Summary

Rename the Codex plugin destructive-action policy value from "always" to "ask".

Problem to solve

plugins.entries.codex.config.codexPlugins[*].allow_destructive_actions: "always" means that every plugin write or destructive action must ask the user for approval. The value name describes neither the user-visible behavior nor the approval boundary, making configuration and documentation easy to misread.

Proposed solution

Replace the string policy with "ask" across the manifest, public types, runtime behavior, persisted binding shape, tests, examples, and documentation. This should be a hard contract cut: old "always" values fail validation and are not silently accepted, normalized, or migrated.

Keep true, false, and "auto" unchanged. Ensure "ask" keeps write/destructive tools available, clears durable per-tool approval overrides, and routes approval through the human reviewer on thread start/resume, turn start, and side-thread fork without changing sibling app policies.

Alternatives considered

• Keep "always" as an alias: rejected because it preserves the contradictory public contract and creates dual behavior indefinitely.
• Add a doctor migration: rejected because the intended contract is a hard cut and old values should fail visibly.
• Rename only in docs: rejected because schema, bindings, runtime modes, and tests would remain contradictory.

Impact

• Affected: operators configuring native Codex plugin apps.
• Severity: medium; the current name can cause approval policy to be misunderstood.
• Frequency: every configuration or review of this string mode.
• Consequence: confusing configuration intent and higher risk of incorrect approval assumptions.

Evidence/examples

• Related implementation that introduced "always": feat(codex): add always plugin approval mode #97123.
• Related per-app reviewer follow-up: fix(codex): preserve per-app approval reviewer policy #97327.
• The current Codex protocol persists approvalsReviewer overrides across thread and subsequent-turn configuration, so the replacement must be carried through thread start/resume, turn start, and fork paths.

Additional information

This is intentionally backward-incompatible for this one string value. Boolean policies and "auto" remain unchanged.