Add authenticated immutable source references for Code Mode `exec`

What variant of Codex are you using?

Codex CLI and App Server Code Mode. The behavior was reproduced with the
standalone x86_64-unknown-linux-musl package at codex-cli 0.148.0 and
reconciled against public tag rust-v0.148.0.

What feature would you like to see?

Please add a versioned, trusted-client Code Mode execution variant that can
reference one immutable local source file by approval-bound identity instead
of carrying its JavaScript through the model-facing free-form exec input.
The host should open and authenticate that file under one host-configured
allowed root, then parse and execute the exact same verified byte buffer.

The requested contract is provisionally called
authenticated-source-reference-v1. The name and public wire encoding are
not requirements; the security and compatibility properties below are.
Ordinary model-authored raw JavaScript should remain backward compatible,
while a trusted client that explicitly selects reference mode must not fall
back to raw source.

Additional information

Problem

Code Mode currently exposes exec as a free-form custom tool. That is useful
for model-authored programs, but it does not let a supervising client prove
that one previously reviewed local module became the parser input. In a
fail-closed reproduction, manually transporting a reviewed JavaScript module
through the free-form submission changed one numeric literal. The module's
independent self-check rejected the drift before any nested tool lookup, but
the failed attempt demonstrated that free-form transport capacity is not
source provenance.

This request is not for general model filesystem access, a server-side
eval wrapper, chunk reconstruction, or a new way to bypass Codex approvals
and sandboxing. It is for a narrow host-owned input mode usable by an
explicitly trusted client or embedding when exact reviewed bytes matter.

Requested contract

A reference-mode request should be a closed, versioned alternative to raw
source. It should bind one normalized path beneath a fixed host-configured
root, the expected positive UTF-8 byte count, the expected whole-file
SHA-256, and fixed file-identity requirements. The caller must not be able to
select another root, parser, host, operating-system identity, permission
profile, sandbox, network policy, or broader resource limit.

Before creating a V8 isolate or exposing helpers or nested tools, the host
should:

1. reject unknown versions or fields, malformed identity values, mixed
   raw/reference input, and caller-selected authority;
2. resolve the path beneath the configured root without following symbolic
   links;
3. open exactly one regular file with no-follow semantics and validate its
   owner, mode, link count, device, inode, and exact size;
4. read it once into one bounded buffer, revalidate the opened descriptor,
   compare the exact byte count and SHA-256, and decode strict UTF-8 without
   normalization; and
5. parse and execute that same authenticated buffer without rereading the
   path or evaluating a second source value.

A bounded result attestation should report only the contract version,
terminal category, actual parser-input byte count, actual parser-input
SHA-256, and sanitized timing. It should not disclose source bytes, paths,
owner identities, environment values, credentials, raw exceptions, stack
traces, unrestricted logs, or model reasoning.

Public implementation seams

At rust-v0.148.0, the current raw-source path crosses these public
components:

• codex-rs/core/src/tools/code_mode/execute_spec.rs and
  codex-rs/code-mode-protocol/src/description.rs define the model-facing
  free-form exec contract and grammar;
• codex-rs/core/src/tools/router.rs and
  codex-rs/core/src/tools/code_mode/execute_handler.rs carry the custom
  payload into ExecuteRequest;
• codex-rs/code-mode-protocol/src/runtime.rs,
  codex-rs/code-mode-protocol/src/host/payload.rs, the remote-session
  command driver, and the gRPC v1 schema currently represent source as one
  string;
• codex-rs/code-mode-host/src/lib.rs dispatches the host request; and
• codex-rs/code-mode-runtime/src/service.rs, the session runtime,
  runtime/mod.rs, and runtime/module_loader.rs carry that string to V8
  compilation and evaluation.

I am not proposing a private downstream wire encoding. The Codex team should
choose whether the trusted reference enters through a new structured tool,
a versioned Code Mode session method, or another supported client boundary.
The important property is that every enabled transport either carries the
same closed semantics or rejects the mode before filesystem or isolate
access.

Compatibility and failure behavior

• Raw free-form exec remains unchanged for ordinary existing use.
• Reference mode is explicitly selected by trusted client configuration or
  protocol, never inferred from model text.
• Reference failure never falls back to raw source.
• Old/new CLI and codex-code-mode-host pairings fail closed on contract
  mismatch.
• Existing approvals, sandboxing, nested-tool dispatch, timeout,
  cancellation, output bounding, and V8 behavior remain in force.
• Capability absence and version mismatch are machine-detectable without
  revealing the configured root or referenced path.

Suggested model-free coverage

Please cover exact positive submission; raw compatibility; unknown, missing,
duplicate, and mixed fields; path traversal and every symlink position;
wrong type, owner, mode, link count, size, digest, encoding, and JavaScript;
replacement/truncation/rewrite races; same-buffer parser identity; zero
parser/isolate/helper/tool side effects for every pre-parse rejection;
bounded failure sanitization; cancellation and timeout; transport parity;
package skew; and a packaged-release smoke test using generated source only.

Adjacent issues, not duplicates

• #36676 asks remote Code Mode hosts to declare a source language and
  model-facing authoring contract. That concerns what the model should
  author; this request concerns authenticating exact client-selected parser
  input before execution.
• #32505 asks for Code Mode parent provenance and terminal status in tool
  lifecycle hooks. That concerns call attribution around tool execution;
  this request requires source authentication before parsing or tools exist.
• #39652 asks to persist the effective MCP tool-contract fingerprint on a
  completed call. That concerns post-call MCP contract provenance; this
  request concerns the exact JavaScript bytes entering the Code Mode parser.

These requests could share provenance vocabulary, but satisfying any one of
them would not supply the other contracts.

Start by tracing the raw-source path through execute_spec.rs, execute_handler.rs, host/payload.rs, code-mode-host/src/lib.rs, and code-mode-runtime/src/service.rs and module_loader.rs. Review the protocol and gRPC seams before choosing the supported client boundary. Done means a closed reference contract, fail-closed compatibility behavior, same-buffer execution, and model-free coverage for the listed rejection, race, transport, and release cases.