The Body, Not the Pencil

In the space of one month, OpenAI’s Codex deleted three things an operator could once read. Pull request #32093 removed the legacy exec policy engine and its built-in default policy. #38011 removed config lockfiles. #39630, in rust-v0.149.0, retired the untrusted approval preset and its known-safe command allowlist, fourteen months after the rename that named it.

It would be easy to read that as a harness deleting itself. The tree says something narrower. Codex is deleting its deterministic defaults: the built-in policy, the preset, the allowlist that guessed what was safe. It keeps deterministic constraints: at the same tag the policy crate still parses hand-written rules to a hard Allow, Prompt, or Forbidden, and #39630’s own text says an untrusted project now asks about every command “unless an explicit exec policy rule allows it.” And it grows everything around both: threads, state, events, approval routing, an embeddable server. Ambiguous judgment goes to models, hard boundaries stay in rules and the operating system, and the machinery between them thickens. The gate itself is as old as the product. On launch day Michael Bolin, the CLI’s original author, said the modes shipped so the user can pick the mode on a per-action or per-session basis.@bolinfest What sixteen months changed is who sits in it.

What was said, in order

The team states the doctrine in public. In June a Codex teammate located the bottleneck: The limiting factor now is likely giving models and agents access to the right tools, and having them run at the right moments@TheRohanVarma. Two weeks later the engineering lead, Tibo Sottiaux, attached the thesis to a shipping feature: When you let the model be in the driver seat, you actually need less infrastructure.@thsottiaux An AI Engineer attendee supplied the working rule from a May conversation, the only public trace of it we could find:

back in may at @aiDotEngineer, i asked @thsottiaux when they wait for a better model instead of patching the harness and he said: > “oftentimes we actually ask ourselves: what if we don’t fix this in the harness today? how quickly is it going to be possible to improve the models?” now he’s saying today’s codex will look primitive in 2-3 months lol man i wish i could see what they’re testing right now

The engineer whose Harness Engineering writeup the team credits warned against a rulebook the model has to carry, and put the alternative as a slogan: give the model tools and context and let it cook.@_lopopolo

July tested it. Users reported deleted files, and the lead published the failure read: full access, no sandbox, no auto-review, and The model makes an honest mistake and mistakenly deletes $HOME instead.@thsottiaux An operator in the thread stated the constraint every approval design answers to: We want the safeguards but without the friction.@born2code On 30 July OpenAI moved the reviewer to a new model and said we expect Auto-review to cost about 10x less@OpenAI. On 4 August the lead told operators the product itself is temporary: But it will seem primitive in 2-3 months and we're about to go through another major evolution in how we use AI at the frontier.@thsottiaux

On 10 August Thorsten Ball, who builds Amp, argued the harness is no longer what provides the most leverage.@thorstenball A Codex engineer, Eric Provencher, answered the same day that he only half agreed: Codex computer and chrome use are part of the harness and add a ton of leverage.@pvncher Asked later whether multi-agent work is model or harness, he said it is tools the models are trained to use well, built into the harness@pvncher.

On 19 August the lead recapped the deletion fix as layers: instructions, execution checks, a harder-to-reach full access mode, an updated reviewer, and adding reinforcement-learning tasks and graders focused on these risks, and filtering destructive actions from training data.@thsottiaux The next day one operator watched auto-review vanish from their analytics and guessed that codex-auto-review has been deprecated as more is routed to guardian-v2, which was never displayed@acsmif. Another found the part Codex kept, the package that decides whether a command may run: I have been doing this with a hook and a hand-written allowlist. Theirs is better and I am rewriting mine.@the_niresh

The openness question ran alongside. When a reader wrote that the actual code for the UI of the harnass is nowhere to be found@lucasmeijer, the lead drew the line at the loop: The agent code is the harness. The codex app is an app.@thsottiaux The official account said what that leaves to an embedder: Their applications control the interface, context, tools, and approvals while the harness handles the agent loop.@OpenAIDevs

And on 23 August Onur Solmaz, who works on a competing harness, made the eval side’s case: We need to normalize measuring and judging models against a standardized test harness@onusoz. The lead replied:

A better analogy would be to say that your brain suddenly gets placed in the pencil for it to moved around when you need to do the exam. These are entirely different things you are comparing. The harness is much more similar to the body than it is to the classroom and environment.

What the tree says

The velocity is real. From the first commit on 2025-04-16 to rust-v0.149.0 there are 9,577 commits; the ninety days before this piece put 2,905 on main, from 204 distinct author names. The codex-rs workspace grew from 24 top-level entries in June 2025 to 115. The feature table at 0.149.0 holds 116 flags: 38 stable, 41 under development, 34 removed, 3 deprecated. Removed: a JavaScript REPL, tool search, steering, collaboration modes, the first multi-agent mode. Experiments end in public, including ones the rest of the field still sells as products.

The deletions do different jobs. The legacy engine was built-in adjudication, shipped heuristics guessing which commands were safe; the same release ran a one-time, scoped migration of the user’s rules file, deleting exact allow entries for prefixes Codex no longer proposes. The untrusted preset was default trust. Both remove the harness’s opinion and keep the operator’s: rules an administrator writes still bind, and managed requirements can still impose them. The lockfile and auto-compaction’s off switch are another pattern: how the runtime keeps itself productive becomes provider-owned. You keep the boundaries. You lose the freeze switches.

Walk one approval through the tag. Codex edits freely inside its writable workspace. A path outside it, or the network, becomes a request. An explicit rule can settle it: allow runs “without further approval,” forbidden is “blocked without further consideration,” and where several rules match the most restrictive decision wins. Otherwise the request goes to a reviewer. The App Server protocol says that reviewer “Defaults to user,” or, where the client selects it or managed policy requires it, is auto_review, “a carefully prompted subagent” applying “a risk-based decision framework.” The schema still accepts the legacy name, guardian_subagent.

That subagent’s policy is a prose rubric versioned like source: which parts of a session count as trusted, a four-level scale for how much the user authorized, and lines like “Judge authorization by the material semantics, not exact syntax.” It approves or denies a crossing. It cannot widen the sandbox, and a forbidden rule stops a command before any reviewer sees it.

The dispute, line by line

Is a model already in your approval path? No, unless someone put it there. guardian_approval is stable and enabled at 0.149.0, so the capability has graduated; routing is a separate fact, and it defaults to the user. “Approve for me” is a selection an operator or organization makes. Guardian V2, the anticipatory scorer, is in the stable tag and off, as Approvals Belong to the App reported.

Does an embedder get the reviewer? Yes. App Server exposes the auto_review route along with the loop. What it does not hand over is the institution: identity, consent, which actions stay human-only, how approvals enter your audit record. The official account’s sentence holds in both directions.

What is open? Settled by the license. The agent code, terminal UI, protocol and App Server are Apache-2; the desktop app is not in the tree. Meijer is right about the app and wrong if read as the whole product.

Is the harness getting thinner? Not on this record. The lead’s “less infrastructure” describes the defaults; the workspace grew almost fivefold over the same sixteen months. OpenAI’s own platform post says retained reasoning and context compaction raised GPT-5.6 Sol’s ARC-AGI-3 score from 13.3% to 38.3% while cutting output tokens sixfold. Ball’s case that the lever has moved and Provencher’s that computer use still adds one are both consistent with a tree that deletes heuristics and adds tools the model is trained on. The independent check points the same way: on SWE-Marathon no configuration clears 30% pass@1 on ultra-long tasks, and the failures (weak self-verification, premature stops) are ones judgment alone does not fix.

What does the reviewer buy, and what does it cost? OpenAI’s case is worth taking seriously. In its internal Auto-review deployment, sessions stop for human approval roughly 200 times less often, the reviewer approves about 99% of what reaches it, and after a denial Codex finds an acceptable path “in more than half of cases.” Those are the vendor’s measurements of its own deployment, and so is the tenfold cost cut; neither can be checked from outside. The cost that can be seen is opacity. The tags show guardianv2 present and off; they cannot show what runs server-side, on which model, at what price. The protocol carries an unstable decision-source field on auto-review decisions, the seed of a receipt. A judgment you cannot replay is a judgment you cannot govern.

Pencil or body? No receipt settles it, because it is a question about what a benchmark is for. Solmaz wants models compared on a common harness; the lead says the harness is part of what is being measured. The ARC-AGI-3 numbers support his description of his own product, and they are also why a score measured in one lab’s harness does not transfer to anyone else’s.

If you run or embed Codex

Find out who reviews your approvals. If you or your organization selected “Approve for me,” record it as a policy decision: which reviewer, what it may approve, where its rationale goes. Watch the usage dashboard the way you watch the sandbox config, because the reviewer’s cost is the one receipt the tree cannot give you.

Treat upgrades as policy migrations. 0.145.0 migrated your rules file once, narrowly; 0.148.0 dropped config replay; 0.149.0 removed a preset your config may still name, and the setting now fails with an actionable error instead of being silently ignored, which is the right kind of removal. Before promoting a new stable, replay the actions you care about (ordinary, ambiguous, destructive, adversarial) and compare what got approved, denied and recorded. If you wrote your own allowlist in a hook, the policy crate is worth reading before you extend it.

Where the layer bet lands

Bitter Lesson Maxing asks which layer gains value as general models improve. Codex’s answer is not “delete the harness.” It is to delete what the next model absorbs (heuristics, defaults, canned trust) and spend on what it cannot: state, boundaries, events, the protocol a person interrupts through. A harness trained into the model is co-design, the advantage this publication’s thesis assumes providers keep. For everyone else the lesson is to stop building on the layer Codex just deleted and to own what gains value as the model improves: authority, verification, the audit trail, the human boundary. Claude Code’s hooks already pair exit-code rules with prompt hooks; the split is not OpenAI’s alone. The gate’s judgment may be rented. The institution around it cannot be.

Amdahl Maxing says find the serial human moment. OpenAI’s own numbers say the reviewer removes almost all of them, which no approval UI ever managed. What it does not yet give back is what the slow gate gave for free: a decision a person can read afterward. The attention moved downstream, to whoever must answer for judgments made at machine volume.

They deleted the default rulebook and kept the walls. The model may get to decide what you meant. It does not get to decide where the walls are.