hcom relaxation: retire the 2026-10-04 safety posture

[seathatflowsinourveins]

Scope

• What this PR changes: it removes the 2026-10-04 hcom safety posture from main. The user decided at 2026-10-06T03:03:10Z (11:03 PM EDT on October 5) to relax the hcom deny list; the safety rules give way to the seamless, LLM-native workflow. The PR removes:

  • the 52 Claude deny entries;
  • config/hcom-deny.rules;
  • the adapter's running-Codex interlock and its empty-deny refusal;
  • the acceptance checks that required forbidden decisions.

  Peer text stays data and never counts as the user's approval. Upstream hcom.rules becomes the only Codex hcom policy.

• Base commit: ecfa112764c664d35377dd66b8cfcb67e5a94d60

• Lane: lane:foundation

• Owned paths touched:

  • adoption/new-wsl/client-config-map.json
  • under evidence/artifacts/new-wsl-install-plan-20261002/: config/hcom-client-config.py, config/hcom-deny.rules (deleted), install-plan.json, install.sh, accept.sh, check_plan.py, README.md and SOURCES.md
  • tests/test_new_wsl_client_config.py and tests/test_codex_hook_trust.py
  • docs/decisions/2026-10-06-hcom-relaxation.md (new)
  • docs/decisions/2026-10-04-round2-plan-g1-messaging.md (an inline pointer only; no line moves)
  • manifests/evidence.json, in the last commit only

Verdict P1-1 item	Main ecfa112	Change
claude_settings.permissions.deny	map :912-963 (52 entries)	The whole claude_settings object is removed. An empty object would still go through the settings merge.
Prohibition sentence in hcom_config.launch.hints	map :977	Removed. The data, approval and configuration sentences stay.
codex_rule_file and config/hcom-deny.rules	map :983	Removed. Upstream hcom.rules is the only Codex hcom policy.
Prohibition sentences in peer_instructions	map :984	Removed, including the hcom claude prohibition (see below). The data and approval sentences stay.
Quiet interlock and empty-deny refusal	adapter :123-128 and :61	Removed. The adapter also no longer merges settings (:98-106), installs rules (:108-114) or runs the forbidden check (:145-150).
Contract	check_plan.py :179-196	Replaced by the relaxed contract (below).
post_install --check	install-plan row	Dropped. post_install is the upstream-derived smoke only.
after_sign_in	install-plan row	Reduced, not deleted, so stage counts and the after-sign-in owner lists stay valid. Revised at 7eb9bea: it takes the Codex home the way hcom does (CODEX_HOME, else the parent of HCOM_DIR). It exits 78 while retired Claude hcom deny entries remain and until hcom codex writes hcom.rules. Then it passes every *.rules file there to codex execpolicy check; hcom send and hcom term inject must both be allow, so a leftover hcom-deny.rules exits 78.
Decision record	supersedes 2026-10-04-round2-plan-g1-messaging.md:65-72	docs/decisions/2026-10-06-hcom-relaxation.md

The verdict cites the same pieces at #723's head, at other lines (map :894-951, :962, :968 and :969; checker :180-197). The table uses main's lines.

The relaxed check_plan.py contract keeps the four hcom_config value checks and the smoke tokens. It asserts three things:

• no Codex rule file and no Claude hcom settings are mapped;
• both peer texts keep the data and approval sentences;
• after_sign_in derives the Codex home from HCOM_DIR, evaluates every rules file there and checks the retired Claude denies.

The hcom claude rule: hook-gap finding at hcom's current release

• Current release. gh api repos/aannoo/hcom/releases/latest returns v0.7.27, still the latest (published 2026-10-01T02:11:55Z, target 2c5f343b2f9ec4bf2acf49c0431860e7c2ae578b, the existing pin).
• The gap still holds. Hooks load only in hcom <tool> sessions (release notes, #146). The Claude hook handler exits 0 silently without HCOM_PROCESS_ID (claude.rs:135-140). A plain claude has no hooks (start.rs:412-417). Only hcom claude gets automatic delivery; anything else uses manual hcom listen (README.md:230-246).
• Upstream main. Main is 20 unreleased commits ahead, and its claude.rs diff leaves the guard untouched.
• The sentence is dropped (the command center's read at 247d71e, finding P2, option a).
  • The sentence met the task's "stays only if" test, which is a necessary condition, not a sufficient one.
  • The gap is the cost of not launching through hcom claude, not a reason against it.
  • The peer-instruction block now keeps only the neutral route facts: a plain Claude session uses hcom start and hcom listen, which do not wake it when idle, and hcom claude is upstream's automatic-delivery route for Claude Code.
• Why not option b. Option (b) would keep the rule on the wave-5 transport-scoping basis and add Claude lanes to the command center's orchestration decision. That changes the command center's own decision, so it is not this lane's to make.
• No recipes. This PR adds no launch, kill, term or transcript recipe.

Fixes after the command center's read at 247d71e (ACK_AFTER)

Finding	Fix
P2: the kept hcom claude sentence	Option (a): peer_instructions drops "Never launch Claude lanes through hcom claude" and "Claude lanes stay plain Claude sessions" and keeps the route facts. The record's Result and overturn sections are rewritten.
P3: no supersession pointer for the 2026-10-05 combined-rules acceptance	Inline pointer at the start of the old record's :196. No line moves; :65, :109 and :196 stay where the new record cites them.
P3: rc 3 at --apply when the user's own ~/.hcom/config.toml differs (pre-existing)	Recorded in the decision's host section (see Host evidence below). No code change: run_slot scores any non-zero rc, 78 included, as failed.
P3: the adapter's --check has no caller	The docstring marks it a manual operator check that no plan stage runs. The record's post_install row says the same.
P3: the exec_rules_reviewed.json entry stays	No change. The read accepts the deviation.

The history was rebuilt so that manifests/evidence.json changes only in the last commit (docs/lanes.md:96-128):

• f0d9b2f5: the relaxation;
• 88eb3981: the read's fixes;
• 10160d89: the registry.

It was pushed with --force-with-lease, replacing 247d71e.

Deliberate non-changes

• tools/adoption/exec_rules_reviewed.json keeps its hcom-deny.rules entry. This is a deliberate non-change to the verdict's item (e). The entry reviews one exact file for the RTK Codex hook-trust tool and enforces nothing. Removing it would rewrite about twenty trust tests and rtk-rewrite-heads-check.json. It would also make codex_hook_trust.py refuse on any host that did install the file. The plan-wide test that every plan rule file is reviewed or allow-only stays; only its docstring changed, and it is vacuous while the plan ships none.
• The verdict's item (f) quiet-interlock and quiet-apply wording exists only in Repair native install-plan acceptance after the hcom relaxation #723. On main, git grep -i -E 'quiet (interlock|apply|point)' returns nothing.
• Configuration values are unchanged. These are title_mode=off, relay.enabled=false, auto_trust_workspace=false and auto_approve=true. The verdict reserves auto_trust_workspace and title_mode to the user.

SOTA sources

• aannoo/hcom v0.7.27 at 2c5f343b2f9ec4bf2acf49c0431860e7c2ae578b (https://github.com/aannoo/hcom/releases/tag/v0.7.27), still the latest release, read with gh api repos/aannoo/hcom/releases/latest on 2026-10-06:
  • Upstream hcom.rules, the only Codex hcom policy:
    • src/hooks/codex.rs:1538-1563 (build_codex_rules);
    • :1566-1579, which writes <codex home>/rules/hcom.rules;
    • :337-350, the call made when auto_approve=true;
    • :72-75, the Codex home;
    • src/hooks/common.rs:46-72, the command list.
  • Hook-gap check:
    • the release notes (Make the macOS signal-injection tests target the script PID (not $PPID) #146);
    • src/hooks/claude.rs:135-140;
    • src/launcher.rs:920;
    • src/commands/start.rs:412-417;
    • README.md:230-246.
  • Mapped configuration fields: src/config.rs:126-152.
• Codex native policy checker: https://developers.openai.com/codex/rules, and the installed codex-cli 0.160.0 codex execpolicy check --help (repeatable --rules, JSON decision).

Evidence-class table

Claim	Evidence class	Command / receipt
The plan rows, install.sh, accept.sh, the map and the relaxed contract agree	local_integration	check_plan.py exit 0
The adapter applies while a Codex PID is reported, leaves Claude settings unchanged, writes no Codex rules directory, runs no subprocess and keeps the data and approval sentences	synthetic	test_hcom_apply_never_grants_inbound_authorization_or_requires_codex
copy_config still refreshes plan-owned helpers and keeps operator files	synthetic	test_plan_owned_helpers_refresh_without_overwriting_operator_configuration
The contract fails if after_sign_in falls back to a fixed $HOME/.codex	synthetic (throwaway negative control, not committed)	check_plan.py --plan-dir <mutated copy>: exit 1, "after sign-in must evaluate every rules file in the Codex home that hcom derives from HCOM_DIR, and report retired Claude hcom denies"
Native-checker probes and the after_sign_in program on frozen fixtures	synthetic (real codex-cli 0.160.1 and jq 1.8.1 with scratch homes)	Retained receipt evidence/artifacts/hcom-relaxation-20261006/probe-receipt.json, run at 13:11:32Z: allow/allow/no decision over hcom.rules alone, forbidden for term with the retired file, and 8 after_sign_in runs with the expected exits 78,0,78,0,78,0,78,0
The after_sign_in shell logic (HCOM_DIR derivation, every rules file, retired Claude entries)	synthetic (stub codex)	test_hcom_after_sign_in_reads_hcoms_codex_home_and_every_rules_file
hcom v0.7.27 is the latest release, and the plain-Claude hook gap holds there	source_review	gh api releases, tags and compare; pinned source read
No host changed	(scope)	no install.sh, accept.sh or --only agent-messaging run; NativeStack2604 never had the posture (the command center's read-only check)

Review threads at 3b6ea9d, fixed at 7eb9bea

The fix commit is 2c8890c9, and the registry and regenerated outputs are the last commit, 7eb9beaa.

Thread	Fix
P1, decision record :131: retain the probe's actual result	evidence/artifacts/hcom-relaxation-20261006/ keeps the frozen synthetic hcom.rules (sha256 2a667dcb…) and probe-receipt.json (every argv, sanitized environment, UTC times, exit codes, stdout and stderr). The record's Evidence section cites it.
P2, accept.sh:330: resolve under the Codex home hcom derives from HCOM_DIR	The after_sign_in derives CODEX_HOME, else the parent of HCOM_DIR (hcom src/hooks/codex.rs:72-75, src/paths.rs:26-53). The check_plan contract requires it.
P2, accept.sh:335: check the effective policy	Every *.rules file in that home goes to the native checker, as Codex loads them (openai/codex rust-v0.160.0 exec_policy.rs:662-700). hcom send and hcom term inject must both be allow. A leftover hcom-deny.rules, or any of the 52 retired Claude hcom deny entries, reports needs_user (78).
P2, README.md:476: the generated handbook still stated the retired posture	The handbook's source record (layer consensus, wave 5, agent-messaging) and the WSL recipe's exec-rules sentence were updated. assemble_manifest.py and scripts/build_new_wsl_handbook.py --write then regenerated the outputs, and the handbook receipt follows them.

The installed Codex is now 0.160.1, which adds two commits to rust-v0.160.0, neither touching exec policy.

Local commands run

Run at head 7eb9beaaf9680acebe0d8d1c8b0331cb50e4ff2a with nice -n 19 and PYTHONDONTWRITEBYTECODE=1:

$ python3 scripts/validate.py
exit 0: {"components": 69, "hashed_files": 10322, "profiles": 4, "receipts": 212, "status": "passed"}
$ python3 evidence/artifacts/new-wsl-install-plan-20261002/check_plan.py
exit 0: OK: 84 rows ... 185 commands and 113 acceptance entries agree with the scripts (2 additional checks included)
$ python3 tools/adoption/new_wsl_client_config.py --check
exit 0: check passed (two existing MCP_AUTO_OPEN_ENABLED warnings)
$ python3 scripts/build_new_wsl_handbook.py --check
exit 0
$ (cd evidence/artifacts/new-wsl-definitive-defaults-20261001 && python3 assemble_manifest.py --check && python3 render_tables.py --check ../../../docs/decisions/2026-10-01-new-wsl-definitive-defaults.md)
exit 0, exit 0
$ bash -n install.sh && bash -n accept.sh; git diff --check 3b6ea9d1e..HEAD
exit 0, exit 0
$ python3 -m unittest <the 6 touched modules>; python3 -m unittest <the 4 other pinning modules>
exit 0: 567 tests OK (skipped=3); exit 0: 122 tests OK (skipped=1)

The earlier runs at 10160d8 and 247d71e follow.

$ python3 scripts/validate.py
exit 0: {"components": 69, "hashed_files": 10271, "profiles": 4, "receipts": 212, "status": "passed"}
$ python3 evidence/artifacts/new-wsl-install-plan-20261002/check_plan.py
exit 0: OK: 84 rows ... 185 commands and 113 acceptance entries agree with the scripts (2 additional checks included). Base ecfa11276 gives the same counts, so no stage was dropped.
$ python3 tools/adoption/new_wsl_client_config.py --check
exit 0: check passed, with two MCP_AUTO_OPEN_ENABLED warnings. Base ecfa11276, run in a `git archive` extraction, gives the same exit 0 and the same two warnings.
$ python3 scripts/build_new_wsl_handbook.py --check
exit 0: status passed (no regeneration needed)
$ python3 evidence/artifacts/new-wsl-install-plan-20261002/config/hcom-client-config.py --repo-root . --check-map
exit 0
$ bash -n evidence/artifacts/new-wsl-install-plan-20261002/install.sh && bash -n evidence/artifacts/new-wsl-install-plan-20261002/accept.sh
exit 0
$ git diff --check origin/main...HEAD
exit 0
$ python3 -m unittest tests.test_codex_hook_trust tests.test_new_wsl_client_config tests.test_new_wsl_definitive_defaults tests.test_new_wsl_handbook tests.test_new_wsl_profile tests.test_wsl_new_distro_recipe tests.test_gpt6_family_tiering_20260926 tests.test_gpu_inference tests.test_local_inference_latest_20260926 tests.test_workflow_policy
exit 0: Ran 670 tests in 176.855s, OK (skipped=4)
$ python3 scripts/component_matrix.py --write && python3 scripts/new_host_grand_list.py --write
exit 0, exit 0: no output change

The module list covers every test module that names hcom, agent-messaging, hcom-deny, the plan directory, the map, check_plan, exec_rules_reviewed or the round-2 record. It is the git grep -l over tests/.

Decision record

docs/decisions/2026-10-06-hcom-relaxation.md records:

• the user's decision, described rather than quoted;
• the sources;
• six alternatives;
• the overturn conditions, both for the posture and for reinstating an hcom claude launch rule;
• the host boundaries and a completeness critic.

It supersedes docs/decisions/2026-10-04-round2-plan-g1-messaging.md:65-72, plus that record's 2026-10-05 combined-rules acceptance.

Host evidence

Not applicable: no evidence/hosts/ change. NativeStack2604 never had the posture applied, so nothing needs undoing. A host that did apply it keeps its hcom deny entries and ~/.codex/rules/hcom-deny.rules until that host's owner removes them; none is known.

Expected after landing on NativeStack2604. This behavior is unchanged from base.

• The user's own ~/.hcom/config.toml already exists there.
• Unless it matches the mapped template's digest, install.sh --only agent-messaging writes the two instruction blocks, keeps the file, prints needs_user and prints agent-messaging | install | 3. run_slot scores that rc as failed.
• The four mapped hcom values are not written there.

Integration

• Hot files are in the last commit only (docs/lanes.md:96-128). That commit removes the retired file's registry entry and re-registers the ten changed registered files.
• Repair native install-plan acceptance after the hcom relaxation #723 rebases onto this PR after it lands, in the fixwave-defects lane.

Checklist

• New/changed GitHub Actions are pinned to a full commit SHA with a
  version comment (no floating tags). No workflow changes.
• New/changed workflows declare top-level permissions: {} and grant each job
  only what it needs (contents: read, or an explicitly justified addition). No workflow changes.
• No secrets are printed, logged or committed; no new required secret was
  added without a documented owner.
• No new paid hosting, subscription or billing surface was introduced.
• Peer-owned untracked files and worktrees were preserved (not deleted,
  moved or overwritten).

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-06T11:32:29.083532Z	b1f6c45	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b1f6c45bde

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[seathatflowsinourveins]

Claude session native-agent-stack-5f: landing at head 9c7cd71c72f122120f3b4ea857960f6a65028df1. The command center (wsl-architecture-design) gave its ACK at 7eb9beaaf968, which reaches this head only through recorded mechanical refreshes whose owned non-registry patch-ids are equal (its carry rule); under the user's 2026-10-04 decision it owns merges that touch the hot registry. The read-only cross-family review (GPT-6.1 Sol max, the packaged Codex SDK worker) returned ACCEPT at 7eb9beaaf968; this head is reached from it through recorded carry edges (equal owned patch-ids, or a cross-family delta read returning ACCEPT at the edge's target), with no P1 item.

Observed main 67c6b6f94b456a3a7b5d28bb1fa34625a808d316. coordination/merge_tree_landing_check.py (sha256 a11649fcf2e5844c…) exit 0:

main 67c6b6f94b456a3a7b5d28bb1fa34625a808d316 head 9c7cd71c72f122120f3b4ea857960f6a65028df1 base 67c6b6f94b456a3a7b5d28bb1fa34625a808d316 merged-tree 037f36244cd044b743660113107d7364c91fe811 merge-tree-exit 0
ok   1: clean three-way merge
ok   2: merged-vs-main paths 23, outside PR-owned 0 []
ok   3: main drift 0 paths, overlap with PR-owned inputs (registry excluded) []
ok   4: registry foreign rows equal True, order preserved True, PR-owned rows 22, unowned top-level keys differing []
ok   5: merged files[] sorted by path with no duplicates: True (10361 rows)
LANDABLE
condition 5: merged files[] sorted and unique (tree 037f36244cd044b743660113107d7364c91fe811)

Required checks at this head: 7 pass . Unresolved review threads: 0.

[seathatflowsinourveins]

Claude session native-agent-stack-5f: post-merge observation. Landed as e28d0eec112527ac02659ac23753533b8ed39a73 (parent 67c6b6f94b456a3a7b5d28bb1fa34625a808d316), tree 037f36244cd044b743660113107d7364c91fe811. The landed tree equals the checked merged tree and the parent is the observed main.