[MEDIUM] armorcodex runtime banner claims ENFORCING despite documented gaps that make most tools uninterceptable

[Aniketvish0]

Migrated from armoriq/conmap-auto#716.

Fix lands in: armoriq/armorcodex. Filed here because conmap-auto is this session's tracker for CLI/SDK work.

armorcodex @ origin/main (72d9e13).

CODEX_HARNESS_LIMITATIONS.md states that only Bash, apply_patch and MCP calls emit hooks, and that 11 tools including multi_agents*/agent_jobs emit none — so sub-agent orchestration cannot be intercepted and a denied command can be re-run inside a spawned sub-agent.

It further documents that:

• hooks fire concurrently with no ordering guarantee that a deny precedes side effects,
• hooks are inert without codex_hooks = true in a user-writable TOML,
• hooks are disabled on Windows.

plugin.json is honest ("not a complete boundary"); handleSessionStart (engine.mjs:162-167) is not.

Also dead as a consequence: engine.mjs:675 handlePostToolUseFailure and :787 handleSessionEnd — Codex emits neither event, so failed tool calls are never audited.

Ask

Make the banner state actual coverage.