Add codex-app-server-byo-auth research topic

codex-app-server-byo-auth/next-steps.md

@@ -0,0 +1,22 @@
+# Next Steps — Codex App Server: Embeddable Agent Protocol & BYO Auth
+
+> Part of [[codex-app-server-byo-auth/index|Codex App Server — Embeddable Agent Protocol & BYO Auth]]
+
+## Decisions pending
+
+- [ ] Pick the target app shape first: local/desktop (stable, recommended) vs hosted multi-tenant (experimental transport, more work)
+- [ ] For hosted: decide key placement — user's browser (localStorage) vs your DB vs Codex-managed device-code tokens
+- [ ] For hosted: contact OpenAI for the known-clients list / compliance assessment before building for enterprise
+
+## Build considerations
+
+- [ ] Prototype the device-code flow with a minimal app-server client (Node/TS) to validate the no-sign-in UX
+- [ ] Design the provider adapter interface (Effect Layer): `ApiKeyProvider` vs `ChatGptAuthProvider`
+- [ ] Evaluate per-version bindings (`generate-ts` / `generate-json-schema`) for type safety
+- [ ] Consider Codex SDK for any CI/headless automation needs (separate from app-server embedding)
+
+## Open questions
+
+- [ ] Does OpenAI's BYO-ChatGPT posture change over time? (monitor; Anthropic precedent exists)
+- [ ] What's the real token-refresh behavior of `chatgptAuthTokens` mode in production?
+- [ ] Rate-limit surfacing: which plan limits matter per target user base?