Codex runtime mapping

Keep the canonical TSV and pinned source scripts/log.sh intact. The bundled helper requires --root <task-root> and a logfile below that root; it rejects path escapes and symlink components or targets while preserving append-only TSV sanitization. Write only inside the authorized workspace or task scratch path, verify evidence links, and use the native task history/rollout for transcript audit. Independent review follows the standing model router and is reported only when performed.

Show me your work

Keep one canonical log.

The format

A single TSV file, one row per decision. Cells stay single-line. Evidence is a pointer, not prose.

Copy references/decision-log-template.tsv (the header row) to start a clean log. Columns: