Codex is the only harness here where the OS sandbox is load-bearing. Four independent gates sit on every exec: Starlark-defined execpolicy prefix rules, an LLM "guardian" auto-approver that fails closed, the platform sandbox itself, and a full MITM HTTPS proxy with per-host allow/deny/ask decisions. Writable roots carry read-only subpaths so .git/hooks and .codex stay immutable inside a directory you can otherwise write.
It has also made the sharpest protocol bet: Responses API only. Chat Completions was removed — the wire-API enum has one variant and the string "chat" deserializes to a hard error. Even Ollama and LM Studio are wired as Responses providers, and a Responses-over-WebSocket transport is reused across a turn's requests.
The system prompt is not a repo constant. It arrives from a remote model catalog as a per-model instructions template, alongside context window, auto-compact limits, truncation policy, which edit tool to use and which shell tool to use — so prompt text, tool selection and compaction thresholds are all server-tunable without shipping a binary.
Context is handled as a diff. Roughly fifteen independently-versioned "world states" — AGENTS.md, environment, permissions, tools, model, personality, plugins, collaboration mode — are recomputed each turn and only the changed fragments are injected, so switching sandbox mode mid-thread costs one small fragment rather than a re-prefix.