{"record":{"id":"f3b2416c8d6e4461","repo":"openai/codex","slug":"invalid-rules-in-requirements-set-by-requirement","errorCode":null,"errorMessage":"invalid rules in requirements (set by {requirement_source}): {reason}","messagePattern":"invalid rules in requirements \\(set by (.+?)\\): (.+?)","errorType":"validation","errorClass":"ConstraintError","httpStatus":null,"severity":"error","filePath":"codex-rs/config/src/constraint.rs","lineNumber":25,"sourceCode":"#[derive(Debug, Error, PartialEq, Eq)]\npub enum ConstraintError {\n    #[error(\n        \"invalid value for `{field_name}`: `{candidate}` is not in the allowed set {allowed} (set by {requirement_source})\"\n    )]\n    InvalidValue {\n        field_name: &'static str,\n        candidate: String,\n        allowed: String,\n        requirement_source: RequirementSource,\n    },\n\n    #[error(\"To use model `{model}`, you need to use auto review.\")]\n    AutoReviewRequired { model: String },\n\n    #[error(\"field `{field_name}` cannot be empty\")]\n    EmptyField { field_name: String },\n\n    #[error(\"invalid rules in requirements (set by {requirement_source}): {reason}\")]\n    ExecPolicyParse {\n        requirement_source: RequirementSource,\n        reason: String,\n    },\n\n    #[error(\n        \"invalid requirement for MCP server `{server_name}` (set by {requirement_source}): {reason}\"\n    )]\n    McpServerRequirementParse {\n        server_name: String,\n        requirement_source: RequirementSource,\n        reason: String,\n    },\n}\n\nimpl ConstraintError {\n    pub fn empty_field(field_name: impl Into<String>) -> Self {\n        Self::EmptyField {","sourceCodeStart":7,"sourceCodeEnd":43,"githubUrl":"https://github.com/openai/codex/blob/339751715c64496cb86246bfb3935f40e309dd3d/codex-rs/config/src/constraint.rs#L7-L43","documentation":"ConstraintError::ExecPolicyParse (codex-rs/config/src/constraint.rs:25) wraps a parse failure of the exec policy rules inside a requirements layer. The requirement_source in the message identifies which requirements file (system, user, cloud/managed) carries the broken rules; reason is the underlying parse error.","triggerScenarios":"Loading a requirements TOML whose exec policy rules table does not match the expected rule schema: wrong executor pattern, missing required keys, or wrong value types; the constraint system parses the rules from that RequirementSource during config load.","commonSituations":"An admin hand-edits managed requirements and introduces a syntax or type error; schema drift between an older requirements file and a newer codex build; exec rules copy-pasted from docs of a different version.","solutions":["Open the requirements file named by requirement_source and fix the rules stanza according to the reason text","Dry-parse the corrected rules against the current exec-policy schema before redeploying","Redeploy the fixed requirements through the same channel (cloud/MDM/system file)"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Dry-parse a requirements file before shipping it\nlet _: RequirementsToml = toml::from_str(&requirements_str)\n    .map_err(|e| format!(\"requirements would fail to load: {e}\"))?;","typeGuard":null,"tryCatchPattern":"match build_constraints(...) {\n    Err(ConstraintError::ExecPolicyParse { requirement_source, reason }) => {\n        eprintln!(\"fix rules in {requirement_source}: {reason}\");\n    }\n    r => r?,\n}","preventionTips":["Round-trip managed requirements through a strict parse in CI before deployment","Version requirements payloads alongside the codex version that consumes them","Generate requirements files instead of hand-editing TOML"],"tags":["config","exec-policy","sandbox-rules","requirements","toml","rust"],"backgroundTag":"invalid-config-syntax","analyzedSha":"339751715c64496cb86246bfb3935f40e309dd3d","analyzedAt":"2026-08-25T05:35:09.876Z","schemaVersion":2},"datasetVersion":"2026-08-25T06:17:31.827Z"}