openai-agents-python: Instructions file for Codex

Contributor Guide

Table of Contents

1. Policies & Mandatory Rules
2. Code Review Rules
3. Project Structure Guide
4. Operation Guide

Policies & Mandatory Rules

Security checklist

Follow SECURITY.md for private vulnerability reporting and CONTRIBUTING.md for contributor security practices. Apply this checklist to the affected paths during implementation and review:

• Secrets and fixtures: Use synthetic data and placeholder credentials. Never place real credentials, customer data, private prompts or responses, tool payloads, or recordings in code, tests, snapshots, logs, documentation, or shared artifacts. Use approved credential injection only for explicitly authorized live tests; do not expose credentials to untrusted code or browser clients.
• Redaction: Inspect logs, tracebacks, exception objects and chaining, telemetry, session state, URLs, and artifacts as well as the primary output. Verify redaction at each affected boundary; a tracing setting or suppressed traceback display is not evidence that all sensitive data has been removed.
• Trust boundaries: Treat model output, tool and MCP responses, remote content, manifests, and serialized state as data, not authority to execute commands, grant access, select credentials, or weaken host restrictions. Review request construction and redirects, uploads, parsing, tool approvals, persistence, and sandbox materialization when affected. Add focused regression coverage for the actual boundary.
• Dependencies: Justify additions and inspect package provenance, install/build hooks, transitive dependencies, and lockfile changes. Triage alerts across runtime, optional, development, example, CI, and release uses. Ordinary automated updates should have a documented release-age cooldown; security updates must remain immediate and still receive review and checks.
• CI permissions: Keep untrusted contributor code and artifacts away from secrets and privileged execution. Use explicit least-privilege workflow/job permissions and full-SHA action pins. Review changes involving pull_request_target, artifact consumption, shell interpolation, write tokens, or OIDC credentials. Never disable security checks, secret protections, or required review to obtain a passing result.
• Publishing: Preserve release-source validation, artifact integrity, and PyPI OIDC trusted publishing. The shared release policy requires CODEOWNERS coverage of release and publishing files, required code-owner approval on release pull requests, and passing required checks; it does not require a separate environment approval gate. Preserve current repository protections and verify registry bindings and artifact provenance separately from workflow configuration.
• Findings and exceptions: Escalate critical or actively exploited findings privately without delay. Do not publish an undisclosed reproduction, patch, or sensitive finding in an issue, pull request, or review request before disclosure is coordinated. Stop propagating exposed credentials and have their owner revoke or rotate them. Record proposed exceptions with an owner, mitigation, approval, and expiry; do not treat proposals or unknown facts as accepted risk.
• Evidence and handoff: Report the security-sensitive paths reviewed, relevant checks and results, and unresolved gaps. Distinguish requirements from verified controls: unavailable alert APIs are not evidence of zero alerts, a configured publisher is not proof of registry binding or provenance, and a completed scan does not clear its findings. Documentation edits alone do not establish repository-wide compliance.