Won Park 520e13a4bc Allow configuring the Guardian prompt template (#45516) ...

## What changed

Add `auto_review.experimental_policy_template` to override the Guardian prompt template in `config.toml`. Trim the configured value and ignore it when empty. Prefer the override over the model catalog template, retaining the bundled template as the final fallback.

The template's `{{ tenant_policy_config }}` placeholder is replaced with the resolved Guardian policy.

## Testing

Extend tests to cover template deserialization, trimming, precedence over the catalog template, and rendered policy text in Guardian inference requests.

GitOrigin-RevId: 85b4a8fc193a42735354894203ccbd1f738a3b58

2026-09-14 21:06:36 +00:00

..

loader

Enforce managed provider requirements on existing app-server threads (#44944)

2026-09-12 00:12:26 +00:00

requirements_layers

Expose effective login methods in config requirements (#45495)

2026-09-14 19:11:29 +00:00

thread_config

Keep credentials out of app-server logs (#39993)

2026-08-21 19:04:32 +00:00

application_requirements_tests.rs

Expose managed application network requirements (#42417)

2026-09-03 02:09:10 +00:00

application_requirements.rs

Expose managed application network requirements (#42417)

2026-09-03 02:09:10 +00:00

auth_policy.rs

Enforce managed authentication requirements locally (#37132)

2026-08-05 18:09:26 +00:00

bedrock_runtime_tests.rs

Add AWS credential export commands for Amazon Bedrock (#44028)

2026-09-09 03:17:48 +00:00

browser_computer_use_requirements_tests.rs

Expose managed WebMCP policy through the app server (#42823)

2026-09-04 18:30:26 +00:00

browser_computer_use_requirements.rs

Expose managed WebMCP policy through the app server (#42823)

2026-09-04 18:30:26 +00:00

browser_use_tests.rs

Add browser and computer use configuration (#40018)

2026-08-21 21:41:55 +00:00

browser_use.rs

Add browser and computer use configuration (#40018)

2026-08-21 21:41:55 +00:00

cloud_config_bundle_tests.rs

Support execution-host context when resolving cloud config (#38086)

2026-08-11 23:31:26 +00:00

cloud_config_bundle.rs

Enforce managed provider requirements on existing app-server threads (#44944)

2026-09-12 00:12:26 +00:00

cloud_config_layers_tests.rs

Clarify config layer iteration APIs (#36774)

2026-08-03 17:29:42 +00:00

cloud_config_layers.rs

Switch runtime to cloud config bundle (#24622)

2026-06-02 13:18:59 -07:00

codex_home_symlink.rs

Allow trusted symlinks beneath CODEX_HOME on macOS (#42716)

2026-09-04 10:12:03 +00:00

computer_use_tests.rs

Add browser and computer use configuration (#40018)

2026-08-21 21:41:55 +00:00

computer_use.rs

Add browser and computer use configuration (#40018)

2026-08-21 21:41:55 +00:00

config_layer_source.rs

Support packaged defaults in config layering (#37810)

2026-08-10 11:22:55 +00:00

config_requirements.rs

Resolve permission profiles with explicit execution-host path context (#44676)

2026-09-11 00:03:40 +00:00

config_toml.rs

Allow configuring the Guardian prompt template (#45516)

2026-09-14 21:06:36 +00:00

constraint.rs

Enforce automatic review for managed models (#37511)

2026-08-07 23:43:14 +00:00

diagnostics.rs

Support packaged defaults in config layering (#37810)

2026-08-10 11:22:55 +00:00

filesystem_constraints.rs

Resolve filesystem denials with explicit path context (#44669)

2026-09-10 23:08:23 +00:00

fingerprint.rs

Enforce managed model provider selection and definitions (#44650)

2026-09-10 21:41:39 +00:00

hook_config.rs

Run executor hooks for interrupted turns (#41432)

2026-08-28 23:03:05 +00:00

hooks_tests.rs

Generalize hook handler execution (#37644)

2026-08-09 00:57:15 +00:00

host_name.rs

Add hostname to the configurable TUI status line (#39795)

2026-08-20 20:08:11 +00:00

in_app_browser_requirements_tests.rs

Expose managed policy for browser settings imports (#39720)

2026-08-20 14:13:56 +00:00

in_app_browser_requirements.rs

Expose managed policy for browser settings imports (#39720)

2026-08-20 14:13:56 +00:00

key_aliases.rs

Unify multi-agent settings under agents (#33550)

2026-07-16 09:00:51 +00:00

lib.rs

Add trusted enterprise MCP auth configuration (#44832)

2026-09-11 14:25:56 +00:00

marketplace_edit.rs

Keep marketplace upgrade state out of config (#39595)

2026-08-20 05:24:56 +00:00

mcp_edit.rs

Consolidate MCP config editing in codex-core (#36359)

2026-07-31 16:28:22 +00:00

mcp_ema_tests.rs

Resolve enterprise-managed MCP registrations in the catalog (#45459)

2026-09-14 16:30:00 +00:00

mcp_ema.rs

Resolve enterprise-managed MCP registrations in the catalog (#45459)

2026-09-14 16:30:00 +00:00

mcp_requirements_tests.rs

Move MCP policy types into codex-protocol (#39017)

2026-08-17 16:20:52 +00:00

mcp_requirements.rs

Move MCP policy types into codex-protocol (#39017)

2026-08-17 16:20:52 +00:00

mcp_types_tests.rs

Add trusted enterprise MCP auth configuration (#44832)

2026-09-11 14:25:56 +00:00

mcp_types.rs

Resolve enterprise-managed MCP registrations in the catalog (#45459)

2026-09-14 16:30:00 +00:00

merge_tests.rs

Handle credential provider source remapping across config layers (#44241)

2026-09-09 17:45:17 +00:00

merge.rs

Handle credential provider source remapping across config layers (#44241)

2026-09-09 17:45:17 +00:00

model_provider_requirements_tests.rs

Enforce managed model provider selection and definitions (#44650)

2026-09-10 21:41:39 +00:00

model_provider_requirements.rs

Enforce managed model provider selection and definitions (#44650)

2026-09-10 21:41:39 +00:00

overrides.rs

Add credential brokering to network proxy feature config (#40466)

2026-08-24 19:52:27 +00:00

path_context_tests.rs

Resolve permission profiles with explicit execution-host path context (#44676)

2026-09-11 00:03:40 +00:00

path_context.rs

Resolve permission profiles with explicit execution-host path context (#44676)

2026-09-11 00:03:40 +00:00

permissions_toml.rs

Remove unused Rust helpers (#34345)

2026-07-20 13:45:29 +00:00

plugin_edit.rs

Move plugin out of core. (#20348)

2026-04-30 14:26:14 -07:00

profile_toml.rs

Retire the untrusted approval policy (#39630)

2026-08-20 07:03:02 +00:00

project_root_markers.rs

Extract codex-core-skills crate (#15749)

2026-03-25 12:57:42 -07:00

requirements_exec_policy.rs

Move requirements policy ownership to execpolicy (#38899)

2026-08-16 20:27:05 +00:00

schema.rs

Move Guardian thread context into guardianv2 configuration (#43104)

2026-09-05 21:28:11 +00:00

shell_environment_policy_tests.rs

Add keyed shell environment policy filters (#34590)

2026-07-21 18:23:26 +00:00

shell_environment_policy.rs

Add keyed shell environment policy filters (#34590)

2026-07-21 18:23:26 +00:00

skills_config_tests.rs

Honor per-directory bundled skill settings in skills/list (#37979)

2026-08-11 10:20:54 +00:00

skills_config.rs

Add a configurable skill catalog token budget (#38978)

2026-08-17 10:01:59 +00:00

state_tests.rs

Handle credential provider source remapping across config layers (#44241)

2026-09-09 17:45:17 +00:00

state.rs

Enforce managed model provider selection and definitions (#44650)

2026-09-10 21:41:39 +00:00

strict_config_tests.rs

Warn about ignored configuration settings (#44691)

2026-09-11 00:55:51 +00:00

strict_config.rs

Warn about ignored configuration settings (#44691)

2026-09-11 00:55:51 +00:00

test_support_tests.rs

Switch runtime to cloud config bundle (#24622)

2026-06-02 13:18:59 -07:00

test_support.rs

Switch runtime to cloud config bundle (#24622)

2026-06-02 13:18:59 -07:00

thread_config.rs

Allow custom providers to opt into standalone web search (#34846)

2026-07-23 00:02:15 +00:00

tui_keymap_chord_tests.rs

Support two-stroke TUI key chords (#36511)

2026-08-01 17:43:03 +00:00

tui_keymap.rs

Add worktree session creation to the agents overview (#45276)

2026-09-13 18:53:06 +00:00

types_tests.rs

Add configurable memory versions with isolated storage (#43797)

2026-09-08 10:55:48 +00:00

types.rs

Resolve enterprise-managed MCP registrations in the catalog (#45459)

2026-09-14 16:30:00 +00:00