Add scoped Codex configuration target

AGENTS.md

@@ -0,0 +1,33 @@
+# AGENTS.md
+
+## Repository purpose
+
+This is a chezmoi source repository for cross-platform personal configuration.
+The `home/` tree maps to the target home directory; `.tmpl` files use strict Go
+templates with `missingkey=error`.
+
+## Required checks
+
+- Run `make lint` after changing shell scripts.
+- Run `make codex-check` after changing Codex, MCP, hook, or skill-sync files.
+- Run `make test` for broader shell and configuration changes.
+- Preview home-directory effects with `chezmoi diff` before applying them.
+
+## Implementation rules
+
+- Shell uses Bash, `set -euo pipefail`, quoted variables, `[[ ]]`, and `printf`.
+- Chezmoi templates use `.chezmoi.homeDir` for absolute home paths and trim
+  conditional whitespace.
+- Add every referenced template flag to both `chezmoi.toml` and
+  `.chezmoi.toml.tmpl` before using it.
+- Preserve application-owned state. Use merge or idempotent CLI configuration
+  instead of overwriting files that Codex, Claude Code, Zed, or gh also edit.
+- Do not expose secrets in templates, tests, logs, or generated examples.
+
+## Agent host boundaries
+
+- `~/.agents/skills` is the merged skill view shared by Codex, Claude Code, and Raxol.
+- `~/.agents/skills-upstream` and `~/.agents/skills-extra` are source roots, not host-facing inventories.
+- Codex configuration belongs under `~/.codex`; Claude Code configuration belongs under `~/.claude`.
+- Keep MCP enablement flags aligned between the Claude and Codex renderers.
+- Non-managed Codex hooks require explicit user review and trust; never bypass it automatically.

CLAUDE.md

@@ -20,6 +20,8 @@ make doctor               # Health check across tools, config, security
 make perf                 # 5-run shell startup benchmark
 make perf-report          # Bare vs configured startup breakdown
 make test                 # Test suite (zsh syntax, module loading)
+make codex-diff           # Preview only Codex-owned target changes
+make codex-apply          # Apply Codex target from this checkout only
 
 make brew-install         # Install Brewfile packages
 make brew-dump            # Update Brewfile from current system
@@ -66,7 +68,12 @@ Use in templates: `{{- if .rust -}}...{{- end -}}`. Use `{{- -}}` to trim whites
 - `run_onchange_after_brew-bundle.sh.tmpl` -- runs `brew bundle install` when Brewfile hash changes
 - `run_onchange_after_mise-install.sh.tmpl` -- runs `mise install` when mise config changes
 - `run_onchange_after_reload-hammerspoon.sh.tmpl` -- reloads Hammerspoon on config change (macOS)
-- `run_after_sync-skills.sh.tmpl` -- symlinks skills from `~/.agents/skills/` to `~/.claude/skills/` (always runs; script is idempotent)
+- `run_after_sync-skills.sh.tmpl` -- merges upstream and vendored skills into `~/.agents/skills/`, then mirrors that inventory into `~/.claude/skills/`
+- `run_onchange_after_setup-codex.sh.tmpl` -- registers enabled MCP servers through the Codex CLI without replacing app-owned config
+
+For Codex-only rollout, use `make codex-diff` followed by `make codex-apply`.
+These targets bind `--source` to this checkout and select only Codex-owned
+targets; do not use an unscoped `chezmoi apply` for that rollout.
 
 **Files the app also writes (`modify_` scripts)**: a plain managed file is authoritative, so `chezmoi apply` deletes any key the app added at runtime. That is the recurring `MM` in `chezmoi status`. When both chezmoi and an application own parts of a file, use a `modify_` source instead: chezmoi pipes the **current target** to the script on stdin and takes its stdout as the new target, so it can merge rather than overwrite.
 
@@ -183,17 +190,18 @@ Local skills (`ethskills/`, `solidity-auditor/`, `noir/`) provide offline Ethere
 | Standards  | `ethskills.com/standards/SKILL.md` | ERC-8004, EIP-7702, token standards         |
 | Gas        | `ethskills.com/gas/SKILL.md`       | Current costs (mainnet ~$0.002, L2 ~$0.002) |
 
-**Blockscout MCP**: Configured in `~/.mcp.json`. Provides type-safe blockchain data queries (balances, tokens, NFTs, contracts) across multiple chains via Model Context Protocol.
+**Blockscout MCP**: Configured for Claude Code in `~/.mcp.json` and for Codex in `~/.codex/config.toml`. Provides type-safe blockchain data queries across multiple chains.
 
 ## MCP Servers
 
-Managed via `~/.mcp.json` (chezmoi template: `home/dot_mcp.json.tmpl`). Toggle in `chezmoi.toml`, then `chezmoi apply`.
+Claude Code uses `~/.mcp.json` (`home/dot_mcp.json.tmpl`). Codex entries are registered idempotently by `home/run_onchange_after_setup-codex.sh.tmpl`, preserving Codex-owned model and project settings. Toggle either host's inventory through the same flags in `chezmoi.toml`, then run `chezmoi apply`.
 
 | Server       | Flag           | Transport  | Notes                                                                                             |
 | ------------ | -------------- | ---------- | ------------------------------------------------------------------------------------------------- |
 | context7     | always on      | stdio      | Library docs via npx                                                                              |
 | blockscout   | always on      | http       | Blockchain data queries                                                                           |
 | coingecko    | `coingecko`    | http       | Crypto market data                                                                                |
+| scribe       | any agent flag | stdio      | Session insight extractor shared by agent workflows                                               |
 | digest       | `digest`       | stdio      | Multi-platform activity digest                                                                    |
 | recall       | `recall`       | stdio      | Knowledge capture/retrieval (FTS5)                                                                |
 | autoresearch | `autoresearch` | stdio      | Autonomous experiment runner                                                                      |
@@ -222,28 +230,30 @@ Agent MCP servers (coingecko through patchbot) all share the same `<binary> serv
 
 ## Agent Skills
 
-Skills are portable `SKILL.md` files sourced from [DROOdotFOO/agent-skills](https://github.com/DROOdotFOO/agent-skills), pulled via `home/.chezmoiexternal.toml` on `chezmoi apply` (refresh window 168h; force with `--refresh-externals`) to `~/.agents/skills/`. Two hosts load the same files:
+Skills are portable `SKILL.md` files sourced from [DROOdotFOO/agent-skills](https://github.com/DROOdotFOO/agent-skills). Chezmoi unpacks the archive into `~/.agents/skills-upstream/`; `run_after_sync-skills.sh.tmpl` merges it with vendored extras into the host-facing `~/.agents/skills/` view. Three hosts load the same files:
 
 - **Raxol agent (primary host).** `Raxol.Agent.Skills.Store` scans `~/.agents/skills/` and `~/.agents/skills-extra/` for `**/SKILL.md` and holds them as read-only procedural memory, reached by the agent via the `skills_list` / `skill_view` / `skill_manage` tools. Enabled by `config :raxol_agent, skills_provider: Raxol.Agent.Skills.Store` in the raxol repo (`packages/raxol_agent/config/config.exs`); external dirs are set alongside it.
-- **Claude Code (secondary host).** `run_after_sync-skills.sh.tmpl` symlinks `~/.agents/skills/*` and `~/.agents/skills-extra/*` into `~/.claude/skills/*`, where Claude Code auto-injects a skill when its trigger clause matches the conversation.
+- **Codex.** Reads the merged `~/.agents/skills/` view directly and loads `~/.codex/AGENTS.md` plus repository AGENTS.md guidance.
+- **Claude Code.** Receives symlinks to the same merged view under `~/.claude/skills/`.
 
 **Skills roots:**
 
-- `~/.agents/skills/` -- the agent-skills collection (chezmoi external, read-only). To add/port a skill, add it under `skills/` in the [agent-skills](https://github.com/DROOdotFOO/agent-skills) repo, push to `main`, then `chezmoi apply --refresh-externals`.
-- `~/.agents/skills-extra/` -- chezmoi-vendored third-party skills the external does not manage (source: `home/dot_agents/skills-extra/`).
+- `~/.agents/skills/` -- symlink-only merged view consumed by all hosts.
+- `~/.agents/skills-upstream/` -- read-only agent-skills archive external.
+- `~/.agents/skills-extra/` -- chezmoi-vendored third-party source root.
 - `~/.raxol/skills/` -- writable managed root for **agent-authored** skills only (the raxol curation loop writes here). Runtime state, left unmanaged by chezmoi. Human and vendored skills come from the chezmoi-managed externals above, never here.
 
-**Name clashes: `skills-extra/` wins in both hosts.** chezmoi never prunes an archive external, so `~/.agents/skills/` can keep serving a stale copy of a skill that has since moved to `skills-extra/`. Raxol resolves this via `skills_external_dirs: ["~/.agents/skills", "~/.agents/skills-extra"]` -- `Skills.Store` scans in order and later `:ets.insert` calls overwrite earlier ones, so the **last** root wins. `run_after_sync-skills.sh` links the **first** root, so its `SKILL_ROOTS` is ordered `skills-extra` then `skills` to reach the same answer. Changing either without the other silently desyncs the two hosts.
+**Name clashes: `skills-extra/` wins.** The merger rebuilds symlinks in source priority order, so Codex and Claude Code resolve the same file. Raxol's later `skills-extra` scan resolves to that same preferred copy.
 
-One further asymmetry: Raxol globs `**/SKILL.md` (any depth) while the sync script only looks one level down. No skill is nested today, so both index the same set -- but a nested `SKILL.md` would appear in Raxol and not in Claude Code.
+The merger intentionally supports one skill directory level, matching Codex and Claude Code discovery. Do not nest skill entry points.
 
-**Skill accounting** (re-derive with `find -L ~/.agents/skills ~/.agents/skills-extra -name SKILL.md`, don't trust this prose):
+**Skill accounting** (re-derive with `find -L ~/.agents/skills -name SKILL.md`):
 
 | Source                     | Count  | Notes                                                                               |
 | -------------------------- | ------ | ----------------------------------------------------------------------------------- |
-| agent-skills `skills/`     | 59     | upstream also ships one empty placeholder dir with no `SKILL.md`, which never loads |
-| `skills-extra/` (vendored) | 2      | `virtuals-protocol-acp`, `hf-cli` (the latter originally installed by the `hf` CLI) |
-| **loaded by Claude Code**  | **61** | symlinks in `~/.claude/skills/`                                                     |
+| `skills-upstream/`         | 59     | the optional git submodule is absent from source archives                           |
+| `skills-extra/` (vendored) | 2      | `virtuals-protocol-acp`, `hf-cli`                                                    |
+| **merged host inventory**  | **61** | loaded by Codex, Claude Code, and Raxol                                              |
 
 **Code pattern skills** -- language-specific examples and idioms:
 

Makefile

@@ -1,4 +1,4 @@
-.PHONY: help install update diff status backup clean doctor bootstrap sync sync-from-remote backup-full install-optional generate-template setup-age age-retrieve age-status setup-mise mise-status mise-upgrade mise-doctor setup-raycast raycast-export raycast-import raycast-status setup-emacs emacs-grammars emacs-restart emacs-status setup-signoz-mcp signoz-mcp-status signoz-mcp-update lint perf perf-report skills-status
+.PHONY: help install update diff status backup clean doctor bootstrap sync sync-from-remote backup-full install-optional generate-template setup-age age-retrieve age-status setup-mise mise-status mise-upgrade mise-doctor setup-raycast raycast-export raycast-import raycast-status setup-emacs emacs-grammars emacs-restart emacs-status setup-signoz-mcp signoz-mcp-status signoz-mcp-update lint test codex-check codex-diff codex-apply perf perf-report skills-status
 
 # Configuration
 DOTFILES_ROOT := $(shell pwd)
@@ -74,6 +74,15 @@ test: ## Run comprehensive dotfiles test suite
 	@echo "Running Dotfiles Test Suite..."
 	@$(SCRIPTS_DIR)/utils/test-suite.sh
 
+codex-check: ## Validate Codex skills, MCP, instructions, and hooks
+	@$(SCRIPTS_DIR)/utils/test-codex-target.sh
+
+codex-diff: ## Preview only the Codex-owned target files
+	@$(SCRIPTS_DIR)/utils/apply-codex-target.sh --dry-run
+
+codex-apply: ## Apply only Codex skills, instructions, hooks, and MCP servers
+	@$(SCRIPTS_DIR)/utils/apply-codex-target.sh
+
 perf: ## Benchmark shell startup time
 	@$(SCRIPTS_DIR)/utils/performance-monitor.sh measure
 
@@ -221,15 +230,15 @@ brew-update: ## Update Homebrew and all packages
 setup-ci: ## Setup CI/CD tools and pre-commit hooks
 	@$(SCRIPTS_DIR)/setup/setup-ci.sh
 
-# Claude Code skills (source: github.com/DROOdotFOO/agent-skills)
-skills-status: ## Show installed Claude Code skills
-	@echo "Skills (pinned version):"
+# Shared agent skills (source: github.com/DROOdotFOO/agent-skills)
+skills-status: ## Show installed Codex, Claude Code, and Raxol skills
+	@echo "Skills (upstream version):"
 	@grep -o 'v[0-9.]*' home/.chezmoiexternal.toml 2>/dev/null || echo "  (unknown)"
 	@echo ""
-	@echo "Skills (deployed):"
+	@echo "Skills (merged for Codex/Raxol):"
 	@ls -1 ~/.agents/skills/ 2>/dev/null || echo "  (none)"
 	@echo ""
-	@echo "Skills (symlinked):"
+	@echo "Skills (mirrored for Claude Code):"
 	@ls -la ~/.claude/skills/ 2>/dev/null || echo "  (none)"
 
 # Template generation

README.md

@@ -33,7 +33,7 @@ brew install chezmoi && chezmoi init --apply https://github.com/DROOdotFOO/dotfi
 | **System**    | btop, fastfetch, tldr (`help`)                                  |
 | **Windows**   | Hammerspoon + PaperWM (macOS)                                   |
 | **Launcher**  | Raycast (macOS)                                                 |
-| **AI**        | Claude Code (61 skills, 14 MCP servers)                         |
+| **AI**        | Codex, Claude Code, Raxol (61 shared skills, 15 MCP servers)    |
 | **Secrets**   | 1Password (SSH agent + age encryption), AWS CLI, Infisical      |
 | **Network**   | Tailscale with pre-configured hosts                             |
 | **Languages** | Elixir, Rust, Go, Python, Node.js, Lua (via mise)               |
@@ -135,8 +135,11 @@ make dashboard        # Service status overview
 make rotate-keys      # Generate, store in 1Password, sync to hosts
 make sync-keys        # Push public key to Tailscale nodes
 
-# Claude Code
+# Agent hosts
 make skills-status    # Show installed AI coding skills
+make codex-check      # Validate Codex skills, MCP, instructions, and hooks
+make codex-diff       # Preview only Codex-owned target changes
+make codex-apply      # Apply Codex target without reconciling unrelated dotfiles
 ```
 
 ## Secrets
@@ -193,13 +196,8 @@ dotfiles/
 │   │   ├── fastfetch/                  # System info
 │   │   ├── starship/                   # Prompt
 │   │   └── direnv/                     # direnv layouts
-│   ├── dot_agents/skills/              # Claude Code skills (auto-symlinked)
-│   │   ├── claude-api/                # Anthropic SDK reference
-│   │   ├── droo-stack/               # Polyglot patterns (Elixir/TS/Go/Rust/Py/Lua/Noir/Shell)
-│   │   ├── noir/                     # ZK circuits, Aztec contracts/security/e2e testing
-│   │   ├── solidity-auditor/           # Solidity dev + security auditing
-│   │   ├── ethskills/                # Ethereum tooling + EIP/ERC reference
-│   │   └── raxol/                    # Raxol TUI/agent framework
+│   ├── dot_agents/skills-extra/        # Vendored skills merged with upstream
+│   ├── private_dot_codex/              # Codex guidance + hooks
 │   └── private_dot_claude/             # Claude Code config + hooks
 ├── config/
 │   ├── raycast/                        # Raycast settings

home/.chezmoiexternal.toml

@@ -1,14 +1,10 @@
-[".agents/skills"]
+[".agents/skills-upstream"]
     type = "archive"
     url = "https://github.com/DROOdotFOO/agent-skills/archive/main.tar.gz"
+    exact = true
     stripComponents = 2
     include = ["*/skills/**"]
     refreshPeriod = "168h"
-    # NOTE: `include` correctly limits extraction to upstream skills/, but chezmoi
-    # never PRUNES an archive external -- entries written by an earlier refresh
-    # survive after they disappear upstream. Earlier layouts had more top-level
-    # dirs, and with stripComponents = 2 their children landed here (agents/scribe
-    # -> scribe, .github/workflows -> workflows, benchmarks/suites -> suites, ...).
-    # Those leftovers are inert: run_after_sync-skills.sh only links dirs holding a
-    # SKILL.md. If this directory accumulates non-skill entries again, delete them
-    # by hand -- a refresh will not.
+    # Keep this exact source root separate from the host-facing
+    # ~/.agents/skills view. Chezmoi prunes files removed from the archive, then
+    # run_after_sync-skills.sh safely rebuilds the merged symlink inventory.

home/dot_gitconfig.tmpl

@@ -1,9 +1,7 @@
 [user]
     name = {{ .name }}
     email = {{ .email }}
-{{- if .gpg_signing_key }}
-    signingkey = {{ .gpg_signing_key }}
-{{- end }}
+{{ "\t" }}signingkey = key::ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPUSQxidN3mlV514FqrtPyridWtUoa6IxCXHMPdQPF9H
 
 [core]
     editor = zed --wait
@@ -39,9 +37,10 @@
 
 [gpg]
     program = gpg
+{{ "\t" }}format = ssh
 
 [commit]
-    gpgsign = false
+{{ "\t" }}gpgsign = true
 
 [push]
     default = current
@@ -157,3 +156,5 @@
 [credential "https://gist.github.com"]
 	helper ={{ " " }}
 	helper = !{{ .brewPrefix }}/bin/gh auth git-credential
+[gpg "ssh"]
+{{ "\t" }}allowedSignersFile = {{ .chezmoi.homeDir }}/.config/git/allowed_signers

home/dot_mcp.json.tmpl

@@ -20,6 +20,12 @@
       "args": ["serve"]
     }
 {{- end }}
+{{- if or .digest .recall .autoresearch .watchdog .prepper .sentinel .patchbot .regen }},
+    "scribe": {
+      "command": "scribe",
+      "args": ["serve"]
+    }
+{{- end }}
 {{- if .recall }},
     "recall": {
       "command": "recall",

home/dot_zshenv

@@ -1 +1,3 @@
 [[ -f "$HOME/.cargo/env" ]] && . "$HOME/.cargo/env"
+
+export PATH="$PATH:/Users/droo/.foundry/bin"

home/dot_zshrc.tmpl

@@ -30,3 +30,11 @@ if [[ $- == *i* ]] && [[ ${SHLVL:-1} -le 2 ]]; then
         precmd_functions+=(_fastfetch_precmd)
     fi
 fi
+
+# grok
+export PATH=/Users/droo/.grok/bin:$PATH
+export PATH="$HOME/.aztec/current/bin:$HOME/.aztec/current/node_modules/.bin:$HOME/.aztec/bin:$PATH"
+
+export NARGO_HOME="/Users/droo/.nargo"
+
+export PATH="$PATH:$NARGO_HOME/bin"

home/private_dot_claude/CLAUDE.md.tmpl

@@ -119,7 +119,7 @@ Superpowers skills (if installed):
 
 ## Agent Skills
 
-Skills sourced from [DROOdotFOO/agent-skills](https://github.com/DROOdotFOO/agent-skills), installed to `~/.agents/skills/`. The **Raxol agent** is the primary host (`Raxol.Agent.Skills.Store` loads them as procedural memory, reached via the `skills_list`/`skill_view`/`skill_manage` tools); **Claude Code** is the secondary host (symlinked into `~/.claude/skills/`, auto-loaded when a skill's trigger matches):
+Skills sourced from [DROOdotFOO/agent-skills](https://github.com/DROOdotFOO/agent-skills) and merged with vendored extras under `~/.agents/skills/`. **Raxol** reads that shared inventory as procedural memory, **Codex** discovers it directly, and **Claude Code** receives matching symlinks under `~/.claude/skills/`:
 - `claude-api` -- Anthropic SDK reference (Python, TS, Go, Elixir, Rust, Lua, cURL)
 - `droo-stack` -- Polyglot patterns (Elixir, TS, Go, Rust, Python, Lua, Shell, Noir, Chezmoi)
 - `noir` -- ZK circuit design, Aztec contracts, constraint optimization, nargo testing

home/private_dot_codex/AGENTS.md.tmpl

@@ -0,0 +1,8 @@
+# Global Codex working agreements
+
+- Preserve uncommitted user changes and avoid destructive git operations.
+- Ask before adding production dependencies or expanding the requested scope.
+- Prefer `rg` for repository search and existing project commands for verification.
+- Run focused tests after changes, then the relevant broader suite when practical.
+- Never read or print credentials from SSH, cloud, package-manager, or keychain files.
+- Follow the closest repository AGENTS.md when its guidance is more specific.