LedgerInfra
Menu
Start free

USE CASE 02 · EC2 CODEX BUGFIX

Give Codex your team’s guidelines before it changes code.

In this illustrative workflow, an EC2 runner retrieves a fixed guideline version. Codex uses that source to prepare a bugfix your team can review.

See the workflow
WORKFLOW ASSET · 1600 × 900
Five-step workflow from an approved bug report and Git checkout through a fixed guideline fetch, Codex workspace edit, draft pull request, and human review

THE RESPONSIBILITY BOUNDARY

One fixed source enters the job. Each tool keeps its own responsibility.

This is an illustrative workflow for an organization that wants a bugfix to begin with the coding context it has approved. “Organization-wide” means one shared Workspace source; it does not mean a grant across every Workspace.

LedgerInfra owns
The service-account read grant, one Workspace boundary, the fixed Slide version, and the authenticated HTML fetch. Private Slides are excluded.
EC2 runner owns
The approved job start, isolated .agent-context, one led fetch wrapped by led auth run, and the handoff into the isolated Codex process.
Codex owns
Reading the supplied HTML and repository instructions, making the smallest useful bugfix, and running the required tests with codex exec --sandbox workspace-write.
GitHub owns
The separately authorized branch push and draft pull request. It is not granted through a LedgerInfra read access grant.

FROM BUG REPORT TO DRAFT PR

Five explicit steps. One human merge decision.

The fetch is a single, short-lived read operation. If the source is unavailable, expired, or conflicts with the repository instructions, the job returns to a person instead of merging automatically.

  1. 01
    START

    Begin with an approved bug report and checkout

    The job starts from a bug report and a Git checkout that the organization has already approved for this run.

  2. 02
    FETCH

    Fetch one fixed guideline Slide

    A trusted runner uses one Workspace service-account read grant and one auth-wrapped fetch to retrieve the approved Slide version. Private Slides and other Workspaces remain outside the grant.

  3. 03
    CODEX

    Give Codex the source and the bug

    The trusted runner passes the fetched HTML, the bug, and the repository to an isolated Codex process running codex exec --sandbox workspace-write. Codex follows the repository instructions, makes the smallest useful fix, and runs the required tests.

  4. 04
    DRAFT PR

    Prepare the change for review

    A separately authorized GitHub publishing step pushes the branch and opens a draft pull request. The PR records the fix, tests, Slide key, version, and fixed reference.

  5. 05
    REVIEW

    Let a person decide what merges

    A person checks the referenced guideline version, the diff, and CI before deciding whether the draft pull request should merge.

PREPARE BEFORE THE JOB

Keep credentials out of Git. Keep run context isolated.

Before a run, an administrator creates the service account and read grant. The trusted runner prepares the non-secret bug.md and source.json job inputs. Credentials stay in a separate OS/container boundary with a 0700 directory and 0600 file, so Codex and tests cannot access them. The fetched HTML and PR notes use an isolated .agent-context/ working directory that is excluded from Git. Codex reads the HTML as reference content; it is never executed.

  • Install led CLI 4.2.0, authenticate Codex, and provide the approved network access for the API and repository checks.
  • Give the separate GitHub publisher only the branch and draft PR permissions it needs; it does not receive LedgerInfra credentials.
  • Define the repository test policy and run those checks before the draft PR is opened; a failed fetch or test returns the job to a person.
  • Use a 0700 credentials directory and 0600 credential file. One token lasting at most 15 minutes wraps exactly one fetch, with no refresh in the Codex process.

KEEP THE DECISION HUMAN

Review the source version, diff, and CI before merge.

The runner, Codex, and GitHub each perform their bounded part of the workflow. A draft PR remains a draft until a person confirms the fixed guideline reference and the resulting change.