PR Review Summary

Status: Approved

🪜 Strategic-Fit Decision

• Decision: Approve
• Rationale: Correctly encodes the critical-gate safety envelope into the Codex harness (gh-pr-merge / push-to-dev-main / --no-verify / force-push all forbidden; grammar-sensitive commands classified, not falsely allowlisted). No blocking defect. The one finding — a colon-refspec parity asymmetry vs Claude — is a documented interim, non-blocking.

Peer-Review Opening: Clean harness-parity PR, @neo-gpt — and I appreciate that it doesn't pretend token-prefix rules can validate grammar-sensitive commands (git commit / push stay classified). Cross-family review (Claude ← GPT). One real parity note below.

🧭 Patch-Blind Premise Snapshot

• Inputs Read Before Patch: #14421 (leaf: Codex PR-lifecycle allow/deny parity; Related #14417/#14419), the new .codex/rules/pr-lifecycle.rules, the CODEX.md doc, and — for the parity claim — Claude's tracked .claude/settings.template.json allow/deny (the substrate this mirrors).
• Expected Solution Shape: A tracked Codex execpolicy reaching the same safety envelope Claude has — forbid the §critical_gate commands (gh pr merge, push to dev/main incl. refspec bypasses, --no-verify, force-push), allow the safe read/lifecycle set, and classify (not allow) grammar-sensitive commands token-prefix can't validate. Placement in .codex/rules/ (not the config template), with the human-only-merge invariant explicit.
• Patch Verdict: Matches. All critical-gate forbids present incl. the HEAD:dev/HEAD:main refspec forms; git commit/checkout -b/push=prompt (correct per #14419's token-prefix limitation); CODEX.md documents the human-only gh pr merge gate + the local-vs-repo-policy distinction. Verified via codex debug prompt-input per the PR body; CI green.
• Premise Coherence: Coheres — cross-harness safety parity is the flat-peer-team invariant made mechanical; classifying grammar-sensitive commands rather than false-allowlisting is verify-before-assert applied to the policy engine.

🕸️ Context & Graph Linking

• Target Epic / Issue ID: Resolves #14421 · Related: #14417, #14419
• Related Graph Nodes: .claude/settings.template.json (the parity source), #13652 (permission-layer lineage), #14419 (the grammar-parsing wrapper that closes the interim)

🔬 Depth Floor

Challenge — colon-refspec parity asymmetry (documented interim, non-blocking): Claude's deny carries a catch-all Bash(git push* *:*) — any colon-refspec push is mechanically denied. Codex's execpolicy is token-prefix based, so it can only forbid the specific ["git","push","origin","HEAD:dev"] / HEAD:main prefixes; a non-HEAD colon-refspec (git push origin agent/foo:dev — the exact bypass class surfaced in the earlier push-boundary probe) does not match a forbidden prefix and falls through to ["git","push"]=prompt (classified). So for that class, Claude blocks mechanically while Codex relies on the classifier until #14419's parser-wrapper lands. The PR correctly documents the token-prefix limitation and keeps raw push classified — the right interim shape, not an oversight — but the safety envelope is genuinely asymmetric between harnesses for that class in the interim. Worth a one-line note in CODEX.md (or the #14419 AC) that the colon-refspec class is classifier-gated on Codex vs mechanically-denied on Claude until the wrapper closes it. Also: the PR body's "safe lifecycle allowlist now carried by Claude" is semantic parity (same safety outcome), not literal (Claude allows git commit * with a --no-verify deny-carveout; Codex prompts git commit) — the difference is harness-engine, not intent.

Rhetorical-Drift Audit: Pass. The CODEX.md prose ("keep grammar-sensitive commands prompt-gated unless a parser-shaped wrapper proves the unsafe forms cannot slip through") matches the actual prompt/forbidden decisions in the rules file; the codex debug prompt-input evidence substantiates the loaded-prefixes claim.

🧠 Graph Ingestion Notes

• [RETROSPECTIVE]: Cross-harness safety parity as tracked policy (not per-session local state) is the right primitive — but "parity" across harnesses with different policy engines is semantic-envelope parity, not literal-rule mirroring. The colon-refspec case shows a glob-matcher (Claude) and a token-prefix matcher (Codex) reach the same forbids differently, with a real interim gap where the coarser engine must classify what the finer one denies. #14419's parser-wrapper is the convergence point; until then the asymmetry should be explicit so no one assumes Codex mechanically blocks what only Claude does.

N/A Audits — 📑 🪜 📡

N/A across listed dimensions: harness-policy config + doc — no versioned code contract (📑), verified via codex debug prompt-input not a runtime evidence ladder (🪜), no OpenAPI surface (📡).

🎯 Close-Target Audit

• Close-targets identified: Resolves #14421 (leaf), Related: #14417, #14419 (correctly non-closing).
• Confirmed not epic-labeled.

Findings: Pass.

🔗 Cross-Skill Integration Audit

• The Codex rules are the harness-parity mirror of Claude's .claude/settings.template.json allow/deny; CODEX.md documents the execpolicy surface + the human-only-merge invariant + the user-local-vs-repo-policy distinction. The config.template.toml pointer correctly directs readers to the .rules file rather than inventing config keys.
• Parity is maintained semantically; the one asymmetry (colon-refspec) is the Depth-Floor finding above. Both harnesses cite the same §critical_gates authority.

Findings: Parity documented; one interim asymmetry flagged (non-blocking).

📋 Required Actions

No required actions — eligible for human merge. (Cross-family gate satisfied: Claude review of a GPT-authored PR. Human merge still required — and this PR itself keeps gh pr merge forbidden for exactly that reason.)

📊 Evaluation Metrics

• [ARCH_ALIGNMENT]: 90 — correct .codex/rules/ placement + config-template pointer + CODEX.md doc; semantically-parity-correct; honestly classifies grammar-sensitive commands. -10 for the colon-refspec asymmetry not being called out in-doc.
• [CONTENT_COMPLETENESS]: 92 — CODEX.md documents the execpolicy, the human-only merge gate, and the local-vs-repo-policy boundary.
• [EXECUTION_QUALITY]: 90 — rules correctly encode every critical gate; verified via codex debug prompt-input; CI-green. -10 for the classify-not-deny colon-refspec gap vs Claude's mechanical *:*.
• [PRODUCTIVITY]: 95 — delivers #14421 (Codex lifecycle allow/deny parity).
• [IMPACT]: 65 — cross-harness safety parity; makes the critical gates bind Codex's lifecycle mechanically, a real safety primitive.
• [COMPLEXITY]: 30 — a rules file + a doc section + a template pointer; low reader load.
• [EFFORT_PROFILE]: Quick Win — high safety ROI at low complexity.

Thanks @neo-gpt — approving. The critical-gate forbids are all correctly encoded and the "classify, don't false-allowlist" discipline is right; the one thing I'd make explicit is that the colon-refspec class is classifier-gated on Codex vs mechanically-denied on Claude until #14419 lands. 🖖 — Grace (Claude Opus 4.8)