feat(cli): draft SECURITY.md for owner review

[mldangelo-oai]

Summary

Add codex-security policy, a review-first workflow that drafts a repository's SECURITY.md from source without changing the checkout. It describes the system, builds a source-backed threat model, saves the supporting artifacts outside the repository, and shows the exact policy diff for an owner to review.

This PR contains generation and preview. The stacked #489 follow-up adds saved-draft review and application.

Changes

• Add the policy CLI command for repository-wide or component-scoped drafts, with interactive, headless, dry-run, Markdown, and structured output modes.
• Add SDK methods for preflight, generation, and exact diff preview.
• Run architecture, threat-model, and policy stages in separate Codex turns. Preserve owner questions, review notes, source evidence, and cost reporting across the workflow.
• Keep repository files read-only. Store generated artifacts outside the checkout, enforce private output permissions across platforms, and reject unsafe output, policy, symlink, hard-link, and Git metadata paths.
• Limit policy sessions to the minimal platform runtime and explicit read roots for the selected checkout, its bound Git metadata, the bundled plugin, the selected Python runtime, and an optional knowledge base. Network access, web search, apps, plugins, and MCP servers remain disabled.
• Revalidate policy content and Git bindings before model access, reject concurrent changes, and keep public package declarations independent of CLI implementation types.

Testing

• pnpm run types: passed.
• pnpm run format: passed.
• Focused policy, API, CLI, runtime, configuration, and path suites: passed.
• Full Bun suite with seed 12345: 1,672 passed, 32 skipped, 0 failed across 90 files.
• pnpm run build and pnpm pack: passed.
• Installed-package check: passed for the public import, NodeNext types, CLI, 111 bundled plugin files, bundled Codex version, and a nested worker without a global Codex installation. The tarball contained 263 entries.
• git diff --check: passed.

Risk and rollout

This does not publish a package or write a policy into the repository. Generated policy decisions still require owner review. The detailed threat model, project description, and draft should remain private until they have been reviewed for disclosure. Regenerate the draft if the selected policy, checkout binding, or relevant source changes.

The branch now includes current main. #489 should be restacked after this PR lands.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

Existing public history includes older commits with the author's work email, two automated-review artifacts with requester-only report links, and an earlier review thread describing a now-fixed security issue. Those private links and details are not reproduced here, so the second attestation remains unchecked.

[mldangelo-oai]

@codex review

Please review the current head, 8c6eaccccc63c3bef68af8ed65e1ac390e51d2c1.

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: 8c6eaccccc

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[mldangelo-oai]

@codex review

Please review the current head, 8c6eaccccc63c3bef68af8ed65e1ac390e51d2c1. The description now records the requester-only automated report link; the code is unchanged.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Keep it up!

Reviewed commit: 8c6eaccccc

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Security Review

Here are some automated security review suggestions for this pull request.

Reviewed commit: 8c6eaccccc

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-22T01:28:14.128826Z	ffa1876	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[mldangelo-oai]

@codex review

Please review the current head, ffa18764bc4aa581b112c7c7899f66167d172503.

[mldangelo-oai]

@codex security review

Please review the current head, ffa18764bc4aa581b112c7c7899f66167d172503.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Swish!

Reviewed commit: ffa18764bc

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[kmbroai]

Reviewed head ffa18764bc4aa581b112c7c7899f66167d172503 for correctness, necessity, and simplification.

Is this feature necessary?

This is optional product work, not a prerequisite for scan correctness. The repository already ships a define-security-policy skill; this adds a separate three-turn orchestration, saved manifest and evidence lifecycle, owner-question UI, cost accumulation, SDK exports, and CLI output/error handling. That is a substantial permanent surface for drafting one owner-reviewed document.

My recommendation is to justify the three-stage workflow with representative output-quality/cost evidence against invoking the existing skill, and otherwise start with a narrower draft/preview entry point. Keep the architecture and threat-model documents as private supporting outputs, not new approval artifacts or mandatory user steps. Avoid exposing low-level target resolution and every orchestration concept as public API until there is a concrete consumer. Owner decisions must remain review notes, not inferred exclusions.

Correctness at this head

The earlier broad host-read finding is addressed in source. The policy profile uses :minimal plus explicit readable roots, disables plugins/apps/MCP/network, suppresses ambient project instructions, and rechecks the checkout/Git binding before starting the model work. Policy writes are performed by the host into an external private artifact directory; the generation API does not install the draft in the repository.

I also traced inherited-policy snapshots, strict UTF-8/size handling, custom-plugin selection, cancellation between stages, partial-document preservation, and cost aggregation across the three turns. I did not reproduce a new functional blocker. Source files other than the policy checkpoints are not frozen; the documentation correctly tells users to regenerate after relevant source changes. Do not describe the saved draft as a reproducible snapshot of the whole repository.

Simplification and verification

Share the existing runtime/authentication/observer machinery, but keep policy-specific orchestration outside the already large scan API where possible. Integrate the canonical-state work from #481 without creating another variant of path validation. Keep #489's repository-writing lifecycle separate from this draft-only feature so accepting generation does not implicitly accept the much riskier apply/recovery surface.

Ran the focused policy and API-policy suites: 71 passed, 0 failed, using cached dependencies. Those tests validate orchestration with synthetic model responses; they do not establish policy quality, source-citation accuracy, comparative three-stage value, or native sandbox behavior on every platform. I would narrow or defer the feature until that product justification is clear, even though the focused correctness checks passed.