## Thinking Path
> - Paperclip is the open source app people use to manage AI agents for
work.
> - The runner admits a verified Codex ACPX profile before any provider
process can start.
> - The pinned ACPX library needs a narrow adapter to the admitted
runtime host.
> - That adapter must keep credentials and launch controls out of
durable session records.
> - It must preserve exact recovery identity, model controls, and
ownership of the complete provider process tree.
> - This pull request adds the Codex-only package adapter without
registering production execution.
## Linked Issues or Issue Description
**Agent or provider**
Codex through the exact ACPX and Codex ACP packages landed in #12400.
**Why this adapter is useful**
The package-local runtime host has an injected port, but no production
implementation. This implementation uses the verified executable lease
and private runtime sandbox without persisting managed credentials or
other launch-only state in ACPX recovery records.
**How the agent is invoked**
The adapter creates one persistent ACPX Codex session. ACPX receives a
placeholder registry command, while its patched spawn callback launches
through Paperclip's verified command lease. The private launch
environment is supplied only at spawn time. Durable session state
receives only the session key, workspace, model, and bounded system
instructions.
**Additional context**
#12400 is merged. This PR does not register an adapter, start runnerd,
expose a server route, or change any direct adapter. It supports Codex
only, rejects non-Codex profiles, and fails closed on Windows until
provider descendants can be contained with an owned Job Object or
equivalent.
## What Changed
- Add a Codex-only adapter from the pinned ACPX library to the admitted
runtime port.
- Create the ACPX store inside the private runtime state directory.
- Open one persistent session with the qualified model and bounded
system instructions.
- Route provider launches through the verified executable lease and a
dedicated POSIX process group.
- Retain cleanup ownership through asynchronous errors and late
termination.
- Supply the private launch environment at spawn time without persisting
it.
- Require all ACPX recovery identity fields before returning the runtime
port.
- Map status, exact model selection, and state-preserving close
operations.
- Add regression coverage for secret isolation, verified spawning,
process-tree cleanup, lifecycle mapping, identity failure, and the
Codex-only boundary.
## Verification
- Exact verified head: `dc89439d0b2e3dee46d212715caeefc8ae0c0959`.
- Full GitHub PR workflow passed in [run 33341468207, attempt
3](https://github.com/paperclipai/paperclip/actions/runs/33341468207/attempts/3),
including runner verification/build, typecheck, all test shards, canary,
and e2e.
- Greptile is 5/5 on the exact head with zero unresolved review threads.
- Superagent Security, Snyk, contributor trust, and commitperclip passed
on the exact head.
- Storybook skipped by path as expected.
- The diff contains 2 files and does not change `pnpm-lock.yaml`,
workflows, migrations, server selection, or UI behavior.
- No additional local suite was run during the final restack; GitHub
Actions is the authoritative verification environment.
## Risks
The primary risk is leaking launch credentials into durable ACPX state.
Session options are constructed explicitly and regression-tested; the
launch environment remains behind the spawn-time callback. Another risk
is orphaning credential-bearing descendants. Supported launches use a
retained POSIX process-group identity with bounded TERM-to-KILL cleanup.
Windows fails closed before runtime construction until equivalent
process-tree containment exists.
## Model Used
OpenAI Codex with GPT-5 and repository tool use.
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used with version and capability
details
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either linked an existing public item or described the
issue in this PR
- [x] I have not referenced internal or instance-local Paperclip issues
or links
- [x] My branch name describes the change and contains no internal task
identifier
- [x] I have added or updated tests where applicable
- [x] I have documented the process, credential, recovery, and rollout
risks
- [x] All applicable GitHub Actions are green
- [x] Greptile is 5/5 with every actionable comment resolved
- [x] I have addressed all review findings before merge
db52ec0ca0