docs(codex): clarify codex auth marker

bot_bottle/manifest.py

@@ -188,10 +188,12 @@ EGRESS_AUTH_SCHEMES = ("Bearer", "token")
 #                      logic — declare the role on whichever route
 #                      injects the OAuth header.
 #
-#   codex_auth: legacy marker for Codex API-key-style egress routes.
-#               It is still accepted for older bottle manifests, but
-#               no longer triggers an OPENAI_API_KEY placeholder. Codex
-#               bottles should prefer device/ChatGPT login state.
+#   codex_auth: placeholder marker reserved for follow-up Codex
+#               credential-injection work. It is still accepted so
+#               existing manifests and future egress-held auth flows
+#               have a stable role name, but it no longer triggers an
+#               OPENAI_API_KEY placeholder. Codex bottles should prefer
+#               device/ChatGPT login state today.
 #
 # Routes without a `role` are pure proxy entries: egress
 # enforces path_allowlist + injects auth on its own, but nothing

docs/prds/0026-agent-provider-templates.md

@@ -86,9 +86,10 @@ agent_provider:
 
 ## Open questions
 
-- `codex_auth` is retained only as a legacy accepted route marker. The
-  Codex template should not inject an `OPENAI_API_KEY` placeholder;
-  Codex bottles use device/ChatGPT login state instead.
+- `codex_auth` is retained as a placeholder marker for follow-up Codex
+  credential-injection work. The Codex template should not inject an
+  `OPENAI_API_KEY` placeholder; Codex bottles use device/ChatGPT login
+  state instead.
 - Existing state-folder transcript capture is Claude-specific and should remain gated to Claude until the follow-up state/transcript refactor.
 
 ## References