Move requirements policy ownership to execpolicy (#38899)

## What changed

- Define and export `RequirementsExecPolicy` from `codex-execpolicy`, alongside the
  underlying `Policy` type.
- Re-export the type from `codex-config` so existing config consumers retain the
  same API.
- Preserve its order-independent equality and `AsRef<Policy>` behavior.

GitOrigin-RevId: e94c56b36824d07f2bc7ba14ce40bdb770d4ab46

codex-rs/config/src/config_requirements.rs

@@ -17,12 +17,12 @@ use std::fmt;
 use std::path::PathBuf;
 use wildmatch::WildMatchPattern;
 
-use super::requirements_exec_policy::RequirementsExecPolicy;
 use super::requirements_exec_policy::RequirementsExecPolicyToml;
 use crate::Constrained;
 use crate::ConstraintError;
 use crate::ManagedAuthPolicy;
 use crate::ManagedHooksRequirementsToml;
+use crate::RequirementsExecPolicy;
 use crate::config_toml::ConfigToml;
 use crate::mcp_requirements::McpServerRequirement;
 use crate::mcp_types::AppToolApproval;

codex-rs/config/src/lib.rs

@@ -48,6 +48,7 @@ pub use cloud_config_layers::CloudConfigFragment;
 pub use cloud_config_layers::CloudConfigFragmentSource;
 pub use cloud_config_layers::CloudConfigLayerError;
 pub use cloud_config_layers::cloud_config_layers_from_fragments;
+pub use codex_execpolicy::RequirementsExecPolicy;
 pub use codex_protocol::config_types::ProfileV2Name;
 pub use codex_protocol::config_types::ProfileV2NameParseError;
 pub use codex_protocol::config_types::ToolExposureSurface;
@@ -144,7 +145,6 @@ pub use plugin_edit::clear_user_plugin;
 pub use plugin_edit::set_user_plugin_enabled;
 pub use project_root_markers::default_project_root_markers;
 pub use project_root_markers::project_root_markers_from_config;
-pub use requirements_exec_policy::RequirementsExecPolicy;
 pub use requirements_exec_policy::RequirementsExecPolicyDecisionToml;
 pub use requirements_exec_policy::RequirementsExecPolicyParseError;
 pub use requirements_exec_policy::RequirementsExecPolicyPatternTokenToml;

codex-rs/config/src/requirements_exec_policy.rs

@@ -1,5 +1,6 @@
 use codex_execpolicy::Decision;
 use codex_execpolicy::Policy;
+use codex_execpolicy::RequirementsExecPolicy;
 use codex_execpolicy::RuleRef;
 use codex_execpolicy::rule::PatternToken;
 use codex_execpolicy::rule::PrefixPattern;
@@ -9,42 +10,6 @@ use serde::Deserialize;
 use std::sync::Arc;
 use thiserror::Error;
 
-#[derive(Debug, Clone)]
-pub struct RequirementsExecPolicy {
-    policy: Policy,
-}
-
-impl RequirementsExecPolicy {
-    pub fn new(policy: Policy) -> Self {
-        Self { policy }
-    }
-}
-
-impl PartialEq for RequirementsExecPolicy {
-    fn eq(&self, other: &Self) -> bool {
-        policy_fingerprint(&self.policy) == policy_fingerprint(&other.policy)
-    }
-}
-
-impl Eq for RequirementsExecPolicy {}
-
-impl AsRef<Policy> for RequirementsExecPolicy {
-    fn as_ref(&self) -> &Policy {
-        &self.policy
-    }
-}
-
-fn policy_fingerprint(policy: &Policy) -> Vec<String> {
-    let mut entries = Vec::new();
-    for (program, rules) in policy.rules().iter_all() {
-        for rule in rules {
-            entries.push(format!("{program}:{rule:?}"));
-        }
-    }
-    entries.sort();
-    entries
-}
-
 /// TOML representation of `[rules]` within `requirements.toml`.
 #[derive(Debug, Clone, PartialEq, Eq, Deserialize)]
 pub struct RequirementsExecPolicyToml {

codex-rs/execpolicy/src/lib.rs

@@ -22,6 +22,7 @@ pub use parser::PolicyParser;
 pub use policy::Evaluation;
 pub use policy::MatchOptions;
 pub use policy::Policy;
+pub use policy::RequirementsExecPolicy;
 pub use rule::NetworkRuleProtocol;
 pub use rule::PatternToken;
 pub use rule::PrefixPattern;

codex-rs/execpolicy/src/policy.rs

@@ -31,6 +31,43 @@ pub struct Policy {
     host_executables_by_name: HashMap<String, Arc<[AbsolutePathBuf]>>,
 }
 
+/// A requirements-owned execution policy with order-independent equality.
+#[derive(Debug, Clone)]
+pub struct RequirementsExecPolicy {
+    policy: Policy,
+}
+
+impl RequirementsExecPolicy {
+    pub fn new(policy: Policy) -> Self {
+        Self { policy }
+    }
+}
+
+impl PartialEq for RequirementsExecPolicy {
+    fn eq(&self, other: &Self) -> bool {
+        policy_fingerprint(&self.policy) == policy_fingerprint(&other.policy)
+    }
+}
+
+impl Eq for RequirementsExecPolicy {}
+
+impl AsRef<Policy> for RequirementsExecPolicy {
+    fn as_ref(&self) -> &Policy {
+        &self.policy
+    }
+}
+
+fn policy_fingerprint(policy: &Policy) -> Vec<String> {
+    let mut entries = Vec::new();
+    for (program, rules) in policy.rules().iter_all() {
+        for rule in rules {
+            entries.push(format!("{program}:{rule:?}"));
+        }
+    }
+    entries.sort();
+    entries
+}
+
 impl Policy {
     pub fn new(rules_by_program: MultiMap<String, RuleRef>) -> Self {
         Self::from_parts(rules_by_program, Vec::new(), HashMap::new())