#312 Prove parity cell: secret-egress taint floor on Codex

[Anonymous]

Originally created by: fu351
Originally owned by: jasperdingg

The parity matrix shows secret-egress taint floor proven on Claude Code and the MCP proxy, but ◻ (not yet proven) on Codex. The guarantee: once a session has read a secret, a later egress that the per-call floor would let pass gets raised to AUTH/BLOCK. The Codex adapter runs the same decision spine, so this is real and mirror-able — it just needs a test.

What to do

1. Read the sibling that proves this on Claude Code: tests/unit/test_hosthook_taint_floor.py (see test_tainted_session_egress_is_blocked_in_strict). It records taint, then asserts a later egress is escalated.
2. Write the Codex equivalent (a new test, e.g. tests/unit/test_hosthook_codex_taint_floor.py) driving doberman.hosthooks.codex.evaluate_pre with a captured-shape Codex payload (tests/fixtures/codex/pre_bash.json is a good base — tool_name: "Bash", string command). Record the secret via the post path, then assert the egress is raised.
3. Mark the test so it claims the cell:
   python @pytest.mark.guarantee("secret-egress-taint-floor", host="codex")
4. Mutation-check it (this is the bar for a ✅, not just a green test): temporarily break the taint floor so the egress would pass, confirm your test goes red, revert. Note "mutation-checked" in the PR.
5. Regenerate the matrix: python -m tools.parity.generate_parity (CI's --check will fail if you skip this).

The matrix cell flips to ✅ automatically once the marked test is collected. Small, self-contained, and it makes a real Codex guarantee provable.

[Anonymous]

Originally posted by: jasperdingg

I'll take this one, will open PR soon.

[Anonymous]

• assigned_to: jasperdingg

[Anonymous]

Originally posted by: fu351

Assigned to you. You've built a whole shelf of these parity cells now (#374, [#377], [#395]), so you know the shape cold. The Codex taint-floor row in docs/PARITY.md is still ◻ — the cell to prove is: a session that read a secret gets a raised floor on egress. Shout on the thread if the fixture setup fights you.