[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6DB6X1CCSWTQSNWJP58JX9J":3,"skill-same:01M6DB6X1CCSWTQSNWJP58JX9J":79},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":49,"commitSha":50,"skillDirectory":51,"forksCount":14,"repositoryHtmlUrl":52,"repositoryHomepageUrl":6,"ownerHtmlUrl":53,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":54,"install":55,"resources":68},"01M6DB6X1CCSWTQSNWJP58JX9J","codex-invoke",null,"The ONE canonical entry point for invoking OpenAI Codex with per-call scoping. Use whenever you run `codex exec` (or drive the `mcp__codex__codex` \u002F `codex-reply` rail) with a specific model, sandbox\u002Fapproval policy, MCP allowlist or seal, skills allowlist, or structured `--output-schema` output. NEVER hand-roll `codex exec` argv. NOT for MCP-rail routing (codex-orchestrate).","Prekzursil\u002Fagent-skills-toolchain","Prekzursil","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F54636077?v=4","01M6DACZ1PCQHD99SCR1YXG28B","Andrei Mihai Visalon","01M6DACZ670WZF535V3WYYSS4Z",0,"MIT","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fcodex-invoke\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"codex invoke","codex","use","exec","openai codex","structured","call","reply","drive","never","schema","MCP","scoping","model","orchestrate","openai","routing","run","policy","sandbox","2026-11-10 10:12:30",false,"---\nname: codex-invoke\ndescription: The ONE canonical entry point for invoking OpenAI Codex with per-call scoping. Use whenever you run `codex exec` (or drive the `mcp__codex__codex` \u002F `codex-reply` rail) with a specific model, sandbox\u002Fapproval policy, MCP allowlist or seal, skills allowlist, or structured `--output-schema` output. NEVER hand-roll `codex exec` argv. NOT for MCP-rail routing (codex-orchestrate).\nlicense: MIT\n---\n# Codex Invoke\n\nThe single, definitory way to invoke Codex with **per-call scoping**. Every other\ncodex skill either routes intent on the always-full MCP rail (`codex-orchestrate`,\n`codex-consult`) or handles a different axis (transport, recovery, session hygiene).\n**This skill owns the exec rail and is the only one that can scope a Codex run**\n(restrict its MCP servers, seal its base, or allowlist its skills).\n\n**Definitory rule: never hand-roll `codex exec` argv anywhere. Route through\n`scripts\u002Fcodex_invoke.ps1`.** It builds a Windows-safe argv array, materializes the\nscope exactly once, previews it with `--print-command`, and wraps the run in the\nerror contract below.\n\nVerified live against **codex-cli 0.144.1** (flags, `mcp get\u002Flist --json -c`, and the\n`mcp … --ignore-user-config` rejection — see Ground Truth).\n\n---\n\n## Canonical docs\n\nThe full HOW-TO (rail decision table, the 5 profiles, M0–M3, DRY-RUN honesty, error\ncontract, deploy) lives in **[`guides\u002Fcodex-invocation.md`](..\u002F..\u002Fguides\u002Fcodex-invocation.md)**.\nWatching a run live on **either** rail is specified in\n**[`guides\u002Fcodex-monitor-reconcile.md`](..\u002F..\u002Fguides\u002Fcodex-monitor-reconcile.md)** — the ONE\ndocumented way: `run-taskwatch_monitor` for one detached `codex exec`, the `workflow-monitor`\nCodex lane for an in-session `mcp__codex__codex` call \u002F the whole fan-out.\n\n---\n\n## Rails — which knob each supports\n\nThe skill auto-picks the rail and **states which one it used** in its output.\n\n| Knob | `exec` rail (`codex exec`) | MCP rail (`mcp__codex__codex` \u002F `codex-reply`) |\n|---|---|---|\n| model \u002F effort | `-m` \u002F `-c model_reasoning_effort` | tool params |\n| profile scalar keys | materialized `-c` from `\u003Cname>.config.toml` | inherits base only |\n| **MCP allowlist \u002F seal** | M0 static \u002F M1 diff-disable \u002F M2 sealed | inherits full base — no per-call scoping |\n| skills allowlist | ephemeral CODEX_HOME + materialized `config.toml` | base skills only |\n| structured output | `--output-schema \u003Cfile>` | MCP typed output (⚠ landmine below) |\n| detached \u002F one-shot | background + `codex resume` | in-session only |\n| threadId continuation | `codex exec resume --last` | `codex-reply(threadId)` |\n\n**Routing rule:** *any* `mcps` \u002F `skills` \u002F `seal` request → **exec rail** (the only\nrail that can scope). Otherwise a plain model\u002Feffort call may ride the MCP rail.\n\n⚠ **Workflow landmine:** a typed `--output-schema` on the exec rail while MCP tools\nare active can break (see `workflow-authoring`). The DRY-RUN surfaces this; the\n`fanout-json` profile (sealed, zero-MCP) is the safe structured-output path.\n\n---\n\n## Scoping mechanisms (keyed off `\u003Cname>.scope.json.mode`)\n\nProfiles give the *easy* axis (model\u002Feffort\u002Fsandbox\u002Fapproval\u002Fweb_search) via\nmaterialized `-c`. True scoping needs one of four mechanisms — because a static\nprofile cannot express \"disable everything NOT in this allowlist\" against a base\nwhose future server names are unknown at author time.\n\n- **M0 — Static disable (known base, no live read).** `.config.toml` carries\n  explicit `mcp_servers.\u003Cname>.enabled=false` lines; materialized as `-c`. Fully\n  offline, deterministic, `--strict-config`-clean. Use when the base set is stable.\n- **M1 — Difference-disable (default; drift-robust).** Enumerate the live base once\n  via `codex mcp list --json`, compute `live_base − mcp_allowlist`, emit\n  `-c mcp_servers.\u003Cx>.enabled=false` for each. Anything the base gains that isn't\n  allowlisted is auto-disabled.\n- **M2 — Sealed base (`seal:true`).** Two strictly-separated sub-modes:\n  - **M2a — Full-seal \u002F zero-MCP (empty allowlist).** `--ignore-user-config` drops the\n    base entirely; no enable-block supplied → runtime loads zero MCP servers. The\n    fan-out path. **Allowed only with an empty allowlist.**\n  - **M2b — Sealed + explicit allowlist (non-empty).** `--ignore-user-config` drops the\n    base, then supply a fully explicit `-c mcp_servers.\u003Cx>.command\u002F.args\u002F.env` ENABLE\n    block for only the allowlisted servers. **Definitions are harvested from the live\n    base** (`codex mcp get \u003Cname> --json`, secrets as `${VAR}`) into\n    `.scope.json.captured_mcp_defs` — never invented. **Fail-closed:** seal + non-empty\n    allowlist but no captured def (or an unset `${VAR}`) → refuse\n    (`FAILED:\u003Cid> seal-uncaptured`).\n- **M3 — Feature\u002Ftool toggles.** `web_search=\"disabled\"` in the toml +\n  `--enable\u002F--disable \u003Cfeature>` per `.scope.json.tools`.\n\n**Skills scoping** (no native per-invocation flag exists): when `skills_allowlist` is\nnon-empty the skill stages an **ephemeral CODEX_HOME** (`$TMP\u002Fcodex-scope-\u003Chash>\u002F`)\nholding (1) copied `auth.json`, (2) a **materialized `config.toml`** carrying exactly\nthe allowlisted MCP defs (harvested — an ephemeral home does NOT inherit the base\nconfig, so without this step the run would silently have zero MCPs) **plus** the\nprofile scalar keys, and (3) a `skills\u002F` dir with only the allowlisted skills. The\nephemeral home is passed to the **codex child process only** (never a session-global\n`CODEX_HOME` export) inside a `try\u002Ffinally` that restores the prior value.\n\n---\n\n## DRY-RUN \u002F `--print-command` (mandatory)\n\n`codex_invoke.ps1 -PrintCommand` emits the **exact** argv it will run — resolved\ncanonical CODEX_HOME, the single-materialized `-c` disable-set \u002F enable-block, `-s`,\n`--output-schema`, `-C`, `--skip-git-repo-check`, chosen rail — and runs nothing\n**beyond the one live config read** the materialization requires. The launch reuses\nthe identical cached set (single-materialization rule), so `--print-command` can\nnever print a set the launch won't use.\n\n**Honesty note:** M1\u002FM2b\u002Fskills perform **one live read** (`codex mcp list --json`\nand\u002For `codex mcp get --json`, read-only, no state mutation) to compute the set — so\nDRY-RUN is *not* fully offline for those modes. **M0 and M2a require no live read and\nARE offline.** Base drift between print and launch is *detected* via\n`base_snapshot_hash`, not silently divergent.\n\n---\n\n## ERROR CONTRACT (explicit — AGENTS.md §4)\n\nEvery invocation ends in a terminal marker: `SUCCESS:\u003Cid>` or `FAILED:\u003Cid> \u003Creason>`.\n\n1. **Malformed-config (deterministic, no timing guess).** Classified on **exit code +\n   the codex stderr parse-error signature** (\"failed to parse config\" \u002F unrecognized\n   key), NEVER wall-clock — a legit fast one-shot yields an empty `-o` in \u003C2s, and a\n   malformed config can hang. `--strict-config` is also probed **unconditionally at\n   deploy\u002Fdoctor time**, so parse failures are caught proactively. Runtime signature →\n   `FAILED:\u003Cid> config-parse` + route to **`codex-runtime-recovery`**.\n2. **Auth\u002Fquota preflight.** `codex login status` first (exit 0 == \"Logged in using\n   ChatGPT\" — codex-cli 0.144.1 has **no** `codex auth status` subcommand); on 5h rate\n   cap \u002F weekly cap \u002F `429` \u002F budget-pause → no retry-storm; `FAILED:\u003Cid> quota` + reset\n   window. A transient probe `429` ≠ exhaustion (fall back to cached status).\n3. **Timeout.** Wrap via `longrun` (`-HangTimeoutSec`), detached + `Monitor`\n   (AGENTS.md §4a) — never a blocking foreground call.\n4. **Detached-run recovery.** Record session id + `-o` path; recovery re-reads the log\n   and `codex resume`s (reuse **`codex-runtime-recovery`** + **`run-taskwatch_monitor`**).\n5. **Scope-assertion (fail-closed).** If the exec-runtime scope proof shows a forbidden\n   server loaded, or a required def is uncaptured → refuse to launch,\n   `FAILED:\u003Cid> scope-breach` \u002F `seal-uncaptured`. A scoping mechanism that can't prove\n   its scope must not run.\n6. **Base drift.** Live-base hash ≠ pinned `base_snapshot_hash` → `WARN base-drift`;\n   re-harvest for M2b\u002Fskills before proceeding.\n\nThe **0-second-exit** case (auth\u002Fconfig failure that dies instantly) is caught by\nclauses 1+2 via exit-code+signature, not by treating a fast exit as failure.\n\n---\n\n## Windows-safe command construction (ACCEPTANCE CRITERION)\n\n- Build argv as a **PowerShell array** (`& codex @args`) — never a shell string.\n- **No Git-Bash** for any `codex -C \u003Cpath>` or device-ish arg (MSYS path-conversion\n  truncation, windows-shell.md §1). The builder is `.ps1`; if a POSIX arg is\n  unavoidable, `MSYS_NO_PATHCONV=1`.\n- Never `New-Item -Force` on an existing profile file (windows-shell.md §4); the\n  deployer uses `Set-Content`\u002Fcopy.\n- The smoke matrix round-trips the **real** footguns byte-exact through `& codex @args`\n  on PowerShell 7 (not just a generic argv): (1) multi-element array with spaces\n  `-c 'mcp_servers.x.args=[\"a b\",\"c d\"]'`; (2) env sub-table\n  `-c 'mcp_servers.x.env={API_KEY=\"${API_KEY}\",REGION=\"eu west\"}'`; (3) `${VAR}`\n  placeholders survive un-expanded; (4) values containing `$`\u002F`[`\u002F`]`\u002Fquotes\u002Fspaces.\n  Each asserts the string codex *receives* (`codex mcp get x -c … --json`) equals the\n  intent. This is the acceptance gate for the M2b\u002Fskills materialization path.\n\n---\n\n## codex-doctor (health-check + config-lint)\n\n`scripts\u002Fcodex_doctor.ps1` (canonical CODEX_HOME). Runs proactively at deploy and per\ncodex release:\n\n1. `codex login status` → authed? (exit 0 == logged in; `codex auth status` does not exist).\n2. Each `\u003Cname>.config.toml` parses **and is `--strict-config`-clean** (unconditional,\n   **token-free**). The profile is staged as the sole `config.toml` of an *unauthenticated*\n   temp `CODEX_HOME` and run under `codex exec --strict-config` with a deliberately-absent\n   `--output-schema`: a malformed config dies at config-load (\"Error loading config.toml\"),\n   a clean config short-circuits on the missing schema — **before any auth or network**, so\n   a clean profile never spends a token. Verdict keys on the parse-error signature.\n3. Each `.scope.json` parses; every `mcp_allowlist` name exists in the live base.\n4. **Model slug declared** (offline structural check only — codex 0.144.1 has no offline\n   model-resolve probe, so there is no `--print-command`). The slug's **real resolution** is\n   proven live in check 6 (`-Live`): an `unknown model` in the exec-runtime run →\n   resolve-or-fallback to `.scope.json.model_fallbacks`, warn on fallback.\n5. **Harvest + pin:** for seal+allowlist or skills profiles, harvest\n   `codex mcp get \u003Cname> --json` into `captured_mcp_defs` (`${VAR}` secrets), record\n   `base_snapshot_hash`; fail-closed on any uncaptured def (`seal-uncaptured`).\n6. **Exec-runtime scope proof (the anti-fake check):** materialize each profile's\n   flags, run a real `codex exec --json` no-op, parse the startup\u002Fsession events for the\n   **actual loaded MCP + tool inventory**, assert `loaded_mcp_set == mcp_allowlist`\n   (and, for skills profiles run with `CODEX_HOME=\u003Cephemeral>`, `loaded_skills ⊆\n   skills_allowlist`). This is the ONLY proof valid under seal — `codex mcp list` cannot\n   be sealed (G3) and proves the resolver, not the runtime. Re-run per release.\n\nThe doctor pins the `codex exec --json` startup-event shape via a shared fixture (also\nconsumed by the monitor lane); if the event schema changes it **fails loudly** rather\nthan trusting a stale parse.\n\n---\n\n## Parameters (`scripts\u002Fcodex_invoke.ps1`)\n\n`-Model -Effort -Profile -Mcps[] -Skills[] -Tools -Sandbox -Approval -OutputSchema\n-Seal -Mode(M0|M1|M2) -Rail(auto|exec|mcp) -Cwd -Prompt -Timeout -Id -PrintCommand\n-Doctor -ProfilesDir`.\n\n- `-Mcps` overrides the profile allowlist; `-Rail auto` (default) applies the routing\n  rule; `-Doctor` shells to `codex_doctor.ps1`.\n- Profiles are read from `-ProfilesDir` (default: repo `tools\u002Fcodex\u002Fprofiles\u002F`, then\n  `$CODEX_HOME\u002Fprofiles\u002F`). CODEX_HOME resolves via `HARNESS_LIVE_CODEX_HOME` →\n  `~\u002F.codex` (never a possibly-ephemeral bare `CODEX_HOME`).\n\n## The 5 recommended profiles\n\n| Profile | model \u002F effort | sandbox \u002F approval | web | mcp_allowlist | mode | seal | skills |\n|---|---|---|---|---|---|---|---|\n| **audit-readonly-max** | gpt-5.6-sol \u002F max | read-only \u002F never | live | read-only: basic-memory, scholarly-access, context7, deepwiki, repomix, semgrep | M1 | no | RE\u002Fanalysis read set |\n| **build-sandboxed** | gpt-5.6-sol \u002F high | workspace-write \u002F on-request | live | context7, repomix, qlty, codacy, github, basic-memory | M1 \u002F ephemeral if skills | no | tdd-workflow, python-testing, security-review, systematic-debugging |\n| **exec-fast** | gpt-5.6-sol \u002F medium | workspace-write \u002F on-request (fast tier) | disabled | basic-memory only | M0 | no | none |\n| **fanout-json** | gpt-5.6-sol \u002F max | read-only \u002F never | disabled | none | M2a | yes | none |\n| **consult-review** | gpt-5.6-sol \u002F max | read-only \u002F never | live | context7, deepwiki, exa, firecrawl, tavily, scholarly-access | M1 \u002F ephemeral if skills | no | receiving-code-review, rubric-verifier, acceptance-review |\n\n`build-sandboxed` and `consult-review` carry both a non-empty skills AND MCP allowlist\n→ they run in an ephemeral home whose materialized `config.toml` carries exactly the\nallowlisted MCP defs (else the MCPs silently vanish on the skills path).\n\n**Secrets discipline:** MCP creds are `env_vars=[\"NAME\"]` \u002F `${VAR}` only — never inline,\nin the base, in `captured_mcp_defs`, or in any materialized ephemeral config.\n`.scope.json` carries names + `${VAR}` placeholders, never secret values.\n\n---\n\n## Reconciliation — how this skill relates to the others\n\n**The canonical exec-rail entry point. It does not overlap the others** —\n`codex-orchestrate` (MCP-rail intent routing) and `codex-vscode-host-routing` (IDE\ntransport) are orthogonal axes. `codex-consult` used to be a third axis (the PromptBridge\nlanes); those lanes were deleted on 2026-08-09 and that skill is now a redirect tombstone\npointing at `codex-orchestrate` and this skill.\n\n- **Leverages (cites, does not rebuild):** `codex-runtime-recovery` (fast-exit \u002F\n  detached-run \u002F CODEX_HOME-drift recovery), `run-taskwatch_monitor` (detached-exec\n  JSONL adapter), `workflow-monitor` (the cross-vendor cockpit's Codex lane),\n  `codex-fleet-github` (shares the skill-allowlist file format).\n- **Session hygiene continuation:** `codex-session-reunion` \u002F `format-codex-sessions`.\n- **Integration owed by the design (scoped work, not a free cross-link):**\n  `codex-orchestrate` gains an **exec-rail delegation branch** that fires on any scoping\n  request and delegates to this skill, with its own test. Until that edit ships it remains\n  MCP-rail-only. (The same item previously covered `codex-consult`; that skill is retired,\n  so its half of the work is cancelled, not outstanding.)\n\n## Ground Truth (verified live, codex-cli 0.144.1)\n\n- `codex exec` exposes `-c\u002F--config`, `--strict-config`, `-m`, `-s`, `-C`,\n  `--output-schema`, `--output-last-message`, `--ignore-user-config`,\n  `--enable`\u002F`--disable`, `--skip-git-repo-check`, `--json`, `--profile`. **PRESENT.**\n- `codex mcp get --json -c` and `codex mcp list --json -c` — **PRESENT** (harvest +\n  config-resolver surfaces).\n- `codex mcp list --ignore-user-config` → **REJECTED** (\"unexpected argument\") — the\n  `mcp` subcommand cannot be sealed, so a sealed profile's only valid scope proof is the\n  **exec-runtime** `codex exec --json` startup-event inventory (G3).\n- **`codex auth status` and `codex exec --print-command` do NOT exist** in 0.144.1. The\n  auth probe is **`codex login status`** (exit 0 == \"Logged in using ChatGPT\"). There is\n  **no** flag that prints the resolved argv or dry-resolves a model, and `-c\n  config_path=\u003Cfile>` is **not** an external-config loader (it just sets an unknown key).\n  Strict-config lint therefore loads the profile as a staged temp-`CODEX_HOME`\n  `config.toml` under `codex exec --strict-config` and keys on the `Error loading\n  config.toml` parse signature (token-free — a missing `--output-schema` short-circuits a\n  clean config before any auth\u002Fnetwork). `--strict-config` is honored **only** by `codex\n  exec` (rejected by `codex mcp` \u002F `codex features`).\n","# Codex Invoke\n\nThe single, definitory way to invoke Codex with **per-call scoping**. Every other\ncodex skill either routes intent on the always-full MCP rail (`codex-orchestrate`,\n`codex-consult`) or handles a different axis (transport, recovery, session hygiene).\n**This skill owns the exec rail and is the only one that can scope a Codex run**\n(restrict its MCP servers, seal its base, or allowlist its skills).\n\n**Definitory rule: never hand-roll `codex exec` argv anywhere. Route through\n`scripts\u002Fcodex_invoke.ps1`.** It builds a Windows-safe argv array, materializes the\nscope exactly once, previews it with `--print-command`, and wraps the run in the\nerror contract below.\n\nVerified live against **codex-cli 0.144.1** (flags, `mcp get\u002Flist --json -c`, and the\n`mcp … --ignore-user-config` rejection — see Ground Truth).\n\n---\n\n## Canonical docs\n\nThe full HOW-TO (rail decision table, the 5 profiles, M0–M3, DRY-RUN honesty, error\ncontract, deploy) lives in **[`guides\u002Fcodex-invocation.md`](..\u002F..\u002Fguides\u002Fcodex-invocation.md)**.\nWatching a run live on **either** rail is specified in\n**[`guides\u002Fcodex-monitor-reconcile.md`](..\u002F..\u002Fguides\u002Fcodex-monitor-reconcile.md)** — the ONE\ndocumented way: `run-taskwatch_monitor` for one detached `codex exec`, the `workflow-monitor`\nCodex lane for an in-session `mcp__codex__codex` call \u002F the whole fan-out.\n\n---\n\n## Rails — which knob each supports\n\nThe skill auto-picks the rail and **states which one it used** in its output.\n\n| Knob | `exec` rail (`codex exec`) | MCP rail (`mcp__codex__codex` \u002F `codex-reply`) |\n|---|---|---|\n| model \u002F effort | `-m` \u002F `-c model_reasoning_effort` | tool params |\n| profile scalar keys | materialized `-c` from `\u003Cname>.config.toml` | inherits base only |\n| **MCP allowlist \u002F seal** | M0 static \u002F M1 diff-disable \u002F M2 sealed | inherits full base — no per-call scoping |\n| skills allowlist | ephemeral CODEX_HOME + materialized `config.toml` | base skills only |\n| structured output | `--output-schema \u003Cfile>` | MCP typed output (⚠ landmine below) |\n| detached \u002F one-shot | background + `codex resume` | in-session only |\n| threadId continuation | `codex exec resume --last` | `codex-reply(threadId)` |\n\n**Routing rule:** *any* `mcps` \u002F `skills` \u002F `seal` request → **exec rail** (the only\nrail that can scope). Otherwise a plain model\u002Feffort call may ride the MCP rail.\n\n⚠ **Workflow landmine:** a typed `--output-schema` on the exec rail while MCP tools\nare active can break (see `workflow-authoring`). The DRY-RUN surfaces this; the\n`fanout-json` profile (sealed, zero-MCP) is the safe structured-output path.\n\n---\n\n## Scoping mechanisms (keyed off `\u003Cname>.scope.json.mode`)\n\nProfiles give the *easy* axis (model\u002Feffort\u002Fsandbox\u002Fapproval\u002Fweb_search) via\nmaterialized `-c`. True scoping needs one of four mechanisms — because a static\nprofile cannot express \"disable everything NOT in this allowlist\" against a base\nwhose future server names are unknown at author time.\n\n- **M0 — Static disable (known base, no live read).** `.config.toml` carries\n  explicit `mcp_servers.\u003Cname>.enabled=false` lines; materialized as `-c`. Fully\n  offline, deterministic, `--strict-config`-clean. Use when the base set is stable.\n- **M1 — Difference-disable (default; drift-robust).** Enumerate the live base once\n  via `codex mcp list --json`, compute `live_base − mcp_allowlist`, emit\n  `-c mcp_servers.\u003Cx>.enabled=false` for each. Anything the base gains that isn't\n  allowlisted is auto-disabled.\n- **M2 — Sealed base (`seal:true`).** Two strictly-separated sub-modes:\n  - **M2a — Full-seal \u002F zero-MCP (empty allowlist).** `--ignore-user-config` drops the\n    base entirely; no enable-block supplied → runtime loads zero MCP servers. The\n    fan-out path. **Allowed only with an empty allowlist.**\n  - **M2b — Sealed + explicit allowlist (non-empty).** `--ignore-user-config` drops the\n    base, then supply a fully explicit `-c mcp_servers.\u003Cx>.command\u002F.args\u002F.env` ENABLE\n    block for only the allowlisted servers. **Definitions are harvested from the live\n    base** (`codex mcp get \u003Cname> --json`, secrets as `${VAR}`) into\n    `.scope.json.captured_mcp_defs` — never invented. **Fail-closed:** seal + non-empty\n    allowlist but no captured def (or an unset `${VAR}`) → refuse\n    (`FAILED:\u003Cid> seal-uncaptured`).\n- **M3 — Feature\u002Ftool toggles.** `web_search=\"disabled\"` in the toml +\n  `--enable\u002F--disable \u003Cfeature>` per `.scope.json.tools`.\n\n**Skills scoping** (no native per-invocation flag exists): when `skills_allowlist` is\nnon-empty the skill stages an **ephemeral CODEX_HOME** (`$TMP\u002Fcodex-scope-\u003Chash>\u002F`)\nholding (1) copied `auth.json`, (2) a **materialized `config.toml`** carrying exactly\nthe allowlisted MCP defs (harvested — an ephemeral home does NOT inherit the base\nconfig, so without this step the run would silently have zero MCPs) **plus** the\nprofile scalar keys, and (3) a `skills\u002F` dir with only the allowlisted skills. The\nephemeral home is passed to the **codex child process only** (never a session-global\n`CODEX_HOME` export) inside a `try\u002Ffinally` that restores the prior value.\n\n---\n\n## DRY-RUN \u002F `--print-command` (mandatory)\n\n`codex_invoke.ps1 -PrintCommand` emits the **exact** argv it will run — resolved\ncanonical CODEX_HOME, the single-materialized `-c` disable-set \u002F enable-block, `-s`,\n`--output-schema`, `-C`, `--skip-git-repo-check`, chosen rail — and runs nothing\n**beyond the one live config read** the materialization requires. The launch reuses\nthe identical cached set (single-materialization rule), so `--print-command` can\nnever print a set the launch won't use.\n\n**Honesty note:** M1\u002FM2b\u002Fskills perform **one live read** (`codex mcp list --json`\nand\u002For `codex mcp get --json`, read-only, no state mutation) to compute the set — so\nDRY-RUN is *not* fully offline for those modes. **M0 and M2a require no live read and\nARE offline.** Base drift between print and launch is *detected* via\n`base_snapshot_hash`, not silently divergent.\n\n---\n\n## ERROR CONTRACT (explicit — AGENTS.md §4)\n\nEvery invocation ends in a terminal marker: `SUCCESS:\u003Cid>` or `FAILED:\u003Cid> \u003Creason>`.\n\n1. **Malformed-config (deterministic, no timing guess).** Classified on **exit code +\n   the codex stderr parse-error signature** (\"failed to parse config\" \u002F unrecognized\n   key), NEVER wall-clock — a legit fast one-shot yields an empty `-o` in \u003C2s, and a\n   malformed config can hang. `--strict-config` is also probed **unconditionally at\n   deploy\u002Fdoctor time**, so parse failures are caught proactively. Runtime signature →\n   `FAILED:\u003Cid> config-parse` + route to **`codex-runtime-recovery`**.\n2. **Auth\u002Fquota preflight.** `codex login status` first (exit 0 == \"Logged in using\n   ChatGPT\" — codex-cli 0.144.1 has **no** `codex auth status` subcommand); on 5h rate\n   cap \u002F weekly cap \u002F `429` \u002F budget-pause → no retry-storm; `FAILED:\u003Cid> quota` + reset\n   window. A transient probe `429` ≠ exhaustion (fall back to cached status).\n3. **Timeout.** Wrap via `longrun` (`-HangTimeoutSec`), detached + `Monitor`\n   (AGENTS.md §4a) — never a blocking foreground call.\n4. **Detached-run recovery.** Record session id + `-o` path; recovery re-reads the log\n   and `codex resume`s (reuse **`codex-runtime-recovery`** + **`run-taskwatch_monitor`**).\n5. **Scope-assertion (fail-closed).** If the exec-runtime scope proof shows a forbidden\n   server loaded, or a required def is uncaptured → refuse to launch,\n   `FAILED:\u003Cid> scope-breach` \u002F `seal-uncaptured`. A scoping mechanism that can't prove\n   its scope must not run.\n6. **Base drift.** Live-base hash ≠ pinned `base_snapshot_hash` → `WARN base-drift`;\n   re-harvest for M2b\u002Fskills before proceeding.\n\nThe **0-second-exit** case (auth\u002Fconfig failure that dies instantly) is caught by\nclauses 1+2 via exit-code+signature, not by treating a fast exit as failure.\n\n---\n\n## Windows-safe command construction (ACCEPTANCE CRITERION)\n\n- Build argv as a **PowerShell array** (`& codex @args`) — never a shell string.\n- **No Git-Bash** for any `codex -C \u003Cpath>` or device-ish arg (MSYS path-conversion\n  truncation, windows-shell.md §1). The builder is `.ps1`; if a POSIX arg is\n  unavoidable, `MSYS_NO_PATHCONV=1`.\n- Never `New-Item -Force` on an existing profile file (windows-shell.md §4); the\n  deployer uses `Set-Content`\u002Fcopy.\n- The smoke matrix round-trips the **real** footguns byte-exact through `& codex @args`\n  on PowerShell 7 (not just a generic argv): (1) multi-element array with spaces\n  `-c 'mcp_servers.x.args=[\"a b\",\"c d\"]'`; (2) env sub-table\n  `-c 'mcp_servers.x.env={API_KEY=\"${API_KEY}\",REGION=\"eu west\"}'`; (3) `${VAR}`\n  placeholders survive un-expanded; (4) values containing `$`\u002F`[`\u002F`]`\u002Fquotes\u002Fspaces.\n  Each asserts the string codex *receives* (`codex mcp get x -c … --json`) equals the\n  intent. This is the acceptance gate for the M2b\u002Fskills materialization path.\n\n---\n\n## codex-doctor (health-check + config-lint)\n\n`scripts\u002Fcodex_doctor.ps1` (canonical CODEX_HOME). Runs proactively at deploy and per\ncodex release:\n\n1. `codex login status` → authed? (exit 0 == logged in; `codex auth status` does not exist).\n2. Each `\u003Cname>.config.toml` parses **and is `--strict-config`-clean** (unconditional,\n   **token-free**). The profile is staged as the sole `config.toml` of an *unauthenticated*\n   temp `CODEX_HOME` and run under `codex exec --strict-config` with a deliberately-absent\n   `--output-schema`: a malformed config dies at config-load (\"Error loading config.toml\"),\n   a clean config short-circuits on the missing schema — **before any auth or network**, so\n   a clean profile never spends a token. Verdict keys on the parse-error signature.\n3. Each `.scope.json` parses; every `mcp_allowlist` name exists in the live base.\n4. **Model slug declared** (offline structural check only — codex 0.144.1 has no offline\n   model-resolve probe, so there is no `--print-command`). The slug's **real resolution** is\n   proven live in check 6 (`-Live`): an `unknown model` in the exec-runtime run →\n   resolve-or-fallback to `.scope.json.model_fallbacks`, warn on fallback.\n5. **Harvest + pin:** for seal+allowlist or skills profiles, harvest\n   `codex mcp get \u003Cname> --json` into `captured_mcp_defs` (`${VAR}` secrets), record\n   `base_snapshot_hash`; fail-closed on any uncaptured def (`seal-uncaptured`).\n6. **Exec-runtime scope proof (the anti-fake check):** materialize each profile's\n   flags, run a real `codex exec --json` no-op, parse the startup\u002Fsession events for the\n   **actual loaded MCP + tool inventory**, assert `loaded_mcp_set == mcp_allowlist`\n   (and, for skills profiles run with `CODEX_HOME=\u003Cephemeral>`, `loaded_skills ⊆\n   skills_allowlist`). This is the ONLY proof valid under seal — `codex mcp list` cannot\n   be sealed (G3) and proves the resolver, not the runtime. Re-run per release.\n\nThe doctor pins the `codex exec --json` startup-event shape via a shared fixture (also\nconsumed by the monitor lane); if the event schema changes it **fails loudly** rather\nthan trusting a stale parse.\n\n---\n\n## Parameters (`scripts\u002Fcodex_invoke.ps1`)\n\n`-Model -Effort -Profile -Mcps[] -Skills[] -Tools -Sandbox -Approval -OutputSchema\n-Seal -Mode(M0|M1|M2) -Rail(auto|exec|mcp) -Cwd -Prompt -Timeout -Id -PrintCommand\n-Doctor -ProfilesDir`.\n\n- `-Mcps` overrides the profile allowlist; `-Rail auto` (default) applies the routing\n  rule; `-Doctor` shells to `codex_doctor.ps1`.\n- Profiles are read from `-ProfilesDir` (default: repo `tools\u002Fcodex\u002Fprofiles\u002F`, then\n  `$CODEX_HOME\u002Fprofiles\u002F`). CODEX_HOME resolves via `HARNESS_LIVE_CODEX_HOME` →\n  `~\u002F.codex` (never a possibly-ephemeral bare `CODEX_HOME`).\n\n## The 5 recommended profiles\n\n| Profile | model \u002F effort | sandbox \u002F approval | web | mcp_allowlist | mode | seal | skills |\n|---|---|---|---|---|---|---|---|\n| **audit-readonly-max** | gpt-5.6-sol \u002F max | read-only \u002F never | live | read-only: basic-memory, scholarly-access, context7, deepwiki, repomix, semgrep | M1 | no | RE\u002Fanalysis read set |\n| **build-sandboxed** | gpt-5.6-sol \u002F high | workspace-write \u002F on-request | live | context7, repomix, qlty, codacy, github, basic-memory | M1 \u002F ephemeral if skills | no | tdd-workflow, python-testing, security-review, systematic-debugging |\n| **exec-fast** | gpt-5.6-sol \u002F medium | workspace-write \u002F on-request (fast tier) | disabled | basic-memory only | M0 | no | none |\n| **fanout-json** | gpt-5.6-sol \u002F max | read-only \u002F never | disabled | none | M2a | yes | none |\n| **consult-review** | gpt-5.6-sol \u002F max | read-only \u002F never | live | context7, deepwiki, exa, firecrawl, tavily, scholarly-access | M1 \u002F ephemeral if skills | no | receiving-code-review, rubric-verifier, acceptance-review |\n\n`build-sandboxed` and `consult-review` carry both a non-empty skills AND MCP allowlist\n→ they run in an ephemeral home whose materialized `config.toml` carries exactly the\nallowlisted MCP defs (else the MCPs silently vanish on the skills path).\n\n**Secrets discipline:** MCP creds are `env_vars=[\"NAME\"]` \u002F `${VAR}` only — never inline,\nin the base, in `captured_mcp_defs`, or in any materialized ephemeral config.\n`.scope.json` carries names + `${VAR}` placeholders, never secret values.\n\n---\n\n## Reconciliation — how this skill relates to the others\n\n**The canonical exec-rail entry point. It does not overlap the others** —\n`codex-orchestrate` (MCP-rail intent routing) and `codex-vscode-host-routing` (IDE\ntransport) are orthogonal axes. `codex-consult` used to be a third axis (the PromptBridge\nlanes); those lanes were deleted on 2026-08-09 and that skill is now a redirect tombstone\npointing at `codex-orchestrate` and this skill.\n\n- **Leverages (cites, does not rebuild):** `codex-runtime-recovery` (fast-exit \u002F\n  detached-run \u002F CODEX_HOME-drift recovery), `run-taskwatch_monitor` (detached-exec\n  JSONL adapter), `workflow-monitor` (the cross-vendor cockpit's Codex lane),\n  `codex-fleet-github` (shares the skill-allowlist file format).\n- **Session hygiene continuation:** `codex-session-reunion` \u002F `format-codex-sessions`.\n- **Integration owed by the design (scoped work, not a free cross-link):**\n  `codex-orchestrate` gains an **exec-rail delegation branch** that fires on any scoping\n  request and delegates to this skill, with its own test. Until that edit ships it remains\n  MCP-rail-only. (The same item previously covered `codex-consult`; that skill is retired,\n  so its half of the work is cancelled, not outstanding.)\n\n## Ground Truth (verified live, codex-cli 0.144.1)\n\n- `codex exec` exposes `-c\u002F--config`, `--strict-config`, `-m`, `-s`, `-C`,\n  `--output-schema`, `--output-last-message`, `--ignore-user-config`,\n  `--enable`\u002F`--disable`, `--skip-git-repo-check`, `--json`, `--profile`. **PRESENT.**\n- `codex mcp get --json -c` and `codex mcp list --json -c` — **PRESENT** (harvest +\n  config-resolver surfaces).\n- `codex mcp list --ignore-user-config` → **REJECTED** (\"unexpected argument\") — the\n  `mcp` subcommand cannot be sealed, so a sealed profile's only valid scope proof is the\n  **exec-runtime** `codex exec --json` startup-event inventory (G3).\n- **`codex auth status` and `codex exec --print-command` do NOT exist** in 0.144.1. The\n  auth probe is **`codex login status`** (exit 0 == \"Logged in using ChatGPT\"). There is\n  **no** flag that prints the resolved argv or dry-resolves a model, and `-c\n  config_path=\u003Cfile>` is **not** an external-config loader (it just sets an unknown key).\n  Strict-config lint therefore loads the profile as a staged temp-`CODEX_HOME`\n  `config.toml` under `codex exec --strict-config` and keys on the `Error loading\n  config.toml` parse signature (token-free — a missing `--output-schema` short-circuits a\n  clean config before any auth\u002Fnetwork). `--strict-config` is honored **only** by `codex\n  exec` (rejected by `codex mcp` \u002F `codex features`).\n",{"name":5,"license":15,"description":7},"main","a298c929b6cbd662e1fce54302ce520d5ceea1a5",".agents\u002Fskills\u002Fcodex-invoke","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain","https:\u002F\u002Fgithub.com\u002FPrekzursil","2026-11-02 14:30:57",{"source":8,"skillName":5,"commands":56,"prompt":66,"zipAvailable":67},[57,60,63],{"tool":58,"command":59},"npx","npx skills add Prekzursil\u002Fagent-skills-toolchain --skill codex-invoke",{"tool":61,"command":62},"bunx","bunx skills add Prekzursil\u002Fagent-skills-toolchain --skill codex-invoke",{"tool":64,"command":65},"pnpm","pnpm dlx skills add Prekzursil\u002Fagent-skills-toolchain --skill codex-invoke","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fcodex-invoke\u002FSKILL.md",true,[69,75],{"path":70,"resourceType":71,"resourceTypeDesc":72,"sizeBytes":73,"sourceHtmlUrl":74},"scripts\u002Fcodex_doctor.ps1","SCRIPT","脚本",14971,"https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fcodex-invoke\u002Fscripts\u002Fcodex_doctor.ps1",{"path":76,"resourceType":71,"resourceTypeDesc":72,"sizeBytes":77,"sourceHtmlUrl":78},"scripts\u002Fcodex_invoke.ps1",15350,"https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fcodex-invoke\u002Fscripts\u002Fcodex_invoke.ps1",[80,101,127,154,168,184],{"skillNo":81,"name":82,"nameZh":6,"description":83,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":84,"categories":85,"keywords":86,"publishedAt":44},"01M6DF7D7478R55P46REYH4QAC","clarify-requirements","Resolve genuine pre-execution ambiguity by scanning repo context, generating 1-6 grounded options, and asking 1-3 focused questions via AskUserQuestion. NOT for mid-task use (injection risk); NOT when the goal is already unambiguous; use to disambiguate vague prompts before any file edits.","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002Ftools\u002Fworkspace-hooks\u002Fskills\u002Fclarify-requirements\u002FSKILL.md",[],[87,88,89,90,91,92,93,94,95,26,96,97,98,99,100],"clarify requirements","clarify","requirements","risk","options","task","prompts","goal","scanning","context","repo","injection","execution","file",{"skillNo":102,"name":103,"nameZh":6,"description":104,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":105,"categories":106,"keywords":108,"publishedAt":44},"01M6DF79CA4BHJS66J8EZDBPWJ","openmm-md","Run FREE, open-source, Windows-native GPU molecular dynamics via the openmm-md MCP (OpenMM + CUDA on the local NVIDIA GPU). Use for protein \u002F protein-ligand MD when you want a free stack or are on Windows without a Schrodinger license. Covers the full workflow (prepare, solvate, minimize, equilibrate, production, analyze, mmgbsa) AND an honest decision guide vs Schrodinger Desmond, including how to run Desmond legitimately on Linux or a cloud GPU with a real license. This is a deliberately LESSER free alternative and does NOT replace the schrodinger MCP tools. Do NOT use it to pick a free tool when a validated FEP+, WaterMap, IFD-MD, or Prime MM-GBSA result is actually required.","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002Ftools\u002Fmcp\u002Fopenmm-md-mcp\u002Fskill\u002Fopenmm-md\u002FSKILL.md",[107],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[109,110,111,112,113,114,115,116,117,118,119,120,121,122,26,123,124,125,126,35],"openmm md","how","decision","pick","linux","analyze","tool","stack","open","NVIDIA","gpu","license","workflow","windows","free","molecular dynamics","local","do",{"skillNo":128,"name":129,"nameZh":6,"description":130,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":131,"categories":132,"keywords":139,"publishedAt":44},"01M6DF76C1MG85VEWP8VZCBNMN","visual-review","Take screenshots of web pages and UI using Playwright for visual review and iteration","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002Ftools\u002Feditor\u002Fmetaswarm\u002Fskills\u002Fvisual-review\u002FSKILL.md",[133,136],{"categoryNo":134,"categoryName":135,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":137,"categoryName":138,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",[140,141,142,143,144,145,146,147,148,149,110,150,151,152,153],"review","visual","visual review","pages","web","false","iteration","take","check","slides","ui","screenshot","playwright","screenshots",{"skillNo":155,"name":156,"nameZh":6,"description":157,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":158,"categories":159,"keywords":160,"publishedAt":44},"01M6DF73AQVCBZKEN0YXEX9FXP","status","Diagnostic status report — shows metaswarm installation state, project setup, and potential issues","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002Ftools\u002Feditor\u002Fmetaswarm\u002Fskills\u002Fstatus\u002FSKILL.md",[],[156,161,162,163,164,165,166,167],"setup","report","project","installation","project setup","issues","state",{"skillNo":169,"name":170,"nameZh":6,"description":171,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":172,"categories":173,"keywords":175,"publishedAt":44},"01M6DF6X6C2XB0P6GX76P7TTYV","start","Use when starting work on any task, when the user mentions metaswarm, or when the user wants to begin tracked development work","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002Ftools\u002Feditor\u002Fmetaswarm\u002Fskills\u002Fstart\u002FSKILL.md",[174],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[170,176,92,177,178,179,26,180,181,182,183],"start issue","issue","ready","work on issue","user","work","work on","development",{"skillNo":185,"name":161,"nameZh":6,"description":186,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":187,"categories":188,"keywords":189,"publishedAt":44},"01M6DF6QMJ9AJKFKHHKRT005PQ","Interactive project setup — detects your project, configures metaswarm, writes project-local files","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002Ftools\u002Feditor\u002Fmetaswarm\u002Fskills\u002Fsetup\u002FSKILL.md",[],[161,163,125,190,165,191],"files","interactive"]