Request: Audit and optimize Codex configuration for GPT-5.6

[onlycyndi]

Hi @doccker,

First of all, thank you for maintaining cc-use-exp. I have been using its Codex configuration in real development projects, and the layered design around AGENTS.md, rules, profiles, and skills has been very helpful.

After upgrading to GPT-5.6, especially GPT-5.6 Sol, I have noticed significantly more friction around Codex permissions and automatic approval.

Some routine, in-scope operations inside a trusted workspace may unexpectedly require manual approval or be rejected by the automatic reviewer. Examples I have encountered include:

• Modifying ordinary source or resource files inside the workspace
• Creating or updating task files under .codex/tasks
• Running normal Git operations such as git add or git commit
• Retrying a workspace write after a sandbox or filesystem permission failure

I cannot confirm that cc-use-exp is the direct cause. Some of these failures may come from Codex's own sandbox, filesystem permissions, automatic approval reviewer, or temporary approval-service errors. There is also a similar upstream report:

openai/codex#34007

However, since cc-use-exp installs global Codex instructions, approval rules, and profiles, and the current Codex documentation and profiles still mainly reference GPT-5.5, could you please review the project for GPT-5.6 compatibility?

The official GPT-5.6 model guidance recommends clearly defining safe local actions that can proceed without approval and avoiding repeated “ask first” instructions, because overly broad or repeated approval constraints may cause unnecessary permission checks:

https://developers.openai.com/api/docs/guides/latest-model

It would be very helpful if a future update could cover the following areas:

1. Update the Codex profiles and documentation for GPT-5.6 Sol, Terra, and Luna, including recommended reasoning-effort defaults.

2. Review the global AGENTS.md instructions and consolidate approval boundaries so that safe, in-scope local work is explicitly allowed, including:

   • Reading and searching workspace files
   • Editing files inside the authorized workspace
   • Running non-destructive builds and tests
   • Performing normal, explicitly requested Git operations

3. Audit .codex/global/rules against the latest Codex exec-policy and command-segmentation behavior.

4. Preserve strict confirmation for genuinely risky operations, such as:

   • Destructive commands
   • Writes outside the workspace
   • External publication or third-party data disclosure
   • Production changes
   • Material expansion of the user's requested scope

5. Add a troubleshooting section explaining how to distinguish among:

   • A cc-use-exp approval rule
   • Codex sandbox or workspace-scope restrictions
   • Automatic-review denial
   • Filesystem permission errors
   • Temporary approval-service failures

6. If possible, add a small compatibility or regression test matrix covering GPT-5.5 and GPT-5.6 with common operations such as apply_patch, workspace file creation, Gradle builds, git add, and git commit.

My expected behavior is that, in a trusted workspace-write project, explicitly requested local edits and non-destructive verification can proceed autonomously, while external, destructive, or out-of-scope operations still require confirmation.

I understand that some approval behavior is controlled upstream by Codex and may not be fixable entirely within this repository. Even so, an updated GPT-5.6-oriented configuration and troubleshooting guide would be extremely valuable.

Thank you again for maintaining this project. I would be happy to provide sanitized logs, rule-evaluation results, or additional reproduction details if they would help with the investigation.