Complete procedures with a way back.

Use Codex to investigate an unfamiliar repository, freeze scope and acceptance criteria, implement a focused change, run proportional tests, review the complete diff, commit intentionally, and recover without erasing unrelated work.

Build a two-job GitHub Actions workflow where untrusted pull-request tests run without secrets and a trusted base-branch Agent SDK harness reviews only a bounded diff with no tools, no target-code execution, explicit time and cost limits, structured evidence, and a mandatory human decision.