The prompt that had not yet entered the conversation
In Codex, submitted text can wait in pending input while a UserPromptSubmit hook inspects the session, turn, working directory, transcript, model, permission mode, and prompt. Only after that inspection does the runtime commit the message into the turn.
The hook can allow the prompt, block it with a reason, stop processing, or attach context. Plain-text hook output can become DeveloperInstructions, placing machine-supplied material above ordinary user text. The first model request can therefore differ materially from the sentence visible in the composer.
What changed since the first Atlas draft
Skills and instruction payloads now travel through model metadata, tightening the first-request envelope.
alejandro-ao/tau Tau Turns Agent Architecture Into OnboardingA project-level agent architecture map becomes part of how new work begins.
openai/codex Codex Reset The Meter After Background Work Became User WorkBackground work and user-visible quota relief show that the runtime envelope has product consequences.
What actually happens
-
Restore thread
goal, lineage, permissions
-
Resolve tool mode
model-specific action surface
-
Buffer prompt
pending input
-
Run hooks
inspect, block, add context
-
Commit turn
record accepted state
-
Invoke model
assembled decision envelope
The first request carries a contract
Codex commit a1ecf0cf replaces thread-store SandboxPolicy fields with canonical PermissionProfile fields. The runtime persists the profile as JSON, continues reading legacy values, and propagates it through local storage, in-memory storage, live metadata synchronization, and rollout extraction. Permission is durable session data rather than a transient prompt label.
Commit 5577a9e1 resolves model tool behavior into direct, code_mode, or code_mode_only. The selected ToolMode lives on TurnContext and participates in turn creation, model switches, review turns, tool planning, and code execution. Two turns with identical visible prompts can receive different action surfaces.
The prompt crosses an execution boundary
Codex places prompt inspection before history is finalized. That ordering lets policy or project automation reject malformed work, add repository-specific instructions, or prevent a turn from starting. It also creates a privileged boundary where invisible software can rewrite the effective request before the model sees it.
Gemini CLI exposes a comparable boundary through BeforeAgent. Hook output can block execution or return additionalContext, which is appended inside a delimiter. Tests escape delimiter-like text, acknowledging that injected context is itself an input-security surface.
The task gets a record separate from the message
Codex PR 21981 fixed threads that began with a goal but failed to appear in resume lists because discovery depended on a normal first user message. The design added a separate thread preview field so the goal can supply display metadata without pretending the objective was literally the first message.
Separating goal, preview, and user-message fields prevents one value from carrying incompatible meanings. A runtime can preserve the objective, render a useful session label, and retain the original conversation without quietly rewriting one into another.
A delegated worker has another first moment
Codex commit d661ab70 adds SubagentStart, which runs after a child is created but before its first model request. The hook receives the child agent ID and resolved agent type, and its output can add context to the child conversation. The child begins inside a separately assembled envelope.
Later lineage fields make that envelope traceable. parent_thread_id identifies the spawning thread, subagent_kind records the child's role, and forked_from_thread_id records copied history. Parentage and inherited history are distinct facts; collapsing them makes permission, recovery, and audit records tell the wrong story.
Where the contract breaks
Invisible instruction escalation
Hook output can enter the request with more authority than ordinary user text.
Control state disappears at a boundary
A resume, model switch, worker, or child falls back when permission context is not propagated.
Lineage fields collapse distinct relationships
Parentage and copied history describe different inheritance paths.
What the product must prove
- Show the resolved PermissionProfile, ToolMode, model, working directory, and hook results before the first request.
- Distinguish submitted text, blocked text, and hook-added instructions in the input history.
- Expose parent thread, fork source, child kind, and effective child context before delegated work starts.