Codex template: headroom MCP runs offline (HEADROOM_OFFLINE=1, DO_NOT_TRACK=1)

[seathatflowsinourveins]

Scope

• What this PR changes: adoption/templates/codex.config.template.toml gives the user-scope headroom MCP server HEADROOM_OFFLINE=1 and DO_NOT_TRACK=1, and docs/decisions/2026-09-25-codex-mcp-scope.md gets a dated addendum.
  • headroom-ai 0.37.0 turns its usage beacon on by default (telemetry/beacon.py BEACON_DEFAULT_ON = True).
  • HEADROOM_OFFLINE is its master no-egress switch (offline.py): beacon, update check, usage reporter and model downloads off.
  • DO_NOT_TRACK still disables the beacon if a later release renames that switch.
• This host: Codex user scope was re-registered with codex mcp add … --env HEADROOM_OFFLINE=1 --env DO_NOT_TRACK=1. codex mcp get headroom --json lists both variable names, and the server still serves headroom_compress, headroom_retrieve and headroom_stats (MCPorter ad-hoc stdio). Claude user scope and the token-report service were changed to match by the token-efficiency owner, whose PR covers the recipe and docs.
• Version: headroom stays on 0.37.0. The 0.39.0 qualification found its log summaries lossy, with a misleading omission count.
• Lane: lane:foundation.

SOTA sources

• The installed headroom-ai 0.37.0 package source, headroom/offline.py and headroom/telemetry/beacon.py (upstream https://github.com/headroomlabs-ai/headroom (the repository in manifests/stack.json), PyPI headroom-ai 0.37.0), read by the token-efficiency owner and cross-checked on this host.
• codex mcp add --help (codex-cli 0.155.1) for --env on stdio servers.

Local commands run

validate.yml's offline validate-job steps + evidence_manifest.py --check -> 0 failures
tests.test_render_config tests.test_adoption_docs_consistency tests.test_adoption_contract -> OK (skipped=1)

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[seathatflowsinourveins]

Cross-family review (Codex CLI 0.155.1, gpt-6-astra, model_reasoning_effort=max, read-only sandbox), 2026-09-26. Run by the workstation coordinator against a clean checkout of main after merge. Supported findings get a repair PR (one repair round; residuals recorded).

DEFECTS FOUND

• medium | adoption/templates/codex.config.template.toml:59 | The “model downloads off” claim is false for mcp serve. In 0.37.0, Hugging Face offline settings are applied by proxy startup, but MCP startup skips that initialization. Kompress can still download missing models. | Explicitly set HF_HUB_OFFLINE=1 and TRANSFORMERS_OFFLINE=1; verify compression with an empty cache and blocked network before claiming no egress.

• medium | docs/decisions/2026-09-25-codex-mcp-scope.md:195 | Neither the claimed 0.39.0 qualification failure nor the post-change Codex/Claude registration has retained command output. Existing Headroom receipts exercise 0.37.0 with explicitly supplied environment variables; they establish neither client registration nor the asserted version comparison. This violates the returned-evidence requirements. | Retain sanitized registration readbacks and the 0.39.0 trial’s version, fixture, commands, output and omission comparison, or label those claims unverified.