Date: 2026-08-29 UTC Scope: GPT↔Codex continuity relay only Fork baseline: main version 186 Runtime under test: R9-ISOLATED-AUTH-PROVENANCE Production: NO_GO

Durable File Library authority recovered at task start: SECOND_BRAIN_CONTINUITY_CURRENT_V9_20260829.json effective_at_utc: 2026-08-29T03:23:30Z.

V9 is stale for implementation details because the live relay has since advanced through R9/R9.1 and V4 acceptance. Its fail-closed truth boundary remains applicable: no actual Windows Codex runtime may be claimed without authentic runtime evidence.

Live promoted release: R9_RECONCILIATION_RELEASE.md post-merge state: PASS / LIVE_FAIL_CLOSED / PRODUCTION_NO_GO.

Implementation: R9-ISOLATED-AUTH-PROVENANCE Active lane: CODEX_REAL_RUNTIME_ACCEPTANCE_V4 Challenge id: 5abe8d3e-d35f-411f-b1c7-a8f4dc3e4b89 Challenge SHA-256: d7fe64c4a5b4e3d27ef3c9e636610a2a67812c9b7234dccb86a1061f17b8ab50 Checkpoint SHA-256: 2e65b96eea80b8aaa4a7bbf737f02131851e8f38c87519a7ba6ec3d7fad7e03c Deadline: 2026-08-31T03:15:00Z

Python launcher: version 5.1 bytes 20536 SHA-256 8ced417e29c746410ba7a12e62832c5e8a4896b3ea535ca90a67f9a8b9ea852e

Windows wrapper: bytes 3443 SHA-256 65545541e8973b275a23068b38a033cccc58f09d0b83a895b03626626b256d92

acceptance_selftest.ts evaluation: 01a04c50-1338-76a8-9edb-e8d59dbdad19 PASS.

Observed:

• V1/V2/V3 superseded by V4;
• V4 PENDING_CODEX_ACK;
• mechanical_checks_passed=false;
• lane revision 1;
• checkpoint exact;
• downloaded Python launcher exact bytes/SHA PASS;
• downloaded Windows launcher exact bytes/SHA PASS;
• audit chain PASS;
• audit event count 88;
• production_go=false.

continuity_runtime_watch.ts evaluation: 01a04c50-25ed-7233-a8ca-731c863cdf2b PASS.

Observed:

• changed=false;
• urgent=false;
• contractDrift=false;
• codex_acks=0;
• codex_responses=0;
• active_device_tokens=0;
• pending_pairings=0;
• approved_not_delivered=0;
• audit chain PASS;
• hours_until_deadline approximately 44.3.

Remote Desktop Commander: connected devices = 0.

Therefore the authentic Windows/Codex execution is still unavailable from this chat and must not be simulated.

Current OpenAI Codex sources corroborate:

• approval policy supports never;
• read-only sandbox is a supported mode;
• --ask-for-approval never can be used with read-only;
• approvals_reviewer=auto_review has had a reported path that can defeat an explicit sandbox level when inherited configuration is active.

R9 mitigates that class by requiring:

• isolated CODEX_HOME;
• regular auth.json copy only;
• --ask-for-approval never;
• --sandbox read-only;
• --ignore-user-config;
• --ignore-rules;
• user/project/global AGENTS inheritance false;
• preflight capability checks before pairing.

Disposable branch: r9-live-adversarial-audit forked from main@186.

Evaluation: 01a04c4f-c784-704b-b7b5-64235f1e849d PASS.

The fixture used direct SQLite rows and never published or ACKed acceptance evidence.

Verified:

1. Legacy environment Codex tokens are not valid authentication routes:
   • CODEX_TOKEN -> HTTP 401
   • CODEX_TOKEN_V2 -> HTTP 401
   • CODEX_TOKEN_V3 -> HTTP 401
   • CODEX_TOKEN_V4 -> HTTP 401
   • CODEX_TOKEN_SELFTEST -> HTTP 401
   • CODEX_SELFTEST_TOKEN_R3 -> HTTP 401
2. A correctly derived synthetic device bearer can read only its exact V4 lane state.
3. Cross-lane state access is rejected with DEVICE_TOKEN_SCOPE_VIOLATION.
4. Generic device inbox access is rejected with DEVICE_TOKEN_USE_CHALLENGE_ROUTE.
5. Device challenge route returns the exact V4 challenge id/SHA.
6. A non-runtime message kind is rejected.
7. A runtime response with wrong base revision is rejected.
8. After synthetic DB revocation the bearer returns HTTP 401.
9. Codex ACK count remained 0 -> 0.
10. Codex response count remained 0 -> 0.
11. Fixture cleanup PASS.

Final database recheck:

• codex_acks=0;
• codex_responses=0;
• active_device_tokens=0;
• fixture_rows=0.

No audit event was added by the synthetic direct-DB fixture.

Legacy static Codex bearer environment variables remain physically stored for historical/self-test purposes but authFrom does not consult them. Only GPT/admin environment tokens and active per-device token hashes are accepted.

Server acceptance requires authenticated device provenance for both ACK and response, the same pairing/token for both, an exact device contract, token active at response publication and token revoked/expired before final GPT ACK.

The launcher additionally requires actual Codex exec, read-only/never approval isolation, a fresh local probe absent from the prompt, completed local command evidence, exact manifest/SKILL hashes, no file_change/web_search/mcp_tool_call, exact challenge/canonical bindings, and self-revocation after response publication.

R9_MAIN = PASS_LIVE R9_1_BOOTSTRAP = PASS_LIVE R9_LIVE_ADVERSARIAL_AUDIT = PASS

ACTIVE_ACCEPTANCE = CODEX_REAL_RUNTIME_ACCEPTANCE_V4 ACCEPTANCE_STATE = PENDING_CODEX_ACK REAL_CODEX_ACK = NOT_PROVEN REAL_CODEX_RESPONSE = NOT_PROVEN FINAL_CHATGPT_ACK = NOT_PROVEN ACTUAL_WINDOWS_CODEX_RUNTIME = NOT_OBSERVED FULL_FEDERATED_RUNTIME = NO_GO PRODUCTION = NO_GO

NEXT_GATE: AUTHENTIC WINDOWS HOST RUNS /v1/bootstrap/codex-device.ps1 -> user provides short device code -> ChatGPT inspects and approves exact pairing id/contract -> authentic Codex isolated exec -> authenticated Codex ACK + response -> device token revoked -> mechanical acceptance PENDING_CHATGPT_ACK -> ChatGPT semantic review -> exact final GPT ACK -> PASS_RUNTIME_ROUNDTRIP -> production remains a separate NO_GO/authorization boundary.