The related public PRs explain the shape of the fix: #29697 builds on earlier network-context and shared-ingress work in #29456 and #29668, then narrows the solution to short-lived execution tokens passed through the existing Linux sandbox bridge instead of adding per-exec proxy listeners.
The Pressure
Managed-network commands in one Codex conversation share HTTP and SOCKS proxy ingress. When several exec calls run at once, the proxy can see the destination but may not know which tool call caused it. The PR says that meant Guardian could deny a request without Codex safely attaching the outcome to the right call.
The Intervention
The merged change registers each active exec with a short-lived attribution token, passes it to the Linux sandbox helper, strips it before the user command runs, and has the host bridge prepend the token to each proxy connection. The proxy consumes the bounded frame and clones the existing network policy state for that exec.
Why Maintainers Should Watch
The transferable lesson is to attach policy outcomes at the trust boundary that already exists. Codex did not create a new proxy per exec; it used the existing bridge and proved the concurrent path with tests that compare the exact call IDs and commands.
Limits
This is Linux-only. macOS and Windows keep the current shared-proxy behavior, and the PR explicitly leaves UI display, parent-turn unattributed denials, and Guardian circuit-breaker accounting for later work. What to watch: whether the attribution model expands across platforms.