codex - 💡(How to fix) Fix Docs: network-proxy limited HTTPS security note conflicts with source behavior

Summary

I found a source-level docs/source mismatch in the network-proxy README. This is a static source proof, not a live proxy runtime reproduction.

The README's quickstart/debugging section says limited-mode HTTPS CONNECT requires MITM to enforce limited-mode method policy, otherwise it is blocked. The Rust source comments and tests agree with that behavior. A later Security notes bullet still says limited-mode method enforcement does not apply to HTTPS.

Evidence Checked

Repository: openai/codex

Commit inspected: 9f42c89c0112771dc29100a6f3fc904049b2655f

README surface:

codex-rs/network-proxy/README.md says:

In "limited" mode, only `GET`, `HEAD`, and `OPTIONS` are allowed. HTTPS
`CONNECT` requests require MITM to enforce limited-mode method policy;
otherwise they are blocked.

The same README later says:

HTTPS `CONNECT` remains a tunnel; limited-mode method enforcement does not apply to HTTPS

Source/test surface:

• NetworkMode::Limited docs say HTTPS CONNECT is blocked unless MITM is enabled so the proxy can enforce method policy on inner requests.
• http_connect_accept_blocks_in_limited_mode expects limited CONNECT to be blocked with blocked-by-mitm-required.
• MITM tests expect limited-mode POST requests to be blocked with blocked-by-method-policy.

Observed Mismatch

The Security notes bullet appears stale: it says limited-mode method enforcement does not apply to HTTPS, while the current source/tests indicate limited HTTPS is either blocked without MITM or inspected through MITM so inner method policy can be enforced.

Semantic TDD Proof

Invariant used:

If source and tests show limited-mode HTTPS CONNECT is blocked unless MITM can
inspect inner requests, and MITM enforces limited-mode method policy, then the
README must not also claim that limited-mode method enforcement does not apply
to HTTPS.

Result:

openai/codex at 9f42c89c0112771dc29100a6f3fc904049b2655f went RED because the README still contains the stale HTTPS limitation.

A fixed proof surface went GREEN after the Security notes bullet was aligned with the MITM/blocking behavior.

Proposed Repair

If the implementation is the source of truth, update the Security notes bullet to say HTTPS CONNECT is blocked unless MITM is enabled; with MITM, inner HTTPS requests are subject to limited-mode method policy.

Alternative Repair

If the Security notes bullet is intended to be the source of truth, the alternative valid repair is to update source/tests so limited-mode HTTPS really does remain an uninterpreted tunnel. That seems less likely based on the current tests.

Scope

This proves one source-level README/source/test documentation mismatch. It does not claim a live proxy runtime exploit, production incident, or full audit of Codex network policy.