[taras]

Why

The carried Codex adapter launched bundled Codex 0.148.0. Its catalog omitted GPT-6.1-Sol, so explicit effort selection failed even when the host had a working CLI that supported it. Fixes #1202.

What changes

Before: ordinary Codex sessions used the bundled agent unless CODEX_PATH was set.

After: they use nonempty CODEX_PATH or codex on the host PATH. A missing or unlaunchable selection refuses before inference with recovery guidance. The adapter contains no Codex CLI dependency or bundled fallback.

How it works

Reuse the existing host executable and transient child-environment boundaries for Claude and Codex. Each overlay applies only to its matching carried adapter command. Custom commands and native-bound observed executable selection retain their behavior.

The Codex adapter is rebuilt from its pinned producer plus a readable patch. Recorded lock, executable and archive hashes match a fresh private reproduction.

Review guide

Start with the readable Codex producer patch, runtime host executable helper and command-qualified overlay. Review the manifest and provenance alongside the generated snapshot.

The documentation correction at 3ff8dea addresses the four human review items: provider-specific session confirmation, transient CODEX_PATH precedence, the indexed dated decision record with owner backlinks, and the distinction between adapter reproducibility and host CLI/catalog variability.

What must stay true

• Model and effort come from the selected host's advertised choices and are applied and verified exactly.
• Native identity, acceptance/checkpoint metadata, ownership, release and handoff/reacquisition retain their behavior.
• Completed replay starts no host selection or process.
• Fresh adapter materialization and the built npm package install no Codex CLI or platform packages.

How to verify it

The implementation is fa34905; the current head 3ff8dea adds documentation only.

• Focused workflow, host assembly, real protocol, provider and native-launch evidence: 34 tests / 284 steps passed on the pre-format candidate. Architect and Planner independently verified that its generated module differs from the committed module only in whitespace.
• Committed-tree materialization, vendor, distribution and built npm-package evidence: 7 tests / 48 steps passed.
• Selected runtime/CLI/fixture typechecks, formatting and dead-code checks passed. Both changed manifest consumers also passed a focused committed-tree typecheck.
• Fresh producer reproduction matched patch, lock, executable and archive hashes.
• deno task verify:clean passed at fa34905, including fresh preparation, offline source/release builds, unchanged dependency/cache content and runtime interference checks.
• At 3ff8dea, relative-link checks, architecture lint and the added-lines banned-word scan passed. The original Architect and Planner passed the documentation delta, and independent Claude Fable review returned PASS at that exact head with no blocking findings.

Scope

Host Codex execution only. #1177's Claude reconnect repair is separate.

Generated or mechanical changes

The maintained archive and generated snapshot encode the rebuilt adapter. Their 5,801 changed generated lines account for most of the diff. Readable source, hash, protocol and distribution evidence cover the payload.

Risks and limitations

The host must provide the CLI. Updating it can change ordinary availability and catalogs independently of the adapter digest; native build binding remains strict.

Architecture, acceptance and independent Fable review passed at the current head. This remains a draft: current-head CI failed the DR6 contender assertion already tracked by #1200, and focused diagnosis is underway. Its complete first output is preserved. Prior-head CI twice reached the Implementation fixture deadline tracked by #1143; that shard passes on this documentation-only head. No deadline or assertion was weakened.

Scope confirmation

• Every changed file supports host-installed Codex execution and its evidence.
• Generated changes identify their readable source and reproduction.
• The description distinguishes verified evidence from pending delivery gates.

[github-actions]

PR #1204: Use the host-installed Codex CLI for agent sessions

24 files, +3945 / -3010

Scope

🔴 PR has 6955 lines changed. Split into focused PRs.

🟡 6955 lines changed. PRs under 400 receive more thorough review.

🟡 24 files changed. Are all changes related?

🟡 Changes span 9 directories.

Structural

🟡 2 console statements.

Oxlint structural signals:

• no-empty-function ×4: packages/runtime/node-host-agent-executable.ts, packages/acp/src/adapter-snapshots.ts
• no-unnecessary-type-assertion ×1: packages/cli/tests/fixtures/agent-assemblies.ts

Slop

✅ Slop indicators look low.

Static Analysis

Oxlint: 11 diagnostics across 4 files (6 rules)
Density: 0.003 violations/added-line

no-empty-function (4): packages/runtime/node-host-agent-executable.ts, packages/acp/src/adapter-snapshots.ts
no-array-sort (2): packages/acp/src/adapter-snapshots.ts
no-floating-promises (2): packages/cli/tests/fixtures/agent-assemblies.ts, packages/cli/tests/fixtures/host-agent.ts
no-unnecessary-template-expression (1): packages/acp/src/adapter-snapshots.ts
no-unnecessary-type-assertion (1): packages/cli/tests/fixtures/agent-assemblies.ts
unbound-method (1): packages/cli/tests/fixtures/agent-assemblies.ts

Correctness

No extraneous code patterns detected.

[taras]

Reviewed the specification and decision-document changes at fa3490586824fd1bd7ce52c94aacafc16df8d095, against #1202 and the linked contract sections. The distinction between carrying the ACP adapter and using the host-installed agent matches the accepted direction. I have two contract clarifications and two documentation notes:

1. Keep SessionStart explicitly Claude-specific. ACP workflow profile, lines 1278–1282 now introduces both Claude and Codex, then says “Its SessionStart confirmation.” The creation contract identifies that hook as Claude's mechanism; Codex obtains native identity from the App Server response. Qualify this sentence for Claude and keep the common acceptance/save/mapping ordering separate. Sharing executable selection should not imply a shared session-confirmation protocol.

2. State the Codex transient-environment precedence. Lines 1831–1847 extend the host overlay to both agents, while the preceding precedence rule still names only CLAUDE_CODE_EXECUTABLE. Please specify how transient CODEX_PATH ranks against a session-provided value, alongside the existing rule that a native-bound observed executable takes precedence. This lets a reimplementation preserve the validated host selection without inferring merge order from code. This is a documentation gap, not a claim that the implementation currently chooses the wrong executable.

3. Reconcile the new decision's home and backlinks. DEC-018 is added to the legacy log, while the existing decision-record guide directs new decisions into individual dated files and asks for links from their owning specifications. AGENTS still points at the old log, so this is an existing governance inconsistency rather than a reason to migrate the entire log in this PR. Prefer a new record in specs/decisions/, index it there, and link it from the ACP/release owners—or explicitly settle the location first.

4. Make the reproducibility trade-off explicit in Consequences. DEC-018 and release §11 correctly describe reproducible adapter bytes. The host Codex executable and its model catalog are outside that reproduced payload. Record the operational consequence: the host must provide the CLI, and updating it can change ordinary live availability/catalogs independently of the adapter digest; strict native build binding remains the separate case. In §11, a small Codex subsection would also make this distinction easier to find under the current “Prepared Claude adapter” heading.

Scope: documentation review only. I inspected the relevant executable-selection code and protocol assertions for context; I did not run tests, inspect CI, or issue an implementation/merge approval.