# `ASM.RuntimeAuth.CodexMaterialization`
[🔗](https://github.com/nshkrdotcom/agent_session_manager/blob/v0.10.0/lib/asm/runtime_auth/codex_materialization.ex#L1)

Codex-specific governed materialization guard owned by ASM.

Codex-native auth, OAuth, and app-server mechanics remain in `codex_sdk`.
This module only decides whether a governed ASM run may hand a materialized
Codex command/env/cwd/config-root envelope to that SDK boundary.

# `t`

```elixir
@type t() :: %ASM.RuntimeAuth.CodexMaterialization{
  api_key: String.t() | nil,
  base_url: String.t() | nil,
  clear_env?: true,
  command: String.t(),
  config_root: String.t(),
  connector_binding_ref: String.t(),
  credential_lease_ref: String.t(),
  cwd: String.t(),
  env: %{optional(String.t()) => String.t()},
  native_auth_assertion: map(),
  native_auth_assertion_ref: String.t(),
  provider_account_ref: String.t(),
  source: atom(),
  target_auth_posture: atom()
}
```

# `authorize_config`

```elixir
@spec authorize_config(
  map(),
  keyword()
) :: {:ok, t() | nil} | {:error, ASM.Error.t()}
```

# `codex_option_attrs`

```elixir
@spec codex_option_attrs(t() | nil) :: keyword()
```

# `connect_opts`

```elixir
@spec connect_opts(t() | nil) :: keyword()
```

# `exec_attrs`

```elixir
@spec exec_attrs(t() | nil) :: keyword()
```

# `metadata_key`

```elixir
@spec metadata_key() :: atom()
```

# `new`

```elixir
@spec new(term(), ASM.RuntimeAuth.t() | map()) :: {:ok, t()} | {:error, ASM.Error.t()}
```

# `put_redacted_metadata`

```elixir
@spec put_redacted_metadata(map(), t() | nil) :: map()
```

# `redacted_evidence`

```elixir
@spec redacted_evidence(t() | nil) :: map() | nil
```

# `thread_attrs`

```elixir
@spec thread_attrs(t() | nil) :: keyword()
```

---

*Consult [api-reference.md](api-reference.md) for complete listing*