Lab 12 — Graph engineering

Capability: Codex has subagent parent/child relationships, not a verified, user-facing declarative workflow graph CLI. Here the human routes two questions to separate Codex runs; conditional edges, loop-back and join semantics remain outside Codex.

Install Codex CLI; create a private temporary CODEX_HOME, copy this lab’s config.toml.example to $CODEX_HOME/config.toml and fill in your endpoint (ending in /openai/v1) and deployment. Provide AZURE_OPENAI_API_KEY through your resource key from a secret manager. The Microsoft guide says Entra ID is not supported for Codex; never save the key in files. Workspace: start in lab12-graphs/ and follow the common preflight. Create these synthetic files:

'demo-order: Go, port 3000, queue orders-demo' |
  Set-Content (Join-Path $workdir 'service.txt') -Encoding utf8
"product,status,total`nbowl,completed,20`nleash,completed,10`nbowl,pending,20" |
  Set-Content (Join-Path $workdir 'orders.csv') -Encoding utf8

printf 'demo-order: Go, port 3000, queue orders-demo\n' > "$workdir/service.txt"
printf 'product,status,total\nbowl,completed,20\nleash,completed,10\nbowl,pending,20\n' > "$workdir/orders.csv"

Route a code question to the retrieval action:

codex exec --skip-git-repo-check -C "$workdir" --sandbox read-only `
  "Read service.txt. Which queue does demo-order use? Cite the file."

codex exec --skip-git-repo-check -C "$workdir" --sandbox read-only \
  "Read service.txt. Which queue does demo-order use? Cite the file."

Route a data question to the calculation action:

codex exec --skip-git-repo-check -C "$workdir" --sandbox read-only `
  "Using only orders.csv, calculate completed revenue by product in a markdown table. Show the rows included and excluded."

codex exec --skip-git-repo-check -C "$workdir" --sandbox read-only \
  "Using only orders.csv, calculate completed revenue by product in a markdown table. Show the rows included and excluded."

Verify the queue citation and the table totals (bowl=20, leash=10). Now deliberately send the code question to the calculation action and observe the wasted work. For an ambiguous request, ask a human which branch; do not assert Codex provided a graph HITL node. Record routing choice, calls, result and why each action was (or was not) needed. Do not execute model-generated code on your host for this exercise; an ACA-backed secure code-execution graph needs an external orchestrator and is not provided by Codex CLI.

Follow reset and cleanup afterward.