#334 Prove parity cells: AUTH deadline auto-deny, and timeout logged distinctly from refusal, on Codex

[Anonymous]

Originally created by: fu351
Originally owned by: jasperdingg

Two related ◻ cells, one PR (they share setup). Both proven on Claude Code by tests/unit/test_auth_challenge_timeout.py, but that proof is host-agnostic engine code: it calls doberman.auth.challenge.run_auth_challenge directly and never touches doberman.hosthooks.claude_code. For Codex, you need a test proving the Codex hook's OWN wiring reaches and correctly surfaces that same deadline behavior. Waiting the real 1200-second default (DEFAULT_CHALLENGE_TIMEOUT_S) isn't practical in a unit test, so stub the result the way tests/unit/test_hosthook_auth_challenge.py::test_timed_out_auth_denies_with_expired_no_response_hint already does for Claude Code (unmarked, but it's the right pattern): monkeypatch doberman.auth.challenge.run_auth_challenge to return AuthResult(method=TIMEOUT_METHOD, approved=False, ...) instead of actually sleeping.

What to do

1. Read ADR 0046 (wall-clock deadline) and test_a_blocked_prompter_denies_within_the_deadline / test_a_timeout_is_distinguishable_from_a_human_denial in test_auth_challenge_timeout.py for the contract each cell proves.
2. In tests/unit/test_hosthook_codex.py, using the same AUTH-tier action as test_auth_runs_dobermans_own_challenge (Write to .github/workflows/ci.yml):
3. a test stubbing run_auth_challenge to a TIMEOUT_METHOD result, asserting codex.evaluate_pre denies → @pytest.mark.guarantee("auth-deadline", host="codex")
4. a second test comparing that timeout's reason text against a plain-denial stub's reason text, asserting they read differently → @pytest.mark.guarantee("timeout-vs-deny-logging", host="codex")
5. Mutation-check both: make the two reasons identical (or drop the TIMEOUT_METHOD branch), confirm red, revert.
6. Regenerate: python -m tools.parity.generate_parity.

[Anonymous]

Originally posted by: jasperdingg

I'll take this one too, will open PR soon

[Anonymous]

• assigned_to: jasperdingg

[Anonymous]

Originally posted by: fu351

Yours too — assigned. This one's two cells: AUTH auto-denying at the wall-clock deadline, and a timeout logging distinctly from a refusal. tests/unit/test_hosthook_codex.py already carries the destructive-command-gate and auth-action-bound markers to mirror; you're adding auth-deadline and timeout-vs-deny-logging. Same groove as [#395].

[Anonymous]

Originally posted by: fu351

@jasperdingg checking in on [#334] and [#312], no rush. If you're stuck on either one ask here and I'll help. If you've moved on that's fine too, just let me know and I'll unassign them.

[Anonymous]

Originally posted by: jasperdingg

Sorry, I've been a bit busy recently, but I'm mostly done. I'll open a PR today.