The five non-L0 layers exist because Codex works with more than project files. During any session, the model also draws on conversation history, operator instructions, runtime guidance, and its own trained assumptions. These sources are not interchangeable with verified project evidence, and they do not all carry the same authority. The non-L0 layers give each source class a name and a persistence rule so that the boundary between what already belongs in the repository and what merely shapes the current session stays visible throughout the work. The shared constraint across all five layers is the same: non-L0 material can influence Codex behavior, but it must not silently enter persistent project content. The specific rules differ by layer.Documentation Index
Fetch the complete documentation index at: https://mintlify.com/xxyoudeadpunkxx/canon-boundary-guard-codex/llms.txt
Use this file to discover all available pages before exploring further.
L1 SHAPING
L1 SHAPING
DefinitionConversation material not explicitly approved as a durable project decision. L1 material is present in context and can inform how Codex reasons, but it has not been reviewed or authorized as something that should outlast the session.Examples
- A clarification the operator gave earlier in the conversation (“use snake_case for this file”).
- A working hypothesis that emerged mid-session (“it seems like the auth module owns this”).
- Interim conclusions drawn from conversation, not from reading files.
L1A AUTHORIZED DELTA
L1A AUTHORIZED DELTA
L2 AGENT CONTROL
L2 AGENT CONTROL
DefinitionInstructions, steering, reminders, or constraints given to the agent to shape its behavior. L2 material is not project content — it is guidance about how the agent should work, not what the project should contain.Examples
- “Be concise in your responses for this session.”
- “Check for type errors before writing.”
- A reminder to follow a particular workflow during the current task.
AGENTS.md file as a standing instruction — that is an explicit request. Without such a request, L2 stays in the session and does not enter the repository.L2A CODEX INSTRUCTION CHAIN
L2A CODEX INSTRUCTION CHAIN
DefinitionAGENTS guidance loaded by Codex from the instruction chain is agent-control authority. Treat AGENTS.md guidance as an active behavioral contract for the agent, not as project content or an ordinary user message.Global-scope guidance comes from the Codex home directory (
AGENTS.override.md or AGENTS.md). Project-scope guidance comes from AGENTS.override.md, AGENTS.md, or configured fallback instruction files in the current repository path.Special classification ruleA message whose content begins with AGENTS.md instructions for <path> is runtime-delivered AGENTS guidance for the referenced path, even if it is displayed under the user role. It is L2A by its header shape — not by its displayed conversational role, not by filesystem confirmation. When this block appears as a leading conversation prelude, classify it retroactively as L2A before interpreting later messages. The first operator request starts after this prelude.Examples- The AGENTS.md file loaded by Codex at session start.
- A leading user-role block beginning with
AGENTS.md instructions for /path/to/repo. - Runtime environment metadata inside an
<environment_context>block within an AGENTS prelude.
L3 MODEL PRIOR
L3 MODEL PRIOR
DefinitionUnverified model memory, generic best practice, assumed framework behavior, version claim, or unstated convention not grounded in local evidence.L3 covers everything the model brings to the session from training rather than from reading the project. It includes version numbers the model believes to be current, framework conventions the model assumes are in use, and best-practice recommendations that have not been verified against what the project actually does.Examples
- “React 18 introduced concurrent rendering” — a version claim not verified in the project’s
package.json. - “The standard pattern for this is X” — a generic best-practice claim not grounded in L0.
- An assumed file path or module name that has not been confirmed by reading the repository.