From 1f322d46fdda5bc215d2bd02b3fd5cc119dc0f47 Mon Sep 17 00:00:00 2001
From: Charles Cunningham <ccunningham@openai.com>
Date: Tue, 24 Mar 2026 20:24:56 -0700
Subject: [PATCH] Clarify execve guardian short-circuit

Co-authored-by: Codex <noreply@openai.com>
---
 codex-rs/core/src/tools/runtimes/shell/unix_escalation.rs | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/codex-rs/core/src/tools/runtimes/shell/unix_escalation.rs b/codex-rs/core/src/tools/runtimes/shell/unix_escalation.rs
index 303ab48465..56a9b91ebd 100644
--- a/codex-rs/core/src/tools/runtimes/shell/unix_escalation.rs
+++ b/codex-rs/core/src/tools/runtimes/shell/unix_escalation.rs
@@ -434,6 +434,9 @@ impl CoreShellActionProvider {
         let approval_id = Some(Uuid::new_v4().to_string());
         Ok(stopwatch
             .pause_for(async move {
+                // Guardian-routed execve reviews short-circuit in
+                // `process_decision()` before calling this helper. `prompt()`
+                // is only the human approval path.
                 let available_decisions = vec![
                     Some(ReviewDecision::Approved),
                     // Currently, ApprovedForSession is only honored for skills,