Codex

Automatic connection

On macOS and Linux, run:

majlis daemon

For detected Codex installations, startup maintains notify and [mcp_servers.majlis] in ~/.codex/config.toml. Existing notify argv are retained privately and invoked first through a bounded supervised runner. Foreign MCP entries and unrelated settings are preserved.

Run Codex normally in your project. Its first completed-turn notification can enroll the harness-supplied thread-id under the standing local-operator grant after physical checkout verification. Later notifications use that durable binding; their cwd cannot move the session.

Using Majlis inside a thread

The CLI can select the enrolled native cache from the harness-supplied CODEX_THREAD_ID when no explicit Majlis identity is set. Before the first notification, a shell majlis workspace command can enroll that thread through the same verified Git-checkout path, if ordinary sandbox permissions permit access and private-state writes. Operator commands and explicit identity selections never trigger this automatic enrollment.

Codex MCP calls attach thread metadata. The shim links it to the matching native cache; it never guesses a Codex identity from its process directory. Before enrollment, tools return IDENTITY_REQUIRED; retry after the CLI or notification has established the binding. Conflicting metadata or another thread on the same connection is rejected. Shared-server multiplexing of several native threads has no verified supported contract.

Use workspace: "" in a tool call to select the bound session’s workspace. The ordinary inbox defaults to that session’s actor. MCP access does not grant operator or reviewer authority.

Harness permissions and sandbox access

Codex controls its own tool approvals and sandbox. Majlis never changes those controls or approves an MCP call for you.

Measured macOS read-only and workspace-write sandbox runs refused the daemon’s Unix-socket connection unless the harness’s network access was explicitly enabled. Mutations also need permission to write private operation records under the Majlis state directory. The installer changes neither setting. A refused socket connection is reported as DAEMON_UNREACHABLE, with the operation not sent or applied; a state-write refusal names the unavailable directory.

Treat those observations as version-specific evidence, not a compatibility promise. Use majlis doctor to inspect the actual endpoint, state root, binding and gaps, then make any harness-permission choice through Codex’s own controls.

Policy and delivery

Automatic scopes use advisory warn policy. Notifications observe activity; they neither grant leases nor establish prospective write ownership.
Notify cannot enforce block or ask. Unavailable denial returns CAPABILITY_UNAVAILABLE; installation cannot turn an unverified native path into strict enforcement.
The notify wrapper exits 0. Its exit status does not prove an event was recorded, a write was admitted or a message was read.
Native wake and item-specific acknowledgment remain unverified. Durable questions and replies remain available through the inbox.

For an explicit custom-config installation:

majlis install codex --preview-only
majlis install codex

The explicit installer targets $CODEX_HOME/config.toml, or ~/.codex/config.toml. Use --config <absolute-file> for another file. This differs from automatic startup, which targets the conventional user path above. Existing notify argv are chained through the managed runner.

majlis install uninstall codex --preview-only
majlis install uninstall codex

Install plugins/codex/majlis-notify.ps1 under your install prefix and use plugins/codex/config.fragment.windows.toml, which invokes it through pwsh -File. Preserve an existing notifier through a reviewed wrapper invoking its original argv first. Windows runtime and callback behavior remain unverified.

Explicit native session registration is also available:

majlis session register <thread-id> --actor <handle> --checkout <root> --harness codex

Select the exact returned session file through MAJLIS_SESSION_FILE and continue that same thread. Registration grants no harness permission and proves no native capability.

Removal and diagnostics

majlis daemon --no-integrations disables startup integration maintenance. majlis uninstall removes unchanged owned wiring while preserving foreign edits; a later normal daemon start restores managed integrations.

Bounded metadata-only gap files under the effective state’s codex-hook-gaps/ contain no original payload or identity and cannot replay an observation. A previous notifier exceeding its bound leaves diagnostic metadata in codex-notify.log. Inspect majlis doctor; do not treat either record as an admitted write or read confirmation.