Complete procedures with a way back.

Combine codex exec, the TypeScript Codex SDK, and openai/codex-action@v1 into bounded maintenance workflows with read-only defaults, scoped credentials, structured artifacts, explicit write jobs, human review gates, and resumable failure handling.

Build a two-job GitHub Actions workflow where untrusted pull-request tests run without secrets and a trusted base-branch Agent SDK harness reviews only a bounded diff with no tools, no target-code execution, explicit time and cost limits, structured evidence, and a mandatory human decision.

Build a one-job Linux runner with restricted repository access, an unprivileged account, verified release, minimal network, external logs, immutable updates, fork isolation, and complete post-job destruction.