Source-bound English reading edition. The original as_of date, source URLs, dates, locators, claim IDs and factual approvals remain in the canonical metadata. Review of this edition is separate and does not refresh those facts or authorize runtime.

Codex CLI: published base instructions and the update_plan tool schema at a pinned commit

This card records only one open-source coding agent's published base-instructions file and one tool definition at a pinned commit, for Week 2's notes section "Reading a production agent's instructions" and the optional activity "Compare two production prompts". It does not describe the complete prompt that a current Codex CLI release sends to a model: the runtime may add other templates, such as the "Sandbox and approvals" section the file mentions but does not contain, and this card infers none of them. Installation, sign-in and run records are on the Codex CLI card; sandbox and approval semantics are on the Codex card.

Open the two files at the pinned commit: the base instructions (read "Task execution", "Validating your work" and "update_plan") and the update_plan tool definition.

Use boundary: link the original at the pinned commit; do not copy the file into the course repository. The Apache-2.0 obligations are those stated in the original LICENSE. The card compares no vendors and does not judge the quality of the instructions.

Course verification: students read the pinned files side by side with the matching files of another open-source coding agent. In each of four parts (role and instructions, tools and schemas, safety and permission, stopping and plans) they pick sentences or rules and ask of each: what does it make the model do, and what enforces it: the schema, the tool's own code, a runtime permission or sandbox outside the model, or nothing visible? For example, update_plan's status values are an enum in the schema, while "at most one in_progress" appears only in the description and the instructions. This card does not establish whether other code checks that rule, so mark it "cannot tell" rather than assuming it is enforced.