Codex Control Tower

Codex writes. GPT-5.6 independently challenges the proof without seeing the expected answer. Control Tower locks facts, blocks dangerous targets before execution, and the developer decides.

Comment

Inspiration

AI coding work can end with changed files, passing tests, and a confident summary, yet still leave critical questions unanswered: What actually ran? What was skipped? Do the tests prove the mission, or only a narrow behavior?

A recent public report of an AI coding agent deleting files outside its intended workspace made one safety risk vivid. But the larger problem is broader: agent work needs bounded missions, evidence, and authority that cannot be silently rewritten.

Deterministic code can record facts, but it cannot reliably judge whether a mission, implementation, tests, and evidence truly support one another. A model can reason about that relationship, but it should not be allowed to rewrite repository truth.

I built Codex Control Tower around that separation of authority:

Codex writes. GPT-5.6 challenges. Control Tower locks the facts. The developer decides.

What it does

Codex Control Tower adds a mission-control and evidence layer around Codex-assisted development.

  1. It records the mission, allowed scope, forbidden actions, risks, required tests, and human approval.
  2. Local code scans the repository and locks structural and execution facts before any model review.
  3. Real gpt-5.6-sol receives neutral claims and bounded raw evidence, but not the expected answer.
  4. GPT-5.6 must return SUPPORTS, CONTRADICTS, or INSUFFICIENT with bounded citations and reasoning.
  5. Only after the response returns does local code compare the model opinion with the hidden local policy.
  6. A disagreement raises HUMAN REVIEW REQUIRED; it never changes PASS, WARN, FAIL, NOT_RUN, SIMULATED, or the developer's Review Gate.

The result is not another AI-generated summary. It is a reviewable separation between recorded facts, semantic model judgment, and human authority.

The recorded GPT-5.6 result

The submission contains a recorded real Codex run using pinned codex-cli 0.144.3 and exact model gpt-5.6-sol.

The model ran in an empty, ephemeral, read-only, no-tool workspace. The expected assessment classes and locked local statuses were withheld. The accepted event stream contained zero tool events.

GPT-5.6 found a specific mission gap in the controlled sample: the mission required a durable audit trail for rejected payment attempts, but the implementation and focused test evidence did not prove it.

That honest FAIL is the product working. The GPT-5.6 invocation completed successfully, product CI passed, and the model exposed a gap that a passing narrow test and structural precheck did not establish. The disagreement raised HUMAN REVIEW REQUIRED without changing any locked local fact.

Destructive Action Preflight

A second safety layer analyzes supported destructive targets before execution.

In the recorded example, a recursive-delete request for $HOME/.. resolves to the protected <USER_HOME_PARENT> boundary and returns:

  • BLOCKED
  • NOT_RUN
  • executed: false

No delete command runs.

This is a bounded project-level decision and evidence layer. It does not replace Codex sandboxing, permissions, operating-system security, or human review. Unsupported or uncertain cases fail closed instead of receiving a safety clearance.

How we built it

The project includes:

  • a local Node.js CLI;
  • deterministic repository scanning and governance scoring;
  • mission, context, Review Gate, Flight Recorder, and evidence-pack surfaces;
  • the real Blind GPT-5.6 Semantic Audit;
  • fail-closed event and structured-output validation;
  • citation allowlists, hashes, freshness, and Git provenance;
  • deterministic destructive-target preflight;
  • a React and Vite dashboard;
  • GitHub Actions verification and a no-install GitHub Pages exhibit.

The deterministic workflow requires no OpenAI API key. The explicit GPT-5.6 audit uses the ChatGPT account already signed in to Codex.

I am not a professional developer, so I used Codex not only to write code, but also to explain decisions, expose uncertainty, and preserve evidence I could inspect.

Codex was the primary development collaborator. It helped translate competition requirements into implementation and evidence requirements, build the CLI and dashboard, diagnose failed tests and deployment drift, redesign the model review as a blind challenge, verify the product, and prepare the final submission.

Challenges and lessons

The hardest problem was making the model useful without making it authoritative.

We had to prevent answer echoing, reject every tool event, validate every claim and citation, preserve local states, and show disagreements without silently converting them into success. We also learned that a zero exit code proves execution, not complete mission coverage.

The core lesson is that deterministic facts and model reasoning are complementary only when their authority boundaries remain visible.

Honest evidence boundary

InvoiceFlow Mini is a fictional controlled sample. Its prepared before-and-after snapshots are not customer outcomes.

The scans, two focused fixture tests, evidence hashes, provenance checks, destructive-target analysis, and recorded GPT-5.6 execution are real controlled tool outputs.

Unavailable browser, load, deployment, provider, and independent security checks remain visibly NOT_RUN. Codex Control Tower does not claim production validation, complete security enforcement, or market validation.

What's next

Next steps are real brownfield-repository pilots, measurable workflow studies, broader platform testing, and carefully expanding preflight coverage only where deterministic parsing and interception can be verified.

Built With

Share this project:

Updates