Enterprise protected context injection for monorepo policy enforcement

Summary

Add enterprise-grade protected context injection so Codex can load organization-owned policy bundles at runtime from secret/config systems, without storing sensitive artifacts in repository files.

Problem

Today, teams often place policy artifacts (for example AGENTS.md, hook scripts, or shared instruction files) directly in monorepos. This creates several issues:

• Sensitive rules become visible to all repo contributors.
• Policy differs across repo areas/environments and drifts over time.
• Rollouts and emergency updates are slow because changes require repository edits.

Requested capability

1. Runtime injection source

• Support protected policy retrieval from an external runtime source (secret manager, broker, or startup wrapper).

1. Deterministic policy composition

• Merge order must be explicit and deterministic.
• Required precedence (high to low): platform safety constraints, protected enterprise bundle, local project instructions, user prompt.

1. Monorepo/environment mapping

• Resolve bundle by cwd/repo-path pattern and optional project/environment metadata.

1. Configurable fail behavior

• fail_closed: refuse session startup when required protected policy is unavailable.
• fail_open: start with warning and no protected policy.

1. Metadata and integrity

• Include and record policy_id, policy_version, and optional content hash for each session.

1. Redaction and output safety

• Do not expose protected bundle content in logs/UI by default.
• Show only metadata unless admin debug mode is explicitly enabled.

1. Hook policy enforcement

• Protected policies can require/deny/constrain hooks.
• Local repo hooks cannot override protected deny rules.

Security/operations expectations

• Enterprise identity for policy retrieval.
• Encrypted transport.
• Optional encrypted TTL cache.
• No automatic writing of protected bundle content into workspace files.
• No secret values in telemetry.
• Startup latency target around p95 <= 500ms with bounded retries and configurable timeout.

UX and audit requirements

• Show concise status: policy loaded, version, and mode.
• Actionable failure messages without content leakage.
• Per-session audit metadata: policy ID/version/hash, timestamp, source.
• Deterministic evidence in CI of policy version used.

Acceptance criteria

• No protected artifacts required in monorepo files for enforcement.
• Correct bundle resolution for at least two monorepo paths with different bundles.
• Metadata visible without content exposure.
• Both fail_open and fail_closed validated.
• CI can prove policy version used during the run.

Source

Based on internal requirements doc: docs/enterprise-protected-context-requirements.md.