# dexgate™ Codex Adapter One-Pager

## Purpose
Provide a concise overview of the dexgate™ Codex adapter as a standalone local hard gate with an upgrade path to governance through the Dexgate runtime (paid pilot).

## Audience
- Engineering teams evaluating safer Codex usage
- Security and assurance reviewers
- Enterprise evaluators of governed coding workflows

## Free Standalone Mode (available free)
The Codex adapter starts as a conservative standalone local hard gate:

- Allow read-only shell commands through `functions.shell_command` from a conservative allowlist only
- Allow `functions.update_plan` and `functions.view_image`
- Block `functions.apply_patch` by default
- Block broad interpreters, shell chaining / control operators, redirection, and mutating commands such as `git commit` / `git push`
- No Passport; free mode does not mint Action Passports

## Paid Pilot Mode (early access)
In paid mode, the adapter sends normalized requests to the customer-hosted Dexgate policy runtime and receives allow / deny / constrain decisions with Passport-shaped evidence when entitled.

Also available on validated paths:
- Live destructive-action governance (live licensed runtime)
- Stable reason codes and governed traces
- Explicit readonly **governance-gap** signaling when the host lacks a pre-execution hook

## Current Claim Boundary
- Commercial posture: **OpenClaw and Codex free adapters on public npm**; paid runtime is **early access / pilot** (not generally available production for all customers). Roadmap adapters are not on public npm yet.
- Current status is defined only in the Compatibility Matrix (AVAILABLE / PILOT / ROADMAP)—not a general production guarantee
- Supporting evidence includes controlled host coverage; additional Linux validation may support a declared row without expanding commercial posture

## Why Teams Use It
- Reduce accidental production-bound mutation during evaluation
- Keep early Codex usage useful for read-only inspection without opening patch or unrestricted shell
- Add shared PDP monitor/record and Passport evidence only when ready for paid pilot