Codex Harness Engineering and Configuration

~/.codex/
|-- AGENTS.md
`-- config.toml
 
repo/
|-- AGENTS.md
|-- .codex/
|   `-- config.toml
|-- .agents/
|   `-- skills/
|       `-- release-check/
|           `-- SKILL.md
|-- docs/
|   `-- agent-runs/
`-- package.json

# Personal Codex instructions
 
## Working agreements
- Be concise unless the task asks for detailed reasoning.
- Prefer small, reviewable diffs.
- Before editing, identify the validation command you will run.
- Ask before adding a production dependency.
- Do not commit unless I explicitly ask.
 
## Review style
- Lead with correctness, security, data loss, and regression risk.
- Include file paths and evidence for each finding.
- Do not list broad style preferences as blockers.

# AGENTS.md
 
## Project map
- App routes: app/
- Shared code: lib/
- UI components: components/
- Generated output: out/ and .next/ must not be edited.
 
## Setup
- Install: npm install
- Dev server: npm run dev
 
## Checks
- Lint: npm run lint
- Tests: npm test
- Build: npm run build
 
## Protected areas
- Do not change auth, payments, secrets, migrations, deploy scripts, or generated files without explicit approval.
- Do not weaken tests or lint rules to make a task pass.
 
## Definition of done
- The requested behavior is implemented.
- Relevant tests or checks pass.
- The final response lists changed files, commands run, and remaining risk.
 
## Review guidelines
- P0: data loss, auth bypass, secret exposure, destructive migration, payment risk.
- P1: production regression, broken critical path, missing test for changed behavior.
- P2: maintainability or coverage risk that should be fixed before merge.
- P3: small cleanup or wording issue.

# packages/legacy-billing/AGENTS.override.md
 
## Override for legacy billing
 
This package does not follow the root TypeScript conventions.
 
- Do not run the root formatter here.
- Use: npm run test:legacy-billing
- Do not change database schema files in this package.
- Any behavior change needs an owner approval note in docs/agent-runs/.
 
This file replaces parent instructions for this subtree because the normal root checks are wrong for this package.

model = "gpt-5.5"
sandbox_mode = "workspace-write"
approval_policy = "on-request"
 
project_doc_max_bytes = 32768
project_doc_fallback_filenames = ["AGENTS.local.md"]
 
[sandbox_workspace_write]
network_access = false
 
[features]
goals = true
 
[mcp_servers.docs]
command = "npx"
args = ["-y", "@upstash/context7-mcp"]
startup_timeout_sec = 20

# .codex/config.toml
# Keep this repo-scoped. Provider, auth, telemetry, and profile-selection keys belong in user config.
 
sandbox_mode = "workspace-write"
approval_policy = "on-request"
 
project_doc_max_bytes = 20000
project_doc_fallback_filenames = ["AGENTS.local.md"]
 
[sandbox_workspace_write]
network_access = false

Run in read-only mode.
 
Task:
Explain why the checkout tests are flaky.
 
Boundaries:
- Do not edit files.
- Do not install dependencies.
- Read only test files, CI logs, package scripts, and related checkout code.
 
Return:
- most likely cause
- evidence with file paths or log lines
- the smallest implementation plan
- the exact commands to run after the fix

/goal Reduce p95 checkout latency below 120 ms, verified by the checkout benchmark, while keeping the correctness suite green. Use only checkout service code, benchmark fixtures, and related tests. Between iterations, record what changed, what the benchmark showed, and the next experiment. If the benchmark cannot run or no valid path remains, stop with evidence, attempted paths, blocker, and next input needed.

---
name: release-check
description: Use before merging or publishing a change that needs lint, tests, build, preview review, and a risk note.
---
 
# Release check
 
## Inputs
- current diff
- repo AGENTS.md
- validation commands
- preview route when UI changed
 
## Procedure
1. Inspect the current diff.
2. Run the relevant lint, test, and build commands.
3. Review the runtime behavior when UI or API behavior changed.
4. Run /review or request a fresh reviewer for non-trivial diffs.
5. Return changed files, commands run, failures, fixes, and remaining risk.
 
## Stop conditions
- Validation passes and no P0/P1 review finding remains.
- A required secret, owner approval, or external service is missing.