Skip to main content
This example places a customer-owned OpenAI Agents SDK loop behind the same harness boundary as any other admitted agent loop. It is not a separate managed Codex product and it does not introduce OpenAI-specific Checkfu resources. Start with the quickstart. In one Workspace, create or update an Agent, select an Environment, and start a Session. Session admission freezes the resolved AgentVersion and Environment authority. Every later interaction is read from and appended to the Session event log.

​
What this example demonstrates

  1. Package the OpenAI Agents SDK loop and its ACP adapter as an immutable OCI workload.
  2. Keep the OpenAI SDK’s internal agent loop behind a trusted Checkfu driver. SDK state and ACP handles remain lane-local.
  3. Route admitted model calls through the Checkfu model plane when the selected capability supports that wire. The harness never receives a reusable model-provider Credential.
  4. Translate only the observations supported by the qualified ACP lane into canonical Session events. Checkfu still owns Turn, Run, RunAttempt, approval, and settlement lifecycle.
  5. Treat cooperative cancellation or richer ACP signals as optional lane capabilities. Checkfu Session and Run authority still decides lifecycle state.
  6. Create a new AgentVersion before changing the harness selection or material agent configuration for future Sessions.

​
Credential and telemetry boundary

Do not place an OpenAI API key, Checkfu model-plane token, provider Credential, or Connection secret in the Agent configuration, harness image, sandbox environment, model context, or Session event. Short-lived authority is delivered only to the trusted plane that needs it. An SDK trace exporter is a separate data path. Disable it or configure it so that Checkfu authority and retained Session content are not sent to an ungoverned destination. Checkfu’s Session event log remains execution truth even when the SDK produces its own spans or conversation objects. Standard retention may preserve accepted Session content under Workspace policy. ZDR prevents durable execution-content storage and narrows replay and recovery. Usage, not OpenAI SDK telemetry, is authoritative for Budget enforcement. Check capability status before treating this customer-owned lane, a model wire, or custom OCI execution as supported.

​
Source and support boundary

The optional checkfu-examples checkout contains the standalone build and adapter source. Its existence is not proof that the exact image, OpenAI model path, ACP capability set, or customer-hosted topology is supported in every deployment. For the protocol floor without an agent SDK, read the custom ACP example.

​
What this example omits

This page does not define a second Checkfu Agent ontology, use an SDK transcript for recovery, expose provider credentials, claim native Codex behavior, or promise remote trace delivery, MCP delivery, checkpoint restoration, or cooperative cancellation unless those exact capabilities are qualified.