[codex] Rust breadth, setup, and governed graph surface#7
Conversation
Almost-all-languages + best-in-class offline governed graph UI redesign, phased with hard rails so the long autonomous goal reads it from its worktree. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Small local model (opt-in, default-off, localhost only) that PROPOSES graph organization + semantic facts through the proposal gate — AI thinks, governance decides. Never authority. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
… model) The brain is the harness's own model (GPT/Codex, Opus-Sonnet/Claude); OAF makes no model calls, just governed tools + best-in-class harness detection and one-command setup. Governance unchanged: AI proposes, gate decides. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
… not rebuild) The graphify-pattern token-smart governed brain already exists in skills/oaf-memory; real new work is harness detection+setup + extending the skill with graph organization/curation tasks. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Native agent-plugin distribution (per-agent manifests, /plugin marketplace add), instruction-tier AGENTS.md fallback, FEATURE tiers lite/full/ultra, portability table — minimal client-side install across many agents. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8d84c8dc0f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| notes: Some(notes), | ||
| supersedes: None, | ||
| }; | ||
| let mut store = Store::open(&config.sqlite_abs, config.store_options())?; |
There was a problem hiding this comment.
When the MCP server is started with --read-only and OAF_FEATURE_TIER=ultra, tools/call can still reach brain.propose_graph_organization; this line opens the writable store and queues a proposal. The Rust MCP command currently drops --read-only while existing agent/handoff invocations use it to guarantee no local state mutation, so an Ultra read-only session can mutate .local/memory.sqlite.
Useful? React with 👍 / 👎.
| let source = args | ||
| .get("source") | ||
| .and_then(Value::as_str) | ||
| .map(workspace_locator) | ||
| .unwrap_or_else(|| "workspace://host-agent/brain".to_string()); |
There was a problem hiding this comment.
If a host passes a URL-like source such as https://... or one carrying a token, .map(workspace_locator) coerces it into a workspace://... string instead of rejecting it; remember_batch then persists that provenance because source validation only sees a workspace locator. This violates the brain tool's workspace-relative/no-provider-URL boundary and can store sensitive or misleading source refs.
Useful? React with 👍 / 👎.
| json!({ | ||
| "command": command, | ||
| "args": ["mcp", "server", "--stdio"], | ||
| "env": { "OAF_FEATURE_TIER": tier.as_str() } |
There was a problem hiding this comment.
For target.format == Toml (Codex), the installer later reads only server.command when building the managed TOML block, so this OAF_FEATURE_TIER env value is silently discarded. oaf install/setup --client codex --tier lite|ultra therefore writes a config that launches the server at the default Full tier, making lite restrictions and Ultra's brain tool differ from the receipt/docs.
Useful? React with 👍 / 👎.
| | "call" | ||
| | "list_lit" |
There was a problem hiding this comment.
In Elixir and Clojure, ordinary function forms are parsed as call/list_lit; because import_targets first extracts any quoted literal from import nodes, calls like IO.puts("hello") or (println "hello") will emit bogus IMPORTS module:hello facts. That pollutes the governed graph for the new languages and can affect recall/architecture results; only actual import/require forms should reach the quoted-literal import path.
Useful? React with 👍 / 👎.
| { | ||
| "already-written" | ||
| } else { | ||
| atomic_write(&file.path, &next)?; |
There was a problem hiding this comment.
When oaf setup --uninstall is confirmed, the MCP target entries are removed/restored above, but this manifest loop still writes/recreates every generated plugin manifest and .oaf/AGENTS.md. Users trying to uninstall the setup are left with active agent instructions/manifests, and rerunning uninstall can continue to report changes instead of cleaning them up.
Useful? React with 👍 / 👎.
1 participant
Summary
Validation
Notes
This branch was rebased onto origin/main after PR #6 merged, then pushed with --force-with-lease so the PR diff is against current main.