Skip to main content
Version: Alpha

Codex local operator runtime

Golf has an opt-in Codex-first operator runtime, separate from its network-disabled shell CI worker. It is a trusted local foundation, not a managed Golf coding-agent connection: personal login and re-authentication now have a separate in-Golf account page. This helper is not required for connecting your account. Repository/task authorization, execution and publication still need their own integration and qualification. AI and Cloudflare remain optional.

Use a separate private connection​

Build the pinned Codex CLI 0.160.0 image and resolve its actual local SHA-256 ID. The helper refuses a mutable tag or an image different from the connection's saved ID.

docker build -t golf-codex:development -f Dockerfile.codex .
docker image inspect golf-codex:development --format '{{.Id}}'
python3 scripts/codex-local.py --image '<LOCAL_SHA256_IMAGE_ID>' \
  --state-directory /absolute/private/golf-codex login-device
python3 scripts/codex-local.py --image '<LOCAL_SHA256_IMAGE_ID>' \
  --state-directory /absolute/private/golf-codex status

Choose a fresh owner-only directory outside the checkout with an existing private parent. Connection state is mode 0700; it binds a random identity, exact image and separately labeled auth volume. The helper never reads or copies host ~/.codex credentials.

Device login requires human authorization through the official browser flow and may depend on account/workspace settings. Alternatively, login-api --key-file /absolute/private/openai-key requires an owned 0600 regular file and passes it through native login stdin, not Docker environment or arguments. Cached login status alone proves neither model entitlement nor inference success.

Account-auth automation is limited to trusted private workflows. Official OpenAI guidance recommends API keys for most automation and preserves a single serialized native auth cache when account auth is specifically required. See advanced account-auth guidance.

The named auth volume holds native credential state outside Golf's encrypted keyring and canonical recovery archive. Protect the Docker host/storage separately. A single-host file lock serializes login, status, run and disconnect; native Codex owns refresh writes. This is not distributed refresh ownership. Explicit disconnect verifies ownership before removing attempt containers and the auth volume; the lock directory remains to prevent locking races.

Trusted-source task boundary​

The operator explicitly authorizes the ordinary tar snapshot; the helper does not establish repository access or independently validate its supplied commit label. It records canonical source SHA-256 and rejects Git/Codex configuration, links, special files, unsafe paths, duplicates and file-parent collisions. Bounds are 16 MiB total, 4,096 entries and 8 MiB/file. Full Git history, LFS hydration, submodules and existing harness sessions are unsupported.

A task uses an owned 0600 prompt file, a fresh tmpfs workspace and synthetic Git baseline. The runtime is UID 1000 with a read-only root, no capabilities, no-new-privileges and no Docker socket, host workspace, forge/admin or deployment credential. Its fixed security profile keeps Codex's native workspace-write sandbox active. User config/rules are ignored and sessions are ephemeral.

Model/auth traffic needs network access outside the shell sandbox; provider egress is not firewalled by a qualified Golf policy. Runtime authentication is available to the harness, and shell write denial does not establish credential-read confidentiality from every agent tool. This profile is for trusted private source, not hostile multi-tenant isolation.

An ordered native thread/turn terminal stream plus successful process exit is required for an inference-complete receipt. Agent prose is insufficient; completion also does not imply tests passed or publication was authorized. A paused-container bounded checkpoint, text diff/binary transitions and private 0600 event/diagnostic artifacts stay in a fresh result directory. Nothing is automatically applied or pushed. Timeout/cancellation removes the attempt before releasing the auth lock; interrupted tasks are not automatically resumed or replayed.

Current evidence and remaining gate​

The qualified arm64 image is sha256:9bdc4c4929ee08cb5e211450eda5d46c156ac5c982a90d740d70dd2cd9db55b5. Offline checks pass. Actual native sandbox qualification passes workspace writes and denial of auth-volume/root writes and shell network access, including a live bridged TCP target. Full container-ID matching, ANSI device-code parsing and rejection of noncanonical source paths have regression coverage. A separate deliberately invalid API-key proof passes native cache persistence, failed/cancelled execution, private artifacts and cleanup. It does not prove authorized successful inference, account renewal or OAuth refresh.

The earlier terminal device challenge was cancelled when account setup moved into Golf. Use the personal account page for a new explicit login. No one-time code or credential is published in these docs. Successful authorized repository work and refresh/revocation remain unqualified, as do amd64, Kubernetes, Cloudflare and managed Golf task execution. This does not complete N5 or support the other four harnesses.

The authoritative local runtime contract contains the task command and exact bounds. Runnable checks are scripts/codex-local-test.py, scripts/codex-sandbox-smoke.py and scripts/codex-local-smoke.py; consult the implementation ledger for final source/image evidence.