# Specification
## Scope
The crate owns one interaction boundary: a standard Codex app-server turn with
caller-defined dynamic functions. It does not execute application functions,
implement application policy, or prescribe the meaning of a function.
## Startup
- `Codex::open` rejects empty configuration and requires a successful Codex
`login status` identifying ChatGPT authentication.
- Provider API-key variables are removed from child processes.
- Each turn uses a fresh app-server process with JSONL over standard IO.
- The client initializes with the experimental API capability because dynamic
tools are currently experimental in Codex app-server.
- Codex receives never-approve and read-only policies. Built-in web search,
configured MCP servers, the shell tool, and remote plugins are disabled.
- An optional caller-supplied sanitized model catalog is passed to Codex, and
automatic compaction is disabled.
- The Codex tool-output token-limit override is fixed at 180,000 tokens for
every app-server process.
## Turns
- A fresh thread receives the supplied model, base instruction, dynamic tool
definitions, and exact input text.
- A continued thread is resumed by ID and receives only the supplied new input.
- `ProviderInput` contains the exact UTF-8 bytes, represented as a `String`,
written to Codex for each client request or response, including the trailing
newline. The crate does not reformat that event.
- Dynamic calls are yielded in the order Codex requests them. The caller must
return one matching result before a sequential Codex call can proceed.
- The runtime does not add application idempotency, batching, or retry policy.
- A completed turn contains the final non-commentary assistant item, thread and
turn IDs, and the latest reported token usage.
## Failure
Malformed requests fail before process startup. Authentication, timeout,
transport, cancellation, and protocol failures have stable `ErrorKind` values.
Dropping or cancelling `AgentTurn` terminates the owned app-server process.