[jbeckwith-oai]

Establish the existing public-main custom-code policy on next before syncing the branches. The policy is copied byte-for-byte from main 0e5794dc48b8f8d51f6047f8a0b1814eb1e65850: schema 1, maximum 10,000 custom patch lines. No ceiling increase over main is proposed.

next currently has no policy file. Landing this separately lets the subsequent main-to-next sync preserve the required policy-only change boundary instead of mixing policy establishment with SDK/runtime/workflow changes. This PR contains only .castiron-ratchet.json; it changes no accounting, exclusions, checker, ownership, generated snapshot or release behavior.

Validation: reviewed the single-file diff and verified exact blob identity with current main. Existing next CI and SDK-team human review are required. The following sync will bring the trusted reporter and normal next workflow onto the same baseline.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-20T05:53:15.578241Z	041455d	New commits
🔒 Security Review	✅ Completed 2026-10-20T05:53:56.968527Z	041455d	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[jbeckwith-oai]

Temporarily deferring this policy-only prerequisite: existing next CI fails before jobs start because setup-rye is no longer allowed by repository Actions policy. I am repairing that baseline first, then will reopen this same policy-only PR on the repaired next baseline. The prepared main sync and policy branch are preserved; no budgets or action allowlists are being weakened.