- Create a focused branch.
- Never use real Codex credentials in fixtures or tests.
- Run
pre-commit run --all-files. - Run
go test -race ./...andgo build ./.... - Document user-visible behavior and compatibility changes.
Authentication format changes must fail closed, preserve unknown JSON fields, and include redacted fixtures. New logging must be reviewed for credential exposure.