feat(project): add Codex project skills and MCP installation

.github/workflows/agentplugins-native-clients.yml

@@ -69,10 +69,15 @@ jobs:
           AGENTPLUGINS_NATIVE_DISPOSABLE_HOSTED: '1'
         shell: bash
         run: |
+          project_args=()
+          if [[ '${{ matrix.client }}' == 'codex' ]]; then
+            project_args+=(--project-components)
+          fi
           python scripts/run-native-client-matrix.py \
             --client '${{ matrix.client }}' \
             --target '${{ matrix.platform.target }}' \
-            --output '${{ runner.temp }}/native-client-proof'
+            --output '${{ runner.temp }}/native-client-proof' \
+            "${project_args[@]}"
       - name: Upload native evidence including failed stages
         if: ${{ always() }}
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.0

docs/plans/project-install-e2e/codex-authority-recovery-plan.md

@@ -0,0 +1,91 @@
+# Codex exact project authority recovery — fresh amendment C2
+
+The reset erased finald8daad5a including exact authority corrections and public
+lifecycle fixtures. C1 is now independently reviewed with current tests at
+5708e861 and reports8c4e1cec. C2 restores the known separate obligations against
+that concrete parser seam. Historical GOs/native passes are context, never proof
+for reconstructed bytes. Two fresh independent plan GOs precede C2 code.
+
+## Exact authority before effects
+
+Every project candidate includes either project scope or any nonempty project
+root; inconsistent user/project facts must not fall into user CLI behavior. At
+Codex project boundaries require literal ClientCodex for detected client, plan,
+and populated delivery; matching explicit ScopeProject on plan and context; a
+validated canonical target context retaining the exact original user ConfigRoot;
+nonempty exact native project root; clean portable nonempty physical artifact;
+and literal deterministic managed target/active paths under selected project's
+.uap/managed/clients/codex/<artifact>. Reject omitted, rebound, cleaned aliases,
+foreign client/profile/project/artifact and malformed paths before reads/writes
+or native runner effects. Root and native object ownership rules stay strict.
+
+Early activation preflight legitimately occurs before staging. Accept only an
+entirely zero/unstaged delivery there, after validating exact plan/context; once
+any delivery fact is present require full exact delivery client, active path and
+owned base. Actual Activate always requires populated exact delivery. Validate
+ActivationComplete refusal before any operational effect. Readiness remains
+prepared with independently observed installed native configuration, never
+automatically active/native discovery/trust or attested activation.
+
+Prepared inspection must construct complete client/scope/artifact/native-root/
+active-locator binding facts rather than relying on missing-field tolerance.
+A real managed project binding requires literal client/scope/artifact/root and
+target locator equality against the validated plan; validate native objects as
+before. Confirmed project removal similarly requires exact recorded client,
+artifact, selected original profile/project/native root and deterministic managed
+artifact path before mutation, independent of current executable/version.
+No current user-scope behavior or legacy marketplace evidence is broadened.
+
+## Physical stage and current stdio reuse
+
+Before ProjectOpenAIMCP writes anything, validate project staging as an existing
+clean absolute physical nonalias directory strictly inside the selected project
+and its managed target area, separate from active/native source/watch locations.
+Validate all existing ancestors using no-follow containment; do not silently
+canonicalize caller input. Refuse project root, original user profile, project B,
+external source, active-path alias, symlink and nonclean spelling with whole-tree
+inventories unchanged. This is adapter-local, not a generic pathpolicy rewrite.
+
+Read-only active reconstruction requires root exactly equal to plan.ActivePath
+and strict plan authority. For each selected stdio server require the current
+selected data locator to be nonempty clean absolute physical project-contained
+input, then exact projected PLUGIN_ROOT==plan.ActivePath and
+PLUGIN_DATA==current data locator. Omitted/relative/rebound data or either stale
+package/data projection returns errors wrapping existing
+domain.ErrProjectionRefreshRequired, with zero writes; installer can reproject
+from the exact pinned package. Remote-only and skill-only reuse remains valid
+without an artificial data requirement. Keep all authentication-reference and
+transport validation. Never execute the inert MCP command.
+
+## Fresh composed proof and boundaries
+
+Direct adapter and real provider tests exercise all omitted/mismatched identity,
+scope/context, artifact/layout, populated-delivery, prepared-binding and recorded
+removal facts; assert no runner invocation and unchanged user/A/B/source/package
+inventories on refusal. Positive exact project delivery must still install/
+verify/update/remove supported skill/command and stdio/remote MCP components.
+Preserve malformed/collision/foreign-edited receipt and user contract tests.
+
+Reconstruct a real public Engine/SDK A/B journey with original user profile,
+stdio persistent-data binding, unchanged sync, restart/cold pinned repair despite
+moving source, explicit update and confirmed removal retaining owned data.
+Reconstruct public production CLI journeys over actual disposable TLS Git and
+HTTPS ZIP transports: saved manifest/lock/state, source pins and cold repair,
+selected native config/skills, user/B foreign policy preservation, update/status/
+remove with retained data. Reuse existing project fixture infrastructure without
+substituting fake parser/installer/provider results; host detector/security and
+network endpoints may be inert controlled boundaries. Test fixture seed roots
+are physically canonical before composition, retaining intentional alias
+negative tests; no production normalization or platform skips.
+
+Run complete preserved Codex client/provider packages, affected public Engine/
+SDK and CLI journeys, unchanged architecture closure and both pinned changed
+code/full-file size/arch lint. No vendor/model/auth/trust or MCP execution.
+Freeze for two fresh independent code reviews, resolve findings, commit reports
+and send root checkpoints immediately. C2 fixture proof does not relabel old
+macOS/Windows native evidence or replace required current assembled/native gates.
+
+The existing project configuration readers have a known post-read size check;
+this amendment does not authorize an unrelated kernel/reader redesign. Any new
+concrete bounded-reader defect requiring source changes receives its own narrow
+reviewed amendment rather than broadening this recovery silently.

docs/plans/project-install-e2e/codex-code-review-r1.md

@@ -0,0 +1,103 @@
+# Codex project implementation independent review R1
+
+Reviewer: core_clients, 2026-10-23. Reviewed frozen `048c3455` including the
+`fda36d23` TOML codec, `6387ac85` adapter and source-native discovery addition.
+This review is independent of the codec-only R1 and the author implementation.
+
+## Decision
+
+**R1 GO at `4f4a320bc58c5c45e23a75d56c43bc0c2b3da1a6`.** No remaining
+implementation blocker was found in scope authority, ownership, mutation or
+native evidence boundaries. The R2 selector correction and R1 follow-up below
+are independently inspected closed. Hosted native discovery is still pending;
+this review supplies no runtime GO.
+
+## Reviewed behavior
+
+- Project admission uses the declarative native-config scoped policy instead
+  of Codex user CLI-registry traits. The adapter requires both plan and target
+  context to name project scope, retains the original detected user profile,
+  and checks the explicit project registry root and no-follow native children.
+  Project layout does not derive authority from a prepared package path.
+- The production planner/stager/projector/activator path emits exact owned
+  `.agents/skills` directories and `.codex/config.toml` MCP members. Existing
+  rendered commands, OpenAI MCP projection, managed stdio package/data/cwd
+  materialization and authentication references are reused. Active reprojection
+  validates the bound stdio locators without editing immutable package bytes.
+- Skill and MCP mutation consumes the reviewed shared component transaction
+  and native ownership kernel. Per-object IDs, kinds, logical names, paths and
+  digests fence update/remove, foreign disabled entries remain collisions, and
+  missing exact owned skills can be repaired. Project operations do not run
+  Codex user marketplace registration/removal or mutate its user cache.
+- The TOML parser refuses malformed/duplicate documents. Retained syntax edits
+  are re-parsed and compared against complete requested MCP entries and all
+  non-MCP semantic settings before publication. Existing JSON/JSONC lifecycle
+  remains on the same kernel. SSE is refused rather than silently converted.
+- Project file success is always prepared activation plus installed
+  verification. The adapter's preflight unconditionally rejects project
+  activation attestation, including through the composed provider shortcut.
+  Visible user/project restrictions are diagnostic observations rather than a
+  claim to reconstruct native trust, profile, managed or session precedence.
+- The new native gate is restricted to current-source Codex. It uses exact
+  required-test accounting, rejects released/draft/prepared evidence inputs,
+  retains hosted disposal and artifact integrity gates, and fails skipped or
+  missing required tests. No guard is spoofed or removed.
+- The native fixture uses fresh genuine pinned app-server processes and the
+  documented `initialize`/`skills/list` route only. Its parser requires exact
+  selected-project repository paths, enabled entries, no plugin identity,
+  correct cwd, no discovery errors and no duplicates. Update, deleted-skill
+  repair and removal observe fresh discovery; project B must not see A's
+  fixture skills and recorded foreign user/cache/project files retain bytes.
+  Exact rendered command bytes are checked. No thread/model request, trust,
+  credentials, MCP initialization or effective-policy proof is manufactured.
+
+## Independent execution
+
+Go 1.26.10, GOMAXPROCS=3, `-p=2`, RAM toolchain/cache:
+
+- Focused nativeconfig Codex contracts: PASS 0.011s.
+- Codex client contracts (including existing user Codex cases): PASS 0.033s.
+- Production provider Codex contracts: PASS 0.242s.
+- Domain compatibility and planner goldens: PASS 0.005s / 0.020s.
+- Exact new response-parser and disposable-boundary contracts: PASS 0.008s.
+- Native runner Python safety/evidence suite: 56 tests, PASS 0.495s.
+
+The first broader user tests correctly rejected this harness's case-duplicate
+ambient proxy entries. A clean process environment resolved those failures;
+production validation was unchanged. An overbroad repotest name selection also
+reached existing legacy CLI build cases whose two uncached dependencies could
+not be downloaded without inherited network configuration. Those unrelated
+legacy cases are not claimed as passing; the exact new parser/safety contracts
+were rerun successfully. No native client was executed on the task host.
+
+## Selector correction and R1 closure
+
+Independently compared the pinned native `codex-rs/config/src/skills_config.rs`
+with `9d128aa2`. Ordered matching, trimmed names, canonical SKILL.md document
+identity, ignored both-selector rules, and user/session-only selector authority
+are reflected by the bounded user-file warning helper. Project rules no longer
+manufacture a native disable observation; session effective policy is explicit
+unknown.
+
+One R1 follow-up was confirmed: native SkillsConfig decoding is all-or-nothing
+per layer. A missing required enabled value or nonabsolute typed path
+invalidates the section before selector interpretation, including a relative
+path on an otherwise ignored both-selector entry. The initial correction
+skipped only the invalid rule and could falsely retain a disable warning from
+another rule. Closed in `b39a4e9d` and final `4f4a320b`: these typed-invalid
+sections now suppress all bounded selector warnings. The focused composed
+regressions retain the exact invalid-section cases.
+
+Independently reran all `^TestProjectCodex` production provider contracts at the
+final frozen SHA: **PASS 0.283s**. The code remains conservatively prepared,
+never accepts project activation attestation, and never interprets a partial
+settings observation as native effective policy. No production file was edited
+by this reviewer and no native client was executed.
+
+## Remaining gates
+
+Retain both full independent implementation GO results on the final SHA. Run
+hosted current-source native
+discovery and cross-platform CI. Complete the saved production CLI composed
+project journey after integration. Project MCP initialization, native effective
+trust/policy, task completion and release qualification remain unqualified.

docs/plans/project-install-e2e/codex-code-review-r2.md

@@ -0,0 +1,111 @@
+# Codex project adapter independent implementation review R2
+
+Reviewer: cursor_clients, 2026-10-23. Reviewed the final adapter checkpoint
+`6387ac8509a76b84cd42ef19bcf53ebcefa91dcb` and source-only native discovery gate
+`048c34555543534bfc38eecf0a58cb64ff0d5ac5` in `work/uap-project-codex`.
+The earlier codec-only review is separate and is not counted as full-adapter
+approval. Scope includes production planner/provider composition, selected
+project roots, exact native ownership, activation/deactivation, policy-warning
+truthfulness, and the new hosted native-test selection and evidence boundary.
+
+## Initial decision: NO GO pending configured-warning correction
+
+The adapter's bounded skill restriction warnings do not match pinned Codex
+`rust-v0.153.4` semantics. `project_status.go` currently inspects skill rules
+from both project and user files and treats any matching disabled selector as
+effective. Native `codex-rs/config/src/skills_config.rs` accepts skill rules only
+from User and SessionFlags layers and processes ordered selectors, allowing
+later matching enables to override earlier disables. Rules with both a name
+and a path are ignored. Consequently the adapter can incorrectly report that a
+preserved project selector disables a skill, or report a disable that a later
+user rule reverses. The author independently confirmed the exact-tag source
+and is correcting the narrow configured-warning claim. No project trust,
+profile, ancestor, managed or session-policy evaluator should be added.
+
+## Reviewed boundaries without another blocker
+
+- Project context binds the selected root to its original detected user
+  ConfigRoot; native authority is the project root, with independent contained
+  `.agents/skills` and `.codex/config.toml` paths. Scope/root/user mismatches
+  refuse before native effects. Prepared packages and persistent data remain
+  under the project's `.uap` namespace. `CODEX_HOME` remains the original user
+  profile; project operations do not invoke marketplace/cache mutation.
+- Project skills and rendered command skills use the shared exact directory
+  transaction; MCP uses CodecCodex and the existing nativeconfig kernel.
+  Object identity, selected path and staged digest validation cover updates,
+  missing-same-pin repair, drift, unowned collisions and exact removal. Foreign
+  MCP fields, TOML comments/settings, skills and user cache remain outside
+  ownership. Unsupported SSE is withheld rather than rewritten as HTTP.
+- Active reprojection reads already staged values and verifies the bound
+  package/data locators without changing digest-covered package bytes. Auth
+  references retain the existing nonsecret OpenAI projection contract.
+- Preflight executes before generic activation-attestation shortcuts and also
+  on direct adapter activation. File configuration remains `prepared` plus
+  installed verification with ActivationAttested false. Native trust,
+  selection/aliases, effective managed/session policy and MCP initialization
+  remain unobserved. Exact native-file verification is not a native session
+  discovery claim.
+- The source matrix adds the exact anchored project-test name to existing
+  required Codex tests. Released/draft/prepared evidence inputs refuse the new
+  selection. Existing immutable client pins, fresh environment and disposable
+  hosted guard remain intact; skipped or omitted required tests cannot pass.
+  The workflow is still limited to its existing configured platforms and
+  triggers; writing this test is not evidence of a successful hosted run.
+- The new skills-only native suite uses fresh app-server `skills/list`, exact
+  repo scope/path/enabled checks, expected rendered command bytes and project-B
+  absence through add/update/missing-skill repair/removal. It has no thread,
+  model, trust mutation or configured MCP initialization request. Evidence
+  explicitly separates those unobserved stages from project discovery.
+
+## Independent verification
+
+With Go 1.26.10, GOMAXPROCS=3 and bounded existing caches:
+
+- Complete `clients/codex`: PASS, 0.140s.
+- Complete `adapters/nativeconfig`: PASS, 3.624s.
+- Complete `providers`: PASS, 1.888s.
+- Complete `planner`: PASS, 0.023s; complete `domain`: PASS, 0.025s.
+- `repotests -run 'TestCodexProjectDiscoveredSkills|TestNativeDisposableBoundary|TestNativePlatformEnvironmentIsolation' -count=1`:
+  PASS, 0.014s. Only inert validators/environment contracts were selected.
+- `python scripts/test_native_client_matrix.py`: PASS, 17 tests.
+
+The task host carries duplicate uppercase/lowercase proxy environment names.
+An initial pattern that also selected existing user Codex provider tests
+reproduced their existing strict environment refusal. Excluding only lowercase
+`http_proxy`, `https_proxy`, `all_proxy`, `no_proxy` for the full inert package
+run gave the passing results above; no production/test/golden change was made
+for that host condition. No native Codex process, package payload, model call,
+MCP command, login or trust action ran during this review.
+
+## Fix verification and final decision: GO
+
+Independently rechecked correction
+`9d128aa206fd9560a2c3d4d32602e4cf3b17ab59` against the exact-tag
+`codex-rs/config/src/skills_config.rs` source snapshot. Only the visible user
+file now contributes skill selectors. Ordered matching name/document selectors
+honor later enables, names are trimmed, both/no selector combinations are
+ignored and existing document aliases are canonicalized. Messages identify
+the user settings and leave session/effective enablement unobserved. Project
+selectors no longer manufacture a disabled-policy claim. This is bounded
+observation, without a second native settings/precedence engine.
+
+Independently ran all composed `providers -run '^TestProjectCodex' -count=1`
+contracts at the fixed checkpoint: PASS, 0.244s. The new cases exercise
+disabled canonical document/name, later name/path enable, ignored ambiguous
+selectors, directory versus document path, ignored project selector and a
+canonical document alias. Existing scope/rollback/attestation contracts remain
+selected. No native process was launched.
+
+The sole implementation blocker is closed. GO for the configured project
+component implementation and authored source-only discovery gate. Hosted
+runtime qualification remains separate: this review does not establish
+native skills discovery, MCP initialization, effective trust/policy, model
+use, real task completion or release readiness.
+
+Final frozen-checkpoint follow-up: reviewed
+`4f4a320bc58c5c45e23a75d56c43bc0c2b3da1a6`, including the native all-or-nothing
+SkillsConfig section decoding guard. A missing required enabled value or any
+nonabsolute typed selector path suppresses warnings from the whole section,
+matching the native layer decoder. Independent complete `^TestProjectCodex`
+provider selection PASS, 0.298s, including nine selector scenarios plus a
+canonical document alias. Final decision remains GO at this checkpoint.