From c3bfbc07026484f1c5865a4334c96691bbf4c894 Mon Sep 17 00:00:00 2001
From: Eva Wong <evawong@openai.com>
Date: Mon, 4 May 2026 10:12:00 -0700
Subject: [PATCH] Document Windows metadata request boundary

---
 codex-rs/windows-sandbox-rs/src/setup_main_win.rs     | 2 ++
 codex-rs/windows-sandbox-rs/src/setup_orchestrator.rs | 5 +++++
 2 files changed, 7 insertions(+)

diff --git a/codex-rs/windows-sandbox-rs/src/setup_main_win.rs b/codex-rs/windows-sandbox-rs/src/setup_main_win.rs
index ad571ba169..208de12355 100644
--- a/codex-rs/windows-sandbox-rs/src/setup_main_win.rs
+++ b/codex-rs/windows-sandbox-rs/src/setup_main_win.rs
@@ -79,6 +79,8 @@ use sandbox_users::resolve_sandbox_users_group_sid;
 use sandbox_users::resolve_sid;
 use sandbox_users::sid_bytes_to_psid;
 
+/// Layer: Windows enforcement request boundary. Helper-process copy of the
+/// setup payload decoded from the orchestrator.
 #[derive(Debug, Clone, Deserialize, Serialize)]
 struct Payload {
     version: u32,
diff --git a/codex-rs/windows-sandbox-rs/src/setup_orchestrator.rs b/codex-rs/windows-sandbox-rs/src/setup_orchestrator.rs
index 0b7d821d23..d843be1b74 100644
--- a/codex-rs/windows-sandbox-rs/src/setup_orchestrator.rs
+++ b/codex-rs/windows-sandbox-rs/src/setup_orchestrator.rs
@@ -91,6 +91,9 @@ pub struct SandboxSetupRequest<'a> {
     pub proxy_enforced: bool,
 }
 
+/// Layer: Windows enforcement request boundary. These overrides are already
+/// projected by the adapter layer; setup code only packages them for the helper
+/// process.
 #[derive(Default)]
 pub struct SetupRootOverrides {
     pub read_roots: Option<Vec<PathBuf>>,
@@ -430,6 +433,8 @@ pub(crate) fn gather_write_roots(
     out
 }
 
+/// Layer: Windows enforcement request boundary. Serialized setup-helper process
+/// input; this carries prepared enforcement data, not policy decisions.
 #[derive(Serialize)]
 struct ElevationPayload {
     version: u32,