[dpiet-oai]

Changes being requested

Python's generated-file custom patch is now empty after #4157, but the policy still allows 10,000 custom lines. Set .castiron-ratchet.json to schema v2 strict mode with max_custom_patch_lines: 0, leaving zero headroom for new customizations of generated files.

This policy-only PR activates the existing verifier: generated paths, bytes, and Git modes must match the verified ownership manifest. The cleanup is already generated and merged, so no further generator change is needed to lower the ceiling.

Additional context & links

The trusted checker from main 56a55f243960e05e6268bb48ba6bf45299b8f90b passes against candidate 1a9bb74cd036ce5a7fe920572263998f0f950fce:

• Existing Castiron suite: python3 -m unittest discover -s scripts/castiron -p 'test_custom_code*.py' — 221 tests, OK (1 skipped).
• Policy isolation passes; only .castiron-ratchet.json changes.
• 0 additions + 0 deletions = 0 custom lines; checked limit 0; 0 mixed files.
• Strict verification passes with no violations against snapshot b045ae7e94f055f952b812dfc4ddee314a691df7.

The report's base-policy headroom remains 10,000 until this policy lands; the proposed zero limit is already enforced when checking this PR. This activates strict policy on main; next has its own reviewed policy pin protocol.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-23T18:52:42.964295Z	1a9bb74	PR opened
🔒 Security Review	✅ Completed 2026-10-23T18:53:12.840406Z	1a9bb74	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

Castiron custom code

Evaluated main: 56a55f243960e05e6268bb48ba6bf45299b8f90b.

Trusted main policy: 56a55f243960e05e6268bb48ba6bf45299b8f90b.

✅ No new custom-code files detected.

0 mixed files remain; 0 existing customizations changed.

Compared 56a55f243960 → 1a9bb74cd036. Generated baselines verified.

A changed generated baseline means this report cannot reliably identify which handwritten lines changed.

Inspect the custom-code diff

Download the exact patch produced by this run (requires repository access):

gh run download 40007154280 --repo openai/openai-python \
  --name castiron-custom-code-40007154280-1 --dir /tmp/castiron-custom-code-40007154280-1
git apply --stat /tmp/castiron-custom-code-40007154280-1/custom-code.patch
cat /tmp/castiron-custom-code-40007154280-1/custom-code.patch

Or reproduce it from an SDK checkout containing the vendored reporter:

git fetch --no-tags origin 56a55f243960e05e6268bb48ba6bf45299b8f90b 1a9bb74cd036ce5a7fe920572263998f0f950fce
python3 scripts/castiron/custom_code_report.py report \
  --base 56a55f243960e05e6268bb48ba6bf45299b8f90b \
  --head 1a9bb74cd036ce5a7fe920572263998f0f950fce --target-branch main --fetch --require-head-hash --public \
  --out /tmp/castiron-custom-code-1a9bb74cd036
cat /tmp/castiron-custom-code-1a9bb74cd036/custom-code.patch

This is the current full custom patch for mixed files, not an attribution of only the handwritten lines changed by this PR.

Full report and patch

[jbeckwith-oai]

Reviewed 1a9bb74. This isolated policy change activates the existing strict generated-file verifier and lowers the custom-patch budget to zero. The checker enforces proposed decreases on the activating PR and validates generated paths, bytes, and modes against the verified ownership manifest. Hosted budget and isolation checks passed; hosted checks are successful or skipped. No actionable findings in two independent static reviews. No candidate code or local tests executed.

[marcuswood-oai]

LGTM 👍 No changes requested.

The existing budget tests pass locally. Trusted CI confirms zero custom lines and exact generated-file ownership at this head.

---

Reviewed: 1a9bb74 · Base: 56a55f2 · sdk-pr-review

[markstuart-oai]

Reviewed 1a9bb74cd036ce5a7fe920572263998f0f950fce. This isolated policy change activates the existing strict generated-file verifier and reduces the custom-patch budget to zero. The trusted checker enforces both requirements on the activating PR. No blocking findings.

Source-only review; I did not run candidate code or tests. Hosted Castiron budget and isolation checks passed. Hosted checks are successful or skipped.