Published · npm latest
Block the complete local patch.
Patch over 4.6.2. Codex CLI and local ChatGPT Desktop/App Server can
stop a complete apply_patch before disk mutation—only
when the exact hook is trusted and the operation is observed at runtime.
No required config migration.
Upgrade
Get 4.6.3
Restart Codex or the local Desktop session, review and trust the
exact project hook, then exercise a governed apply_patch.
Installed files alone remain unverified.
What changed
Hard where the evidence is complete.
Current Codex payload
ArkGate reads the real patch body from
tool_input.command when
tool_name is apply_patch.
Operation-scoped hard block
A trusted, runtime-observed, completely reconstructed local
patch can report hard:true and exit
2 before mutation.
Files are not proof
.codex/hooks.json on disk is configured but
unverified. A fresh covered invocation proves the local boundary.
CI still covers every path
The required arkgate-check --strict-merge status
remains the only hard boundary shared by every write path.
Honesty notes
What the hard claim does not cover
- Hosted tools and specialized paths that do not use the local hook
- Shell or direct filesystem writes, human edits, and incomplete patch reconstruction
- OpenCode, which remains warning only—not a hard local boundary
- MCP, which remains advisory and must be called by the agent
- Repair reinjection: an envelope may emit, but Codex is not guaranteed to re-apply it
Published from gitHead 17f8c30.
GitHub release v4.6.3 ↗
· Maintainer source:
docs/releases/4.6.3.md ↗