Daily harness signal

Plan from cache. Execute from truth.

July 28, 2026 · JST One fresh finding MCP cache · live authority
Codex’s newest alpha exposes cached MCP schemas before startup, but deliberately refuses to trust them at execution. The transferable rule: caches may accelerate planning; only live capability state may authorize a side effect.
01 · Fresh · source date 2026-07-27

Keep cached discovery separate from execution authority

Use when: Your agent uses saved MCP or tool definitions so the model can plan before a server, authentication flow, or execution environment finishes starting—especially for startup-sensitive remote tools and connectors.

Action: Split discovery from authority. Cache only tool identity, description, and input/output schemas. Before rendering a cached entry, strip every safety-affecting annotation or hint, including read-only, idempotent, destructive, and open-world claims. On a call: await the selected server with a bounded timeout; fetch its current catalog; re-resolve by server plus tool name; re-run enabled-tool filters, approval, authentication, sandbox, and argument validation; then execute only the live binding. If the tool is absent, changed, or startup failed, return a model-visible error—never invoke from cache. Persist cache provenance and retrieval time, and log the cache-versus-live diff.

Acceptance check: Seed a warm cache with a read-only echo and a second tool. Make the next live server expose echo as mutating and remove the second tool. Block startup and verify both schemas reach inference but neither call dispatches. Unblock it. Pass only if echo receives current approval and returns the live server’s result, the removed tool produces an observable unavailable error, and stale readOnly never suppresses confirmation. Repeat with startup failure and require zero side effects.

Evidence: Official merged OpenAI Codex PR #35590 shipped in 0.146.0-alpha.13. Its integration test proves cached definitions reach inference before initialization, a successful call comes from the new server process, and a cached-only tool returns a model-visible error. The MCP specification independently says tool annotations are untrusted unless they come from a trusted server.

Caveat: This is a prerelease Codex implementation, not a stable cross-client guarantee. MCP defines live listing and list-change notifications but does not standardize caching. An early stale description can still bias planning, so do not use cached presence as an availability promise; retain normal consent and approval gates.

Compact source notes

  1. OpenAI Codex PR #35590 and merged commit 3bbf1fe (2026-07-27). Official implementation, explicit cache/live boundary, and tests.
  2. Versioned integration test (2026-07-27). It blocks initialization, inspects model-visible cached schemas, then verifies live-process execution and a live-visibility failure.
  3. Codex 0.146.0-alpha.13 (published 2026-07-27 16:03 UTC). Official prerelease containing the commit.
  4. MCP Tools specification 2025-11-25 (retrieved 2026-07-28). Normative live discovery, list-change, timeout, logging, and untrusted-annotation guidance.
  5. Method: anchor lens—merged code and executable tests; unity lens—one invariant, “cached discovery never grants execution authority.” The startup-blocked live-rebinding fixture is the falsification test.