codex: keep full access justification requirements-only

Remove the app-server protocol and schema exposure for require_full_access_justification so the flag stays internal to requirements.toml loading and runtime enforcement.

Co-authored-by: Codex <noreply@openai.com>

codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json

@@ -6871,12 +6871,6 @@
               "object",
               "null"
             ]
-          },
-          "requireFullAccessJustification": {
-            "type": [
-              "boolean",
-              "null"
-            ]
           }
         },
         "type": "object"

codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.v2.schemas.json

@@ -3431,12 +3431,6 @@
             "object",
             "null"
           ]
-        },
-        "requireFullAccessJustification": {
-          "type": [
-            "boolean",
-            "null"
-          ]
         }
       },
       "type": "object"

codex-rs/app-server-protocol/schema/json/v2/ConfigRequirementsReadResponse.json

@@ -98,12 +98,6 @@
             "object",
             "null"
           ]
-        },
-        "requireFullAccessJustification": {
-          "type": [
-            "boolean",
-            "null"
-          ]
         }
       },
       "type": "object"

codex-rs/app-server-protocol/schema/typescript/v2/ConfigRequirements.ts

@@ -6,4 +6,4 @@ import type { AskForApproval } from "./AskForApproval";
 import type { ResidencyRequirement } from "./ResidencyRequirement";
 import type { SandboxMode } from "./SandboxMode";
 
-export type ConfigRequirements = {allowedApprovalPolicies: Array<AskForApproval> | null, allowedSandboxModes: Array<SandboxMode> | null, allowedWebSearchModes: Array<WebSearchMode> | null, requireFullAccessJustification: boolean | null, featureRequirements: { [key in string]?: boolean } | null, enforceResidency: ResidencyRequirement | null};
+export type ConfigRequirements = {allowedApprovalPolicies: Array<AskForApproval> | null, allowedSandboxModes: Array<SandboxMode> | null, allowedWebSearchModes: Array<WebSearchMode> | null, featureRequirements: { [key in string]?: boolean } | null, enforceResidency: ResidencyRequirement | null};

codex-rs/app-server-protocol/src/protocol/v2.rs

@@ -855,7 +855,6 @@ pub struct ConfigRequirements {
     pub allowed_approval_policies: Option<Vec<AskForApproval>>,
     pub allowed_sandbox_modes: Option<Vec<SandboxMode>>,
     pub allowed_web_search_modes: Option<Vec<WebSearchMode>>,
-    pub require_full_access_justification: Option<bool>,
     pub feature_requirements: Option<BTreeMap<String, bool>>,
     pub enforce_residency: Option<ResidencyRequirement>,
     #[experimental("configRequirements/read.network")]
@@ -7240,7 +7239,6 @@ mod tests {
                 }]),
                 allowed_sandbox_modes: None,
                 allowed_web_search_modes: None,
-                require_full_access_justification: None,
                 feature_requirements: None,
                 enforce_residency: None,
                 network: None,

codex-rs/app-server/README.md

@@ -185,7 +185,7 @@ Example with notification opt-out:
 - `externalAgentConfig/import` — apply selected external-agent migration items by passing explicit `migrationItems` with `cwd` (`null` for home).
 - `config/value/write` — write a single config key/value to the user's config.toml on disk.
 - `config/batchWrite` — apply multiple config edits atomically to the user's config.toml on disk, with optional `reloadUserConfig: true` to hot-reload loaded threads.
-- `configRequirements/read` — fetch loaded requirements constraints from `requirements.toml` and/or MDM (or `null` if none are configured), including allow-lists (`allowedApprovalPolicies`, `allowedSandboxModes`, `allowedWebSearchModes`), `requireFullAccessJustification`, pinned feature values (`featureRequirements`), `enforceResidency`, and `network` constraints.
+- `configRequirements/read` — fetch loaded requirements constraints from `requirements.toml` and/or MDM (or `null` if none are configured), including allow-lists (`allowedApprovalPolicies`, `allowedSandboxModes`, `allowedWebSearchModes`), pinned feature values (`featureRequirements`), `enforceResidency`, and `network` constraints.
 
 ### Example: Start or resume a thread
 

codex-rs/app-server/src/config_api.rs

@@ -374,7 +374,6 @@ fn map_requirements_toml_to_api(requirements: ConfigRequirementsToml) -> ConfigR
             }
             normalized
         }),
-        require_full_access_justification: requirements.require_full_access_justification,
         feature_requirements: requirements
             .feature_requirements
             .map(|requirements| requirements.entries),
@@ -480,7 +479,7 @@ mod tests {
             allowed_web_search_modes: Some(vec![
                 codex_core::config_loader::WebSearchModeRequirement::Cached,
             ]),
-            require_full_access_justification: Some(true),
+            require_full_access_justification: None,
             guardian_developer_instructions: None,
             feature_requirements: Some(codex_core::config_loader::FeatureRequirementsToml {
                 entries: std::collections::BTreeMap::from([
@@ -524,7 +523,6 @@ mod tests {
             mapped.allowed_web_search_modes,
             Some(vec![WebSearchMode::Cached, WebSearchMode::Disabled]),
         );
-        assert_eq!(mapped.require_full_access_justification, Some(true));
         assert_eq!(
             mapped.feature_requirements,
             Some(std::collections::BTreeMap::from([