Add P0 execution substrate behind frozen MCP tools

.github/workflows/ci.yml

@@ -33,13 +33,21 @@ jobs:
         run: |
           cargo fmt --check
           cargo fmt --check --manifest-path crates/patch/Cargo.toml
+          cargo fmt --check --manifest-path crates/codex-runtime/Cargo.toml
       - name: Clippy
         run: |
           cargo clippy --all-targets -- -D warnings
           cargo clippy --manifest-path crates/patch/Cargo.toml --all-targets -- -D warnings
+          cargo clippy --manifest-path crates/codex-runtime/Cargo.toml --all-targets -- -D warnings
       - name: Test
         run: |
           cargo test --manifest-path crates/patch/Cargo.toml
           cargo build --manifest-path crates/patch/Cargo.toml --bin codespace-patch
+          cargo test --manifest-path crates/codex-runtime/Cargo.toml
+          cargo build --manifest-path crates/codex-runtime/Cargo.toml --bin codespace-codex-runtime
+          # Worker apply_patch still shells out to the patch helper. Export
+          # CODESPACE_PATCH_BIN before workspace and UDS tests. RuntimeProcess
+          # tests spawn the worker when CODESPACE_RUNTIME_BIN is set.
           export CODESPACE_PATCH_BIN="${PWD}/crates/patch/target/debug/codespace-patch"
+          export CODESPACE_RUNTIME_BIN="${PWD}/crates/codex-runtime/target/debug/codespace-codex-runtime"
           cargo test --workspace

Cargo.toml

@@ -1,7 +1,7 @@
 [workspace]
 resolver = "2"
 members = ["crates/domain", "crates/policy", "crates/runner", "crates/store", "crates/server"]
-exclude = ["crates/patch", "third_party"]
+exclude = ["crates/patch", "crates/codex-runtime", "third_party"]
 
 [workspace.package]
 version = "0.6.0"

NOTICE

@@ -23,6 +23,9 @@ under the Apache License, Version 2.0.
   depends on other Codex workspace crates (including
   `codex-exec-server`, path utilities, and tree-sitter bindings).
   The adapter lives in `crates/patch` and calls the library in-process.
+  Isolated `crates/codex-runtime` (`codespace-codex-runtime`) reuses
+  `codex-process-hardening` and `codex-uds` for the opt-in Unix-socket
+  worker. `codespace-patch` also calls `pre_main_hardening()`.
 
 Codex copyright: OpenAI.
 Codex license: Apache License 2.0.

README.ko.md

@@ -14,7 +14,9 @@ stdin/stdout으로 Rust `codespace-patch` 헬퍼와 대화합니다. 그 헬퍼
 프로세스는 Codex를 **프로세스 내부에서** 호출합니다. `exec_command`는
 현재 워크스페이스를 cwd로 하는 **호스트** 프로세스
 (`tokio::process::Command`)를 띄웁니다. 격리된 Linux 디스패치가 목표
-러너 경계이며, 현재 exec 경로는 아닙니다.
+러너 경계이며, 현재 exec 경로는 아닙니다. 선택적 `CODESPACE_RUNNER=uds`는
+CodeSpace JSON으로 `codespace-codex-runtime`과 대화합니다. 그것은 Linux
+격리가 아닙니다.
 
 다음이 **아닙니다**.
 
@@ -56,7 +58,8 @@ cargo run -p codespace-server --bin codespace-mcp -- --http
 ```
 
 시험: `cargo test --workspace`와
-`cargo test --manifest-path crates/patch/Cargo.toml`. ChatGPT Custom
+`cargo test --manifest-path crates/patch/Cargo.toml`와
+`cargo test --manifest-path crates/codex-runtime/Cargo.toml`. ChatGPT Custom
 Connector 절차와 **검증하지 않은** 항목:
 [docs/chatgpt-connector.md](docs/chatgpt-connector.md).
 운영자 설치: [docs/operations.md](docs/operations.md).

README.md

@@ -14,6 +14,8 @@ helper over JSON stdin/stdout. That helper process calls Codex
 **in-process**. `exec_command` currently spawns a **host** process
 (`tokio::process::Command`) with the workspace as cwd. Isolated Linux
 dispatch is the target runner boundary, not the current exec path.
+Opt-in `CODESPACE_RUNNER=uds` talks CodeSpace JSON to
+`codespace-codex-runtime`; that is not Linux isolation.
 
 This is **not**:
 
@@ -55,7 +57,8 @@ cargo run -p codespace-server --bin codespace-mcp -- --http
 ```
 
 Tests: `cargo test --workspace` and
-`cargo test --manifest-path crates/patch/Cargo.toml`. ChatGPT Custom
+`cargo test --manifest-path crates/patch/Cargo.toml` and
+`cargo test --manifest-path crates/codex-runtime/Cargo.toml`. ChatGPT Custom
 Connector steps and what is **not** verified:
 [docs/chatgpt-connector.md](docs/chatgpt-connector.md).
 Operator install: [docs/operations.md](docs/operations.md).