Runbook basis: OpenAI's Codex app, CLI, IDE, security, use-case and plan documentation was checked on 25 August 2026. The runbook describes repository controls; it does not claim that this site executed Codex against a test repository.

Safety in an existing codebase is a sequence of recoverable states. The agent should never be the only place where the plan, current diff or rollback path exists.

Assign a risk tier before asking for code

Tier 0 — inspect: read files, explain behaviour and propose tests. No edits.

Tier 1 — bounded edit: change named files with no dependency, schema or configuration change.

Tier 2 — cross-cutting change: touch shared components, dependencies, build settings or data migrations.

Tier 3 — external state: deploy, rotate credentials, change accounts, write production data or send messages.

The tier belongs to the highest-impact action, not the apparent size of the request. A one-line permission change can be Tier 3.

Branch, approval, test and rollback runbook

  1. Capture baseline
    Action
    Record repository path, branch, dirty files, current tests and the requested outcome.
    Output
    A before-state that preserves user work.
    Stop when
    Stop if the target checkout or ownership of existing changes is unclear.
  2. Isolate the task
    Action
    Create an approved branch or worktree and write allowed files plus prohibited actions.
    Output
    A recoverable workspace with a narrow scope.
  3. Review the plan
    Action
    Inspect proposed files, commands, dependencies and external effects before implementation.
    Output
    A task plan with separate approval points for higher-risk actions.
    Stop when
    Stop if the plan introduces production writes, secrets or unrelated refactors.
  4. Verify the change
    Action
    Run focused tests, type checks, build and browser or platform checks proportional to risk.
    Output
    Evidence tied to the exact diff and environment.
  5. Prepare rollback
    Action
    Describe how to revert code and restore any external state before release approval.
    Output
    A handoff that separates verified, pending and untested work.

Control branches and worktrees

Never hide an existing dirty checkout. If unrelated changes are present, preserve them and isolate new work only after confirming the branch base. A worktree helps parallel tasks when every path is known; it does not make two agents safe to edit the same file.

Keep commits narrow enough that a reviewer can explain them. Do not mix package-manager changes, formatting sweeps or route migrations into a feature fix unless the task requires them.

Treat approvals as scoped capability

An approval should name the operation and its target. Permission to run tests is not permission to install a package. Permission to edit website files is not permission to touch a native wrapper. Permission to prepare a release is not permission to push or deploy.

Recheck commands containing globs, environment variables, recursive operations or shell composition. Inspect third-party scripts before execution. Never expose environment contents in logs to prove configuration.

Test at the layer of the claim

A passing unit test can prove a pure rule. It cannot prove a page renders, a listener accepts HTTP, a mobile WebView loads CSS or a production route propagated. Pair each completion claim with evidence from its layer and state what could not be checked.

For a bug fix, reproduce the failure first, then add a regression test. For a UI change, include representative widths and long content. For a route or metadata change, inspect generated output and the actual HTTP response.

Preserve rollback evidence

Before release, capture the commit, migration direction, configuration delta and any external action that cannot be undone by reverting Git. If an action deletes data or rotates a key, obtain fresh authority and document recovery before execution.

Use the Codex surface selector to choose the supervision interface. This runbook's unresolved point is product enforcement: we did not observe a Codex sandbox, approval prompt or rollback in a live session, so local configuration still requires a bounded trial.