Inside the Codex Harness: Compaction as an API Primitive
On July 29 OpenAI published a post admitting its own model looked dumb on ARC-AGI-3 until they changed two harness settings: retain reasoning, enable compaction. Score went from 13.3 to 38.3 percent with six times fewer output tokens. The same model. That post is the best argument for reading harness source, and Codex is where those two settings live as first-class machinery.
Stateless transcript, sealed semantics
Codex (the open-source Rust CLI) resends the full item history every request with store: false, so the durable transcript lives on your disk in rollout JSONL files under ~/.codex/sessions/. But three kinds of meaning inside that transcript are opaque: reasoning comes back as encrypted_content, server compaction returns an encrypted compaction item, and since June 2026 inter-agent messages between spawned agents are encrypted too. The file is yours; parts of what it means are not. An open issue, #28058, asks for a readable audit copy of what a parent agent told its child, because today that question has no local answer.
Four compaction paths
The source contains four coexisting compaction implementations, which tells you how central this is: a local summarization fallback for non-OpenAI providers; the remote v1 path that posts the whole prompt to a dedicated /responses/compact endpoint and receives a canonical replacement window; a remote v2 that pushes a compaction-trigger item in-band on a normal streamed request; and a token-budget rollover that skips summarization entirely and reseeds a fresh window from a world-state snapshot. The trigger is 90 percent of the context window, computed in-code, and compaction runs mid-turn: the loop compacts and keeps going without ending the turn.
Two details show how deep the co-design goes. The model gets tools named get_context_remaining and new_context, so the agent itself can ask how much room is left and request a rollover. And a source comment explains that fresh context is spliced above the last user message because "the model is trained to see the compaction summary as the last item." The harness layout is a training assumption. That is what it means for compaction to be a primitive rather than a client hack, and it is exactly the property the ARC post demonstrated: the official benchmark harness truncated and discarded reasoning; the production harness summarizes and retains, and the model was trained for the latter.
Both lanes receive identical turns; each turn establishes one fact the model needs later. The truncating lane drops history when the window fills. The compacting lane summarizes it. Step through and watch the bill.
Two empty windows, capacity 100 units each. Press Step.
The sandbox is the other pillar
Codex's execution side is deny-by-default: Seatbelt profiles on macOS modeled on Chrome's sandbox policy, bubblewrap plus a seccomp network filter on Linux, a native sandbox on Windows, and a permission-profile system with glob deny rules and a local proxy for per-domain network gating with DNS-rebinding protection. When a command cannot be sandboxed, Codex refuses rather than silently running it unprotected. Escalation is itself a tool call with a justification field, which means the model asks in-band and the policy answers.
The trade, stated plainly
Codex is the strongest evidence that harness quality is measurable: same model, two settings, triple the score. It earns that by welding the harness to the provider: compaction, reasoning persistence, and multi-agent messaging all work best, and sometimes only, against OpenAI's servers, and the local record grows more ciphertext each release. Whether that trade is acceptable depends on whether you ever need to hand the session to another model, or answer after an incident what an agent was actually told. Sources: the codex repo at main (2026-07-31), the compaction guide, and the ARC-AGI-3 post.