PromptTripwire

See where Codex disagrees before it writes code—and turn hidden implementation choices into an approved execution contract.

Comment

PromptTripwire

See where Codex disagrees before it writes code—and turn hidden implementation choices into an approved execution contract.

The demo is a completed v0.1.2 capture. v0.1.12 is the final judge distribution to install. Releases v0.1.3–v0.1.12 improved compatibility, safety, localization, and presentation precision without changing the demonstrated human-approval or contract boundary. No separate OPENAI_API_KEY is required.

PromptTripwire human decision boundary

One-line pitch

Codex asks when it knows it is uncertain. PromptTripwire detects when reasonable Codex runs silently disagree—and turns the human answer into an execution contract.

Inspiration

A coding agent can produce a confident plan while silently choosing deletion semantics, API compatibility, dependency scope, or an external action the developer never approved. Reviewing one plan does not reveal that another equally reasonable Codex run would make a different product decision. Action approvals arrive later, after the ambiguity has already shaped the implementation.

PromptTripwire uses observed plan divergence as early evidence. It asks only about choices that change behavior, scope, data, APIs, permissions, reversibility, or verification, then carries the answer into execution.

Concrete judge story

The safe judge task looks small: update greeting(name) so it trims surrounding whitespace and returns Hello, stranger! for an empty trimmed name. The hidden decision is compatibility. Reasonable same-input Codex plans may disagree about whether callers that relied on the old whitespace behavior should change.

PromptTripwire runs three read-only probes, reports how many valid probes support each material alternative, and labels whether the decision came from observed divergence, deterministic policy, both, or insufficient provenance. The judge—not Codex—chooses Allow local implementation. The resulting contract permits only src/greeting.js and test/greeting.test.js, requires npm test, and keeps dependencies, network, remote writes, publish, deploy, release, and other external effects blocked. Execution occurs in a disposable worktree; the report ties the observed diff and passing check back to the approved contract hash while the original fixture remains unchanged.

What it does

  1. Freezes a Git snapshot without modifying the user's checkout.
  2. Runs three fresh, read-only Codex planning threads against identical task, snapshot, instructions, model, and schema inputs.
  3. Uses GPT-5.6 Structured Outputs in a separate tool-free App Server thread to normalize consensus, divergence, unknowns, and evidence references.
  4. Applies deterministic-v2 fail-closed rules to the original task and the validated plans for destructive, external, privileged, production, dependency, API, and irreversible effects, while preserving task-only provenance instead of claiming probe support.
  5. Shows at most three focused decision cards at a time in a loopback-only Decision Inbox or terminal fallback.
  6. When Japanese is selected, shows a source-bound reference translation of the task and decision content while keeping an expandable, deterministically sanitized authoritative source copy and unchanged approval identity.
  7. Creates an immutable, content-addressed execution contract bound to the approved snapshot.
  8. Runs Codex in a disposable worktree, denies network/remote/high-impact effects, correlates approvals to contract evidence, and interrupts deviations.
  9. Produces a sanitized JSON/Markdown report with decisions, contract hash, threads/models, observed actions, checks, diff scope, and remaining unknowns.

How it was built

PromptTripwire is a local TypeScript/Node.js workspace. It uses one OpenAI integration path: codex app-server over stdio. Before reading the target repository, one shared profile measures the resolved executable's consumed normal-schema surface, handshake, and bounded private-temp canary; the version string is audit metadata, not an allowlist. That App Server path supplies authentication, threads, schema-constrained turns, streamed items, approvals, diffs, token usage, and interruption. The existing Codex CLI login is reused; PromptTripwire does not require OPENAI_API_KEY or copy Codex credentials.

Planning uses gpt-5.6-sol at low reasoning. Comparison uses gpt-5.6-terra at low reasoning after a bounded Sol/Terra evaluation. Zod-derived schemas validate model output, a deterministic policy engine adds mandatory decisions, node:sqlite persists crash-safe state, Git worktrees contain probe/execution changes, and React/Vite provides a bundled same-origin Decision Inbox. The v0.1.2 distribution also audits canonical symlink containment before probes and at each static-read approval, expires the review capability at lifecycle/idle boundaries without changing run state, propagates only a non-secret Plugin re-entry sentinel through the minimal App Server environment, rolls failed installs/upgrades back across local and Codex Plugin state, and verifies deterministic archive output.

An API-key-free live Plugin invocation of the clean v0.1.2 artifact then exposed a pinned Codex App Server 0.144.4 compatibility mismatch: a structured listFiles action with command ls was reported as an actual command through /bin/zsh -c or /bin/zsh -lc. The public v0.1.3 release accepts only those exact three-token launcher envelopes, re-tokenizes and cross-checks the single inner command, and keeps the existing grammar, canonical-path, protected-content, sandbox, and network checks. It also assigns App Server an empty controller-owned mode-0700 ZDOTDIR, rejects missing actual commands, observes failed command/file items, and denies direct planning-probe reads of .git content.

A fresh v0.1.3 install then exposed a second boundary: the child App Server retained the exact explicit Plugin task, rediscovered the installed PromptTripwire Skill, and attempted to read it outside the disposable repository. The run correctly failed closed before review or implementation. v0.1.4 disables Plugin contributions at shared App Server startup without rewriting the task, retains the re-entry sentinel, preserves custom Codex-home authentication for App Server only, and accepts the pinned basename-only or multi-target rg shape only after every actual operand passes canonical and protected-content checks.

v0.1.5 adds browser-locale-aware Japanese Decision Inbox chrome and a visible 日本語 / English switch. Localization never rewrites the task, model output, evidence, decision identifiers, contract content, mutations, or reports, and it cannot select a decision or approve a contract.

v0.1.6 keeps the runtime behavior unchanged and corrects every release name, archive path, install root, uninstall command, and Git marketplace tag shipped inside the judge documentation. The v0.1.5 tag and assets remain untouched.

v0.1.7 fixes a deterministic-policy false positive found during a real approval-to-execution rehearsal. An explicit coordinated prohibition such as Do not add dependencies, access the network, publish, deploy, or perform any external action now remains one negated list. Ambiguous comma splices and later positive clauses still fail closed. The approval, contract, containment, report, authentication, Plugin, and platform boundaries are unchanged.

v0.1.8 constrains each planning probe's commands output to literal shell-free argv strings. It keeps the already-active PromptTripwire workflow directive and explanatory check prose out of that field, while malformed values remain fail-closed instead of being normalized into executable authority.

v0.1.9 requires planning probes to invoke allowlisted inspection programs by bare name. A real v0.1.8 flow twice stopped fail-closed when Codex 0.144.4 chose /bin/ls and App Server reported it as unknown. v0.1.9 removes that notation at generation while keeping the unknown-action and canonical-path gates intact.

v0.1.10 adds a separate Japanese reference-presentation turn after final decision normalization. It reuses the authenticated Codex App Server with no tools or network and binds output to exact source decision/option IDs and effect counts. The UI labels the translation as reference text and exposes the source; policy, decision IDs, mutations, contracts, hashes, execution, and reports never consume the translation. Invalid or unavailable output falls back visibly to source text without inferring approval.

v0.1.12 replaces numeric Codex version gates with measured normal-schema, handshake, and bounded-canary compatibility. The attestation is bound to the snapshot and contract and is remeasured before approval and execution; any drift makes the prior approval stale. The bundled Plugin Skill also declares allow_implicit_invocation: false, so Codex requires an explicit $prompt-tripwire:preflight mention. Secret-like source text is redacted before the translation turn and from the browser DTO without changing canonical persistence, IDs, hashes, contracts, or mutations. No hook, MCP server, hosted backend, API key, or automatic approval is added.

Challenges

  • Codex 0.144.4 reports some apparently read-only commands such as pwd and sed as unknown. PromptTripwire kept fail-closed denial and changed probe instructions instead of trusting raw shell text.
  • Stable file approval requests omit paths. PromptTripwire accepts one only when a same-thread, same-ID file item already disclosed contract-valid non-empty paths, then validates completed items and diffs again.
  • A permitted local command can write before aggregate diff monitoring reacts. PromptTripwire states this honestly: the write is contained in a disposable worktree, detected, interrupted, and never described as perfectly prevented.
  • Direct API comparison would add another credential path. Reusing an isolated App Server thread removed the extra API-key setup and secret handling.
  • Static-read labels are insufficient when a repository symlink resolves outside the probe worktree. v0.1.2 adds a whole-worktree canonical audit before any probe thread and repeats canonical CWD/path resolution at each approval.
  • Runtime files, launchers, marketplace state, and Plugin state form one user-visible installation. v0.1.2 stages local changes and restores the prior verified state when a covered install or upgrade step fails.
  • A literal token comparison was too strict for the real App Server launcher representation, but broadly trusting shell wrappers would have introduced startup-file and command-smuggling risks. v0.1.3 normalizes only the two observed zsh envelopes, requires exact inner-action equality, isolates ZDOTDIR, and rejects every other shell, flag, argument, compound command, redirection, or substitution.
  • A prompt-only re-entry warning cannot stop Plugin discovery that happens before the adapter runs. v0.1.4 preserves the request as task evidence but disables Plugin contributions at process startup and keeps the sentinel as a second control. Lossy search metadata is never trusted in place of validating every command operand.
  • A safe read can still become an unknown action when a model chooses an executable path such as /bin/ls. v0.1.9 requires bare program names in probe instructions and keeps the unknown action denied instead of normalizing raw command text.
  • A numeric CLI version can reject compatible updates without proving behavior. v0.1.12 instead validates the exact consumed schema and a bounded semantic canary, then fails closed on missing surfaces or measured drift.

Decision provenance and Japanese reference presentation

The Decision Inbox explains why a decision exists, what each choice changes, and which probe observations support it. Japanese users can read source-bound reference translations while the sanitized authoritative source remains available. Translation never changes approval identity, policy, contracts, hashes, or mutation payloads.

Decision provenance in English

Decision provenance in Japanese

Contract preview and execution evidence

Before execution, PromptTripwire shows the allowed paths, checks, assumptions, and blocked effects that will be bound into the immutable contract.

Contract preview

After a separately approved safe-fixture run, the sanitized report ties the contract, observed diff scope, checks, deviations, and remaining unknowns together.

Sanitized execution report

Accomplishments

  • Real three-thread identical-input planning, not persona-generated disagreement.
  • Real GPT-5.6 schema-constrained comparison with bounded Sol/Terra evidence.
  • Human choices change machine-enforced paths, components, assumptions, and checks.
  • High-impact operational intent can authorize local preparation but never silently authorize the operation itself.
  • P0 functional requirements FR-001–018 and acceptance criteria AC-001–019 have executable traceability.
  • The judge archive runs without rebuilding from TypeScript and includes a safe fixture plus explicitly recorded read-only replay.
  • Original task text remains a deterministic safety input even when every generated plan omits a requested high-impact action; task-only evidence never masquerades as probe consensus.
  • The Decision Inbox capability closes on terminal/archive boundaries or authenticated inactivity without converting transport shutdown into approval, cancellation, or any other human decision.
  • Release packaging normalizes entry order, ownership, modes, timestamps, and gzip metadata, then compares two builds for the same digest.
  • The v0.1.4 compatibility patch was derived from a real logged-in Codex CLI/App Server invocation without API-key environment variables and backed by Plugin-context A/B, exact-task live probe, search-operand, environment-isolation, and adversarial containment checks.
  • The published v0.1.5 archive was anonymously downloaded, matched byte-for-byte with the clean tagged candidate, installed into an isolated prefix, and invoked from a real logged-in Codex task with API-key variables unset. It stopped at human review with no approved contract and left the fixture unchanged.
  • The v0.1.12 release accepts compatible Codex behavior without version branches, packages an explicit-only thin Plugin, adds judge-facing provenance/support/contract-preview UX, and retains transactional install/uninstall plus the existing human approval and containment gates.

What was learned

The most important product insight was that ambiguity detection and action approval are incomplete in isolation. The useful unit is a chain: multiple grounded interpretations, small explicit decisions, an immutable agreement, and runtime evidence that the implementation stayed inside it.

The most important engineering insight was to distinguish preventive controls from detective controls. App Server event ordering, pathless approvals, and contained writes required precise claims rather than a generic "sandboxed" label.

What's next

  • Verify Linux with the same containment and end-to-end suite before advertising support.
  • Expand comparator evaluation beyond two synthetic fixtures.
  • Explore custom repository policy files and sanitized team-review exports.
  • Revisit narrowly enforceable capability grants only when a stable App Server surface can preserve the current fail-closed guarantees.

Hosted backends, account systems, team approvals, non-Codex adapters, and automatic deploy/release/migration actions remain intentionally out of the MVP.

Judge instructions

Download the v0.1.12 macOS arm64 release artifact and its matching checksum, verify them together, and follow JUDGE_GUIDE.md. Its packaged README and Judge Guide self-reference v0.1.12. v0.1.11 and earlier releases remain immutable historical evidence. It supports:

  • direct ./bin/tripwire execution;
  • one-command user-local install/uninstall;
  • tripwire replay for an explicitly recorded, read-only UI sample;
  • a dependency-free safe fixture for the real inspect → review → approve → contained execution → report flow;
  • no PromptTripwire account, hosted service, source build, or separate OpenAI API key.

Known limitations are visible in the README, Judge Guide, and security document. Judges should use a repository they trust enough to inspect with Codex; PromptTripwire is not a malware-analysis sandbox.

Suggested tags

codex, gpt-5.6, developer-tools, agentic-workflows, security, code-review, typescript, local-first

Built With

Share this project:

Updates