@songyang0603/dsh-codex-execpolicy

Configuration modes

Only one initial input mode may be selected:

1. hostConfigStack: real host discovery; this is the bundle default;
2. configStack: already materialized layers and raw requirements layers;
3. rulePaths / ruleSources: a lower-level explicit ordered policy.

Online cloud authentication and fetching are not performed here. A caller may provide a previously acquired cloud: { mode: "snapshot", bundle }; producing that snapshot belongs to a future cloud/auth component.

The native engine is resolved without consulting PATH, in this order:

1. explicit enginePath;
2. DSH_CODEX_EXECPOLICY_ENGINE;
3. native/ -/... inside this package;
4. repository-local debug/release targets for development.

Every process must return protocol version 3 plus the exact pinned commit and source-object identities before any policy result is accepted.