Codex CLI history: answering an audit or security questionnaire

A customer asks how AI-generated code is reviewed and retained. What do we show them?

Why this is hard

The question has stopped being hypothetical: customer security questionnaires now ask about prompt logging and retention directly. The answer has to be a system rather than a description of good intentions, and it has to cover a period that already happened.

What Codex CLI specifically does to you here

Nothing expires, so the archive is complete until a person deletes it for disk space. That is a retention policy with one rule and no owner, which is difficult to write down in an answer to a questionnaire.

du -sh ~/.codex/sessions

Where Codex CLI keeps this in the first place: ~/.codex/sessions/YYYY/MM/DD/rollout-*.jsonl. Nothing prunes ~/.codex/sessions, so it grows until a person deletes it — usually all of it, usually in a hurry.

What a working answer looks like

A working answer means a retained, timestamped record you can point at — with a retention policy you chose rather than inherited from a tool's default.

Start by measuring what you have. npx promptwake doctor reports what every AI tool on the machine is holding and how much of it sits inside a deletion window — no account, writes nothing, sends nothing anywhere. If the conclusion is that the record should not depend on one laptop, that is what PromptWake captures: prompt, response and the resulting diff, local by default and synced into a shared timeline on the paid tiers.