Won Park a2b7c4a655 Use trusted Guardian templates for managed policies (#60646) ...

## Why

User-configured model catalogs can supply Guardian prompt templates that omit policy slots or add conflicting instructions. Managed rules need a trusted template to reach the reviewer.

## What changed

- Use the bundled Guardian policy template when managed policy or additional rules are present, while preserving explicit host-provided templates.
- Remove `auto_review.extra_policy` and `auto_review.experimental_policy_template` from configuration and the schema. Warn when they are used, directing additional rules to `guardian_extra_policy` in managed `requirements.toml`.

## Testing

Add regression coverage for managed rules with user-supplied catalog templates, explicit host templates, and migration warnings for the removed settings.

GitOrigin-RevId: 7f00bfaa85051272ed70ceb2fcb64ffc297b8755

2026-11-10 19:30:21 +00:00

..

loader

Require explicit project trust in non-interactive runs (#60041)

2026-11-07 02:39:03 +00:00

requirements_layers

Honor managed runtime authentication modes and expand coverage (#60014)

2026-11-07 00:18:36 +00:00

thread_config

Allow providers to opt into Cyber access programs (#58190)

2026-10-29 23:24:52 +00:00

application_requirements_tests.rs

Add managed Desktop workspace storage requirements (#55965)

2026-10-21 19:06:57 +00:00

application_requirements.rs

Add managed Desktop workspace storage requirements (#55965)

2026-10-21 19:06:57 +00:00

application_storage_requirements_tests.rs

Add managed Desktop workspace storage requirements (#55965)

2026-10-21 19:06:57 +00:00

application_storage_requirements.rs

Add managed Desktop workspace storage requirements (#55965)

2026-10-21 19:06:57 +00:00

auth_policy.rs

Enforce managed authentication requirements locally (#37132)

2026-08-05 18:09:26 +00:00

bedrock_runtime_tests.rs

Add AWS credential export commands for Amazon Bedrock (#44028)

2026-09-09 03:17:48 +00:00

browser_computer_use_requirements_tests.rs

Add browser extension request headers to config requirements (#51194)

2026-10-05 22:52:14 +00:00

browser_computer_use_requirements.rs

Add browser extension request headers to config requirements (#51194)

2026-10-05 22:52:14 +00:00

browser_use_tests.rs

Add browser and computer use configuration (#40018)

2026-08-21 21:41:55 +00:00

browser_use.rs

Add browser and computer use configuration (#40018)

2026-08-21 21:41:55 +00:00

cloud_config_bundle_tests.rs

Enforce Fast and Ultra Fast policies independently (#51253)

2026-10-06 03:35:55 +00:00

cloud_config_bundle.rs

Require managed configuration from the configured server (#56055)

2026-10-22 02:15:00 +00:00

cloud_config_layers_tests.rs

Clarify config layer iteration APIs (#36774)

2026-08-03 17:29:42 +00:00

cloud_config_layers.rs

Switch runtime to cloud config bundle (#24622)

2026-06-02 13:18:59 -07:00

codex_home_symlink.rs

Allow trusted symlinks beneath CODEX_HOME on macOS (#42716)

2026-09-04 10:12:03 +00:00

computer_use_tests.rs

Add browser and computer use configuration (#40018)

2026-08-21 21:41:55 +00:00

computer_use.rs

Add browser and computer use configuration (#40018)

2026-08-21 21:41:55 +00:00

config_layer_source.rs

Support packaged defaults in config layering (#37810)

2026-08-10 11:22:55 +00:00

config_requirements.rs

Honor managed runtime authentication modes and expand coverage (#60014)

2026-11-07 00:18:36 +00:00

config_server.rs

Add managed configuration loaders for custom config servers (#56314)

2026-10-23 00:54:06 +00:00

config_toml.rs

Use trusted Guardian templates for managed policies (#60646)

2026-11-10 19:30:21 +00:00

constraint.rs

Enforce automatic review for managed models (#37511)

2026-08-07 23:43:14 +00:00

diagnostics.rs

Support packaged defaults in config layering (#37810)

2026-08-10 11:22:55 +00:00

filesystem_constraints.rs

Resolve filesystem denials with explicit path context (#44669)

2026-09-10 23:08:23 +00:00

fingerprint_tests.rs

Simplify configuration fingerprint canonicalization (#49295)

2026-09-29 16:10:27 +00:00

fingerprint.rs

Simplify configuration fingerprint canonicalization (#49295)

2026-09-29 16:10:27 +00:00

guardian_tests.rs

Honor managed runtime authentication modes and expand coverage (#60014)

2026-11-07 00:18:36 +00:00

guardian.rs

Preserve turn configuration in Guardian scoring and approvals (#59642)

2026-11-05 11:41:09 +00:00

hook_config.rs

Add hook configuration to environment attachments (#56302)

2026-10-23 00:02:29 +00:00

hooks_tests.rs

Add observation-only model request lifecycle hooks (#55144)

2026-10-18 22:43:56 +00:00

host_name.rs

Add hostname to the configurable TUI status line (#39795)

2026-08-20 20:08:11 +00:00

in_app_browser_requirements_tests.rs

Expose managed policy for browser settings imports (#39720)

2026-08-20 14:13:56 +00:00

in_app_browser_requirements.rs

Expose managed policy for browser settings imports (#39720)

2026-08-20 14:13:56 +00:00

key_aliases.rs

Skip unrelated subtrees during config alias normalization (#50354)

2026-10-02 16:37:30 +00:00

lib.rs

Support managed OpenTelemetry configuration requirements (#57649)

2026-10-28 05:11:45 +00:00

marketplace_edit.rs

Keep marketplace upgrade state out of config (#39595)

2026-08-20 05:24:56 +00:00

mcp_edit.rs

Consolidate MCP config editing in codex-core (#36359)

2026-07-31 16:28:22 +00:00

mcp_ema_cancellation.rs

Preserve enterprise MCP authorization across runtime refreshes (#55696)

2026-10-20 23:03:56 +00:00

mcp_ema_tests.rs

Support confidential OAuth clients for enterprise-managed MCP auth (#56001)

2026-10-21 22:30:35 +00:00

mcp_ema.rs

Support confidential OAuth clients for enterprise-managed MCP auth (#56001)

2026-10-21 22:30:35 +00:00

mcp_requirements_tests.rs

Make MCP and Code Mode input schema budgets configurable (#47936)

2026-09-24 20:39:37 +00:00

mcp_requirements.rs

Move MCP policy types into codex-protocol (#39017)

2026-08-17 16:20:52 +00:00

mcp_types_tests.rs

Make MCP and Code Mode input schema budgets configurable (#47936)

2026-09-24 20:39:37 +00:00

mcp_types.rs

Add opt-in lazy startup for cached stdio MCP servers (#60039)

2026-11-07 02:28:44 +00:00

merge_tests.rs

Add runtime assertion authentication modes and an auth provider (#55636)

2026-10-20 17:29:40 +00:00

merge.rs

Add runtime assertion authentication modes and an auth provider (#55636)

2026-10-20 17:29:40 +00:00

model_provider_defaults.rs

Allow configuring GCP project and location in provider settings (#56560)

2026-10-23 18:50:54 +00:00

model_provider_requirements_tests.rs

Enforce managed model provider selection and definitions (#44650)

2026-09-10 21:41:39 +00:00

model_provider_requirements.rs

Enforce managed model provider selection and definitions (#44650)

2026-09-10 21:41:39 +00:00

overrides.rs

Add credential brokering to network proxy feature config (#40466)

2026-08-24 19:52:27 +00:00

path_context_tests.rs

Resolve permission profiles with explicit execution-host path context (#44676)

2026-09-11 00:03:40 +00:00

path_context.rs

Resolve permission profiles with explicit execution-host path context (#44676)

2026-09-11 00:03:40 +00:00

permissions_toml_tests.rs

Add scoped request-body secret substitution to MITM hooks (#57174)

2026-10-26 18:14:26 +00:00

permissions_toml.rs

Add scoped request-body secret substitution to MITM hooks (#57174)

2026-10-26 18:14:26 +00:00

plugin_edit.rs

…

profile_toml.rs

Defer unknown TUI config fields to the shared strict-config policy (#54766)

2026-10-17 02:27:35 +00:00

project_root_markers.rs

…

project_trust_tests.rs

Make project trust lookup paths explicit and defer root resolution (#47924)

2026-09-24 19:44:50 +00:00

project_trust.rs

Make project trust lookup paths explicit and defer root resolution (#47924)

2026-09-24 19:44:50 +00:00

requirements_exec_policy.rs

Add opt-in Unicode canonical matching to exec policy rules (#59535)

2026-11-05 00:55:46 +00:00

schema.rs

Add Guardian V3 feature configuration (#56459)

2026-10-23 12:16:36 +00:00

shell_environment_policy_tests.rs

Add keyed shell environment policy filters (#34590)

2026-07-21 18:23:26 +00:00

shell_environment_policy.rs

Add keyed shell environment policy filters (#34590)

2026-07-21 18:23:26 +00:00

skills_config_tests.rs

Use PathUri for skill identity and path matching (#51482)

2026-10-06 21:29:35 +00:00

skills_config.rs

Use PathUri for skill identity and path matching (#51482)

2026-10-06 21:29:35 +00:00

state_tests.rs

Handle credential provider source remapping across config layers (#44241)

2026-09-09 17:45:17 +00:00

state.rs

Require explicit project trust in non-interactive runs (#60041)

2026-11-07 02:39:03 +00:00

strict_config_tests.rs

Use trusted Guardian templates for managed policies (#60646)

2026-11-10 19:30:21 +00:00

strict_config.rs

Use trusted Guardian templates for managed policies (#60646)

2026-11-10 19:30:21 +00:00

test_support_tests.rs

Switch runtime to cloud config bundle (#24622)

2026-06-02 13:18:59 -07:00

test_support.rs

Switch runtime to cloud config bundle (#24622)

2026-06-02 13:18:59 -07:00

thread_config.rs

Add a credential file override for GCP provider authentication (#57188)

2026-10-26 18:33:05 +00:00

tui_effects.rs

Add independent controls for TUI visual effects (#46832)

2026-09-20 16:16:46 +00:00

tui_keymap_chord_tests.rs

Preserve validation errors for invalid TUI keybindings (#49910)

2026-10-01 06:59:13 +00:00

tui_keymap.rs

Add keyboard and mouse navigation for sidebar tabs (#60181)

2026-11-07 23:18:39 +00:00

tui_mouse_scroll.rs

Make transcript mouse scroll speed configurable (#50209)

2026-10-02 06:50:10 +00:00

tui_rendering.rs

Render TUI Markdown lists with Unicode bullets and checkboxes (#47322)

2026-09-22 16:34:07 +00:00

types_tests.rs

Add remote plugin metadata to plugin configuration (#54424)

2026-10-15 21:44:12 +00:00

types.rs

Add optional tool call summaries to the full-screen transcript (#60554)

2026-11-10 08:34:17 +00:00