Codex cloud moves a task into an isolated container on OpenAI's infrastructure, and this changes the very model of work. The cloud environment has no local files or shell state of yours: it clones the repository anew and prepares it itself. Hence the central requirement around which everything revolves: the environment must reproducibly prepare the repository before the agent begins to reason and edit. If the preparation is non-deterministic, so is the result.
The split into a setup phase and an agent phase is not a detail but the foundation of the cloud architecture. Setup prepares the environment: installs dependencies, performs the needed initialization, brings the repository into a working state. Only after this does the agent begin its work on the task. These phases must not be mixed: what should be ready deterministically and once is not the place for the agent to do along the way of reasoning, where the result depends on how it understood the task.
Secrets in the cloud obey a strict rule whose violation breaks the security model. You must not design a workflow where the agent phase "accidentally" depends on a secret left by the setup script in an ordinary file. Setup may have access to what the agent phase must not have access to, and this separation is deliberate. A secret put into a file at the preparation stage and read by the agent later bypasses the boundary the cloud built on purpose - this is a hole, not a convenience.
Hence a practical principle of designing cloud tasks. What is needed only for preparation stays in the setup phase and must not leak into the agent phase. If the agent really needs access to something sensitive, it is granted through the provided mechanism, not through a side effect of the setup script. The boundary between the phases is a trust boundary, and it must be respected the same as the sandbox or permissions: it protects exactly where it would be most convenient to cut a corner.
| Phase | Task | Boundary |
|---|---|---|
| Setup | Clone, dependencies, repository initialization | Deterministic; may see preparatory secrets |
| Agent | Reasoning and edits over the task | Must not depend on a secret left in a file |
| Return | A branch and a PR | Review as strictly as local work |
|---|
The agent's internet access in the cloud is a separate configurable boundary, not a given. An isolated container by default does not mean "free network egress": where the agent can go is determined by the environment configuration. This matters both for security and for reproducibility: a task quietly depending on an external resource will stop working when the resource changes or becomes unavailable. The agent's network access is set explicitly, for a specific need, not opened wholesale just in case.
The result of cloud work is returned through git rather than staying in the container. Codex works autonomously and frames the result via a branch and a PR - that is, through the same mechanism of history and review as any other work. This is convenient precisely because it fits the ordinary process: a cloud task does not create a special delivery channel for changes but uses git. Its result must be checked and accepted as strictly as the result of local work - autonomy of execution does not cancel review.
The point of the cloud is autonomous work without an open computer, and its strengths follow directly from the isolation. A fresh clone, reproducible preparation, an autonomous run - all this makes the cloud a good choice for a long task you do not want to keep on your machine. But the same isolation sets the discipline: deterministic setup, an honest separation of phases, explicit network access and respect for the secrets boundary. The cloud forgives less than local work, where you can fix things on the fly.
The typical failures around the cloud are predictable. Making the preparation non-deterministic and getting different results on one task. Mixing the setup and agent phases, assigning the agent what should be ready in advance. Leaving a secret in a file at the setup stage and letting the agent phase read what it should not have access to. And quietly depending on an external resource without explicit network access. Keep setup reproducible, separate the phases, respect the secrets boundary and set the network explicitly.