fix(codex): replace global guidance with an activation pointer

[astandrik]

What does this PR do?

For Codex, this replaces the full managed guidance in global
$CODEX_HOME/AGENTS.md with a small activation pointer. The detailed
instructions remain in the installed codebase-memory skill.

The installer now:

• creates the managed activation pointer on a fresh Codex install;
• replaces a legacy codebase-memory-mcp block with the pointer while preserving
  content outside the managed markers;
• performs this migration before hook preflight, so malformed or ambiguous hook
  config cannot leave the legacy guidance active;
• lists AGENTS.md in instruction_files_planned, while plan and dry-run modes
  remain non-mutating;
• keeps repeated installs idempotent;
• removes the managed pointer on uninstall without changing user-owned content.

Malformed or unsafe managed markers still fail closed. MCP configuration, the
skill, read-only profiles, and lifecycle hooks keep their existing behavior.

Closes #1689.

Verification

Verified on Linux against the exact patch published in
2c4de516b1e7d7f7b20894917f6a321f038ac8a4:

• tracked fail-before: 299 passed, 6 expected pointer-contract failures;
• focused pass-after: 305 passed;
• Docker lint image build and lint passed;
• the full test suite with CBM_SKIP_PERF=1 passed;
• the production build passed;
• the isolated owner-contract lifecycle fixture passed;
• scripts/smoke-local.sh passed;
• make -f Makefile.cbm security passed, including network egress, fuzz 32/32,
  and vendored integrity checks.

Checklist

• Every commit is signed off (git commit -s) as required by the
  DCO and CONTRIBUTING.md.
• The focused, full-suite, build, smoke, and security checks passed.
• The corrected lifecycle has tracked regression coverage.

[github-actions]

Thanks for opening this — it has been seen, and it is queued.

This note is automated, but it is not a brush-off: it exists so you know where your PR stands instead of having to guess from silence.

Current review status: working through a backlog. 0.9.1-rc.1 is out, so the release freeze that held reviews is over — but it left a large queue of open pull requests behind it, and we are reading through them oldest-first. The background is in discussion #1144.

What that means for this PR, concretely:

• It will not be closed for inactivity. No stale bot touches pull requests here.
• It may still sit a while before a human reads it. That is on us, not on you.
• Older PRs are read first, so a recent one is not being skipped — it is behind a queue.

Things that will genuinely speed it up whenever review does happen:

• Keep it rebased on main — the tree is moving quickly right now, and a conflicting branch cannot be reviewed as the diff you intended.
• Get CI green, or say which failures you believe are pre-existing.
• Keep the change to one claim. Bundled features and refactors get split before they get merged, which costs you a round trip.
• Every commit needs a sign-off (git commit -s) — CI enforces DCO.

If this fixes a bug, a reproduction we can run is worth more than a description of the symptom.

Thanks for contributing, and sorry in advance for the wait.

[Copilot]

Pull request overview

This PR updates the Codex installer behavior so it no longer writes Codebase Memory guidance into the global $CODEX_HOME/AGENTS.md, and instead migrates existing installations by removing only the legacy codebase-memory-mcp managed block while preserving all other user-owned bytes.

Changes:

• Stop creating/planning a new Codex global AGENTS.md during install; add conditional legacy cleanup reporting via cleanup_actions_planned.
• Add Codex legacy-instructions cleanup flow (plan/dry-run/mutate) and serialize cleanup actions in the install-plan JSON receipt.
• Extend tests and the smoke test to verify fresh installs don’t create AGENTS.md, while legacy block cleanup is safe, idempotent, and non-mutating in plan/dry-run modes.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
tests/test_cli.c	Adds plan JSON assertions for cleanup actions and new Codex lifecycle coverage (fresh/no-AGENTS + migration + malformed preservation).
src/cli/cli.c	Stops planning/installing Codex instruction file, adds legacy cleanup recording + JSON receipt support for cleanup actions.
scripts/smoke-test.sh	Updates Codex smoke coverage to assert no fresh AGENTS.md and validate plan/dry-run/migration/reinstall/uninstall behavior in an isolated HOME.
README.md	Updates Codex documentation to reflect that install no longer creates global AGENTS.md and describes the migration behavior.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

Codex hook preflight failures currently skip the independent legacy guidance cleanup.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 1
• Review effort level: Balanced

[DeusData]

Thank you for the careful exact-owned cleanup and preservation cases. I checked current main: Codex installation still writes the full managed guidance block to $CODEX_HOME/AGENTS.md, so the duplication and migration premise is grounded.

The proposed zero-guidance end state does not match the project direction already chosen for #1689. We want the global file to retain only a tiny activation pointer, with all detailed behavior owned by the skill. Please revise the fresh-install path to write that pointer, migrate the legacy full block to the pointer while preserving foreign content, and remove only the exact-owned pointer on uninstall. The README, plan and dry-run receipts, and tests should describe that same end state.

I have labeled this as a Codex UX and installer-security item. This is a targeted policy adjustment, not a rejection of the cleanup work. Our review queue is full, so detailed review may take a little time. Thank you for covering malformed, unowned, marker-only, repeat-install, and uninstall behavior.

[Copilot]

🟡 Changes recommended

The implementation directly contradicts linked issue #1689, which explicitly requires eliminating the global Codex instruction write.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 1
• Review effort level: Balanced

[DeusData]

Before you spend any time on those 24 red checks — they are not yours. main is currently broken, and every PR built against it fails the same way. Yours went red the moment it rebuilt, not because of anything in your push.

The failure:

internal/cbm/lsp/type_registry.h:131:10: error: duplicate member 'type_short_buckets'
internal/cbm/lsp/type_registry.h:132:27: error: duplicate member 'type_short_entries'
internal/cbm/lsp/type_registry.h:133:9:  error: duplicate member 'type_short_bucket_count'
internal/cbm/lsp/type_registry.h:293:6:  error: conflicting types for 'cbm_registry_types_by_short_name'

Your PR touches README.md, scripts/smoke-test.sh, src/cli/cli.c and tests/test_cli.c — not that header. Two separate changes landed a type short-name index into the same struct with different iterator types and the same function name, git merged them without a conflict, and the result does not compile. That is our mistake to fix, and we are on it.

Nothing is being asked of you here. Once main is green again the checks will need a re-run against it, and I will take care of that.

Separately: thank you for turning the activation-pointer revision around so quickly after the 24 August note. The revised description reads as exactly the end state that was asked for — pointer on fresh install, legacy block migrated with foreign content preserved, exact-owned removal on uninstall. That review is queued and is not blocked by any of this.

One heads-up for when it does get reviewed, so it is not a surprise: #1781 lands in the same four files and also introduces cleanup_actions_planned. Whichever merges second will need the other's receipt fields kept rather than replaced — the failure above is a live demonstration of why a clean git merge is not evidence that two changes compose.

[DeusData]

main is fixed — #1993 merged as 17786374.

The duplicate members are gone from type_registry.h and the header is back to the state it had before the two short-name indexes collided. So the 24 red checks you inherited should clear on a re-run.

I have deliberately not touched this branch, because you pushed the activation-pointer revision shortly before all this and I would rather not update a branch out from under someone who is mid-change. Rebase or update the branch whenever suits you and CI should give you a real verdict this time.

Thanks for your patience with a red wall that had nothing to do with your work.