# A Name Is Not an Adapter

The user wrote “open the Codex.” The agent answered that it understood, ran
`pwd`, ran `which codex`, and then announced that Codex was ready.

Codex had never started.

The screenshot made the failure unusually clear. Every individual sentence
sounded plausible. The working directory existed. The executable existed. The
base model knew what Codex was. But none of those facts created a provider
session, so there was no Codex activity, no approval boundary, no session ID,
and no Work Room to reopen. A product cannot call that delegation merely
because the model used the delegate's name in its reply.

We first tried the tempting fix: make the prompt more emphatic. Prompts are
useful for policy, but they are not routing tables. A model can still inspect
the shell, explain what it intends to do, or select a generic tool. That is
exactly how the original failure remained fluent while doing the wrong thing.

Alpha 7 moves the invariant to the boundary. Explicit `run`, `use`, `start`,
`open`, `/codex`, delegation, and equivalent Chinese requests are recognized
before ordinary tool selection and given one native route. If a shell tool
later tries to launch `codex`, the call is rejected before approval or process
creation and the rejection is published as an OIP event. Harmless commands
such as `which codex`, documentation searches, and commit messages remain
ordinary shell work; mentioning a provider is not the same as launching it.

“Open” exposed a second assumption. Our tool required a prompt, so even a
correctly routed open request encouraged the model to invent a task. The native
adapter now starts or resumes the Codex thread without submitting a turn when
the user supplied no work. The returned session ID is still the handle for the
next real task. Opening a work room and asking someone to work are different
actions, even when the same API supports both.

The first public browser run exposed one more lifecycle detail: Codex does not
write a resumable rollout until a thread receives its first turn. Alpha 7 could
therefore display a real open-only thread ID and still fail when the Work Room
tried to resume it in a new app-server process. Alpha 8 keeps that initial
app-server alive behind a bounded, fifteen-minute registry. The first follow-up
claims the exact thread, persists it by completing a real turn, and closes the
process. Expiry and a hard registry limit prevent abandoned rooms from becoming
an unbounded process leak.

The useful measurement was not one happy mocked call. The focused suite now
covers 101 routing, adapter, plugin, and co-ai cases, including false positives
and wrapped shell launches. Four authenticated Codex app-server tests exercise
open-without-turn, its same-thread first follow-up, a real turn, and session
resume. The installed wheel is then
tested in a fresh environment so a source checkout cannot accidentally supply
the new plugin. The final browser acceptance remains the most human test: the
same words from the original screenshot must produce a Codex card and an
openable Work Room, not two Bash rows and a confident sentence.

The broader lesson is small enough to reuse: provider identity belongs in the
protocol path, not in prose. If a request must cross a particular authority,
session, or approval boundary, the system should be able to prove which
adapter handled it. The model can decide what to say after that. It should not
get to decide whether the boundary existed.