nitm-ai-dev-toolkit 3.0.22 → 3.0.23

package/CHANGELOG.md

@@ -7,8 +7,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+
+- Bootstrap audit/creation examples are explicitly conditional on confirmed Copilot use; completion reports describe performed harness-specific checks without assuming OpenCode configuration, Codex trust/loading, or Copilot/Cursor readiness. Codex-scoped install documentation now includes linked standards and their wrapper sources without implying other harness activation.
+
 ### Added
 
+- Native Codex support for repo and monorepo templates: shared `AGENTS.md` and `.agents/skills/`, plus optional comment-only `.codex/config.toml` preserving inherited defaults and requiring explicit user trust
+- Codex setup documentation and native bootstrap/patch guidance, including `.nitm/BOOTSTRAP.md` handoff, manual snippet fallback, and native MCP TOML configuration
 - Custom agent templates (`.agent.md`) for subagent orchestration workflows
 - Feature Builder coordinator agent for end-to-end feature development
 - TDD coordinator agent with Red-Green-Refactor cycle
@@ -40,6 +46,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- CLI default-install documentation and package metadata now include Codex; bootstrap uses actual runtime harness evidence or asks rather than inferring use from scaffolded directories
+- Bootstrap skill commands use confirmed harness flags without hardcoded Copilot/Cursor overrides
 - `install` now aborts if target files already exist (instead of silently skipping) and tells the user to pass `--force` to overwrite or run `patch` to add only missing files
 - `patch` is documented as add-missing-only (never overwrites existing customizations) and re-emits the bootstrap handoff
 - `omo-slim-starter install` now delegates to the published `npx nitm-opencode-starter install` (guides the user if unavailable) instead of cloning the repo and wiring scripts

package/README.md

@@ -11,6 +11,7 @@ This repository serves as a **template source** for AI development instructions
 - **GitHub Copilot instructions** (`.github/copilot-instructions.md`)
 - **GitHub prompts** (`.github/prompts/`) for reusable prompt templates
 - **AGENTS.md** files for AI agent context
+- **Native Codex setup** using `AGENTS.md`, `.agents/skills/`, and an optional comment-only `.codex/config.toml`
 - **Skills recommendations** from [skills.sh](https://skills.sh/) for enhanced AI capabilities
 
 ## Repository Structure
@@ -19,6 +20,7 @@ This repository serves as a **template source** for AI development instructions
 /
 ├── src/
 │   ├── repo/           # Templates for single repositories
+│   │   ├── .codex/     # Optional native Codex config (comment-only)
 │   │   ├── .cursor/    # Cursor IDE configuration
 │   │   │   ├── agents/ # Custom agent templates (subagents)
 │   │   │   ├── rules/  # IDE behavior rules
@@ -39,6 +41,7 @@ This repository serves as a **template source** for AI development instructions
 │   │   └── README.md   # Project README template
 │   │
 │   └── monorepo/       # Templates for monorepos
+│       ├── .codex/     # Optional native Codex config (comment-only)
 │       ├── .cursor/    # Root-level Cursor config
 │       │   ├── agents/ # Custom agent templates (subagents)
 │       │   ├── rules/  # IDE behavior rules
@@ -77,6 +80,8 @@ This repository serves as a **template source** for AI development instructions
 cp -r src/repo/.cursor /path/to/your/project/
 cp -r src/repo/.github /path/to/your/project/
 cp -r src/repo/.agents /path/to/your/project/
+cp -r src/repo/.claude /path/to/your/project/ # Shared snippet sources
+cp -r src/repo/.codex /path/to/your/project/  # Optional Codex config
 cp src/repo/AGENTS.md /path/to/your/project/
 ```
 
@@ -88,6 +93,7 @@ Open your project in Cursor IDE or VS Code with GitHub Copilot, then run:
 
 - **Cursor IDE**: Use the `/bootstrap` command
 - **GitHub Copilot**: Use the `bootstrap.prompt.md` prompt (`/bootstrap`)
+- **Codex**: Ask it to read and follow `.claude/prompt-snippets/bootstrap.md` as a task document (manual copies have no `.nitm/BOOTSTRAP.md`). Do not use `/bootstrap` as a native Codex command.
 
 The bootstrap process will:
 
@@ -108,6 +114,8 @@ After bootstrapping, review the generated files and add any project-specific pat
 cp -r src/monorepo/.cursor /path/to/your/project/
 cp -r src/monorepo/.github /path/to/your/project/
 cp -r src/monorepo/.agents /path/to/your/project/
+cp -r src/monorepo/.claude /path/to/your/project/ # Shared snippet sources
+cp -r src/monorepo/.codex /path/to/your/project/  # Optional Codex config
 cp src/monorepo/AGENTS.md /path/to/your/project/
 # Optionally copy app/package templates
 cp -r src/monorepo/apps/app-template /path/to/your/project/apps/
@@ -122,6 +130,7 @@ Open your project in Cursor IDE or VS Code with GitHub Copilot, then run:
 
 - **Cursor IDE**: Use the `/bootstrap` command
 - **GitHub Copilot**: Use the `bootstrap.prompt.md` prompt (`/bootstrap`)
+- **Codex**: Ask it to read and follow `.claude/prompt-snippets/bootstrap.md` as a task document (manual copies have no `.nitm/BOOTSTRAP.md`). Do not use `/bootstrap` as a native Codex command.
 
 The bootstrap process will:
 
@@ -142,7 +151,7 @@ After bootstrapping:
 
 ## CLI (npx)
 
-Scaffold AI agent config into any repo, then hand off to your AI agent to finish setup (replace `{{PLACEHOLDER}}`s, calibrate agent tools). The CLI scaffolds config for **all** supported harnesses (Claude Code, GitHub Copilot, Cursor, OpenCode); the `/bootstrap` command auto-detects your environment at runtime, so you normally don't need `--env`. `install` aborts if files already exist — use `--force` to overwrite, or `patch` to add only missing files.
+Scaffold AI agent config into any repo, then hand off to your AI agent to finish setup (replace `{{PLACEHOLDER}}`s, calibrate native instructions). The CLI scaffolds config for **all** supported harnesses (Claude Code, GitHub Copilot, Cursor, OpenCode, Codex) by default, so you normally don't need `--env`. Scaffolding does not prove a harness is installed or active: bootstrap uses actual runtime information or asks which harnesses you use. `install` aborts if files already exist — use `--force` to overwrite, or `patch` to add only missing files.
 
 ```bash
 # Scaffold AI config into the current repo (auto-detects repo vs monorepo)
@@ -155,6 +164,7 @@ npx nitm-ai-dev-toolkit install --repo
 
 # Optional: scaffold only one harness (e.g. you only use Cursor)
 npx nitm-ai-dev-toolkit install --env cursor
+npx nitm-ai-dev-toolkit install --env codex
 
 # Add only missing files (never overwrites existing ones) + re-emit the bootstrap handoff
 npx nitm-ai-dev-toolkit patch
@@ -169,7 +179,18 @@ npx nitm-ai-dev-toolkit upgrade
 npx nitm-ai-dev-toolkit omo-slim-starter install
 ```
 
-After `install`, run `/bootstrap` from whatever harness you're in — it auto-detects your environment. You can also read `.nitm/BOOTSTRAP.md` and ask your AI agent to run the bootstrap flow. Use `doctor` to verify the result.
+After `install`, ask your AI agent to read and follow `.nitm/BOOTSTRAP.md`. Harnesses that supply a toolkit `/bootstrap` wrapper can also use it; **Codex has no native toolkit `/bootstrap` command**. Use `doctor` to verify the result.
+
+### Native Codex
+
+- `--env codex` includes `.codex/`, `.agents/`, and shared context, plus `.github/instructions/` and `.claude/rules-snippets/` solely to supply the standards linked from `AGENTS.md` and those standards' wrapper source content. It does not install other harness command, agent, or config directories. These reference files neither establish Copilot/Claude use nor load automatically as Codex rules; other harness scopes are unchanged.
+- Codex reads `AGENTS.md` and discovers `.agents/skills/*/SKILL.md` natively. Monorepos can use more-specific nested `AGENTS.md` files for app/package guidance. Linked standards are references to read as needed, not automatically loaded Claude/Copilot rules.
+- The optional `.codex/config.toml` is deliberately comment-only: it preserves the user's inherited defaults. Codex loads project config only after the user explicitly trusts the project; the toolkit does not grant trust or set model/provider, approval, sandbox, security, or feature overrides.
+- For manual copies without `.nitm/`, provide `.claude/prompt-snippets/bootstrap.md` to Codex directly. For incremental AI-guided merges, provide `.claude/prompt-snippets/bootstrap-patch.md` as a task document; the CLI `patch` command only adds missing files.
+- Codex MCP configuration uses native `[mcp_servers.name]` TOML in Codex config, **not `.mcp.json`**. No MCP servers are activated by the Codex template. Configure only user-approved servers using the native docs; do not copy credentials or activate other harness hooks automatically.
+- Existing `.claude/agents/`, `.github/agents/`, and `.opencode/agents/` formats are tool-specific, not Codex custom agents. This toolkit does not translate their frontmatter or permissions into Codex configuration. Use only delegation capabilities actually available in your running harness.
+
+Official Codex docs: [basic configuration](https://learn.chatgpt.com/docs/config-file/config-basic) · [configuration reference](https://learn.chatgpt.com/docs/config-file/config-reference) · [AGENTS.md](https://learn.chatgpt.com/docs/agent-configuration/agents-md) · [skills](https://learn.chatgpt.com/docs/build-skills) · [MCP](https://learn.chatgpt.com/docs/extend/mcp?surface=cli).
 
 ## Placeholder Reference
 

package/bin/cli.js

@@ -13,15 +13,17 @@ const { execSync, spawnSync } = require('child_process');
 const PKG_ROOT = path.join(__dirname, '..');
 const SRC_DIR = path.join(PKG_ROOT, 'src');
 
-// Platform config dirs per harness. `.agents` is Claude-only (universal skills).
+// Platform config dirs per harness. Claude and Codex share `.agents` (universal skills).
 const ENV_DIRS = {
   claude: ['.claude', '.agents'],
+  codex: ['.codex', '.agents', path.join('.github', 'instructions'), path.join('.claude', 'rules-snippets')],
   copilot: ['.github', '.vscode'],
   cursor: ['.cursor'],
   opencode: ['.opencode'],
 };
 const ENV_INFO = {
   claude: { name: 'Claude Code', command: '/bootstrap (Claude Code command in .claude/commands/)' },
+  codex: { name: 'OpenAI Codex', command: 'read and follow .nitm/BOOTSTRAP.md' },
   copilot: { name: 'GitHub Copilot', command: '/bootstrap (Copilot prompt in .github/prompts/bootstrap.prompt.md)' },
   cursor: { name: 'Cursor', command: '/bootstrap (Cursor command in .cursor/commands/)' },
   opencode: { name: 'OpenCode', command: 'the bootstrap command in .opencode/commands/' },
@@ -84,9 +86,12 @@ function templateFiles(type) {
 function scopeFiles(files, env) {
   if (!env || !ENV_DIRS[env]) return files;
   const allowed = new Set([...SHARED_ROOT, ...SHARED_DIRS, ...ENV_DIRS[env]]);
+  const dirs = [...SHARED_DIRS, ...ENV_DIRS[env]].map((dir) => path.normalize(dir));
   return files.filter((rel) => {
-    const top = rel.split(path.sep)[0];
-    return allowed.has(top) || allowed.has(rel);
+    const normalized = path.normalize(rel);
+    const top = normalized.split(path.sep)[0];
+    return allowed.has(top) || allowed.has(normalized)
+      || dirs.some((dir) => normalized.startsWith(dir + path.sep));
   });
 }
 
@@ -137,8 +142,10 @@ function envHeader(type, env) {
       '2. Calibrate each agent\'s tools for your environment (see the Agent Tool & Permission Calibration section).',
       '3. Verify with `npx nitm-ai-dev-toolkit doctor`.',
       '',
-      'The `/bootstrap` command auto-detects your harness (Claude Code, GitHub Copilot, Cursor, or OpenCode),',
-      'so you do not need to specify it — just run `/bootstrap` from whatever environment you are in.',
+      'The default scaffold includes Claude Code, OpenAI Codex, GitHub Copilot, Cursor, and OpenCode.',
+      'Ask your AI agent to read and follow `.nitm/BOOTSTRAP.md`.',
+      'Claude Code, GitHub Copilot, Cursor, and OpenCode also have harness-specific bootstrap commands.',
+      'For OpenAI Codex, use the handoff file directly; no native `/bootstrap` command is provided.',
       '',
       'The full bootstrap procedure follows.',
     ].join('\n');
@@ -147,7 +154,7 @@ function envHeader(type, env) {
   return [
     `# Bootstrap handoff — environment: ${info.name}`,
     '',
-    `Run the bootstrap via: ${info.command}`,
+    `Bootstrap entry point: ${info.command}`,
     '',
       'Then ask your AI agent to run the full bootstrap flow (procedure below). Key steps:',
       '1. Replace all `{{PLACEHOLDER}}` values in the AI instruction files.',
@@ -168,12 +175,15 @@ function handoff(type, cwd, env) {
   fs.writeFileSync(path.join(nitmDir, 'BOOTSTRAP.md'), header + '\n\n' + body);
   if (env && ENV_INFO[env]) {
     info(`Scaffold complete (tailored to ${ENV_INFO[env].name}). Hand off to your AI agent:`);
-    console.log(`    Run ${ENV_INFO[env].command}`);
+    console.log(`    Bootstrap entry point: ${ENV_INFO[env].command}`);
   } else {
     info('Scaffold complete. Hand off to your AI agent to finish setup:');
   }
-  console.log('    1. Run `/bootstrap` from your AI environment (it auto-detects your harness),');
-  console.log('       OR hand `.nitm/BOOTSTRAP.md` to your AI agent to run the full bootstrap flow.');
+  console.log('    1. Ask your AI agent to read and follow `.nitm/BOOTSTRAP.md`.');
+  if (!env || !ENV_INFO[env]) {
+    console.log('       Includes Claude Code, OpenAI Codex, GitHub Copilot, Cursor, and OpenCode.');
+    console.log('       Other harnesses also have bootstrap commands; Codex uses the handoff file directly.');
+  }
   console.log('    2. Run `npx nitm-ai-dev-toolkit doctor' + (env ? ` --env ${env}` : '') + '` to verify the install.');
 }
 
@@ -319,7 +329,7 @@ function usage() {
   console.log(`nitm-ai-dev-toolkit — scaffold AI agent config into any repo, then hand off to your AI agent.
 
 Usage:
-  npx nitm-ai-dev-toolkit install [--monorepo|--repo] [--env <claude|copilot|cursor|opencode>] [--force]
+  npx nitm-ai-dev-toolkit install [--monorepo|--repo] [--env <claude|codex|copilot|cursor|opencode>] [--force]
       Scaffold AI config into the current repo (auto-detects repo vs monorepo),
       tailored to your harness, then hand off to your AI agent to run the bootstrap flow.
       If files already exist, install aborts (use --force to overwrite, or \`patch\` to add missing).
@@ -341,9 +351,11 @@ Usage:
 
 Options:
   --env <env>  Optional. Limit the scaffold to ONE harness:
-               claude | copilot | cursor | opencode
-               Omit to scaffold ALL environments (cross-compatible). The /bootstrap
-               command auto-detects your harness at runtime, so --env is rarely needed.
+               claude | codex | copilot | cursor | opencode
+               Omit to scaffold ALL environments, including OpenAI Codex.
+               Ask your agent to read and follow .nitm/BOOTSTRAP.md.
+               Other harnesses also have bootstrap commands; Codex uses the handoff
+               file directly (no native /bootstrap command is provided).
   --monorepo   Force monorepo template
   --repo       Force single-repo template
   --force      Overwrite existing files

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "nitm-ai-dev-toolkit",
-  "version": "3.0.22",
-  "description": "Scaffold AI agent config (Cursor, GitHub Copilot, Claude Code, OpenCode) into any repo, then hand off to your AI agent to finish setup.",
+  "version": "3.0.23",
+  "description": "Scaffold AI agent config (Cursor, GitHub Copilot, Claude Code, OpenCode, Codex) into any repo, then hand off to your AI agent to finish setup.",
   "bin": {
     "nitm-ai-dev-toolkit": "bin/cli.js"
   },
@@ -22,6 +22,7 @@
     "cursor",
     "copilot",
     "opencode",
+    "codex",
     "bootstrap",
     "subagents"
   ],

package/src/monorepo/.claude/prompt-snippets/bootstrap-patch.md

@@ -17,6 +17,10 @@ You are helping to patch AI instructions in this project by comparing against th
 
 ## Process
 
+**Codex invocation and scope:** `/bootstrap-patch` is not a native Codex command. Ask Codex to read and follow this snippet as a task document. Identify the actual harness from session/runtime evidence or ask; scaffold directories do not prove use. Codex targets root/nested `AGENTS.md`, `.agents/skills/`, and optional `.codex/config.toml`. Include `.github/instructions/` and `.claude/rules-snippets/` solely as AGENTS-linked standards and their wrapper sources for Codex-scoped installs, not automatically loaded rules or evidence of Copilot/Claude use. Only include other harness command, agent, and config categories when those harnesses are confirmed in use.
+
+**Codex merge guardrails:** preserve existing TOML and inherited user defaults. The shipped `.codex/config.toml` is comment-only; parse it as TOML, do not add model/provider, approval, sandbox, security, feature, self-trust, or active MCP settings. Project config is loaded only after explicit user trust. MCP uses native `[mcp_servers.name]` TOML, not `.mcp.json`; do not migrate or activate servers automatically. Claude/Copilot frontmatter and OpenCode permission blocks are not Codex agent definitions; no Codex custom-agent format is shipped here.
+
 1.  **Fetch Latest Templates**:
 
     Clone or fetch the latest ai-assisted-dev-toolkit templates:
@@ -63,6 +67,7 @@ You are helping to patch AI instructions in this project by comparing against th
     | **Claude Agents**          | `.claude/agents/*.agent.md`              | `src/{type}/.claude/agents/*.agent.md`              |
     | **Skills**                 | `.agents/skills/*/SKILL.md`              | `src/{type}/.agents/skills/*/SKILL.md`              |
     | **AGENTS.md**              | `AGENTS.md`                              | `src/{type}/AGENTS.md`                              |
+    | **Codex Config**           | `.codex/config.toml`                     | `src/{type}/.codex/config.toml`                     |
     | **CLAUDE.md**              | `CLAUDE.md`                              | `src/{type}/CLAUDE.md`                              |
     | **Claude Rules Snippets**  | `.claude/rules-snippets/*.md`            | `src/{type}/.claude/rules-snippets/*.md`            |
     | **Claude Prompt Snippets** | `.claude/prompt-snippets/*.md`           | `src/{type}/.claude/prompt-snippets/*.md`           |

package/src/monorepo/.claude/prompt-snippets/bootstrap.md

@@ -2,6 +2,16 @@ You are helping to bootstrap AI instructions for this monorepo by analyzing the
 
 > **Merge, don't clobber.** If a target file already exists and carries project-specific content — customized agents, rules, skills, or `{{PLACEHOLDER}}` values already replaced — preserve it. Add missing structure; never overwrite a customized file with template defaults. When a template change conflicts with an existing customization, merge the addition and flag it for the user rather than replacing the file. For incremental updates after the first bootstrap, prefer `/bootstrap-patch`, which is purpose-built for meticulous merging.
 
+## Harness selection and native Codex targets
+
+**Codex:** `/bootstrap` is not a native Codex command. For npm installs, ask Codex to read and follow `.nitm/BOOTSTRAP.md`. For manually copied templates without `.nitm/`, ask it to read and follow `.claude/prompt-snippets/bootstrap.md` as a task document.
+
+- Identify the actual running harness from session/runtime information or ask which harnesses the user uses. Directory presence alone is not evidence: the default installer scaffolds every supported harness.
+- Codex uses root and more-specific nested `AGENTS.md` instructions and `.agents/skills/*/SKILL.md` natively. Customize app/package instructions for their scopes. Read linked standards when relevant; Claude snippets and `.github/instructions/` are not automatically loaded as Codex rules.
+- `.codex/config.toml` is optional and comment-only. Preserve inherited defaults and existing user settings. Project config is loaded only after the user explicitly trusts the project; never write self-trust or change model/provider, approvals, sandbox, security, or feature settings during bootstrap.
+- Codex MCP uses native `[mcp_servers.name]` TOML, not `.mcp.json`. Treat other harness MCP templates as references only; do not activate servers, copy credentials, or install hooks automatically.
+- Update and audit only confirmed harness targets. For Codex-only setup, the native targets are root/nested `AGENTS.md`, `.agents/skills/`, and `.codex/config.toml`. `--env codex` also includes `.github/instructions/` and `.claude/rules-snippets/` solely as AGENTS-linked standards and their wrapper sources, not automatically loaded rules or evidence of Copilot/Claude use; other harness command, agent, and config directories are excluded. Tool-specific steps below are conditional.
+
 ## Your Task
 
 1. **Analyze the Monorepo**:
@@ -125,6 +135,8 @@ You are helping to bootstrap AI instructions for this monorepo by analyzing the
 
    **Root Level:**
    - `AGENTS.md` (include project management section)
+   - `.agents/skills/*/SKILL.md` (shared native skills, including Codex)
+   - `.codex/config.toml` (optional Codex config; retain comment-only inherited defaults)
    - `.github/copilot-instructions.md` (include PM context)
    - `.github/instructions/*.instructions.md`
    - `.github/prompts/*.prompt.md`
@@ -241,6 +253,8 @@ For multi-app monorepos with different frameworks, list all with app context (e.
 
 The `tools:` block (Claude Code, GitHub Copilot) and `permission:` block (OpenCode) must match each agent's role **and** the detected project. Templates ship with defaults, but calibrate them during bootstrap so every agent can do its job without being over-provisioned.
 
+**Codex native calibration:** customize project instructions and skills, not Claude/Copilot `tools:` frontmatter or OpenCode `permission:` blocks. This toolkit ships no Codex custom-agent format. Use only delegation capabilities actually available in the running harness; do not generate agent files from this table or change native security settings to simulate per-role tool gating.
+
 **1. Capability baseline per role** — what the agent functionally needs:
 
 | Agent                                                                                                  | read | search | write            | edit | terminal/bash               | spawn subagents |
@@ -278,16 +292,16 @@ Present the replacements and confirm before applying.
 
 9. **Detect Installed AI Agents**:
 
-   Before recommending skills, detect which AI agent directories exist in the workspace. Supported agents are located here: https://github.com/vercel-labs/skills?tab=readme-ov-file#available-agents:
+   Before recommending skills, identify the running harness from session/runtime information and confirm additional harnesses with the user. Consult supported installer IDs at https://github.com/vercel-labs/skills?tab=readme-ov-file#available-agents.
 
-   **Note:** `.agents/` directory is used by multiple agents: `amp`, `codex`, `gemini-cli`, `github-copilot`, `opencode`, `replit`. If only `.agents/` exists, default to `codex` or `github-copilot` based on other indicators.
+   **Note:** `.agents/` is shared by multiple agents. Neither it nor scaffolded `.codex/`, `.claude/`, `.cursor/`, or `.github/` directories proves a harness is installed or used. If runtime evidence is unavailable, ask rather than defaulting to an agent.
 
-   **Note:** `.claude/` directory indicates Claude Code is installed. Add `-a claude-code` to agent flags.
+   **Codex:** the skills installer supports agent ID `codex`; confirmed Codex use maps to `-a codex` and native `.agents/skills/`.
 
    **Build the agent flags string:**
-   - For each detected agent, add `-a <agent>` to the command
-   - Example: If `.cursor/`, `.claude/`, and `.github/` exist → use `-a cursor -a claude-code -a github-copilot`
-   - If no agents detected, omit `-a` flags (CLI will prompt)
+   - For each confirmed harness, add `-a <supported-agent-id>` to the command
+   - Example: confirmed Cursor, Claude Code, and Copilot → `-a cursor -a claude-code -a github-copilot`
+   - If no harness is confirmed, ask before installing (or let the CLI prompt); do not infer from scaffold directories
 
 10. **Recommend and Install AI Agent Skills**:
 
@@ -303,11 +317,11 @@ Based on detected ecosystem and frameworks, recommend relevant skills from [skil
 | `trailofbits/skills`       | Security analysis, Semgrep, property-based testing |
 | `softaworks/agent-toolkit` | README writing, clear documentation                |
 
-**Example commands** (replace `<detected-agents>` with the actual flags from step 9, e.g., `-a cursor -a github-copilot`):
+**Example commands** (replace `{{AGENT_FLAGS}}` with confirmed harness flags from step 9, e.g., `-a codex`):
 
 ```bash
-npx -y skills add <detected-agents> obra/superpowers --skill '*' --agent github-copilot cursor
-npx -y skills add <detected-agents> trailofbits/skills --skill '*' --agent github-copilot cursor
+npx -y skills add {{AGENT_FLAGS}} obra/superpowers --skill '*'
+npx -y skills add {{AGENT_FLAGS}} trailofbits/skills --skill '*'
 ```
 
 **Issue Tracker Skills Health Check (if {{ISSUE_TRACKER}} is configured):**
@@ -361,25 +375,25 @@ When recommending framework-specific skills, include the detected agent flags. E
 
 | Language/Framework | Skill Repository                      | Install Command                                                                                          |
 | ------------------ | ------------------------------------- | -------------------------------------------------------------------------------------------------------- |
-| PHP                | `vapvarun/claude-backup` (php)        | `npx -y skills add <detected-agents> vapvarun/claude-backup --skill "php"`                               |
-| Laravel            | `vapvarun/claude-backup` (laravel)    | `npx -y skills add <detected-agents> vapvarun/claude-backup --skill "laravel"`                           |
-| Python             | `siviter-xyz/dot-agent` (python)      | `npx -y skills add <detected-agents> siviter-xyz/dot-agent --skill "python"`                             |
-| Django             | `vintasoftware/django-ai-plugins`     | `npx -y skills add <detected-agents> vintasoftware/django-ai-plugins --skill "django-expert"`            |
-| Next.js            | `sickn33/antigravity-awesome-skills`  | `npx -y skills add <detected-agents> sickn33/antigravity-awesome-skills --skill "nextjs-best-practices"` |
-| React              | `vercel-labs/agent-skills`            | `npx -y skills add <detected-agents> vercel-labs/agent-skills --skill "vercel-react-best-practices"`     |
-| Vue                | `onmax/nuxt-skills` (vue)             | `npx -y skills add <detected-agents> onmax/nuxt-skills --skill "vue"`                                    |
-| Nuxt               | `onmax/nuxt-skills` (nuxt)            | `npx -y skills add <detected-agents> onmax/nuxt-skills --skill "nuxt"`                                   |
-| Expo               | `expo/skills`                         | `npx -y skills add <detected-agents> expo/skills --skill '*' --agent github-copilot cursor`              |
-| TypeScript         | `pproenca/dot-skills` (typescript)    | `npx -y skills add <detected-agents> pproenca/dot-skills --skill '*' --agent github-copilot cursor`      |
-| Advanced Types     | `wshobson/agents` (ts-advanced-types) | `npx -y skills add <detected-agents> wshobson/agents --skill '*' --agent github-copilot cursor`          |
+| PHP                | `vapvarun/claude-backup` (php)        | `npx -y skills add {{AGENT_FLAGS}} vapvarun/claude-backup --skill "php"` |
+| Laravel            | `vapvarun/claude-backup` (laravel)    | `npx -y skills add {{AGENT_FLAGS}} vapvarun/claude-backup --skill "laravel"` |
+| Python             | `siviter-xyz/dot-agent` (python)      | `npx -y skills add {{AGENT_FLAGS}} siviter-xyz/dot-agent --skill "python"` |
+| Django             | `vintasoftware/django-ai-plugins`     | `npx -y skills add {{AGENT_FLAGS}} vintasoftware/django-ai-plugins --skill "django-expert"` |
+| Next.js            | `sickn33/antigravity-awesome-skills`  | `npx -y skills add {{AGENT_FLAGS}} sickn33/antigravity-awesome-skills --skill "nextjs-best-practices"` |
+| React              | `vercel-labs/agent-skills`            | `npx -y skills add {{AGENT_FLAGS}} vercel-labs/agent-skills --skill "vercel-react-best-practices"` |
+| Vue                | `onmax/nuxt-skills` (vue)             | `npx -y skills add {{AGENT_FLAGS}} onmax/nuxt-skills --skill "vue"` |
+| Nuxt               | `onmax/nuxt-skills` (nuxt)            | `npx -y skills add {{AGENT_FLAGS}} onmax/nuxt-skills --skill "nuxt"` |
+| Expo               | `expo/skills`                         | `npx -y skills add {{AGENT_FLAGS}} expo/skills --skill '*'` |
+| TypeScript         | `pproenca/dot-skills` (typescript)    | `npx -y skills add {{AGENT_FLAGS}} pproenca/dot-skills --skill '*'` |
+| Advanced Types     | `wshobson/agents` (ts-advanced-types) | `npx -y skills add {{AGENT_FLAGS}} wshobson/agents --skill '*'` |
 
 **Skill Creation for Unsupported Frameworks:**
 
-Use `npx -y skills add <detected-agents> anthropics/skills --skill '*' --agent github-copilot cursor` (includes `skill-creator`) to create custom skills.
+Use `npx -y skills add {{AGENT_FLAGS}} anthropics/skills --skill '*'` (includes `skill-creator`) to create custom skills.
 
 **Monorepo-Specific Considerations:**
 
-- Install skills at workspace root (`.cursor/skills/{skill-name}/` or `.github/skills/{skill-name}/`)
+- Install skills at workspace root (Codex: `.agents/skills/{skill-name}/`); verify the installer's reported paths for other harnesses
 - Skills are installed by skill name, not org/repo path (e.g., `superpowers/` not `obra/superpowers/`)
 - Consider per-app skills if apps use different frameworks
 - Update root `AGENTS.md` to reference installed skills
@@ -397,9 +411,9 @@ Using flags: {{AGENT_FLAGS}}
 Based on your monorepo ({{BUILD_SYSTEM}}/{{LANGUAGE}}):
 
 Core Skills (recommended for all projects):
-npx -y skills add {{AGENT_FLAGS}} obra/superpowers --skill '*' --agent github-copilot cursor
-npx -y skills add {{AGENT_FLAGS}} trailofbits/skills --skill '*' --agent github-copilot cursor
-npx -y skills add {{AGENT_FLAGS}} softaworks/agent-toolkit --skill '*' --agent github-copilot cursor
+npx -y skills add {{AGENT_FLAGS}} obra/superpowers --skill '*'
+npx -y skills add {{AGENT_FLAGS}} trailofbits/skills --skill '*'
+npx -y skills add {{AGENT_FLAGS}} softaworks/agent-toolkit --skill '*'
 
 Issue Tracker Skills (bundled — {{ISSUE_TRACKER}}):
 ✅ .agents/skills/issue-tracker/SKILL.md (shared strategy)
@@ -407,49 +421,42 @@ Issue Tracker Skills (bundled — {{ISSUE_TRACKER}}):
 ⚠️ Prune any issue-tracker CLI skills that do not match {{ISSUE_TRACKER}} (if any)
 
 Framework-Specific Skills:
-- web (Next.js): npx -y skills add {{AGENT_FLAGS}} vercel-labs/agent-skills --skill '*' --agent github-copilot cursor
-- api (Hono): npx -y skills add {{AGENT_FLAGS}} elysiajs/skills --skill '*' --agent github-copilot cursor
+- web (Next.js): npx -y skills add {{AGENT_FLAGS}} vercel-labs/agent-skills --skill '*'
+- api (Hono): npx -y skills add {{AGENT_FLAGS}} elysiajs/skills --skill '*'
 
 Install All? (Y/n)
 ```
 
 **Example with detected agents:**
 
-- If `.cursor/` and `.github/` exist: `AGENT_FLAGS="-a cursor -a github-copilot"`
-- If only `.cursor/` exists: `AGENT_FLAGS="-a cursor"`
-- Commands become: `npx -y skills add -a cursor -a github-copilot obra/superpowers --skill '*' --agent github-copilot cursor`
+- If Cursor and Copilot are confirmed: `AGENT_FLAGS="-a cursor -a github-copilot"`
+- If only Codex is confirmed: `AGENT_FLAGS="-a codex"`
+- Codex-only command: `npx -y skills add -a codex obra/superpowers --skill '*'`
 
 **On Confirmation:**
 
 - Run skill installation commands at workspace root
-- Skills installed to `.cursor/skills/`
+- Verify the installer's reported paths; Codex uses `.agents/skills/`
 - Update root `AGENTS.md` to reference installed skills
 - Add skill references to relevant app `AGENTS.md` files
 
 10. **Report Completion**:
 
+Populate this example with only files actually changed and skills actually installed. Omit unconfirmed harness targets; for Codex, include native targets and shared reference standards only when changed. This is a change inventory, not proof of runtime loading or trust.
+
 ```
 ✅ Monorepo Bootstrap Complete!
 
 Ecosystem: {{LANGUAGE}} / {{BUILD_SYSTEM}}
 
 Root Files Updated:
-- AGENTS.md
-- .github/copilot-instructions.md
-- .github/instructions/*.instructions.md
-- .cursor/rules/*.mdc
-- .cursor/commands/*.md
-- .claude/rules/*.md (thin wrappers)
-- .claude/commands/*.md (thin wrappers)
-- .claude/agents/*.agent.md (thin wrappers)
-- .claude/rules-snippets/*.md (rules content)
-- .claude/prompt-snippets/*.md (prompt content)
-- .claude/agents-snippets/*.md (agent content)
-- .opencode/opencode.jsonc
-- .opencode/commands/*.md
-- .opencode/rules/*.md
-- .opencode/agents/*.md
-- .toolkit-version
+- AGENTS.md (if changed)
+- .agents/skills/*/SKILL.md (if changed)
+- .codex/config.toml (Codex; if changed)
+- .github/instructions/*.instructions.md (linked standards or confirmed Copilot; if changed)
+- .claude/rules-snippets/*.md (reference sources; if changed)
+- Other confirmed harness files actually changed (list exact paths)
+- .toolkit-version (if changed)
 
 App Files Created/Updated:
 - {{APP_DIR}}/{{APP_1}}/AGENTS.md
@@ -459,9 +466,9 @@ Package/Library Files Updated:
 - {{PACKAGES_DIR}}/{{PACKAGE_1}}/README.md
 
 Installed Skills:
-- obra/superpowers - Development workflow
-- trailofbits/skills - Security & quality
-- {{FRAMEWORK_SKILL}} - Framework patterns
+- obra/superpowers - Development workflow (only if installed)
+- trailofbits/skills - Security & quality (only if installed)
+- {{FRAMEWORK_SKILL}} - Framework patterns (only if installed)
 
 Next Steps:
 1. Review root AGENTS.md for accuracy
@@ -475,7 +482,7 @@ Next Steps:
 9. **Review Installed Skills**:
 
    After completion, audit all installed skills:
-   - Scan `.github/skills/` and `.cursor/skills/` directories
+   - Scan `.agents/skills/` and confirmed harness skill directories, including `.github/skills/` and `.cursor/skills/` if used
    - Compare each skill against detected ecosystems and frameworks
    - Flag skills that don't match any app's tech stack
 
@@ -507,8 +514,12 @@ Next Steps:
 
     Check for required instruction files at root and app levels:
 
+    For Codex, verify root/app/package `AGENTS.md` instructions and `.agents/skills/*/SKILL.md`; parse optional `.codex/config.toml` as TOML and confirm inherited defaults are preserved. The Copilot-specific audit below applies only when Copilot is confirmed in use; do not create Copilot instructions merely to satisfy a Codex audit.
+
+    **Copilot Audit Example (only if Copilot is confirmed in use):**
+
     ```
-    ## 📋 Instruction Files Audit
+    ## 📋 Copilot Instruction Files Audit — confirmed Copilot use only
 
     ### ✅ Found ({{N}} files)
     | File | Purpose | Status |
@@ -523,48 +534,54 @@ Next Steps:
     | fastapi.instructions.md | FastAPI patterns | api app uses FastAPI |
     | testing.instructions.md | Test conventions | Multiple frameworks |
 
-    Create missing instruction files? (Y/n)
+    Create missing Copilot instruction files? (confirmed Copilot use only; Y/n)
     ```
 
-    **On Confirmation:**
-    - Generate instruction files with appropriate templates
+    **On Confirmation (only if Copilot is confirmed in use):**
+    - Generate missing Copilot instruction files with appropriate templates; skip creation for a Codex-only audit even when shared reference standards are present
     - Include app-specific scoping (applyTo paths)
     - Include framework-specific patterns from skills
     - Report created files
 
 11. **Final Verification Report**:
 
+    Report only actual changes and checks for confirmed harnesses. For Codex, distinguish file inspection and TOML validation from runtime instruction/skill discovery, project trust, and config loading. Mark runtime behavior unverified unless directly confirmed; file presence alone proves none of these. Remove inapplicable rows and mark checklist items complete only after performing the check.
+
     ```
-    ## ✅ Bootstrap Complete & Verified!
+    ## Bootstrap Verification Report
 
     ### Summary
     | Category | Count | Status |
     |----------|-------|--------|
-    | Root files updated | {{N}} | ✓ |
-    | App files created | {{N}} | ✓ |
-    | Package files updated | {{N}} | ✓ |
-    | Skills installed | {{N}} | ✓ |
-    | Skills removed | {{N}} | ✓ |
-    | Instructions created | {{N}} | ✓ |
+    | Root files updated | {{N}} | Report actual result |
+    | App files created | {{N}} | Report actual result |
+    | Package files updated | {{N}} | Report actual result |
+    | Skills installed | {{N}} | Report actual result |
+    | Skills removed | {{N}} | Report actual result |
+    | Instructions created | {{N}} | Report actual result |
 
     ### Quality Checks
-    - [x] Placeholders replaced
-    - [x] Skills match tech stack
-    - [x] No duplicate skills
-    - [x] All apps have AGENTS.md
-    - [x] Instructions cover all frameworks
-    - [x] Snippet directories created
-    - [x] Thin wrappers reference correct snippets
-    - [x] .opencode/ directory configured
-    - [x] .toolkit-version file created
-
-    ### Your Monorepo is Ready! 🎉
-
-    GitHub Copilot and Cursor understand:
-    - Monorepo structure
-    - App-specific frameworks
-    - Shared packages
-    - Cross-cutting patterns
+    - [ ] Placeholders replaced (list any remaining)
+    - [ ] Skills match tech stack
+    - [ ] No duplicate skills
+    - [ ] Applicable apps/packages have scoped AGENTS.md
+    - [ ] Instructions cover applicable frameworks
+    - [ ] Required reference snippet sources present and links resolve
+    - [ ] Thin wrappers reference correct snippets (if applicable)
+    - [ ] OpenCode configuration validated (only if OpenCode is confirmed in use)
+    - [ ] .toolkit-version file created or checked
+
+    ### Native Codex Check Example (only if Codex is confirmed in use)
+
+    | Target | Check to report | Result |
+    | ------ | --------------- | ------ |
+    | Root/app/package `AGENTS.md` | Contents, scopes, and linked standards inspected | Actual inspection result |
+    | `.agents/skills/*/SKILL.md` | Skill contents and relevance inspected | Actual inspection result; runtime discovery unverified unless confirmed |
+    | `.codex/config.toml` (if present) | TOML syntax and inherited defaults inspected | Actual validation result; user trust and native loading unverified unless confirmed |
+
+    ### Next Steps for Confirmed Harnesses
+
+    List the confirmed harnesses, checks actually performed, remaining issues, and runtime checks still needed. Do not infer Copilot/Cursor readiness or Codex trust/loading from scaffold files.
 
     Try asking:
     - "Create an endpoint in apps/api using our patterns"

package/src/monorepo/.codex/config.toml

@@ -0,0 +1,6 @@
+# Codex project configuration (optional).
+# Instructions: AGENTS.md; reusable skills: .agents/skills/.
+# Intentionally comment-only: inherit the user's Codex defaults.
+# Codex loads project config only after the user explicitly trusts the project.
+# Configure optional MCP servers in native [mcp_servers.name] TOML, not .mcp.json.
+# Reference: https://learn.chatgpt.com/docs/config-file/config-basic

package/src/monorepo/AGENTS.md

@@ -104,6 +104,14 @@ Each app has its own `AGENTS.md` with detailed patterns:
 
 ## Detailed Instructions
 
+### Native Codex
+
+Codex-scoped installs include `.github/instructions/` and `.claude/rules-snippets/` solely as AGENTS-linked standards and their wrapper sources. Read them as references when relevant, not as automatically loaded Codex rules or evidence of Copilot/Claude use; other harness command, agent, and config directories are excluded from `--env codex`.
+
+Codex uses root and more-specific app/package `AGENTS.md` instructions and `.agents/skills/` natively. Read linked standards when relevant rather than assuming tool-specific rules are auto-loaded. Optional `.codex/config.toml` is comment-only and preserves inherited defaults; project config loads only after explicit user trust. Do not grant self-trust, change security/model/feature defaults, translate Claude frontmatter into Codex agents, or activate MCP servers automatically. Codex MCP uses native `[mcp_servers.name]` TOML, not `.mcp.json`.
+
+For npm setup, read and follow `.nitm/BOOTSTRAP.md`. If manually copied and `.nitm/` is absent, read `.claude/prompt-snippets/bootstrap.md` as a task document; `/bootstrap` is not a native Codex command. Determine the actual harness from runtime information or ask; scaffold directories alone do not establish use. Named custom-agent examples below apply only to harnesses that support their formats; in Codex, use workflow skills and only available native delegation capabilities.
+
 Detailed standards are split into focused instruction files in `.github/instructions/`:
 
 | Instruction File                   | Description                                       |

package/src/monorepo/README.md

@@ -50,6 +50,14 @@ This is a monorepo managed with {{BUILD_SYSTEM}}.
 
 ## Getting Started
 
+### Native Codex
+
+`--env codex` includes `.codex/`, `.agents/`, and shared context, plus `.github/instructions/` and `.claude/rules-snippets/` solely to supply AGENTS-linked standards and their wrapper source content. No other harness command, agent, or config directories are installed; these references do not establish Copilot/Claude use or load automatically as Codex rules. Other harness scopes are unchanged.
+
+Codex reads root/nested `AGENTS.md` instructions and `.agents/skills/` natively. The optional comment-only `.codex/config.toml` preserves inherited defaults and is loaded only after explicit user trust; it does not grant trust or activate MCP servers. Codex MCP uses native `[mcp_servers.name]` TOML, not `.mcp.json`.
+
+For npm setup, ask Codex to read and follow `.nitm/BOOTSTRAP.md`. For manual copies without `.nitm/`, provide `.claude/prompt-snippets/bootstrap.md` as a task document (copy the shared snippets too). For AI-guided updates, provide `.claude/prompt-snippets/bootstrap-patch.md`. Toolkit slash commands and other tools' custom-agent formats are not native Codex commands or agent definitions. Bootstrap must identify the actual running harness or ask, not infer it from scaffolded directories.
+
 ### Prerequisites
 
 - Node.js {{NODE_VERSION}}

package/src/repo/.claude/prompt-snippets/bootstrap-patch.md

@@ -19,6 +19,10 @@ Fetch the latest AI instruction templates from the ai-assisted-dev-toolkit repos
 
 ## Process
 
+**Codex invocation and scope:** `/bootstrap-patch` is not a native Codex command. Ask Codex to read and follow this snippet as a task document. Identify the actual harness from session/runtime evidence or ask; scaffold directories do not prove use. Codex targets `AGENTS.md`, relevant nested instructions, `.agents/skills/`, and optional `.codex/config.toml`. Include `.github/instructions/` and `.claude/rules-snippets/` solely as AGENTS-linked standards and their wrapper sources for Codex-scoped installs, not automatically loaded rules or evidence of Copilot/Claude use. Only include other harness command, agent, and config categories when those harnesses are confirmed in use.
+
+**Codex merge guardrails:** preserve existing TOML and inherited user defaults. The shipped `.codex/config.toml` is comment-only; parse it as TOML, do not add model/provider, approval, sandbox, security, feature, self-trust, or active MCP settings. Project config is loaded only after explicit user trust. MCP uses native `[mcp_servers.name]` TOML, not `.mcp.json`; do not migrate or activate servers automatically. Claude/Copilot frontmatter and OpenCode permission blocks are not Codex agent definitions; no Codex custom-agent format is shipped here.
+
 1.  **Fetch Latest Templates**:
 
     Clone or fetch the latest ai-assisted-dev-toolkit templates:
@@ -65,6 +69,7 @@ Fetch the latest AI instruction templates from the ai-assisted-dev-toolkit repos
     | **Claude Agents**          | `.claude/agents/*.agent.md`              | `src/{type}/.claude/agents/*.agent.md`              |
     | **Skills**                 | `.agents/skills/*/SKILL.md`              | `src/{type}/.agents/skills/*/SKILL.md`              |
     | **AGENTS.md**              | `AGENTS.md`                              | `src/{type}/AGENTS.md`                              |
+    | **Codex Config**           | `.codex/config.toml`                     | `src/{type}/.codex/config.toml`                     |
     | **CLAUDE.md**              | `CLAUDE.md`                              | `src/{type}/CLAUDE.md`                              |
     | **Claude Rules Snippets**  | `.claude/rules-snippets/*.md`            | `src/{type}/.claude/rules-snippets/*.md`            |
     | **Claude Prompt Snippets** | `.claude/prompt-snippets/*.md`           | `src/{type}/.claude/prompt-snippets/*.md`           |

package/src/repo/.claude/prompt-snippets/bootstrap.md

@@ -8,6 +8,17 @@ Analyze the project structure and customize AI instruction templates for this co
 /bootstrap
 ```
 
+**Codex:** `/bootstrap` is not a native Codex command. For npm installs, ask Codex to read and follow `.nitm/BOOTSTRAP.md`. For manually copied templates without `.nitm/`, ask it to read and follow `.claude/prompt-snippets/bootstrap.md` as a task document.
+
+### Harness selection and native Codex targets
+
+- Identify the actual running harness from session/runtime information or ask the user which harnesses they use. Directory presence alone is not evidence: the default installer scaffolds every supported harness.
+- Codex uses `AGENTS.md` (including more-specific nested instructions) and `.agents/skills/*/SKILL.md` natively. Read linked standards when relevant; `.github/instructions/` and Claude snippets are not automatically loaded as Codex rules.
+- `.codex/config.toml` is an optional, comment-only project config. Preserve inherited defaults and existing user settings. Project config is loaded only after the user explicitly trusts the project; never write self-trust or change model/provider, approvals, sandbox, security, or feature settings during bootstrap.
+- Calibrate Codex by customizing project instructions and skills, not by translating Claude/Copilot `tools:` frontmatter or OpenCode `permission:` blocks. This toolkit ships no Codex custom-agent format; use only delegation capabilities actually available in the running harness.
+- Codex MCP uses native `[mcp_servers.name]` TOML, not `.mcp.json`. Treat other harness MCP templates as references only; do not activate servers, copy credentials, or install hooks automatically.
+- Update and audit only confirmed harness targets. For Codex-only setup, `AGENTS.md`, `.agents/skills/`, and `.codex/config.toml` are the native targets. `--env codex` also includes `.github/instructions/` and `.claude/rules-snippets/` solely as AGENTS-linked standards and their wrapper sources, not automatically loaded rules or evidence of Copilot/Claude use; other harness command, agent, and config directories are excluded. The remaining tool-specific examples below are conditional.
+
 ## Process
 
 > **Merge, don't clobber.** If a target file already exists and carries project-specific content — customized agents, rules, skills, or `{{PLACEHOLDER}}` values already replaced — preserve it. Add missing structure; never overwrite a customized file with template defaults. When a template change conflicts with an existing customization, merge the addition and flag it for the user rather than replacing the file. For incremental updates after the first bootstrap, prefer `/bootstrap-patch`, which is purpose-built for meticulous merging.
@@ -197,6 +208,8 @@ Replace placeholders in all template files:
 **Files to Update:**
 
 - `AGENTS.md` - Project context and patterns (include project management section)
+- `.agents/skills/*/SKILL.md` - Shared native skills (including Codex)
+- `.codex/config.toml` - Optional Codex config; retain comment-only inherited defaults
 - `.github/copilot-instructions.md` - Copilot configuration
 - `.github/instructions/*.instructions.md` - Context instructions
 - `.github/prompts/*.prompt.md` - Reusable prompts
@@ -281,7 +294,7 @@ Use the first available method when interacting with the issue tracker:
 
 **If Jira:**
 
-1. **MCP server** (preferred): `mcp_atlassian_atl_*` tools (configured in `.mcp.json`)
+1. **MCP server** (preferred): use the actual runtime tool names (`.mcp.json` for Claude; native `[mcp_servers.name]` TOML for Codex)
 2. **CLI fallback**: [`acli`](https://developer.atlassian.com/cloud/acli/reference/commands/) — `acli jira auth login --web`
 
 **If GitHub Issues:**
@@ -291,7 +304,7 @@ Use the first available method when interacting with the issue tracker:
 
 **If Linear:**
 
-1. **MCP server** (preferred): `mcp_linear_*` tools (configured in `.mcp.json`)
+1. **MCP server** (preferred): use the actual runtime tool names (`.mcp.json` for Claude; native `[mcp_servers.name]` TOML for Codex)
 2. **CLI fallback**: [`linear`](https://github.com/linear/linear-cli) — `linear auth` or set `LINEAR_API_KEY`
 
 See the `issue-tracker` and relevant CLI skills for detailed setup and usage examples.
@@ -407,6 +420,8 @@ Customize agent definition files (`.github/agents/` and `.cursor/agents/`) based
 
 The `tools:` block (Claude Code, GitHub Copilot) and `permission:` block (OpenCode) must match each agent's role **and** the detected project. Templates ship with defaults, but calibrate them during bootstrap so every agent can do its job without being over-provisioned.
 
+**Codex native calibration:** apply the harness-selection guidance above. Do not generate Codex agent files from this table or change native security settings to simulate per-role tool gating.
+
 **1. Capability baseline per role** — what the agent functionally needs:
 
 | Agent | read | search | write | edit | terminal/bash | spawn subagents |
@@ -481,14 +496,15 @@ Apply agent customizations? (Y/n)
 
 ### Step 6: Detect Installed AI Agents
 
-Before recommending skills, detect which AI agent directories exist in the workspace. Supported agents are located here: https://github.com/vercel-labs/skills?tab=readme-ov-file#available-agents:
+Before recommending skills, identify the running harness from session/runtime information and confirm additional harnesses with the user. Consult supported skill installer IDs at https://github.com/vercel-labs/skills?tab=readme-ov-file#available-agents.
 
-**Note:** `.agents/` directory is used by multiple agents: `amp`, `codex`, `gemini-cli`, `github-copilot`, `opencode`, `replit`. If only `.agents/` exists, default to `codex` or `github-copilot` based on other indicators.
+**Note:** `.agents/` is shared by multiple agents. Neither it nor `.codex/`, `.claude/`, `.cursor/`, or `.github/` proves a harness is installed or in use; the toolkit scaffolds all by default. If runtime evidence is unavailable, ask rather than defaulting to an agent.
 
 **Build the agent flags string:**
-- For each detected agent, add `-a <agent>` to the command
-- Example: If `.cursor/` and `.github/` exist → use `-a cursor -a github-copilot`
-- If no agents detected, omit `-a` flags (CLI will prompt)
+- For each confirmed harness, add `-a <supported-agent-id>` to the command
+- Example: confirmed Codex only → `{{AGENT_FLAGS}}` becomes `-a codex` (supported by the skills installer)
+- Example: confirmed Cursor and Copilot → `-a cursor -a github-copilot`
+- If no harness is confirmed, ask before installing (or let the CLI prompt); do not infer from scaffold directories
 
 ### Step 7: AI Agent Skills Recommendation
 
@@ -553,13 +569,13 @@ This template bundles issue tracker skills in `.agents/skills/`. Verify the corr
 | React              | `vercel-labs/agent-skills`            | `npx -y skills add {{AGENT_FLAGS}} vercel-labs/agent-skills --skill "vercel-react-best-practices"`     |
 | Vue                | `onmax/nuxt-skills` (vue)             | `npx -y skills add {{AGENT_FLAGS}} onmax/nuxt-skills --skill "vue"`                                    |
 | Nuxt               | `onmax/nuxt-skills` (nuxt)            | `npx -y skills add {{AGENT_FLAGS}} onmax/nuxt-skills --skill "nuxt"`                                   |
-| Expo               | `expo/skills`                         | `npx -y skills add {{AGENT_FLAGS}} expo/skills --skill '*' --agent github-copilot cursor`                                                        |
-| TypeScript         | `pproenca/dot-skills` (typescript)    | `npx -y skills add {{AGENT_FLAGS}} pproenca/dot-skills --skill '*' --agent github-copilot cursor`                                                |
-| Advanced Types     | `wshobson/agents` (ts-advanced-types) | `npx -y skills add {{AGENT_FLAGS}} wshobson/agents --skill '*' --agent github-copilot cursor`                                                    |
+| Expo               | `expo/skills`                         | `npx -y skills add {{AGENT_FLAGS}} expo/skills --skill '*'` |
+| TypeScript         | `pproenca/dot-skills` (typescript)    | `npx -y skills add {{AGENT_FLAGS}} pproenca/dot-skills --skill '*'` |
+| Advanced Types     | `wshobson/agents` (ts-advanced-types) | `npx -y skills add {{AGENT_FLAGS}} wshobson/agents --skill '*'` |
 
 **Skill Creation for Unsupported Frameworks:**
 
-Use `npx -y skills add {{AGENT_FLAGS}} anthropics/skills --skill '*' --agent github-copilot cursor` (includes `skill-creator`) to create custom skills.
+Use `npx -y skills add {{AGENT_FLAGS}} anthropics/skills --skill '*'` (includes `skill-creator`) to create custom skills.
 
 **Present Recommendation:**
 
@@ -574,9 +590,9 @@ Based on your project ({{FRAMEWORK}}/{{LANGUAGE}}):
 ### Core Skills (recommended for all projects)
 
 ```bash
-npx -y skills add {{AGENT_FLAGS}} obra/superpowers --skill '*' --agent github-copilot cursor
-npx -y skills add {{AGENT_FLAGS}} trailofbits/skills --skill '*' --agent github-copilot cursor
-npx -y skills add {{AGENT_FLAGS}} softaworks/agent-toolkit --skill '*' --agent github-copilot cursor
+npx -y skills add {{AGENT_FLAGS}} obra/superpowers --skill '*'
+npx -y skills add {{AGENT_FLAGS}} trailofbits/skills --skill '*'
+npx -y skills add {{AGENT_FLAGS}} softaworks/agent-toolkit --skill '*'
 `````
 
 ### Issue Tracker Skills (bundled — {{ISSUE_TRACKER}})
@@ -592,7 +608,7 @@ npx -y skills add {{AGENT_FLAGS}} softaworks/agent-toolkit --skill '*' --agent g
 ### Framework-Specific Skills
 
 ```bash
-npx -y skills add {{FRAMEWORK_SKILL_REPO}} --skill '*' --agent github-copilot cursor
+npx -y skills add {{AGENT_FLAGS}} {{FRAMEWORK_SKILL_REPO}} --skill '*'
 ```
 
 ### Install All?
@@ -604,11 +620,13 @@ Would you like to install these skills now? (Y/n)
 **On Confirmation:**
 
 - Run skill installation commands
-- Skills installed to `.github/skills/{skill-name}/` (by skill name, not org/repo)
+- Verify the installer's reported paths; Codex uses `.agents/skills/{skill-name}/` (by skill name, not org/repo)
 - Update `AGENTS.md` to reference installed skills
 
 ### Step 7: Completion Report
 
+Populate this example with only files actually changed and skills actually installed. Omit unconfirmed harness targets; for Codex, include native targets and shared reference standards only when changed. This is a change inventory, not proof of runtime loading or trust.
+
 ```markdown
 ## ✅ Bootstrap Complete!
 
@@ -623,27 +641,19 @@ Would you like to install these skills now? (Y/n)
 
 ### Updated Files
 
-- [x] AGENTS.md (with {{LANGUAGE}} patterns)
-- [x] .github/copilot-instructions.md
-- [x] .github/instructions/\*.instructions.md
-- [x] .cursor/rules/\*.mdc
-- [x] .cursor/commands/\*.md
-- [x] .github/prompts/\*.prompt.md
-- [x] .claude/rules/\*.md (thin wrappers)
-- [x] .claude/rules-snippets/\*.md (rules content)
-- [x] .claude/prompt-snippets/\*.md (prompt content)
-- [x] .claude/agents-snippets/\*.md (agent content)
-- [x] .opencode/opencode.jsonc
-- [x] .opencode/commands/\*.md
-- [x] .opencode/rules/\*.md
-- [x] .opencode/agents/\*.md
-- [x] .toolkit-version
+- AGENTS.md (with {{LANGUAGE}} patterns; if changed)
+- .agents/skills/\*/SKILL.md (if changed)
+- .codex/config.toml (Codex; if changed)
+- .github/instructions/\*.instructions.md (linked standards or confirmed Copilot; if changed)
+- .claude/rules-snippets/\*.md (reference sources; if changed)
+- Other confirmed harness files actually changed (list exact paths)
+- .toolkit-version (if changed)
 
 ### Installed Skills
 
-- [x] obra/superpowers - Development workflow
-- [x] trailofbits/skills - Security & quality
-- [x] {{FRAMEWORK_SKILL}} - Framework patterns
+- obra/superpowers - Development workflow (only if installed)
+- trailofbits/skills - Security & quality (only if installed)
+- {{FRAMEWORK_SKILL}} - Framework patterns (only if installed)
 
 ### Next Steps
 
@@ -662,7 +672,7 @@ After bootstrap completion, review all installed skills for relevance:
 **Skill Audit Process:**
 
 1. **Inventory Installed Skills**
-   - Scan `.github/skills/` and `.cursor/skills/` directories
+   - Scan `.agents/skills/` and confirmed harness skill directories, including `.github/skills/` and `.cursor/skills/` if used
    - List all installed skill names and descriptions
    - Check each skill's SKILL.md for its purpose
 
@@ -743,7 +753,9 @@ Kept {{N}} relevant skills:
 
 Verify that all necessary instruction files exist and are properly configured:
 
-**Required Instruction Files:**
+For Codex, verify `AGENTS.md`, relevant nested `AGENTS.md` files, and `.agents/skills/*/SKILL.md`; parse `.codex/config.toml` as TOML and confirm it retains inherited defaults. The Copilot-specific audit below applies only when Copilot is confirmed in use; do not create Copilot instructions merely to satisfy a Codex audit.
+
+**Required Copilot Instruction Files (only if Copilot is confirmed in use):**
 
 | File                          | Purpose                         | Location                |
 | ----------------------------- | ------------------------------- | ----------------------- |
@@ -754,10 +766,10 @@ Verify that all necessary instruction files exist and are properly configured:
 | `testing.instructions.md`     | Testing conventions             | `.github/instructions/` |
 | `api.instructions.md`         | API conventions (if applicable) | `.github/instructions/` |
 
-**Detection & Validation:**
+**Copilot Detection & Validation Example (only if confirmed in use):**
 
 ```markdown
-## 📋 Instruction Files Audit
+## 📋 Copilot Instruction Files Audit — confirmed Copilot use only
 
 ### ✅ Found ({{N}} files)
 
@@ -783,18 +795,18 @@ Verify that all necessary instruction files exist and are properly configured:
 | `.claude/prompt-snippets/` | Prompt content (source of truth)    | ✓      |
 | `.claude/agents-snippets/` | Agent definitions (source of truth) | ✓      |
 
-### 📝 Create Missing Instruction Files?
+### 📝 Create Missing Copilot Instruction Files? (confirmed Copilot use only)
 
 These files would help AI understand your project's conventions.
 
 Create recommended instructions? (Y/n)
 ```
 
-**On Confirmation:**
+**On Confirmation (only if Copilot is confirmed in use):**
 
-Generate missing instruction files with appropriate templates:
+Generate missing Copilot instruction files with appropriate templates; skip creation for a Codex-only audit even when shared reference standards are present:
 
-**Example: Framework Instruction Template**
+**Copilot Example: Framework Instruction Template (only if confirmed in use)**
 
 ```markdown
 ---
@@ -848,7 +860,7 @@ Key packages:
 - [Project README](README.md)
 ```
 
-**Example: Testing Instruction Template**
+**Copilot Example: Testing Instruction Template (only if confirmed in use)**
 
 ```markdown
 ---
@@ -899,10 +911,10 @@ Available test utilities:
 - {{TESTING_ANTIPATTERN_2}}
 ```
 
-**Post-Creation Report:**
+**Copilot Post-Creation Report Example (only if confirmed in use and files were created):**
 
 ```markdown
-## ✅ Instruction Files Created
+## ✅ Copilot Instruction Files Created — confirmed Copilot use only
 
 Created {{N}} new instruction files:
 
@@ -922,18 +934,20 @@ All instruction files are automatically loaded by GitHub Copilot when editing ma
 
 ### Step 10: Final Verification
 
+Report only actual changes and checks for confirmed harnesses. For Codex, distinguish file inspection and TOML validation from runtime instruction/skill discovery, project trust, and config loading. Mark runtime behavior unverified unless directly confirmed; file presence alone proves none of these. Remove inapplicable rows and mark checklist items complete only after performing the check.
+
 ```markdown
-## ✅ Bootstrap Complete & Verified!
+## Bootstrap Verification Report
 
 ### Summary
 
 | Category                  | Count | Status |
 | ------------------------- | ----- | ------ |
-| Files updated             | {{N}} | ✓      |
-| Skills installed          | {{N}} | ✓      |
-| Skills removed            | {{N}} | ✓      |
-| Instruction files created | {{N}} | ✓      |
-| Project management        | 1     | ✓      |
+| Files updated             | {{N}} | Report actual result |
+| Skills installed          | {{N}} | Report actual result |
+| Skills removed            | {{N}} | Report actual result |
+| Instruction files created | {{N}} | Report actual result |
+| Project management        | 1     | Report actual result or not configured |
 
 ### Project Management Configuration
 
@@ -941,7 +955,7 @@ All instruction files are automatically loaded by GitHub Copilot when editing ma
 **URL:** {{PM_URL}} _(if applicable)_
 **Project Key:** {{PROJECT_KEY}} _(if applicable)_
 **Issue Format:** `{{PM_ISSUE_KEY}}`
-**Location:** Root AGENTS.md and copilot-instructions.md
+**Location:** Root AGENTS.md; include copilot-instructions.md only if Copilot is confirmed and the file was updated
 
 ### Skill Inventory
 
@@ -953,7 +967,7 @@ All instruction files are automatically loaded by GitHub Copilot when editing ma
 
 ### Instruction Files
 
-**Active Instructions ({{N}}):**
+**Inspected Instructions ({{N}}; report runtime loading separately):**
 
 - {{INSTRUCTION_1}}
 - {{INSTRUCTION_2}}
@@ -961,25 +975,28 @@ All instruction files are automatically loaded by GitHub Copilot when editing ma
 
 ### Quality Checks
 
-- [x] All placeholders replaced
-- [x] Framework patterns match detected stack
-- [x] No duplicate skills
-- [x] AGENTS.md configured
-- [x] Instruction files cover all frameworks
-- [x] Skills align with tech stack
-- [x] Snippet directories created
-- [x] Thin wrappers reference correct snippets
-- [x] .opencode/ directory configured
-- [x] .toolkit-version file created
-
-### Your Project is Ready! 🎉
-
-GitHub Copilot and Cursor will now understand:
-
-- Your project structure
-- Framework-specific patterns
-- Custom conventions
-- Testing strategies
+- [ ] All placeholders replaced (list any remaining)
+- [ ] Framework patterns match detected stack
+- [ ] No duplicate skills
+- [ ] AGENTS.md configured
+- [ ] Instruction files cover applicable frameworks
+- [ ] Skills align with tech stack
+- [ ] Required reference snippet sources present and links resolve
+- [ ] Thin wrappers reference correct snippets (if applicable)
+- [ ] OpenCode configuration validated (only if OpenCode is confirmed in use)
+- [ ] .toolkit-version file created or checked
+
+### Native Codex Check Example (only if Codex is confirmed in use)
+
+| Target | Check to report | Result |
+| ------ | --------------- | ------ |
+| `AGENTS.md` and relevant nested files | Contents and linked standards inspected | Actual inspection result |
+| `.agents/skills/*/SKILL.md` | Skill contents and relevance inspected | Actual inspection result; runtime discovery unverified unless confirmed |
+| `.codex/config.toml` (if present) | TOML syntax and inherited defaults inspected | Actual validation result; user trust and native loading unverified unless confirmed |
+
+### Next Steps for Confirmed Harnesses
+
+List the confirmed harnesses, checks actually performed, remaining issues, and runtime checks still needed. Do not infer Copilot/Cursor readiness or Codex trust/loading from scaffold files.
 
 Try asking:
 

package/src/repo/.codex/config.toml

@@ -0,0 +1,6 @@
+# Codex project configuration (optional).
+# Instructions: AGENTS.md; reusable skills: .agents/skills/.
+# Intentionally comment-only: inherit the user's Codex defaults.
+# Codex loads project config only after the user explicitly trusts the project.
+# Configure optional MCP servers in native [mcp_servers.name] TOML, not .mcp.json.
+# Reference: https://learn.chatgpt.com/docs/config-file/config-basic

package/src/repo/AGENTS.md

@@ -79,6 +79,14 @@ When stopping to ask a question, do not just post an open-ended block of text. F
 
 ## Detailed Instructions
 
+### Native Codex
+
+Codex-scoped installs include `.github/instructions/` and `.claude/rules-snippets/` solely as AGENTS-linked standards and their wrapper sources. Read them as references when relevant, not as automatically loaded Codex rules or evidence of Copilot/Claude use; other harness command, agent, and config directories are excluded from `--env codex`.
+
+Codex uses this `AGENTS.md` and `.agents/skills/` natively; more-specific nested `AGENTS.md` files provide scoped guidance. Read linked standards when relevant rather than assuming tool-specific rules are auto-loaded. Optional `.codex/config.toml` is comment-only and preserves inherited defaults; project config loads only after explicit user trust. Do not grant self-trust, change security/model/feature defaults, translate Claude frontmatter into Codex agents, or activate MCP servers automatically. Codex MCP uses native `[mcp_servers.name]` TOML, not `.mcp.json`.
+
+For npm setup, read and follow `.nitm/BOOTSTRAP.md`. If manually copied and `.nitm/` is absent, read `.claude/prompt-snippets/bootstrap.md` as a task document; `/bootstrap` is not a native Codex command. Determine the actual harness from runtime information or ask; scaffold directories alone do not establish use. Named custom-agent examples below apply only to harnesses that support their formats; in Codex, use workflow skills and only available native delegation capabilities.
+
 Detailed standards are split into focused instruction files in `.github/instructions/`:
 
 | Instruction File                   | Description                                     |

package/src/repo/README.md

@@ -110,6 +110,14 @@ See the following files for AI-assisted development:
 
 ## AI Instructions and Commands
 
+### Native Codex
+
+`--env codex` includes `.codex/`, `.agents/`, and shared context, plus `.github/instructions/` and `.claude/rules-snippets/` solely to supply AGENTS-linked standards and their wrapper source content. No other harness command, agent, or config directories are installed; these references do not establish Copilot/Claude use or load automatically as Codex rules. Other harness scopes are unchanged.
+
+Codex reads `AGENTS.md` and `.agents/skills/` natively. The optional comment-only `.codex/config.toml` preserves inherited defaults and is loaded only after explicit user trust; it does not grant trust or activate MCP servers. Codex MCP uses native `[mcp_servers.name]` TOML, not `.mcp.json`.
+
+For npm setup, ask Codex to read and follow `.nitm/BOOTSTRAP.md`. For manual copies without `.nitm/`, provide `.claude/prompt-snippets/bootstrap.md` as a task document (copy the shared snippets too). For AI-guided updates, provide `.claude/prompt-snippets/bootstrap-patch.md`. The slash commands below and tool-specific custom-agent formats are not native Codex commands or agent definitions. Bootstrap must identify the actual running harness or ask, not infer it from scaffolded directories.
+
 This repository includes AI instruction files to standardize development workflows across tools. The `.cursor/` and `.github/` folders define how AI assistants should analyze, plan, implement, and review changes.
 
 ### Planning