OpenAI Codex CLI AGENTS.md Official Docs, Explained

Updating to codex-cli 0.130.0 does not change how Codex CLI should run in a production repo. What carries a team through any release is the workflow contract: the rules in your own repo that say what the agent may touch, which connectors it may call, and what proof a reviewer needs before merge. A workflow contract is that small set of repo rules, written down once and checked into version control. Codex CLI is fast either way. The contract is what keeps that speed from turning into a mess at merge time.

The version number is the part that changes. The receipts your repo keeps are the part that should not. When a build ships and your PR bodies still have no owner, no connector list, and no command a reviewer can replay, the problem was never the CLI.

Write the four rules into AGENTS.md

Four habits hold steady across releases, and each one fixes a specific way reviews slip.

Verification gets skipped first. An exec shortcut runs codegen, tests never run, and a regression slides back in quietly. Require a transcript snippet that shows the tests ran after the change, and a green merge starts meaning something again.

Browser and CLI runs tell reviewers two different stories. A Chrome task and a terminal task drift apart, so write the staging URLs and credential boundaries down next to any browser work. Then the demo stops contradicting your CI.

Model swaps spike during update weeks. A version bump is a tempting moment to change the default model, and a different model means a different risk appetite. Pin the default model and the escalation rule inside AGENTS.md so a lead can reason about blast radius before the diff lands.

MCP connectors creep in without a sound. Each server you add widens what the agent can reach, and least privilege erodes one connector at a time. Keep a Markdown roster of connectors checked into the repo root, with the MCP specification as the shared vocabulary.

Paste this into AGENTS.md

Drop this snippet near the top of your AGENTS.md. It encodes the three habits a reviewer cannot guess on their own.

# AGENTS.md verification snippet

- Every Codex CLI run ends with the transcript snippet reviewers can replay.
- Pair browser evidence with the project's normal CLI checks before merge.
- If MCP servers are enabled, list allowed actions beside each connector name.

For the official side, the Codex CLI docs and the Codex CLI docs are the reference. The instructions repository that decides your merges, though is your own.

Turn the rules into gates a reviewer can check

Rules only help if a reviewer can apply them without replaying a chat log. Here is the gate set we use, phrased as questions a reviewer asks the PR.

The scope receipt is what makes those gates concrete in a PR description:

• Verification command output is pasted or linked.
• Forked agent work lists parent + child responsibilities.
• Red-folder paths received explicit human acknowledgement.
• Scopes in the PR body match folders in the diff.

The features page, the slash commands reference, and OpenAI Plugins repository will keep moving between releases. None of that replaces your architecture judgement. Agents speed up execution; they do not take over ownership.

Start before the update lands

Install the verification latch as an AGENTS.md rule today, so the first merge after you bump to 0.130.0 already carries a replayable transcript. For a place to practice the whole contract, see Codex CLI workflows.