qualia-framework 6.2.7 → 6.2.9

package/README.md

@@ -1,9 +1,13 @@
-# Qualia Framework v6.2.7
+# Qualia Framework v6.2.9
 
 A harness engineering framework for Claude Code and OpenAI Codex. It installs into `~/.claude/` and/or `~/.codex/` and wraps your AI-assisted development workflow with structured planning, execution, verification, and deployment gates.
 
 It is not an application framework like Rails or Next.js. It doesn't generate code, run servers, or process data. It's an opinionated workflow layer that tells Claude how to plan, build, and verify your projects end-to-end, from "tell me what you want to make" to "here's the handoff doc for your client."
 
+**v6.2.9** — Codex hook noise + status line. Conditional PreToolUse hooks no longer status-message on every Bash call (Codex was printing 8 "Running hook…" lines on every command). Self-filtering added to `pre-deploy-gate.js` and `pre-push.js` so they never trip on unrelated commands (Claude's substring matcher was firing them on for-loop arguments). Installer now writes `[tui] status_line = [...]` to Codex's `config.toml` for the rich native bottom status line.
+
+**v6.2.8** — Codex `/goal` integration + install hardening. Phase-start skills now set the Codex thread goal (with token budget) via `bin/codex-goal.js` and `rules/codex-goal.md`. Installer fixes: agent TOMLs now emit `name = "..."` (Codex 0.133 was rejecting all 9), ERP API key is mirrored from `~/.claude/` → `~/.codex/`, and deprecated skills (`qualia-task`, `qualia-quick`, `qualia-polish-loop`, `qualia-design`, `qualia-prd`) are pruned on upgrade.
+
 **v6.2.7** — Codex runtime compatibility. The installer now writes Codex-native hooks, TOML agents, bin scripts, rules, skills, templates, knowledge, guide, and role config under `~/.codex/`, not just `AGENTS.md`.
 
 **The v5 line (preserved):**

package/bin/codex-goal.js

@@ -0,0 +1,92 @@
+#!/usr/bin/env node
+// codex-goal — suggest a Codex /goal objective + token budget from current
+// .planning/STATE.md + ROADMAP.md state.
+//
+// Output is a single line meant to be pasted into a Codex session, or quoted
+// in an agent prompt that will then issue update_goal itself. The framework
+// does NOT write directly to ~/.codex/goals_1.sqlite — Codex owns the schema
+// and the thread_id; the /goal slash command (and the update_goal tool the
+// model can call) are the stable interfaces.
+//
+// Usage: node bin/codex-goal.js [phase|task|feature|quick]
+//        default scope = phase
+
+const fs = require("fs");
+const path = require("path");
+
+const SCOPE = (process.argv[2] || "phase").toLowerCase();
+
+// Token budgets are calibrated to Codex's per-thread context window and the
+// typical Qualia work-unit size. Phase = full builder loop with verification.
+// Task/feature = single fresh-context spawn. Quick = one-shot inline edit.
+const TOKEN_BUDGETS = {
+  phase: 80000,
+  task: 30000,
+  feature: 30000,
+  quick: 10000,
+};
+
+const PLANNING = path.join(process.cwd(), ".planning");
+const STATE_FILE = path.join(PLANNING, "STATE.md");
+const ROADMAP_FILE = path.join(PLANNING, "ROADMAP.md");
+
+function readSafe(p) {
+  try { return fs.readFileSync(p, "utf8"); } catch { return ""; }
+}
+
+function parseState(content) {
+  if (!content) return null;
+  const phaseMatch = content.match(/^Phase:\s*(\d+)\s+of\s+(\d+)\s*[—-]\s*(.+?)\r?$/m);
+  if (!phaseMatch) return null;
+  return {
+    phase: parseInt(phaseMatch[1], 10),
+    total: parseInt(phaseMatch[2], 10),
+    name: phaseMatch[3].trim(),
+  };
+}
+
+function readPhaseGoal(roadmap, phaseNum) {
+  if (!roadmap) return "";
+  // Match a heading like "## Phase 2 — Name" or "## Phase 2: Name", then
+  // grab the "Goal:" line that follows.
+  const heading = new RegExp(`##\\s*Phase\\s*${phaseNum}\\s*[—:\\-]\\s*[^\\n]+`, "i");
+  const idx = roadmap.search(heading);
+  if (idx === -1) return "";
+  const body = roadmap.slice(idx, idx + 2000);
+  const goalMatch = body.match(/^\s*\*?\*?Goal:?\*?\*?\s*(.+?)$/im);
+  return goalMatch ? goalMatch[1].trim() : "";
+}
+
+function clip(s, max) {
+  return s.length <= max ? s : s.slice(0, max - 1).trimEnd() + "…";
+}
+
+function main() {
+  const budget = TOKEN_BUDGETS[SCOPE];
+  if (budget == null) {
+    process.stderr.write(`unknown scope: ${SCOPE} (use phase|task|feature|quick)\n`);
+    process.exit(2);
+  }
+
+  const state = parseState(readSafe(STATE_FILE));
+  if (!state) {
+    // No .planning/STATE.md — fall back to a generic shape so the helper
+    // still emits something useful for ad-hoc invocations.
+    const objective = `${SCOPE[0].toUpperCase() + SCOPE.slice(1)} in ${path.basename(process.cwd())}`;
+    process.stdout.write(`/goal ${objective}\n`);
+    process.stdout.write(`# token_budget suggestion: ${budget}\n`);
+    return;
+  }
+
+  const phaseGoal = readPhaseGoal(readSafe(ROADMAP_FILE), state.phase);
+  const objectivePrefix = `Phase ${state.phase}/${state.total} — ${state.name}`;
+  const objective = clip(
+    phaseGoal ? `${objectivePrefix}: ${phaseGoal}` : objectivePrefix,
+    280
+  );
+
+  process.stdout.write(`/goal ${objective}\n`);
+  process.stdout.write(`# token_budget suggestion: ${budget}\n`);
+}
+
+main();

package/bin/install.js

@@ -205,19 +205,48 @@ function parseAgentMarkdown(content) {
   return result;
 }
 
-function renderCodexAgentToml(markdown) {
+function renderCodexAgentToml(markdown, filenameFallback) {
   const parsed = parseAgentMarkdown(markdown);
   const body = parsed.body
     .replaceAll("~/.claude/", "~/.codex/")
     .replaceAll("@~/.claude/", "@~/.codex/");
+  const name = (parsed.name || filenameFallback || "").replace(/^qualia-/, "");
   const description = parsed.description || "Qualia Framework specialist agent.";
   return [
+    `name = ${tomlString(name)}`,
     `description = ${tomlString(description)}`,
     `developer_instructions = ${tomlString(body)}`,
     "",
   ].join("\n");
 }
 
+// Skills removed in past versions but still present in older installs.
+// Pruned from BOTH ~/.claude/skills/ and ~/.codex/skills/ on every install run
+// so the active surface matches what the framework currently ships.
+const DEPRECATED_SKILLS = [
+  "qualia-task",         // v5.7.0 — folded into qualia-feature
+  "qualia-quick",        // v5.7.0 — folded into qualia-feature
+  "qualia-polish-loop",  // v5.8.0 — folded into qualia-polish --loop
+  "qualia-design",       // v4 wave 2 — folded into scope-adaptive qualia-polish
+  "qualia-prd",          // v5.8.0 — surface cleanup
+];
+
+function pruneDeprecatedSkills(baseDir) {
+  const skillsDir = path.join(baseDir, "skills");
+  if (!fs.existsSync(skillsDir)) return [];
+  const removed = [];
+  for (const name of DEPRECATED_SKILLS) {
+    const target = path.join(skillsDir, name);
+    try {
+      if (fs.existsSync(target)) {
+        fs.rmSync(target, { recursive: true, force: true });
+        removed.push(name);
+      }
+    } catch {}
+  }
+  return removed;
+}
+
 // Surgically remove orphaned v2.6 install cruft from ~/.claude/ on upgrade.
 // v2.6 installed a separate ~/.claude/qualia-framework/ directory with workflows/,
 // references/, assets/, bin/qualia-tools.js. v3 doesn't use any of that — it was
@@ -474,6 +503,8 @@ async function main() {
     .filter((d) => fs.statSync(path.join(skillsDir, d)).isDirectory());
 
   printSection("Skills");
+  const claudePruned = pruneDeprecatedSkills(CLAUDE_DIR);
+  for (const name of claudePruned) ok(`pruned deprecated: ${name}`);
   for (const skill of skills) {
     try {
       copy(
@@ -783,6 +814,12 @@ async function main() {
     );
     fs.chmodSync(path.join(binDest, "project-snapshot.js"), 0o755);
     ok("project-snapshot.js (ERP/admin project progress snapshot)");
+    copy(
+      path.join(FRAMEWORK_DIR, "bin", "codex-goal.js"),
+      path.join(binDest, "codex-goal.js")
+    );
+    fs.chmodSync(path.join(binDest, "codex-goal.js"), 0o755);
+    ok("codex-goal.js (Codex /goal objective + token-budget suggester)");
   } catch (e) {
     warn(`scripts — ${e.message}`);
   }
@@ -1317,10 +1354,40 @@ async function installCodex(member, target) {
         "hooks = true",
         "plugin_hooks = true",
         "",
+        "# Codex's built-in status line is rendered at the bottom of the TUI.",
+        "# It takes an ARRAY of pre-defined segment names; Codex does NOT support",
+        "# custom-command status lines (unlike Claude's settings.json statusLine),",
+        "# so the Qualia phase/state info is rendered via the SessionStart banner",
+        "# at the top of the session instead. The segment list below mirrors the",
+        "# Codex default rich layout.",
+        "[tui]",
+        'status_line = ["model-with-reasoning", "task-progress", "current-dir", "git-branch", "context-used", "five-hour-limit", "weekly-limit"]',
+        "status_line_use_colors = true",
+        "",
       ].join("\n"));
       ok("config.toml (minimal Codex config)");
     } else {
-      log(`${DIM}config.toml (kept — user has customized)${RESET}`);
+      // Existing user config — append [tui] block only if absent. Leaves
+      // every other user setting untouched.
+      try {
+        const existing = fs.readFileSync(configToml, "utf8");
+        if (!/^\[tui\]/m.test(existing) && !/^status_line\s*=/m.test(existing)) {
+          const append = [
+            "",
+            "# Added by qualia-framework — Codex bottom status line.",
+            "[tui]",
+            'status_line = ["model-with-reasoning", "task-progress", "current-dir", "git-branch", "context-used", "five-hour-limit", "weekly-limit"]',
+            "status_line_use_colors = true",
+            "",
+          ].join("\n");
+          fs.appendFileSync(configToml, append);
+          ok("config.toml (appended [tui] status line block)");
+        } else {
+          log(`${DIM}config.toml (kept — user has customized)${RESET}`);
+        }
+      } catch {
+        log(`${DIM}config.toml (kept — user has customized)${RESET}`);
+      }
     }
   } catch (e) {
     warn(`Codex config.toml — ${e.message}`);
@@ -1347,6 +1414,24 @@ async function installCodex(member, target) {
     warn(`Codex config — ${e.message}`);
   }
 
+  // Mirror the ERP API key from Claude → Codex so erp-retry/report-payload can
+  // post from Codex sessions without a separate provisioning step. The key
+  // resolver at runtime looks in $CODEX_DIR/.erp-api-key only; without this
+  // copy, every Codex ERP write 401s and the queue grows silently.
+  try {
+    const claudeKey = path.join(CLAUDE_DIR, ".erp-api-key");
+    const codexKey = path.join(CODEX_DIR, ".erp-api-key");
+    if (fs.existsSync(claudeKey) && !fs.existsSync(codexKey)) {
+      const key = fs.readFileSync(claudeKey, "utf8");
+      atomicWrite(codexKey, key, 0o600);
+      ok(".erp-api-key (mirrored from ~/.claude/)");
+    } else if (fs.existsSync(codexKey)) {
+      log(`${DIM}.erp-api-key (existing — preserved)${RESET}`);
+    }
+  } catch (e) {
+    warn(`Codex .erp-api-key — ${e.message}`);
+  }
+
   // Scripts
   try {
     const binDest = path.join(CODEX_DIR, "bin");
@@ -1363,6 +1448,7 @@ async function installCodex(member, target) {
       "erp-retry.js",
       "report-payload.js",
       "project-snapshot.js",
+      "codex-goal.js",
     ];
     for (const script of scripts) {
       const src = path.join(FRAMEWORK_DIR, "bin", script);
@@ -1386,7 +1472,7 @@ async function installCodex(member, target) {
       const parsed = parseAgentMarkdown(source);
       const base = parsed.name ? parsed.name.replace(/^qualia-/, "") : path.basename(file, ".md");
       const out = path.join(agentsDest, `${base}.toml`);
-      const toml = renderCodexAgentToml(source);
+      const toml = renderCodexAgentToml(source, base);
       backupIfDifferent(out, toml, `agents/${base}.toml`);
       atomicWrite(out, toml);
     }
@@ -1415,6 +1501,8 @@ async function installCodex(member, target) {
   try {
     const skillsSrc = path.join(FRAMEWORK_DIR, "skills");
     const skillsDest = path.join(CODEX_DIR, "skills");
+    const codexPruned = pruneDeprecatedSkills(CODEX_DIR);
+    for (const name of codexPruned) ok(`pruned deprecated: ${name}`);
     for (const skill of fs.readdirSync(skillsSrc)) {
       const src = path.join(skillsSrc, skill);
       if (!fs.statSync(src).isDirectory()) continue;
@@ -1471,6 +1559,18 @@ async function installCodex(member, target) {
       try { fs.chmodSync(out, 0o755); } catch {}
     }
     const nodeCmd = (hookFile) => `node "${path.join(hooksDest, hookFile)}"`;
+    // Codex's hook schema does NOT include an `if` field — only `command`,
+    // `commandWindows`, `timeout`, `async`, `statusMessage`. Filtering on
+    // tool_input.command happens inside each hook script (they read stdin
+    // JSON and `process.exit(0)` fast when the command doesn't match).
+    //
+    // Codex prints `statusMessage` for every entry in the matched group BEFORE
+    // running the hook. Including statusMessage on conditional hooks produced
+    // 8 lines of "Running PreToolUse hook: Qualia X..." on every Bash call
+    // even when 6 of the 8 immediately exited 0. We only set statusMessage on
+    // hooks that always do real work (auto-update + git-guardrails). The
+    // conditional hooks stay registered (so they still fire when applicable)
+    // but render silently.
     const qualiaHooks = {
       hooks: {
         SessionStart: [
@@ -1482,18 +1582,18 @@ async function installCodex(member, target) {
             hooks: [
               { type: "command", command: nodeCmd("auto-update.js"), timeout: 5, statusMessage: "Qualia update check..." },
               { type: "command", command: nodeCmd("git-guardrails.js"), timeout: 5, statusMessage: "Qualia git safety..." },
-              { type: "command", if: "Bash(git push*)", command: nodeCmd("branch-guard.js"), timeout: 5, statusMessage: "Qualia branch guard..." },
-              { type: "command", if: "Bash(git push*)", command: nodeCmd("pre-push.js"), timeout: 15, statusMessage: "Qualia tracking stamp..." },
-              { type: "command", if: "Bash(vercel --prod*)", command: nodeCmd("pre-deploy-gate.js"), timeout: 180, statusMessage: "Qualia deploy gate..." },
-              { type: "command", if: "Bash(vercel --prod*)|Bash(vercel deploy*)", command: nodeCmd("vercel-account-guard.js"), timeout: 8, statusMessage: "Qualia Vercel account..." },
-              { type: "command", if: "Bash(vercel env*)", command: nodeCmd("env-empty-guard.js"), timeout: 5, statusMessage: "Qualia env guard..." },
-              { type: "command", if: "Bash(supabase*)|Bash(npx supabase*)", command: nodeCmd("supabase-destructive-guard.js"), timeout: 5, statusMessage: "Qualia Supabase guard..." },
+              { type: "command", command: nodeCmd("branch-guard.js"), timeout: 5 },
+              { type: "command", command: nodeCmd("pre-push.js"), timeout: 15 },
+              { type: "command", command: nodeCmd("pre-deploy-gate.js"), timeout: 180 },
+              { type: "command", command: nodeCmd("vercel-account-guard.js"), timeout: 8 },
+              { type: "command", command: nodeCmd("env-empty-guard.js"), timeout: 5 },
+              { type: "command", command: nodeCmd("supabase-destructive-guard.js"), timeout: 5 },
             ],
           },
           {
             matcher: "Edit|Write",
             hooks: [
-              { type: "command", if: "Edit(*migration*)|Write(*migration*)|Edit(*.sql)|Write(*.sql)", command: nodeCmd("migration-guard.js"), timeout: 10, statusMessage: "Qualia migration guard..." },
+              { type: "command", command: nodeCmd("migration-guard.js"), timeout: 10 },
             ],
           },
         ],

package/hooks/pre-deploy-gate.js

@@ -22,6 +22,33 @@ function qualiaHome() {
 
 const QUALIA_HOME = qualiaHome();
 
+// Self-filter on the proposed bash command — only act when the user is
+// actually trying to deploy. Claude Code's `if: "Bash(vercel --prod*)"` does
+// substring matching (not glob), so commands that contain the literal text
+// "vercel --prod" inside a for-loop or grep argument trip the gate. Codex
+// ignores the `if` field entirely. Both runtimes therefore need this hook to
+// inspect tool_input.command itself before doing any work.
+//
+// Direct invocation (no stdin — `node pre-deploy-gate.js`) is treated as
+// "run the gate" so the test suite and manual `qualia-framework verify` flows
+// keep working. Only when stdin contains a parseable tool_input.command that
+// does NOT match a deploy pattern do we exit early.
+(function selfFilter() {
+  if (process.stdin.isTTY) return; // direct invocation — run full gate
+  let command = null; // null = no stdin payload, "" = empty command, "str" = parsed
+  try {
+    const raw = fs.readFileSync(0, "utf8");
+    if (raw) {
+      const payload = JSON.parse(raw);
+      command = (payload && payload.tool_input && payload.tool_input.command) || "";
+    }
+  } catch {}
+  if (command === null) return; // malformed or empty stdin — run full gate
+  if (!/^\s*(npx\s+)?vercel\s+(--prod|deploy\s+--prod)\b/.test(command)) {
+    process.exit(0);
+  }
+})();
+
 function _trace(hookName, result, extra) {
   try {
     const os = require("os");

package/hooks/pre-push.js

@@ -40,6 +40,25 @@ const QUALIA_HOME = qualiaHome();
 const TRACKING = path.join(".planning", "tracking.json");
 const SHELL = process.platform === "win32";
 
+// Self-filter — only stamp on actual `git push`. Claude's `if` matcher does
+// substring matching (so unrelated commands with "git push" as a literal
+// argument trip the hook) and Codex ignores the `if` field entirely. Direct
+// invocation (no stdin) falls through to the legacy behavior so tests and
+// manual runs still stamp tracking.json.
+(function selfFilter() {
+  if (process.stdin.isTTY) return;
+  let command = null;
+  try {
+    const raw = fs.readFileSync(0, "utf8");
+    if (raw) {
+      const payload = JSON.parse(raw);
+      command = (payload && payload.tool_input && payload.tool_input.command) || "";
+    }
+  } catch {}
+  if (command === null) return;
+  if (!/^\s*git\s+push\b/.test(command)) process.exit(0);
+})();
+
 function git(args) {
   return spawnSync("git", args, { encoding: "utf8", timeout: 5000, shell: SHELL });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "qualia-framework",
-  "version": "6.2.7",
+  "version": "6.2.9",
   "description": "Claude Code and Codex workflow framework by Qualia Solutions. Plan, build, verify, ship.",
   "bin": {
     "qualia-framework": "./bin/cli.js"

package/rules/codex-goal.md

@@ -0,0 +1,46 @@
+# Codex /goal integration
+
+When this skill spawns a unit of work on **Codex** (not Claude Code), set the thread goal at the start so Codex's native token-budget + status tracking takes over.
+
+## Runtime detection
+
+You are on Codex when `~/.codex/` exists and `~/.claude/` is absent or stale. The simplest probe:
+
+```bash
+test -f ~/.codex/AGENTS.md && echo codex || echo claude
+```
+
+If the answer is `claude`, **skip this entire rule** — Claude Code has no equivalent surface and emitting `/goal` text would just be noise.
+
+## How to set the goal
+
+1. Run the helper to produce the objective string + suggested token budget:
+
+   ```bash
+   node ~/.codex/bin/codex-goal.js {scope}
+   ```
+
+   `{scope}` is one of: `phase` · `task` · `feature` · `quick`. Use the scope of the current skill.
+
+2. The output is two lines:
+
+   ```
+   /goal {objective text from STATE.md + ROADMAP.md}
+   # token_budget suggestion: {N}
+   ```
+
+3. **If the `update_goal` tool is available** to you (Codex exposes it as a model-callable tool), call it directly with:
+   - `objective` = the text after `/goal ` on line 1
+   - `token_budget` = the integer suggestion on line 2
+
+4. **If `update_goal` is not available**, surface the `/goal` line to the user in your next message and let them paste it. Do not silently skip — the goal-set takes 1 second and is the only way Codex's budget telemetry knows what to track.
+
+## When NOT to set a goal
+
+- The user is on Claude Code (no `/goal` surface).
+- A goal is already active for this thread (Codex rejects `update_goal` when one exists — call `thread/goal/get` first if you're using the tool API directly).
+- The work is open-ended exploration with no clear objective (e.g. `/qualia-idk`, `/qualia-discuss`). Goals are for executing a defined scope.
+
+## Why
+
+Codex's `thread_goals` table tracks `objective`, `token_budget`, `tokens_used`, and a `status` enum (`active | paused | blocked | usage_limited | budget_limited | complete`). Setting the goal lets the user see burn-vs-budget in the TUI without the framework reinventing it. The token-budget number also makes the model self-aware of how much context it has left for the current unit of work.

package/skills/qualia-build/SKILL.md

@@ -24,6 +24,10 @@ Execute phase plan. Each task = fresh subagent. Independent tasks run parallel.
 
 ## Process
 
+### 0. Codex goal (Codex runtime only)
+
+Per `rules/codex-goal.md` — set the thread goal at phase start with scope `phase`.
+
 ### 1. Load Plan
 
 ```bash

package/skills/qualia-feature/SKILL.md

@@ -39,6 +39,10 @@ One command for everything between a typo and a phase. Auto-detects scope from t
 
 ## Process
 
+### 0. Codex goal (Codex runtime only)
+
+Per `rules/codex-goal.md` — set the thread goal with scope matching the auto-detected bucket (`quick` for inline, `feature` for spawn). Do this AFTER Step 2 (auto-detect scope) so the budget matches the actual work shape.
+
 ### 1. Capture description
 
 If invoked without args, ask: **"What do you want to build?"**

package/skills/qualia-plan/SKILL.md

@@ -27,6 +27,10 @@ Spawn planner to break phase into tasks, validate with checker (max 2 revision c
 
 ## Process
 
+### 0. Codex goal (Codex runtime only)
+
+Per `rules/codex-goal.md` — set the thread goal at plan start with scope `phase`. The objective covers both planning and the subsequent build, so a single goal-set at this stage is enough.
+
 ### 1. Determine Phase & Load Context
 
 ```bash

package/tests/bin.test.sh

@@ -1360,7 +1360,7 @@ if [ "$EXIT" -eq 0 ] \
    && [ ! -d "$TMP/.claude" ] \
    && grep -q "Role: OWNER" "$TMP/.codex/AGENTS.md" \
    && ! grep -q "{{ROLE}}" "$TMP/.codex/AGENTS.md" \
-   && grep -q "Qualia deploy gate" "$TMP/.codex/hooks.json" \
+   && grep -q "pre-deploy-gate.js" "$TMP/.codex/hooks.json" \
    && grep -q "developer_instructions" "$TMP/.codex/agents/planner.toml" \
    && ! grep -R "\.claude/bin" "$TMP/.codex/skills" >/dev/null 2>&1; then
   pass "target=2 → Codex runtime files with Role: OWNER, ~/.claude/ skipped"

package/tests/install-smoke.test.sh

@@ -96,7 +96,7 @@ if [ -f "$HOME_DIR/.codex/AGENTS.md" ] \
   && [ -f "$HOME_DIR/.codex/qualia-references/questioning.md" ] \
   && grep -q "Role: OWNER" "$HOME_DIR/.codex/AGENTS.md" \
   && ! grep -q "{{ROLE}}" "$HOME_DIR/.codex/AGENTS.md" \
-  && grep -q "Qualia deploy gate" "$HOME_DIR/.codex/hooks.json" \
+  && grep -q "pre-deploy-gate.js" "$HOME_DIR/.codex/hooks.json" \
   && ! grep -R "\.claude/bin" "$HOME_DIR/.codex/skills" >/dev/null 2>&1; then
   pass "Codex runtime installed with OWNER role"
 else