Includes rules governing what may enter the agent's own model context.
Documents it routes to
This file points the agent at 1 other document in the repository. Open any of them to read it here, as it was at this commit.
└── codex-rs └── tui └──
By the numbers
320
Lines
3,125
Words
about 14 min read
21.9kB
File size
28
Headings
122
Bullet rules
4
Code blocks
0
Links to other docs
123.8k
Repo stars
File measured on main at commit 4875084. Analysis written 2026-09-14. Star count is a snapshot from September 2026.
What kind of file this is
Mostly rules rather than explanation: 122 bullets covering Rust idioms, module size limits, review criteria, snapshot testing and app-server API conventions. Several sections set limits on the change itself rather than on the code it touches.
Quoted lines are verbatim from the file. Open one to see it where it sits.
Limits on the model context
Context budgeting
A review section governs the history Codex sends to the model: build it incrementally, do not rewrite it, avoid changes that cause cache misses, cap every injected item, and mark anything over 1,000 tokens for additional manual review. Injected fragments must be declared as structs implementing a named trait.
A section arguing against the largest crate
The file states that codex-core grew because adding to it is easier than refactoring out of it, then instructs the agent to resist that and to push back in review on changes that add to it. Alternatives are listed: an existing crate, or a new workspace member with the refactor that requires.
A line budget on the diff
Non-mechanical changes are capped at 800 lines, and complex logic changes at 500. A change over the cap is expected to come back as a staging proposal based on the actual diff, dependencies and call sites, identifying the smallest coherent stage to land first.
Module size limits with the affected files listed
Modules target 500 lines excluding tests, and past roughly 800 new functionality goes in a new module. The rule names the specific files it applies to most, on the stated grounds that they already attract unrelated changes.
The sandbox environment variables explained, not just protected
Two environment variables are placed off limits, followed by the reason the code reads them: existing tests use them to exit early from cases the agent cannot run under its own sandbox. The explanation is what distinguishes the checks from dead code.
Test scope that escalates, with a permission gate
Verification by change type
Run the changed project's tests first. If the change touched common, core or protocol, run the full suite, but ask the user before doing so because of its cost. A separate line tells the agent not to kill slow Rust commands by PID.
Takeaways for your own repo
Put a line budget on changes, and ask for a staging plan when one exceeds it.
Name the modules that are already too big. An agent cannot infer which files attract unrelated changes.
Where code exists because of a constraint the code cannot express, record the reason where an agent will read it before deleting it.
Gate expensive test runs behind asking, and state which changes make them mandatory.
Codex's file tells an agent how the codebase works. It cannot tell it which bug three customers hit this week. Modem keeps that context current and attaches it to the work.