[docwilde]

Closes the two weak spots recorded in the 0.165.0 review (reviews/0.165.0.json). Neither was reachable through DOXA's host, but both broke the documented contract inside the provider or its configuration.

1. Stale execpolicy amendment (provider patch)

• Before: if a command approval was pending when doxaAuto tightened the turn to never, a late AcceptWithExecpolicyAmendment answer was denied correctly. But exec_approval had already written its prefix allow rule to the in-memory exec policy and the rules file under codex_home. Later matching commands could then skip the sandbox, in this turn and in later sessions.
• Now: persist_execpolicy_amendment, the only writer, holds the same active_turn lock that apply_turn_settings uses to publish the switch, and refuses once the active turn has switched. The exec-policy update semaphore is a leaf lock, so holding active_turn across it can't deadlock.
• New regression doxa_auto_refuses_an_execpolicy_amendment_answered_after_the_switch, with a positive control. With the guard removed it fails at its unchanged-rules-file assertion (approval denied, rule written).

2. context_management re-enabling the token budget (host)

• Before: with features.context_management=true, a supporting model and a Plus/Pro plan, Codex enabled TokenBudget at session start despite DOXA's features.token_budget=false. Resets stayed gated by PreCompact but were no longer disabled as documented.
• Now: DOXA passes features.context_management=false and refuses startup unless config/read reports it false. The key exists, defaulting to false, in 0.163.0, 0.164.0 and 0.165.0, so retained Docker providers accept it.
• New context-management and missing-context-management refusal modes. With the check removed, the refusal test fails because DOXA proceeds to hooks/list.

Identity and compatibility

• Patch 376dc69901a97e62d19c6bf32377c4d464e93192340aa582d6992f2613f8ca46 replaces 128293eb… on the same source 360319d8 (rust-v0.165.0). The only patch delta is the guard and its test.
• 128293eb stays in the installer migration registry and PREVIOUS_PATCHES for rollback.
• Retained contracts stay keyed by version, so Docker sessions saved with the beta.76 provider resume only with beta.76; their data is retained. 0.163.0 and 0.164.0 sessions are unaffected. Adding a same-version row to retained.json would have blocked the next automatic update.

Compiled verification (local, installer code paths, 8 build jobs instead of CI's 1-job/8 GiB scope)

• Official clone; patch application and regeneration match byte-for-byte. App-server da6755ad…, code-mode host 47453bd4…, Rust 1.99.1, 0 paid requests.
• Guard inventory: 9 core tests (doxa_auto_ ×7 including the new one, async refusal, infrastructure failures) and 1 hook test, all passing.
• verify_automatic.py, lowered and default windows: 9 denial modes give 0 history replacements and an interrupted turn. Allow gives 1 replacement and a completed turn.
• verify_code_mode.py passed, including the new assertion that the real provider's config/read reports context_management: false. The missing-helper control refused.

Tests

• doxa-engines and the daemon codex_legacy_protection, process, router_cli_workers, codex_review_source and bin suites: 338 passed, 0 failed.
• Updater and installer Python suites, workflow pins and whitespace checks pass.

🤖 Generated with Claude Code