pub fn rule_gap(rule: &PolicyRule) -> Result<Option<String>>Expand description
Why Codex cannot enforce a rule its matrix covers: an MCP rule with a
*, since disabled_tools and a tool’s approval_mode take exact
names (ToolFilter in codex-rs 0.154.0 compares names as a set).