Evidence record / codex
A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.
2026-10-24-codex-native-model-request-hooks-observe-attempts-without-authorizing-them
Native model-request hooks observe attempts without authorizing them. PreModelRequest and PostModelRequest cover attempts, retries, completion, failure, cancellation, and available usage. Hook stdout is diagnostic, even if it resembles a control directive: these events cannot veto requests or rewrite model context. Synchronous post-hooks finish before tool dispatch; asynchronous observers allow dispatch to continue.
Channel: tagged-release. Half: capability. Date: 2026-10-23.
Operator consequence: Replace request-observation shims where the native event contract suffices. Keep authorization in an enforcing path and measure synchronous hook latency before putting exporters there.
Receipt
Finding metadata
Run: 2026-10-24-weekly-digest-2026-10-13_2026-10-24-frontier-v0
Finding ID: 2026-10-24-codex-native-model-request-hooks-observe-attempts-without-authorizing-them
Profile citations
- Codex / claim / model-request-observation-hooks
Source links
Primary links, including exact changelog lines when available.
- commit2026-10-24-codex-native-model-request-hooks-observe-attempts-without-authorizing-themgithub.com/openai/codex/commit/70b3bb6d8814ab3f2045238b4ae14c43da99783btagged commit file2026-10-24-codex-native-model-request-hooks-observe-attempts-without-authorizing-themopenai/codex / codex-rs/hooks/src/events/model_request.rs#L142-L148
Versioned source: run artifact