> For the complete documentation index, see [llms.txt](https://faction-os.gitbook.io/faction-os-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://faction-os.gitbook.io/faction-os-docs/.spec_system/archive/sessions/phase11-session03-end-to-end-validation-and-integration-fixes/codex-e2e-validation-record.md). # Codex End-To-End Validation Record **Session ID**: `phase11-session03-end-to-end-validation-and-integration-fixes` **Date**: 2026-05-31 **Package**: Cross-cutting **Status**: Complete - ready for validate workflow *** ## Environment Isolation | Item | Status | Evidence | | --------------------- | -------------- | ----------------------------------------------------------------------------------------------------------------------------------- | | `FACTIONOS_HOME` | Prepared | Temporary session-only home created outside the repository. Exact path is omitted from tracked evidence. | | `CODEX_HOME` | Prepared | Temporary session-only Codex home created outside the repository with one user-owned hook seed. | | Claude settings guard | Prepared | Temporary Claude home includes a user-owned settings seed so Codex-only install can prove no Claude mutation. | | Server port | Occupied | Port `2468` was already bound during preflight; runtime validation will reuse it only if it is a compatible local FactionOS server. | | Web port | Occupied | Port `5193` was already bound during preflight; browser validation will reuse it only if it is a compatible local web server. | | Local auth | Not configured | `FACTIONOS_AUTH_TOKEN` was not set in the shell; no token value was recorded. | ## User-Owned Codex Hook Seed The isolated Codex home starts with one user-owned `SessionStart` command hook and one unknown top-level field. Validation must prove `factionos init --cli codex --faction orc` preserves both while adding only FactionOS-managed Codex hooks. ## Validation Route Live Codex CLI availability will be checked during preflight. Codex `/hooks` trust review requires interactive review in a live Codex session; if it cannot be completed without human input or unsafe trust bypasses, the record will use the Session 02 source-backed fixture replay path and will state that limitation explicitly. *** ## Command Evidence | Step | Result | Evidence | | ------------------------------ | ----------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | CLI link | Pass | `npm --workspace apps/cli link` completed and exposed the local `factionos` command. | | FactionOS CLI help | Pass after T014 fix | `factionos help` ran successfully. Stale Codex deferred wording was removed and rechecked during T014. | | Codex CLI availability | Pass | `codex --version` returned `codex-cli 0.135.0`. | | Codex trust-review feasibility | Source-backed fixture exception finalized | Live `/hooks` review requires interactive human trust. This session did not use or recommend trust bypass flags, so trust review is recorded as unavailable for live automation and browser/runtime validation uses the source-backed fixture path. | | Port preflight | Needs compatibility check | Default ports `2468` and `5193` were occupied before this session started. | ### Install | Check | Result | Evidence | | ------------------------------ | ------ | -------------------------------------------------------------------------------------------------------------------------------------------------------- | | Isolated command | Pass | `factionos init --cli codex --faction orc` exited `0` in the temporary validation homes. | | First run | Pass | Added `15` managed Codex hook commands across `10` FactionOS script kinds. | | User-owned hook preservation | Pass | The pre-existing unmanaged `SessionStart` command remained present; unmanaged hook count stayed `1`. | | Unknown top-level preservation | Pass | The seeded unknown top-level Codex field remained present after install. | | Backup behavior | Pass | A Codex hooks backup was created on the first run because the seed contained user-owned state. | | FactionOS settings | Pass | Local settings recorded `cli=codex-cli`, `faction=orc`, and a configured server URL label. | | Claude no-mutation guard | Pass | The isolated Claude settings checksum was unchanged after the Codex-only install. | | Idempotent rerun | Pass | A second identical init exited `0`, reported unchanged posture, preserved the backup, kept `15` managed hooks, and did not duplicate managed hook slots. | ### Status And Doctor | Command | Result | Evidence | | ------------------------------ | ----------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `factionos status --cli codex` | Pass with privacy observation | Exited `0` under a `5s` timeout. Reported Codex `loaded`, hooks present, JSON valid, `15` managed hooks, `1` unmanaged hook, backup present, feature not configured, and `review with /hooks`. No raw prompt, patch, command-output, transcript, token, or payload labels were detected. | | `factionos doctor --cli codex` | Pass with privacy observation | Exited `0` under a `5s` timeout. Reported Codex loaded posture with `15` managed hooks, `1` unmanaged hook, backup present, feature not configured, and `review with /hooks`. No raw prompt, patch, command-output, transcript, token, or payload labels were detected. | | Broad local path output | Fixed in T014 | Status and doctor were rechecked after the CLI patch; neither command printed absolute local path lines, stale Codex deferred text, or raw payload labels. | ### Uninstall | Check | Result | Evidence | | ------------------------------ | ------ | ---------------------------------------------------------------------------------------------------------------------- | | Isolated command | Pass | `factionos uninstall --cli codex` exited `0` under the temporary validation homes. | | Backup restore | Pass | First uninstall restored the original Codex hooks backup and removed the FactionOS backup file. | | Managed hook removal | Pass | Managed Codex hook count changed from `15` to `0`. | | User-owned hook preservation | Pass | Unmanaged hook count stayed `1`, and the seeded `SessionStart` entry remained present. | | Unknown top-level preservation | Pass | The seeded unknown top-level Codex field remained present after uninstall. | | Idempotent rerun | Pass | Second uninstall exited `0`, reported no managed hooks found, and left counts stable at `0` managed and `1` unmanaged. | | Claude no-mutation guard | Pass | The isolated Claude settings checksum was unchanged after both uninstall runs. | | No erasure overclaim | Pass | Uninstall output did not claim trusted erasure, broad deletion, or account/auth cleanup. | ### Runtime Health | Check | Result | Evidence | | ------------------- | ------ | ------------------------------------------------------------------------------------------------------------------ | | Server-only startup | Pass | Started `apps/server` on a temporary loopback port with `FACTIONOS_MOCK=false` and bounded readiness polling. | | Health response | Pass | Authenticated `/health` returned HTTP `200`, `ok=true`, a present version label, numeric uptime, and `mock=false`. | | Local auth boundary | Pass | Unauthenticated `/health` returned HTTP `401`; no token value was recorded. | | Cleanup | Pass | The temporary runtime was interrupted after validation and the temporary health port was confirmed closed. | ## Ingest Evidence | Surface | Result | Evidence | | ------------------------------------ | ------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Codex lifecycle ingest | Pass | Fixture helper schema validation accepted `SessionStart`, `UserPromptSubmit`, and `Stop`; authenticated `/event` replay accepted all `3` lifecycle steps. `SessionStart` returned a hero id label, and `UserPromptSubmit`/`Stop` returned hero and mission id labels. | | Fixture error mapping | Pass | A local invalid lifecycle payload missing a session id was rejected before network submission with `invalid_payload` and a compact message label. | | Full Codex ingest replay | Pass | An isolated server with `FACTIONOS_MOCK=false` accepted all `14` fixture steps: lifecycle, Bash, `apply_patch`, MCP, permission, subagent start/stop, degraded subagent, unknown redaction probe, and Stop. | | Server state and archive | Pass | Final isolated replay produced `1` hero, `2` missions, `1` archive file, and archive event types for hero, mission, tool, permission, lineage, graph, and opaque mission events. Archive scan found `0` private sentinel hits and `0` raw boundary hits. | | Bash and `apply_patch` observability | Pass | Isolated archive contained `1` `bash_command`, `2` `file_access`, `4` `tool_use`, and `3` `tool_result` events. Raw command strings, command output labels, raw patch bodies, and broad paths were absent; command/path redaction placeholders were present. | | MCP and permission observability | Pass | Archive contained `1` permission request, an MCP tool-use label for `mcp__filesystem__read_file`, and expected tool labels only: `Bash`, `apply_patch`, and `mcp__filesystem__read_file`. Raw MCP sentinel values, JSON argument shapes, bearer/token strings, and auto-approval wording were absent. Degraded fallback metadata was present. | | Subagent lineage observability | Pass | Final isolated replay produced `3` subagent lineage updates, `3` mission graph updates, `1` child mission start, lineage states `active`, `completed`, and `degraded`, reviewer type metadata, and compact degraded reason `missing_subagent_id`. Raw child-agent id strings were absent and lineage placeholders were present in the archive. | ## Browser Evidence | Surface | Result | Evidence | | ------------------------------ | ---------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Loading state | Pass on desktop/mobile | Codex validation browser test asserted the mission-log loading state using a deterministic WebSocket fixture. | | Empty state | Pass on desktop | Codex replay test asserted mission search empty state with a no-match Codex query. | | Error/offline state | Pass on desktop/mobile | Codex validation browser test asserted offline and stream-error states using deterministic WebSocket fixtures. | | Connected Codex lifecycle | Pass on desktop/mobile | Codex replay test accepted fixture events and displayed Codex mission, permission, lineage, and completion states. | | Hero detail | Pass on desktop | Codex replay test asserted Codex CLI/OpenAI labels and mission detail content with visible-text and accessibility guards. | | Mission filters | Pass on desktop | Codex replay test exercised Codex mission search, no-match state, and return to matching search results. | | Tool usage | Pass on desktop | Codex replay test asserted Bash, `apply_patch`, and MCP tool pills and mission detail summaries. | | Replay/export-adjacent privacy | Pass on desktop | Codex replay test opened the replay panel through Settings, asserted redacted local URL fragment copy, and ran visible-text privacy checks. | | Accessibility guards | Pass on desktop/mobile | Codex mission detail controls and replay-visible surfaces passed the existing interactive-name and text-fit/privacy guards; mobile mission activation uses keyboard Enter to avoid dense pointer hit-test ambiguity. | ## Privacy Review | Boundary | Result | Evidence | | ------------------------------------------ | ---------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | CLI install/status/doctor/uninstall output | Pass after T014 fix | Install and uninstall output evidence is label/count based. Status and doctor were rechecked after T014 and did not emit raw payload labels, stale Codex deferred text, or absolute local path lines. | | Hook payload and spool fallback | Fixture observability passed | Bash, `apply_patch`, MCP, permission, subagent, and degraded fallback fixture replay produced bounded metadata with no raw command, command-output, patch-body, MCP-argument, token, child-agent id, or broad-path archive hits. Focused hook tests will run in T024. | | Server ingest and archive boundary | Pass | Isolated full replay accepted all `14` Codex fixture steps and archive scanning found `0` private sentinel or raw boundary hits. | | Browser visible text | Pass on desktop/mobile | Codex replay and state-surface tests ran visible-text privacy checks and private sentinel checks on desktop and mobile. | | Replay share encoding | Pass on desktop/mobile | Replay panel copy stayed on redacted local URL fragments during desktop and mobile Codex replay validation. | | Export-adjacent display copy | Pass on desktop/mobile | Browser replay/export-adjacent copy stayed in local-fragment/no-hosted-claim wording during desktop and mobile validation. | | Tracked evidence artifacts | Pending | Not run yet. | ## Exceptions | Step | Exception | Source-backed reason | Scope | | --------------------------- | --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------- | | Codex `/hooks` trust review | Live automation unavailable | Official Codex hook guidance says hooks are reviewed with `/hooks`; the installed CLI also exposes a dangerous hook-trust bypass flag. This validation did not use that bypass and does not claim live trusted-hook execution. | Trust review only; source-backed fixture replay covers FactionOS ingest, WebSocket delivery, browser display, replay, and privacy behavior. | ## Blocker Fixes | Area | Status | Fix | | -------------------------------------------- | ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | CLI provider/install/status/doctor/uninstall | Fixed | Removed stale Codex deferred help text and compacted status/doctor local path output to configured/unset labels. Focused CLI tests passed. | | Hook normalization/spool | Fixture helper fixed | Bash, `apply_patch`, MCP, permission, and subagent replay produced bounded metadata. The degraded subagent fixture was fixed to omit inherited subagent identifiers so compact degraded lineage is exercised. | | Server ingest | No fix needed | Isolated full replay accepted lifecycle, tool, permission, MCP, subagent, degraded, unknown, and Stop fixture events without private sentinel or raw boundary archive hits. | | Web display/redaction | No app source fix needed | Desktop Codex browser validation passed after e2e scaffolding fixes. `heroCli`, replay, export, and protocol label tests passed; no app source fix was needed. | ## Final Status | Check | Result | | ------------------------------------------ | ------ | | Manual command evidence complete | Pass | | Fixture replay browser validation complete | Pass | | Focused tests complete | Pass | | Quality gates complete | Pass | | Sensitive-string review complete | Pass | | Ready for validate workflow | Pass | --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://faction-os.gitbook.io/faction-os-docs/.spec_system/archive/sessions/phase11-session03-end-to-end-validation-and-integration-fixes/codex-e2e-validation-record.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.