptor remains a mutation (not read/safe), and no Harness consent or
+`permissionDecision` is emitted. All other risky actions remain hard PreToolUse
+blocks; an explicitly required `actionGate` hint still gates. These are
+deterministic mechanism changes, not live-host proof. Codex ask-style decisions
+are not supported.
 
 ## Install/uninstall ownership boundary
 

package/hooks/scripts/action-gate.js

@@ -9,8 +9,6 @@ const {
   getWorkspaceRoot,
   getSessionDir,
 } = require('./lib/harness-state');
-const codexActionAuthorization = require('./lib/codex-action-authorization');
-
 const RULES_PATH = process.env.HARNESS_ACTION_GATE_RULES_PATH || path.join(__dirname, 'action-gate-rules.json');
 const ASK_CAPABLE_HOSTS = new Set(['claude']);
 const VALID_SCOPES = new Set(['always', 'outside-scratch']);
@@ -135,10 +133,25 @@ function normalizeActionDescriptor(payload) {
   };
 }
 
+function isRoutinePullRequestCreation(toolName) {
+  const name = String(toolName || '');
+  const segments = name.split('__');
+  const last = segments[segments.length - 1];
+  return (last === 'create_pull_request' || name === 'create_pull_request');
+}
+
 function structuredRule(payload) {
   const descriptor = normalizeActionDescriptor(payload);
   if (descriptor.toolFamily === 'shell') return { descriptor, rule: null };
   if (descriptor.classification === 'safe') return { descriptor, rule: null };
+  // Routine PR creation is a host-deferred mutation, not a Harness-gated one:
+  // the generic create=>mutate heuristic must not add an extra challenge. The
+  // descriptor stays a mutation (not read/safe). An explicit required
+  // actionGate hint still gates it.
+  const hint = routerActionGateHint(payload);
+  if (isRoutinePullRequestCreation(descriptor.toolName) && !(hint && hint.required)) {
+    return { descriptor, rule: null };
+  }
   if (descriptor.classification === 'gated') {
     return {
       descriptor,
@@ -148,7 +161,6 @@ function structuredRule(payload) {
       },
     };
   }
-  const hint = routerActionGateHint(payload);
   if (hint && hint.required) {
     return {
       descriptor,
@@ -449,19 +461,8 @@ function recordDecision(payload, rule, table, host, disposition, options = {}, e
 }
 
 
-function isScopedCodexStructuredMutation(structured, rule) {
-  return Boolean(
-    rule && rule.id === 'structured-mutate' &&
-    structured && structured.descriptor &&
-    structured.descriptor.toolFamily !== 'shell' &&
-    structured.descriptor.action === 'mutate' &&
-    structured.descriptor.classification === 'gated'
-  );
-}
 
-function safeInline(value) {
-  return String(value == null ? '' : value).replace(/[\r\n\t\u0000-\u001f\u007f]/g, '?').slice(0, 200);
-}
+
 
 function evaluatePreToolUse(payload, options = {}) {
   const context = sessionContext(payload, options.sessionDir);
@@ -470,23 +471,6 @@ function evaluatePreToolUse(payload, options = {}) {
   const rule = structured.rule || classify(payload, table.rules, context.sessionDir);
   const host = detectHost(payload, options.host);
 
-  // Codex explicit authorization applies only to scoped structured mutations.
-  // Shell-governed and other structured actions keep ordinary blocking.
-  if (host === 'codex' && isScopedCodexStructuredMutation(structured, rule)) {
-    const consumed = codexActionAuthorization.consumeGrantIfValid(payload, { sessionDir: context.sessionDir });
-    if (consumed && consumed.authorized) {
-      return {
-        kind: 'allow',
-        exitCode: 0,
-        stdout: null,
-        stderr: null,
-        rule: null,
-        table,
-        descriptor: structured.descriptor,
-      };
-    }
-  }
-
   if (!rule) {
     return {
       kind: 'allow',
@@ -514,25 +498,11 @@ function evaluatePreToolUse(payload, options = {}) {
   const record = recordDecision(payload, rule, table, host, 'rejected', { ...options, sessionDir: context.sessionDir }, {
     rejectionReason: 'host-ask-decision-unverified-or-unsupported',
   });
-  let challengeSuffix = '';
-  let detailsSuffix = '';
-  if (host === 'codex' && isScopedCodexStructuredMutation(structured, rule)) {
-    const challengeId = codexActionAuthorization.issueChallenge(payload, {
-      sessionDir: context.sessionDir,
-      toolName: toolNameOf(payload),
-      digest: (structured.descriptor && structured.descriptor.payloadHash) || hashExact(exactPayloadText(payload)),
-    });
-    if (challengeId) {
-      challengeSuffix = ` challenge id: ${challengeId}`;
-      const digest = (structured.descriptor && structured.descriptor.payloadHash) || hashExact(exactPayloadText(payload));
-      detailsSuffix = ` Tool: ${safeInline(toolNameOf(payload))}. Input SHA-256: ${digest}. Approve with: HARNESS APPROVE ${challengeId}.`;
-    }
-  }
   return {
     kind: 'block',
     exitCode: 2,
     stdout: null,
-    stderr: `${reason} Host '${host}' has no Harness-verified ask-style decision path, so the action is blocked.${challengeSuffix}${detailsSuffix}`,
+    stderr: `${reason} Host '${host}' has no Harness-verified ask-style decision path, so the action is blocked.`,
     rule,
     table,
     record,
@@ -705,4 +675,5 @@ module.exports = {
   validateRuleTable,
   normalizeActionDescriptor,
   structuredRule,
+  isRoutinePullRequestCreation,
 };

package/hooks/scripts/codex-user-prompt.js

@@ -26,22 +26,10 @@ function finish() {
   let payload = null;
   try { payload = JSON.parse(input || '{}'); } catch (_) { payload = null; }
 
-  // Codex explicit authorization: only an exact host-submitted consent prompt
-  // may bind a pending challenge to the host session + consent turn. No
-  // natural-language inference, no tool-input claim.
-  if (payload && payload.hook_event_name === 'UserPromptSubmit') {
-    const prompt = payload.prompt;
-    const match = String(prompt || '').match(/^HARNESS APPROVE ([A-Za-z0-9._-]{8,})$/);
-    if (match) {
-      try {
-        const auth = require('./lib/codex-action-authorization');
-        auth.bindConsent(payload, { challengeId: match[1] });
-      } catch (_) { /* consent state is best-effort; failures do not authorize */ }
-      process.exit(0);
-      return;
-    }
-  }
-
+  // All prompts, including any legacy approval spelling, pass through unchanged
+  // to the normal router. Harness does not parse or intercept authorization
+  // syntax in user prompts; native agent/task scope and native permissions
+  // remain authoritative.
   if (!ROUTER) process.exit(0);
   const result = spawnSync(process.execPath, [ROUTER], { input, encoding: 'utf8', env: process.env, timeout: 25000 });
   const stderr = String(result.stderr || '');

package/opencode-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "harness-enforcement",
   "description": "Repository inventory for the opencode enforcement plugin and its standalone helper",
-  "version": "0.41.2",
+  "version": "0.41.3",
   "runtime": "index.mjs",
   "hooks": {
     "verify": "hooks/verify.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.41.2",
+  "version": "0.41.3",
   "description": "Harness OS: An Orchestrated Agent Operating System for AI-driven Development",
   "main": "harness-everything/scripts/bootstrap.js",
   "bin": {

package/plugins/harness-everything/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "harness-everything",
-  "version": "0.41.2",
+  "version": "0.41.3",
   "description": "Invariant-first engineering harness for routing, verification, and failure recovery while preserving agent autonomy.",
   "author": {
     "name": "Miya Daniel",