Daily harness signal

Carry authority from plan to dispatch

August 1, 2026 · JST One fresh finding Tool routing · permissions · MCP
Fresh Codex changes make one harness rule concrete: names, rationales, and mutable global registries are not execution authority. Resolve target and privilege explicitly, then carry that exact binding from sampling through dispatch.
01 · Fresh · source date 2026-07-31

Names and rationales are not capabilities

Use when: your agent can choose among multiple execution environments, two threads can reuse the same MCP server name, or a tool call may execute after the catalog or runtime has refreshed.

Action: at tool-plan construction, resolve a typed execution binding containing thread ID, step ID, canonical tool identity, environment or server instance, frozen catalog revision, and sandbox policy. Publish an unqualified shell tool only when exactly one local environment exists; otherwise expose qualified targets and reserve the bare name against third-party registration. Treat justification as explanation, never permission: reject any shell call that supplies it without an explicit sandbox_permissions value, and require the escalated enum before entering approval flow. Store the finalized ToolRouter and MCP binding on the step context. Dispatch readiness checks, argument handling, cancellation, parallelism, and execution through that stored object—never by re-resolving the current global registry.

Acceptance check: in a disposable harness, configure Thread A and Thread B with different MCP processes under the same server name, each returning a unique marker. Give the plan two local environments. First submit a rationale-only shell call; pass only if validation rejects it before process start. Confirm the bare shell tool is absent and an external tool cannot claim that reserved name, while qualified variants remain available. Then alternate A/B MCP calls, refresh A between sampling and dispatch, and execute an A call that was already planned. Pass only if every call returns its thread marker, the in-flight A call uses its sampled step binding, and refreshed capabilities appear only in a newly sampled step.

Evidence: OpenAI merged all five controls and shipped them in Codex 0.147.0-alpha.4 on July 31. PRs #36329 and #36350 include multi-environment and no-dispatch validation coverage; #36355 alternates same-named MCP servers across two threads; #36357 and #36360 eliminate alternate router and duplicate catalog paths. These are inspectable implementation commits with regression tests.

Caveat: Codex 0.147.0-alpha.4 is prerelease, and no independent field reproduction was available at this scan. The field names and router types are product-specific. A binding proves dispatch consistency, not that the selected tool is safe or that escalation should be approved; policy still needs an external deny path.

Compact source notes

  1. OpenAI Codex 0.147.0-alpha.4 (published 2026-07-31 17:54 UTC). Official prerelease containing the five merged commits below.
  2. PR #36329 and PR #36350 (merged 2026-07-31). Primary implementation and tests for target disambiguation, reserved tool names, and typed privilege intent before dispatch.
  3. PR #36355, PR #36357, and PR #36360 (merged 2026-07-31). Thread-bound MCP regression plus step-scoped router and frozen-catalog implementation.
  4. Method: anchor lens—merged commits, official prerelease, and regression fixtures; unity lens—execution authority should be a typed, immutable transition receipt. The two-thread/two-environment canary is the falsification check.