Codex MCP servers at user scope so every worktree inherits the token tools; --pinned-versions coverage check

[seathatflowsinourveins]

Scope

• What this PR changes: token efficiency now reaches every future Codex session, including workers started in fresh git worktrees, and the coverage check can report pinned versions.
  • Codex MCP servers at user scope (adoption/templates/codex.config.template.toml): serena, socraticode and ai-memory, plus headroom, codebase-memory and qmd, which mirror the Claude user-scope set the token-efficiency owner (session 8c) registered today. The project template (project.codex.config.template.toml) keeps only jcodemunch, per Register jCodeMunch per project instead of at user scope in the new-PC Claude profile #240, and drops the context-mode cwd override.
  • scripts/adoption_status.py --pinned-versions (Token-efficiency coverage check: adoption profile plus value-free --client-wiring for every host #264's stated residual): per profile, it runs only a pin's declared exec version_probe from adoption/pins-<os>-<arch>.json (Bootstraps: declared, bounded version probes instead of --version on every bin entry #251), located on PATH, with stdin from /dev/null and the pin's timeout. It never runs an npm-metadata probe. It reports booleans, counts and version strings. 54 unit tests.
  • Docs: docs/token-efficiency-stack.md coverage-check section, and a dated decision record with overturn conditions, docs/decisions/2026-09-25-codex-mcp-scope.md.
• Base commit: 0074a0c3 (origin/main, after the v2026.09.25.2 re-pin Point new machines at the attested release v2026.09.25.2 #286). Hot file manifests/evidence.json re-registers the five changed tracked files.
• Lane: lane:foundation

Root cause (primary sources)

• Codex loads a project .codex/config.toml only by walking from the project root to the current directory (developers.openai.com/codex, config-advanced). A git worktree is its own project root, and this repo's .codex/ is excluded through .git/info/exclude.
• codex mcp add has no scope flag and always writes CODEX_HOME (codex mcp add --help, codex-cli 0.155.1).
• So workflow and Codex workers in /tmp worktrees got none of the servers.

Applied on the workstation and read back (native, not only templates)

Check, from a fresh detached worktree at origin/main	Before	After
codex mcp list --json	context-mode (plugin) only	ai-memory, codebase-memory, context-mode, headroom, qmd, serena, socraticode
adoption_status.py --profile token-efficiency --client-wiring → client_wiring.complete	false	true
Each stdio server started from that worktree with the template's launcher (MCPorter ad-hoc list --stdio)	—	serena 23 tools, socraticode 26, headroom 3, codebase-memory 17, qmd 4; ai-memory /healthz 200
--pinned-versions	—	matched: codex, claude-code, qmd. Mismatched: rtk, markitdown, ai-memory, mcporter, which the cleanup session moved ahead of its pin-move PRs, so the divergence is intended. Unchecked: context-mode (npm-metadata); repomix, headroom, toon, ccusage, serena and socraticode have no Linux pin entry

On this host the six servers were added with the native codex mcp add, because the host has no adoption/hosts/<host>.json for render_config.py. SocratiCode keeps its pinned, versioned dist/index.js path, because its recipe creates no bin/ link, so a pin move updates the template and the host together.

Repair round (after the independent review)

The read-only review found two bugs in the new version_output_matches, both in code new to this PR and neither reachable by any pin checked in today:

• Crash on a non-numeric minimum floor. A floor such as 2.0.0.dev0 raised and emptied the whole report.
• Unanchored exact match. It was a substring test, so 2.10 matched 12.10.0.

Commit 698958a4 ports the bootstrap's own rules exactly:

• exact is bounded by (^|[^0-9.])…([^0-9.]|$);
• minimum uses a ported version_at_least that returns no-match for a non-numeric part.

It adds regression tests for both, and for six malformed pins-file shapes. The unit suite goes from 54 to 57 tests, all passing. The host coverage result is unchanged (complete: true; the same matched and mismatched sets).

Local commands run

validate.yml's offline validate-job steps, in order (zizmor/actionlint in CI only), plus evidence_manifest.py --check -> 0 failures
verdict_review_gate.py (from a worktree at origin/main) --root . --base origin/main -> no verdict rows changed
python -m unittest (uv Python 3.13 with jsonschema/PyYAML/numpy; PROMOTION_GATE_PYTHON set) -> Ran 5606 tests, OK (skipped=613) before the repair; after it: tests.test_adoption_status Ran 57, OK, and the validate list again, 0 failures

Residuals

• Unchecked components: the seven have no Linux pin entry (context-mode is npm-metadata). Completing adoption/pins-linux-x86_64.json and bootstrap-linux.sh for them is the next PR; it makes new hosts install the whole token-efficiency profile.
• ai-memory scoping in worktrees: workspace and project name resolution for agents in worktrees (.ai-memory.toml is untracked) is unchanged. Agents pass them per call.
• Main checkout config: the main checkout's untracked project config still holds identical definitions, which take precedence there. A re-render reduces it to jcodemunch.
• Codex trust step: Codex hooks after the ai-memory 2.4.0 cutover still await the user's /hooks trust step.
• Review: the Codex cross-family review is skipped (resets 2026-09-30 23:50). The independent review is a separate read-only session.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[seathatflowsinourveins]

Cross-family review (Codex CLI 0.155.1, gpt-6-astra, model_reasoning_effort=max, read-only sandbox), 2026-09-26. Run by the workstation coordinator against a clean checkout of main after merge. Supported findings get a repair PR (one repair round; residuals recorded).

DEFECTS FOUND

• medium | adoption/templates/project.codex.config.template.toml:18 | Removing context-mode’s explicit project binding introduces cross-worktree ambiguity. The pinned Codex plugin declares cwd: "."; its resolver falls back to the newest Codex session. A two-session fixture resolved caller A to worktree B. | Fix: Restore deterministic per-worktree CONTEXT_MODE_PROJECT_DIR binding and verify concurrent sessions before removing the override.

• medium | scripts/adoption_status.py:507 | Probe exit status is ignored. A real subprocess exiting 42 with the expected version in its error message returned checked: true, matches_pin: true. | Fix: Require returncode == 0 before accepting a match; add a regression covering failed probes whose diagnostics contain the pin.

• medium | scripts/adoption_status.py:502 | The timeout kills only the immediate process. A reproduction returned after 0.2 seconds while its child remained running, violating the bounded-probe guarantee. | Fix: Run probes in an isolated process group and clean up descendants on timeout, interruption and completion, matching the bootstrap’s lifecycle handling.

• medium | docs/decisions/2026-09-25-codex-mcp-scope.md:199 | The native_proven classification and PR’s workstation results lack retained execution artifacts. No evidence file contains the claimed client_wiring or --pinned-versions outputs; the narrative omits exact launcher invocations, exit codes and run metadata required by the acceptance policy. | Fix: Retain sanitized commands and actual returned results, or downgrade these claims to unverified host reports.