diff --git a/.github/scripts/verify_tui_core_boundary.py b/.github/scripts/verify_tui_core_boundary.py
index e66afeca92..2c2c25672c 100644
--- a/.github/scripts/verify_tui_core_boundary.py
+++ b/.github/scripts/verify_tui_core_boundary.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 
-"""Verify codex-tui does not depend on or import codex-core directly."""
+"""Verify codex-tui stays behind the app-server/core boundary."""
 
 from __future__ import annotations
 
@@ -14,10 +14,22 @@ ROOT = Path(__file__).resolve().parents[2]
 TUI_ROOT = ROOT / "codex-rs" / "tui"
 TUI_MANIFEST = TUI_ROOT / "Cargo.toml"
 FORBIDDEN_PACKAGE = "codex-core"
-FORBIDDEN_SOURCE_PATTERNS = (
-    re.compile(r"\bcodex_core::"),
-    re.compile(r"\buse\s+codex_core\b"),
-    re.compile(r"\bextern\s+crate\s+codex_core\b"),
+FORBIDDEN_SOURCE_RULES = (
+    (
+        "imports `codex_core`",
+        (
+            re.compile(r"\bcodex_core::"),
+            re.compile(r"\buse\s+codex_core\b"),
+            re.compile(r"\bextern\s+crate\s+codex_core\b"),
+        ),
+    ),
+    (
+        "references `codex_protocol::protocol`",
+        (
+            re.compile(r"\bcodex_protocol\s*::\s*protocol\b"),
+            re.compile(r"\bcodex_protocol\s*::\s*\{[^}\n]*\bprotocol\b"),
+        ),
+    ),
 )
 
 
@@ -29,10 +41,11 @@ def main() -> int:
     if not failures:
         return 0
 
-    print("codex-tui must not depend on or import codex-core directly.")
+    print("codex-tui must stay behind the app-server/core boundary.")
     print(
-        "Use the app-server protocol/client boundary instead; temporary embedded "
-        "startup gaps belong behind codex_app_server_client::legacy_core."
+        "Use app-server protocol types at the TUI boundary; temporary embedded "
+        "startup gaps belong behind codex_app_server_client::legacy_core, and "
+        "core protocol references should remain outside codex-tui."
     )
     print()
     for failure in failures:
@@ -76,8 +89,9 @@ def source_failures() -> list[str]:
     for path in sorted(TUI_ROOT.glob("**/*.rs")):
         text = path.read_text()
         for line_number, line in enumerate(text.splitlines(), start=1):
-            if any(pattern.search(line) for pattern in FORBIDDEN_SOURCE_PATTERNS):
-                failures.append(f"{relative_path(path)}:{line_number} imports `codex_core`")
+            for message, patterns in FORBIDDEN_SOURCE_RULES:
+                if any(pattern.search(line) for pattern in patterns):
+                    failures.append(f"{relative_path(path)}:{line_number} {message}")
     return failures