From 4bf950af4fc22d529f1ee4df1cf41bf1457834d7 Mon Sep 17 00:00:00 2001
From: Adam Perry <anp@openai.com>
Date: Mon, 22 Jun 2026 23:28:00 +0000
Subject: [PATCH] codex: address PR review feedback (#29497)

---
 .codex/rules/development.rules               | 7 ++++---
 codex-rs/docs/execpolicy-host-executables.md | 4 ++--
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/.codex/rules/development.rules b/.codex/rules/development.rules
index de5395b6d0..006a5c50a3 100644
--- a/.codex/rules/development.rules
+++ b/.codex/rules/development.rules
@@ -1,6 +1,9 @@
 # Shared rules only allow commands that are generally safe for every project
 # developer. Prompt and denial policies belong in user config so the repository
 # does not impose those flows globally.
+# Cargo commands and argument-forwarding recipes may use `--manifest-path` to
+# target manifests outside this checkout. That flexibility is an accepted
+# tradeoff for development.
 
 prefix_rule(
     pattern = [
@@ -25,12 +28,10 @@ prefix_rule(
     decision = "allow",
     justification = """
 Needed: host caches or nested sandbox capabilities.
-Safe: fixed non-publishing recipes only operate on the trusted checkout.
+Safe: these non-publishing recipes are standard development operations.
 """,
 )
 
-# Cargo accepts `--manifest-path`, so these rules may target manifests outside
-# this checkout. That flexibility is an accepted tradeoff for development.
 prefix_rule(
     pattern = ["cargo", ["build", "check", "clippy", "test"]],
     decision = "allow",
diff --git a/codex-rs/docs/execpolicy-host-executables.md b/codex-rs/docs/execpolicy-host-executables.md
index 0c758240a1..c4972de4d8 100644
--- a/codex-rs/docs/execpolicy-host-executables.md
+++ b/codex-rs/docs/execpolicy-host-executables.md
@@ -1,6 +1,6 @@
 # Pin Codex development tool paths
 
-Pinning prevents trusted rules from matching an unexpected executable with the same name.
+Pins constrain absolute-path fallback to binaries trusted by each developer.
 
 From the development shell's repository root:
 
@@ -10,6 +10,6 @@ python3 scripts/setup_dev_execpolicy.py \
   > ~/.codex/rules/codex_dev_tool_paths.rules
 ```
 
-This pins binaries for the repository's
+They constrain absolute executable paths for the repository's
 [development rules](../../.codex/rules/development.rules). Rules load when a
 Codex session starts.