docs(codex-cloud): retire xhigh prompt marker gate and clarify raw-env local policy repair

Merged
BI
1mo ago
+202-113

User description

Summary

  • Remove all xhigh confirmation-marker references (docs/agents/codex-reasoning-effort.md, AGENTS.md, docs/agents/smart-agent-allocation.md, .agents/skills/rag-cloud-sdd/SKILL.md, docs/superpowers/rag-upgrade/, scripts/rag-phase-launch-check.mjs, scripts/build-rag-plan-packages.mjs):** Completely removes the retired xhigh prompt marker, --xhigh-confirmed CLI flag, and xhighConfirmationMarker manifest requirement across all policies, skills, RAG upgrade manifests/plans, and launch scripts. Plain-language confirmation in chat suffices when xhigh is recommended, and .codex/config.toml is explicitly documented as not forcing a model or reasoning-effort setting.
  • Guard against reintroduction (docs/organisation/retired-rules.json, docs/decisions/2026-10-16-remove-cloud-xhigh-marker-gate.md): Registers cloud-xhigh-marker-gate in
    etired-rules.json so
    pm run check:instructions blocks any reintroduction of the marker or resubmission gate.
  • Cleanly scrub platform-injected GH_TOKEN (scripts/check-codex-cloud-raw-env.sh, scripts/check-codex-cloud-setup.mjs, docs/agents/codex-cloud-environment.md, docs/codex-cloud.md, docs/scripts-index.md): Adds GH_TOKEN alongside OPENAI_BASE_URL in known_launcher_defect_variables (FAIL-KNOWN / exit 2 + CONTINUE-RESTRICTED) so container-injected GH_TOKEN routes through the scrubbed ~/.clinical-kb-codex-cloud.sh profile and command shims instead of hard-stopping Codex Cloud tasks, and documents sourcing ~/.clinical-kb-codex-cloud.sh before running
    pm run check:codex-cloud in non-login ash -c shells.
  • Document the three-layer activation lifecycle (docs/codex-cloud.md): Explains how repository instructions (AGENTS.md, docs/agents/**), Cloud environment UI settings, and existing chat/process state update independently.

RAG impact: none — policy, documentation, and Cloud launch/environment guard scripts only; no retrieval, ranking, or answer-generation behavior changed.

Verification

ode scripts/check-codex-cloud-setup.mjs (PASS)

ode scripts/run-vitest.mjs run tests/codex-cloud-setup.test.ts tests/rag-local-agent-policy.test.ts tests/rag-plan-package-parity.test.ts tests/organisation-decisions.test.ts (150 passed)

pm run docs:maintain (PASS)

ode scripts/organisation/check-instructions.mjs (PASS)

ode scripts/organisation/decisions.mjs (PASS)

ode scripts/check-branch-review-ledger.mjs &
ode scripts/check-ledger-write-discipline.mjs (PASS)

CodeAnt-AI Description

Retire the Cloud xhigh prompt gate and clarify safe recovery from inherited credentials

What Changed

  • Cloud tasks no longer require an exact prompt marker or resubmission to use recommended xhigh effort; plain-language confirmation is enough, while phase and effort checks remain.
  • The raw environment check now recognizes inherited GH_TOKEN alongside OPENAI_BASE_URL and directs provider-free work through scrubbed profiles and command shims. Unexpected credentials still block app execution and live provider access, but requested local policy repairs and scrubbed offline checks may proceed.
  • Cloud guidance explains that repository instructions, environment settings, and active chats or processes update separately, and when a fresh task is needed.

Impact

✅ Fewer steps to start xhigh Cloud tasks
✅ Local policy repairs can continue without app or provider access
✅ GH_TOKEN is scrubbed from supported command paths

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

Summary by CodeRabbit

  • Documentation
    • Updated Cloud guidance for reasoning-effort selection and confirmation, and clarified how to proceed when inherited environment variables are detected.
    • Clarified when environment checks allow restricted, provider-free work and when a fresh task is required.
  • Bug Fixes
    • Recognized both documented Cloud environment variables in restricted-path checks, with warnings that identify variable names without exposing values.
  • Chores
    • Updated launch checks and related references to match the revised Cloud guidance.