Make .codex/CODEX.md resident-neutral for multiple Codex peers

Context

A second Codex resident is now concrete through #15041. Before Emmy boots, the shared Codex prompt substrate must stop presenting Euclid-specific identity as universal harness truth.

Current-turn V-B-A established the load path:

• .codex/hooks.json registers .codex/hooks/codex-context.mjs for every trusted repo-root UserPromptSubmit.
• readCodexContext() reads the complete .codex/CODEX.md, and the hook writes that text to stdout as developer context.
• The file is currently 3,533 bytes and appeared verbatim in this Codex turn.
• .codex/CODEX.md is therefore not inert documentation and not fallback project discovery; it is deterministic per-turn prompt substrate.

The live latest-20-open issue sweep and targeted all-state GitHub searches were checked at 2026-07-11T21:18Z. No exact duplicate exists. #10715 owns the hook-loaded Codex-only route, #13241 introduced the single-resident worktree wording, and #13243 already owns executable fail-closed GitHub identity verification. The current A2A all-state sweep found Vega's direct substrate flag but no overlapping [lane-claim] or [lane-intent].

The Problem

The injected file hard-codes one resident into a shared multi-instance surface:

• GitHub username: neo-gpt
• a static A2A peer roster
• Expected Codex identity: neo-gpt
• Euclid's absolute clone root
• NEO_AGENT_IDENTITY=@neo-gpt and an equality check against neo-gpt

That content was valid only under the former one-Codex-resident assumption. In Emmy's checkout it would inject the wrong identity on every prompt, while the static peer roster already drifts whenever the institution changes.

The file also reloads policy and setup prose already owned by AGENTS.md, .codex/rules/, .codex/config.template.toml, or the on-demand .codex/HARNESS_RESTART.md. This spends turn budget without adding a distinct Codex action.

The Architectural Reality

• Resident identity is runtime-bound by NEO_AGENT_IDENTITY and mapped through canonical identityRoots; it is not owned by shared prompt prose.
• ai/graph/assertExpectedIdentity.mjs already compares the runtime-bound expected identity with the live gh api user --jq .login result. GitHub Workflow health and write boundaries consume that fail-closed contract.
• Each Codex resident has an isolated CODEX_HOME, checkout, local config, and NEO_AGENT_IDENTITY; the tracked repository file is shared.
• .codex/CODEX.md remains the right Codex-only home for a tiny set of harness-specific, turn-actionable diagnostics. Deleting it entirely would discard real sandbox-retry and restart-recovery guidance.
• The hook route itself is correct. The defect is the content and the absence of a resident-neutral regression contract.

The Fix

Keep the hook and replace .codex/CODEX.md with a compact, resident-neutral Codex guard card:

1. Remove every concrete maintainer handle, social name, model designation, static peer roster, and operator-specific absolute path.
2. State that the active resident comes from NEO_AGENT_IDENTITY; GitHub identity verification is enforced by the existing canonical identity mapping and write guard, not by a hard-coded prose comparison.
3. Express worktree safety relative to the active identity-mapped checkout, never one resident's filesystem root.
4. Retain only Codex-specific, turn-actionable facts not already loaded or mechanically enforced: sandbox false-negative/retry behavior, exact-payload preservation for retried writes, the restart-card pointer, and a compact execpolicy-location pointer.
5. Add a focused regression contract around the actual emitted context.

This is a replacement/net-reduction of turn-loaded substrate, not substrate accretion.

Contract Ledger

Decision Record impact

No ADR amendment is needed. This is a narrow correction to #10715's harness-scoped context route under the now-real multi-resident topology from #15041. It reuses #13243's identity authority instead of adding a parallel identity contract.

Acceptance Criteria

• .codex/CODEX.md is at most 1,536 bytes and remains emitted by readCodexContext().
• The emitted content contains no concrete Neo maintainer handle, social name, model designation, static peer roster, or /Users/... path.
• The guard card names NEO_AGENT_IDENTITY as the runtime resident selector and points identity enforcement to the existing canonical/fail-closed guard rather than encoding a literal login.
• Useful Codex-only guidance remains: GitHub sandbox false-negative handling, exact-payload preservation on escalated retries, identity-mapped checkout discipline, restart-card pointer, and execpolicy pointer.
• test/playwright/unit/hooks/codexContextHook.spec.mjs asserts the resident-neutral content boundary against the actual readCodexContext() output.
• A focused test plus a direct hook-output probe pass; the PR reports the before/after loaded-byte delta.
• No hook routing, Fleet launch, identity-root schema, roster, or GitHub write-guard behavior is reimplemented in this lane.

Out of Scope

• Registering Emmy or changing any identity root; #15041 owns that.
• Fleet launch, CODEX_HOME provisioning, checkout creation, or auth handoff; #14914 and #14937 own those flows.
• Altering the existing GitHub Workflow identity guard from #13243.
• Making Codex-only diagnostics global across Claude or Gemini.
• Adding resident-specific prompt files or dynamically rendering a concrete identity into the hook output.

Avoided Traps

• Append Emmy beside Euclid — rejected. A two-name roster preserves the wrong ownership model and must churn for every future resident.
• Delete all Codex context — rejected. A few Codex-only diagnostics remain valuable and have no reason to tax other harnesses.
• Reimplement identity comparison in Markdown or hook code — rejected. The runtime guard already owns it.
• Move the content into AGENTS.md — rejected. That recreates the cross-harness pollution #10715 removed.
• Prove all Fleet onboarding again — rejected. This lane fixes one shared prompt boundary and should stay small.

Related

• #15041 — second Codex resident makes the defect live
• #13015 — Fleet Manager MVP
• #14914 / PR #14918 — per-agent launch environment
• #14937 / PR #14965 — turnkey peer onboarding
• #10715 / PR #10728 — Codex-only turn-context route
• #13241 / PR #13242 — origin of the single-resident worktree wording
• #13243 — executable fail-closed GitHub write identity guard
• #11593 — adjacent harness-private/shared codification guidance; not a duplicate

Origin Session ID: de713f27-0e82-4960-b4c6-f281e0c36449 (Codex task 019f484c-662f-7f31-969a-cbde373efd4a)

Retrieval Hint: query_raw_memories("Codex sibling CODEX.md UserPromptSubmit identity-neutral neo-gpt Emmy NEO_AGENT_IDENTITY")