Rewrite the Codex provider onto the host's capability seams. Codex runs as a
real agent provider via `codex app-server` — planning, MCP tools, server-side
history, session resume — not as an MCP tool under Claude.
- Host provider (src/providers/codex.ts, codex-agents-md.ts): registers on the
provider-container seam, composes AGENTS.md from the real config row, mounts a
per-group ~/.codex state dir, vault-only auth stub (no credential in-container).
- Container runtime (codex.ts, codex-app-server.ts): app-server transport, turn
lifecycle, racing-follow-up fix (clear the active turn on completion).
- Provider-owned per-exchange archiving (exchange-archive.ts) via onExchangeComplete.
- Codex CLI pinned to 0.138.0 in the Dockerfile (ARG + global install), guarded
by a structural dockerfile test.
- macOS first-spawn fix: pre-create the auth-stub mountpoint.
The /add-codex skill is dropped from this branch — trunk is its canonical home.
The authored-skills canonical store is deferred to a future provider-seam PR
(its stale host-contribution assertion is removed).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Omri Maya
904871aaa7