feat: configure Codex Graphify approval profile

[Freudator86]

Intent

Configure Codex approval-profile and graphify hook for firstmate

What Changed

• Adds a tracked Codex profile for firstmate background runs and wires fm-spawn.sh to launch Codex tasks through the repo-local approval profile.
• Extends Codex PreToolUse hooks with an optional Graphify hook check while preserving the existing firstmate guard hooks and ignoring missing graphify installs.
• Documents .codex/ and graphify-out/, and expands shell/tests around Codex hooks, dispatch-profile spawning, session start behavior, Pi turn-end handling, and related lint fixes.

Risk Assessment

✅ Low: Captain, the changes are well-scoped to Codex profile activation, Graphify hook wiring, documentation, and matching fixture updates, and I did not find a material merge-blocking risk.

Testing

The prior full baseline was already green; I reran the targeted spawn and session-start behavior suites, then captured end-to-end CLI evidence for Codex profile launch flags and the optional Graphify PreToolUse hook, with all checks passing and no working-tree residue left behind.

Evidence: Codex spawn profile evidence

Tracked Codex profile values:
# Codex FirstMate background profile.
# Not YOLO: workspace sandbox stays active; blocked boundary work escalates on request.
sandbox_mode = "workspace-write"
approval_policy = "on-request"
approvals_reviewer = "auto_review"

fm-spawn command:
FM_HOME=/tmp/no-mistakes-evidence/01KXVCYYAEQK5VQZW5XZ7EZV8Z/codex-spawn-profile-case/home PATH=/tmp/no-mistakes-evidence/01KXVCYYAEQK5VQZW5XZ7EZV8Z/codex-spawn-profile-case/fakebin:$PATH bin/fm-spawn.sh codex-profile-e2e /tmp/no-mistakes-evidence/01KXVCYYAEQK5VQZW5XZ7EZV8Z/codex-spawn-profile-case/project --harness codex --model gpt-5 --effort high --backend tmux

fm-spawn output:
spawned codex-profile-e2e harness=codex kind=ship mode=no-mistakes yolo=off window=firstmate:fm-codex-profile-e2e worktree=/tmp/no-mistakes-evidence/01KXVCYYAEQK5VQZW5XZ7EZV8Z/codex-spawn-profile-case/wt

Captured launch command sent to the task terminal:
codex --model 'gpt-5' -c 'model_reasoning_effort="high"' -c 'sandbox_mode="workspace-write"' -c 'approval_policy="on-request"' -c 'approvals_reviewer="auto_review"' -c "notify=[\"bash\",\"-c\",\"touch '/tmp/no-mistakes-evidence/01KXVCYYAEQK5VQZW5XZ7EZV8Z/codex-spawn-profile-case/home/state/codex-profile-e2e.turn-ended'\"]" "$(cat '/tmp/no-mistakes-evidence/01KXVCYYAEQK5VQZW5XZ7EZV8Z/codex-spawn-profile-case/home/data/codex-profile-e2e/brief.md')"

Persisted task metadata:
window=firstmate:fm-codex-profile-e2e
worktree=/tmp/no-mistakes-evidence/01KXVCYYAEQK5VQZW5XZ7EZV8Z/codex-spawn-profile-case/wt
project=/tmp/no-mistakes-evidence/01KXVCYYAEQK5VQZW5XZ7EZV8Z/codex-spawn-profile-case/project
harness=codex
kind=ship
mode=no-mistakes
yolo=off
tasktmp=/tmp/fm-codex-profile-e2e
model=gpt-5
effort=high

Dangerous bypass flag present? no

Evidence: Graphify PreToolUse hook evidence

Tracked Codex PreToolUse Graphify hook command:
bash -lc 'command -v graphify >/dev/null 2>&1 || exit 0; graphify hook-check'

Case 1: graphify present on PATH via login profile.
exit=0
graphify invoked with args: hook-check

Case 2: graphify absent from PATH via login profile.
exit=0
No graphify executable was available from the login profile PATH; hook returned success.

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

🔧 **Review** - 1 issue found → auto-fixed (2) ✅

• 🚨 .codex/hooks.json:47 - Captain, .codex/hooks.json now defines PreToolUse twice; standard JSON parsers keep only the later key, so Codex sees only the Graphify hook and silently drops the existing fm-arm-pretool-check.sh and fm-cd-pretool-check.sh guards. Merge the Graphify command into the original PreToolUse[0].hooks array and remove the second key.

🔧 Fix: Captain, fix duplicate Codex PreToolUse hook
1 error still open:

• 🚨 .codex/config.toml:3 - Captain, the committed .codex/config.toml does not appear to be loaded by Codex as a repo-local profile: local codex --help says config is loaded from $CODEX_HOME/config.toml or a named $CODEX_HOME/<profile>.config.toml, and codex doctor in this worktree reported /home/crew/.codex/config.toml as the active config path. As committed, these sandbox/approval settings are likely inert for a fresh checkout, so the approval-profile part of the change needs an activation path or corrected documentation.

🔧 Fix: Captain, activate Codex spawn profile
✅ Re-checked - no issues remain.

✅ **Test** - passed

✅ No issues found.

• command -v tmux >/dev/null || { echo "tmux is required for e2e tests" >&2; exit 1; }; tmux -V; rc=0; for t in tests/*.test.sh; do echo "== $t =="; bash "$t" || rc=1; done; exit "$rc"
• Baseline already ran successfully before this validation: command -v tmux >/dev/null || { echo "tmux is required for e2e tests" >&2; exit 1; }; tmux -V; rc=0; for t in tests/*.test.sh; do echo "== $t =="; bash "$t" || rc=1; done; exit "$rc".
• bash tests/fm-spawn-dispatch-profile.test.sh
• bash tests/fm-session-start.test.sh
• Manual evidence check: ran bin/fm-spawn.sh codex-profile-e2e <fixture-project> --harness codex --model gpt-5 --effort high --backend tmux against a fake tmux/treehouse terminal and captured the literal launch command sent to the task terminal.
• Manual evidence check: extracted the Graphify command from .codex/hooks.json and executed it with a fake graphify on PATH, then with Graphify absent from the login-shell PATH.
• Cleanup check: removed /tmp/fm-codex-profile-e2e and confirmed git status --short plus generated-artifact scan produced no working-tree residue.

✅ **Document** - passed

✅ No issues found.

⚠️ **Lint** - 1 warning

• ⚠️ linter found issues (exit code 127)

🔧 Fix: Captain, brace Codex config key expansion
1 warning still open:

• ⚠️ linter found issues (exit code 127)

🔧 Fix: Captain: silence unused afk launch counters
1 warning still open:

• ⚠️ linter found issues (exit code 127)

🔧 Fix: Captain, follow repo-local shell sources
1 warning still open:

• ⚠️ linter found issues (exit code 127)

✅ **Push** - passed

✅ No issues found.