feat(hooks): enforce Codex apply_patch punchcards - #757
Draft
CueCrux-Myles wants to merge 7 commits into
Draft
Conversation
Add canonical apply_patch target parsing and Codex-compatible hook output so apply_patch edits receive the same coordination guard as Claude file tools. ExecPlan: paracrux-program3-program4-parallel-orchestration-2026-08-18 agent:openai
Match Codex trailing-whitespace normalization before deriving punchcard resources, with parser and process-level Add/Move regression coverage. ExecPlan: paracrux-program3-program4-parallel-orchestration-2026-08-18 agent:openai
Remove horizontal tabs from operation target paths before deriving punchcard resources, while retaining Codex-compatible leading-space behavior. ExecPlan: paracrux-program3-program4-parallel-orchestration-2026-08-18 agent:openai
Remove embedded carriage returns from operation target paths before deriving punchcard resources, matching the file names Codex mutates. ExecPlan: paracrux-program3-program4-parallel-orchestration-2026-08-18 agent:openai
Recognize change lines without an @@ context marker and reject empty move-only updates, matching Codex patch grammar before punchcard probing. ExecPlan: paracrux-program3-program4-parallel-orchestration-2026-08-18 agent:openai
ExecPlan: crux-v0.5.60-coordination-enforcement-2026-08-18 Agent: openai-codex
ExecPlan: crux-v0.5.60-coordination-enforcement-2026-08-18 Agent: openai-codex
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds punchcard enforcement parity for Codex
apply_patchhooks:This is a source-only draft. It does not claim ParaCrux fleet M2 closure: mapped-passport authentication still needs a live multi-worker proof. No deployment is included.
ExecPlan:
crux-v0.5.60-coordination-enforcement-2026-08-18(parent orchestration:paracrux-program3-program4-parallel-orchestration-2026-08-18)Agent: OpenAI Codex (
agent:openai). Independent review signed off exact HEAD29f2a906fbac1eed81d58045e4cfbb4e479681d7with no remaining findings.Type
Validation
cargo fmt --all -- --checkcargo clippy --locked -p crux-claude-hooks --all-targets -- -D warningscargo test --locked -p crux-claude-hooks(220 unit tests plus integration suites)cargo test --locked --workspacecrux-mcpauthority-identity namespace unit gateChecklist
cargo fmt --checkpasses-D warningscargo test --workspacepassesRollout boundary
Before enabling fleet enforcement, the daemon must run with agent-passport support and distinct explicit agent-to-passport mappings. The live gate must prove that two named workers resolve to different mapped holders, that worker A can mutate its leased path, and that worker B is denied on that same path. Shared, unmapped, or auth-disabled identities are insufficient.