# The Approval Belonged to the Wrong Room

The Codex Work Room finished a real Rust task, then failed on the smallest
possible follow-up. The browser kept the draft and eventually reported that
the Host had not confirmed it. The Host log said the message had arrived. No
file changed, and Codex never showed a new turn.

The message had stopped at an approval dialog, but not one the Work Room could
answer. A terminal follow-up resumes Codex by calling the framework's `codex`
tool directly. That call still passed through the ordinary agent approval
plugin, which opened an outer tool approval before the native Codex adapter
could start its turn. The focused Work Room owns native Codex approvals; the
outer conversation owns generic tool approvals. We had asked one room to
answer a decision rendered in another.

Making Codex automatic would have hidden the symptom by removing decisions we
want people to see. Letting every direct tool call through would have weakened
the Host boundary. The useful fact was narrower: while holding the durable
session lock, the Host had already verified the requester, the terminal Codex
invocation, and its exact state revision.

The runner now turns that fact into a one-shot capability for one operation:
the outer `codex` wrapper. The approval plugin consumes it at the first tool
boundary. A different tool consumes nothing useful and still asks; a later
Codex call still asks. Once the native adapter starts, its command and file
approvals continue through the Work Room exactly as before.

The regression uses a real Agent with the real approval plugin, not a fake that
jumps straight to the adapter. Negative cases prove the capability cannot
approve another tool or survive for a later call. The focused provider tests
and approval tests pass together, so the boundary is checked from both sides.

An approval is not just a yes-or-no question. It also has an owner and a
surface. When execution crosses from an outer agent into a focused native
provider session, preserving every approval layer can be just as wrong as
removing one. The right question must appear in the room that can answer it.