Codex can carry useful knowledge across tasks, but durable memory can also turn yesterday’s untrusted tool output into tomorrow’s execution context. Verity Cordon makes that trust transition explicit.
Supported Codex hooks send bounded evidence to a loopback-only daemon. Verity screens recognized secrets before any model call, extracts atomic memory candidates, runs deterministic detectors, and can request schema-constrained GPT-5.6 semantic risk advice. A versioned deterministic policy—not the model—makes the final allow, redact, quarantine, or block decision. Only eligible memories are injected into later Codex sessions as typed, delimited context.
Every security decision enters a SHA-256 hash chain signed by a per-installation Ed25519 key. Operators can inspect provenance and policy reasoning, revoke one previously admitted memory, rebuild the active view, and preserve unrelated approved knowledge.
The public demo runs an original, clean-room Trojan Hippo-inspired poisoning fixture against the real local pipeline. A mock documentation tool returns useful release guidance plus a concealed instruction intended to survive into a later task. The terminal triggers the payload while the live Control Room shows shadow-mode admission, then deterministic enforcement of the identical payload, quarantine, signed event history, and successful ledger verification. The fixture uses only fixed synthetic markers, performs no external transmission, and the timed video clearly labels its recorded semantic fixtures. Selective revocation and deterministic replay are implemented and exercised by the offline judge path, but are not compressed into the 1:50 video.
Codex Desktop is the primary human-facing surface on macOS, while Codex CLI provides the deterministic harness. The no-key judge path uses recorded semantic fixtures but exercises the real detector, policy, signed ledger, materialized view, revocation, API, and Control Room code. The live subscription provider requests gpt-5.6-luna through supported ChatGPT sign-in and is explicitly labeled lower-isolation agentic_sandboxed; the requested identifier is not remote-model attestation.
Verification
The final hardened run processed 45 synthetic candidates: deterministic policy allowed 31 and quarantined 14. Selective recovery revoked 8 memories. Ledger verification reported 562 signed events with a complete anchored chain and a consistent materialized view. The repository gate passed 785 backend tests, 13 isolated plugin/example tests, all 11 Control Room tests, frontend type checking, lint, production build, dependency audits, and a 20-sample synthetic evaluation with zero fixture-scoped false positives or false negatives.
How Codex was used
Codex drove current-source research, donor inspection, GitHub Spec Kit initialization, architecture, implementation, adversarial testing, UI work, documentation, demo production, and release verification in the primary project task. The operator chose the identity, security constitution, deterministic-policy boundary, Desktop-first direction, scope cuts, and public claim limits.
How GPT-5.6 was used
After local secret sanitization, the live provider requests GPT-5.6-family structured output for atomic candidate extraction and semantic risk assessment. Its output is advisory; deterministic policy retains final authority. The public timed attack uses recorded semantic fixtures so judges can reproduce it without an API key.
Challenges, accomplishments, and learning
The hardest design problem was integrating through documented Codex surfaces without pretending that undocumented native memory interception exists. That led to a controlled replacement memory plane, explicit hook contracts, fail-closed injection, and a strict separation between semantic advice and deterministic authority. The result is a complete, testable vertical slice rather than an architecture-only prototype: live attack visualization, shadow and enforce modes, selective revocation, deterministic replay, signed verification, and an offline judge path. We learned that durable-memory defense needs provenance and recovery as much as detection, and that demo evidence must distinguish fixture semantics, requested model identifiers, and independently attested behavior.
What is next
The immediate priority is keeping the public judge path stable through judging. Additional storage backends, agent adapters, remote policy delivery, enterprise identity, local packaged models, hardware-backed keys, and exporter ecosystems remain explicitly deferred behind new numbered specifications so they cannot destabilize the Codex-first security boundary.
Judge testing path
git clone https://github.com/MahdiHedhli/verity-cordon cd verity-cordon ./scripts/bootstrap.sh export VERITY_DATA_DIR=.verity-demo ./scripts/demo-offline.sh
The macOS offline path requires no OpenAI API key and exercises the real policy engine, signed ledger, materialized view, revocation flow, API, and Control Room.
Verity Cordon provides tamper-evident history and demonstrated cross-session memory controls. It does not claim tamper-proof storage, factual truth verification, complete prompt-injection prevention, outbound information-flow control, or protection from a compromised host.
Built With
- codex-cli
- codex-desktop
- ed25519
- fastapi
- github-spec-kit
- gpt-5.6
- opentelemetry
- pydantic
- python
- react
- sqlite
- typescript
Log in or sign up for Devpost to join the conversation.