Codex/cloud mcp parity 20260804

.codex/config.toml

@@ -3,16 +3,22 @@
 #
 # checked-in policy:
 # - enabled = false so ordinary/offline Codex sessions do not initialize providers
-# - production Supabase uses "prompt" so every metadata/read operation requires
-# explicit approval; write-capable Figma/Railway/Sentry tools use "writes"
+# - Figma, Frontend Checklist, Supabase, and Sentry use "prompt" so metadata/file/
+# issue reads require explicit approval (matches connected opt-in posture)
+# - Railway keeps "writes" so only mutating tools need confirmation
 # - Paid API canaries (eval:rag, eval:retrieval:quality, eval:quality, verify:release,
 # test:live, check:supabase-project) still need explicit confirmation per AGENTS.md
 # Hosted Cloud tools come from installed OAuth plugins/connectors; `.mcp.json` is a cross-client template, not runtime proof.
 
 [mcp_servers.figma_cloud]
 url = "https://mcp.figma.com/mcp"
 enabled = false
-default_tools_approval_mode = "writes"
+default_tools_approval_mode = "prompt"
+
+[mcp_servers.frontendchecklist_cloud]
+url = "https://mcp.frontendchecklist.io"
+enabled = false
+default_tools_approval_mode = "prompt"
 
 [mcp_servers.supabase_cloud]
 # Production project, read_only=true, docs/development metadata only; database and debugging groups are excluded.
@@ -29,4 +35,4 @@ default_tools_approval_mode = "writes"
 [mcp_servers.sentry_cloud]
 url = "https://mcp.sentry.dev/mcp"
 enabled = false
-default_tools_approval_mode = "writes"
+default_tools_approval_mode = "prompt"

AGENTS.md

@@ -873,14 +873,21 @@ Use `docs/codex-cloud.md` as the environment contract:
 - When MCP tools are already callable in a Cloud session and the task needs them, use the host
  plugin/connector inventory. The production Supabase target is limited to prompted, read-only
  `docs` and `development` metadata tools; do not enable database, SQL, row, or log tools.
- Write-capable Figma, Railway, and Sentry tools still require explicit confirmation. Paid API
+ Figma, Frontend Checklist, and Sentry use `prompt` (reads confirmation-gated); Railway write
+ tools still require explicit confirmation via `writes`. Paid API
  canaries (`eval:rag`, `eval:retrieval:quality`, `eval:quality`, `verify:release`,
  `test:live`, `check:supabase-project`) still need explicit confirmation. Project
  `.codex/config.toml` keeps MCP entries `enabled = false` so ordinary/offline hosts do not
- initialize them. Connected setup writes enabled Railway and constrained Supabase entries to the
- host `$CODEX_HOME/config.toml`; actual availability still requires the installed host
- plugin/connector to complete OAuth and a fresh task to prove the callable inventory with
- read-only identity calls. Root `.mcp.json` is a static cross-client template, not runtime proof.
+ initialize them. Connected setup writes enabled Railway (`writes` approval) and constrained
+ Supabase (`prompt` approval) entries to the host `$CODEX_HOME/config.toml` by default.
+ Optional Figma, Frontend Checklist, and Sentry hosted entries stay off unless the Codex
+ environment configures `CODEX_CLOUD_ENABLE_FIGMA=1`, `CODEX_CLOUD_ENABLE_FRONTENDCHECKLIST=1`,
+ or `CODEX_CLOUD_ENABLE_SENTRY=1` before setup/maintenance runs (re-provision or open a fresh
+ task after changing them — exporting the flag inside a running agent shell does not rewrite
+ `$CODEX_HOME/config.toml`); when enabled they use `prompt` approval so reads stay
+ confirmation-gated. Actual availability still requires the installed host plugin/connector to
+ complete OAuth and a fresh task to prove the callable inventory with read-only identity calls.
+ Root `.mcp.json` is a static cross-client template, not runtime proof.
 - Cloud has no Windows task-start script. Report that exact fact, then perform equivalent
  read-only identity, branch, status, worktree, and Git-operation checks. Proceed only in a
  clean disposable checkout on a task-specific non-protected branch.

docs/branch-review-ledger.md

@@ -624,3 +624,5 @@ Records before 2026-07-28 were written by hand and had drifted: 146 lines carrie
 | 2026-08-04 | claude/search-bar-decisions-doc | a7dea7f777255ade72878820a636413aaf9588af | search-bar handoff doc replacement + review fixes | Docs-only review fixes: mode/shelf accounting, Sort consumers, #230/#170 precision; removed unquoted-output claim from prior row | prettier --check . ; check:outstanding-issues ; docs:check-links ; docs:check-index |
 | 2026-08-04 | claude/search-bar-decisions-doc | 3b4cd6e6bf1f36fb8aff098ce7d333641e0859d3 | search-bar handoff doc replacement + review fixes | Fixed CodeRabbit/Codex findings; Bugbot hosted stuck queued, local Bugbot-equivalent confirmed two P2 doc errors and rejected sheets-are-target finding. verify:pr-local PASS (docs scope). Decisive: prettier All matched files use Prettier code style!; outstanding-issues 228 rows next-id=231; docs link check passed: 1615; docs/codebase-index coverage OK | verify:pr-local (docs); prettier --check; check:outstanding-issues; docs:check-links; docs:check-index; check:branch-review-ledger |
 | 2026-08-04 | codex/fix-mode-switching-and-loading-issues | 3e3b224a2ec13928d1e28173b1fc4c75d202d7d2 | PR #1607 unblock/fix | clean — behind 0, merge-tree clean, 0 unresolved threads, required CI in progress (no code fix) | merge-tree clean; behind_by 0; Unit/Build/Static/ProdUI in progress; no failing required |
+| 2026-08-05 | codex/cloud-mcp-parity-20260804 | 79c4672e31788779793a9317a10f511fa3597e66 | PR #1613 review-fix babysit | addressed open review threads + remaining pasted findings; verify:pr-local PASS; unresolved threads 0; CI watch limited by PAT | verify:pr-local PASS (5098 tests); vitest focused 63; threads resolved |
+| 2026-08-05 | codex/cloud-mcp-parity-20260804 | c35f61400078ded68bf34e96a882e8a3711061c8 | PR #1613 review-fix babysit | env-parity Sentry name contract restored; all review threads resolved; awaiting CI | vitest env-sentry+repo-hygiene PASS; parseEnvSchemaNames includes both Sentry DSNs |

docs/codebase-index.md

@@ -34,19 +34,19 @@ Structured map for AI agents and onboarding. For live routes, see `docs/site-map
 
 Smaller top-level directories that are easy to miss:
 
-| Path | Purpose |
-| --------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `data/` | Committed clinical **snapshot exports** loaded at runtime by `src/lib/` (differentials, forms, medications, services, specifiers). Regenerate via the matching `scripts/import-*-export.ts` / `build-*-index.mjs`; do not hand-edit. Distinct from `src/data/`, which holds hand-authored static content. |
-| `eslint-rules/` | Repo-specific lint rules enforced by `npm run lint` (button wiring, hardcoded hex, type/icon scale, z-index ladder) |
-| `mockups/` | Notes for the design-scratch routes under `src/app/mockups/` (the routes themselves 404 in production) |
-| `plugins/` | `plugins/clinical-kb/` Codex plugin manifest and workflow skill |
-| `.agents/` | Single-word skill catalogue (`npm run skills`, validated by `npm run check:skills`) |
-| `.claude/` | Claude Code agents, skills, hooks, settings — plus the `.claude/worktrees/` working copies |
-| `.codex/` | Project-scoped Codex host config; tracked `config.toml` has disabled, secret-free Figma, Supabase, Railway, and Sentry MCP registrations. Figma/Railway/Sentry use `"writes"`; read-only Supabase uses `"auto"`. Runtime Cloud MCP stays `.mcp.json`; all `.codex/*` stay ignored; OAuth stays in the host credential store. |
-| `.cursor/` | Cursor project rules and local-agent configuration |
-| `.design-sync/` | Generated design-system package metadata, validation notes, and project-sync artifacts |
-| `.githooks/` | Installed by `npm install`; `pre-push` runs `scripts/guard-push.mjs` (format, auto-merge race, drift staleness) |
-| `.vscode/` | Shared VS Code workspace recommendations and settings |
+| Path | Purpose |
+| --------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `data/` | Committed clinical **snapshot exports** loaded at runtime by `src/lib/` (differentials, forms, medications, services, specifiers). Regenerate via the matching `scripts/import-*-export.ts` / `build-*-index.mjs`; do not hand-edit. Distinct from `src/data/`, which holds hand-authored static content. |
+| `eslint-rules/` | Repo-specific lint rules enforced by `npm run lint` (button wiring, hardcoded hex, type/icon scale, z-index ladder) |
+| `mockups/` | Notes for the design-scratch routes under `src/app/mockups/` (the routes themselves 404 in production) |
+| `plugins/` | `plugins/clinical-kb/` Codex plugin manifest and workflow skill |
+| `.agents/` | Single-word skill catalogue (`npm run skills`, validated by `npm run check:skills`) |
+| `.claude/` | Claude Code agents, skills, hooks, settings — plus the `.claude/worktrees/` working copies |
+| `.codex/` | Project-scoped Codex host config; tracked `config.toml` has disabled, secret-free Figma, Frontend Checklist, Supabase, Railway, and Sentry MCP registrations. Figma/Frontend Checklist/Supabase/Sentry use `"prompt"`; Railway uses `"writes"`. Runtime Cloud MCP stays `.mcp.json`; all `.codex/*` stay ignored; OAuth stays in the host credential store. |
+| `.cursor/` | Cursor project rules and local-agent configuration |
+| `.design-sync/` | Generated design-system package metadata, validation notes, and project-sync artifacts |
+| `.githooks/` | Installed by `npm install`; `pre-push` runs `scripts/guard-push.mjs` (format, auto-merge race, drift staleness) |
+| `.vscode/` | Shared VS Code workspace recommendations and settings |
 
 **Do not commit:** `.next/`, `node_modules/`, `coverage/`, `.env*`, `sample-documents/`, logs.