This project modifies a local Codex SQLite database only when auto, protect, or unprotect is explicitly invoked.

The protection trigger blocks every INSERT into the logs table. This is intentional, but it disables local diagnostic log collection.

• Validate the expected logs.id and logs.level schema before mutation.
• Create a consistent SQLite backup before installing the trigger.
• Never delete the database, WAL, SHM, or log rows.
• Never force a checkpoint, change journal mode, or run VACUUM.
• Never remove triggers that were not created by this project.

Open a GitHub security advisory for vulnerabilities that could cause data loss, modify unrelated databases, or bypass the documented safety checks. Do not include sensitive local paths or database contents in a public issue.