chore: prepare final Codex ops foundation PR

[jearonwong]

Summary

• Prepare the final Codex ops foundation PR directly against main.
• Carry forward repo-scoped AGENTS.md, Codex config, reviewer lanes, mirrored skills, goal template, and repo-truth-first script.
• Preserve the three-tier authorization model: normal task-authorized changes, owner-approval-required high-risk changes, and forbidden actions without explicit owner approval.
• Include SoloCrew scope-guard coverage for the Codex ops foundation surface.

Remote Truth / PR Topology

• This is the final PR-to-main surface for the previously stacked Codex ops foundation work.
• Existing stacked PRs are intentionally left open and unmerged.
• No PR was merged as part of this PR chore: prepare final Codex ops foundation PR #2 scope-guard fix wave.
• PR ci: correct runtime production baseline dependency pin #3 was merged separately into main as the runtime production baseline dependency pin correction.

Current Head / Status

• Current PR head: 026025bdb4444f1a4b91430899e22fcb21173a89.
• Branch: codex/latest-ops-foundation-final-main-pr-01.
• Current check: runtime-production-baseline in Runtime Production Baseline.
• Remote status after final push: SUCCESS.
• Successful run: https://github.com/Coregentis/SoloCrew/actions/runs/26809210479

Closed Prior Blockers

• Prior blocker classification: PRE_EXISTING_CI_BASELINE_DEPENDENCY_PIN_BLOCKER.
• PR ci: correct runtime production baseline dependency pin #3 merge commit: 03cc0ac9d193a5343e455b6059216ce95555114e.
• After PR ci: correct runtime production baseline dependency pin #3 merge, PR chore: prepare final Codex ops foundation PR #2 baseline typecheck passed on head d544c571b9aae461beb8389830fbdd4093c73c78.
• Old Cognitive_OS DTO/typecheck blocker is closed.
• Intermediate head d1dc01684aa13db497f3126bb9528168bb3cb6ee failed closed in the scope-guard test because the CI checkout still lacked a resolvable comparison merge-base.

New Blocker Root Cause Fixed In This PR

• Failing file: tests/app/solocrew-codex-ops-foundation-scope-guard.test.ts.
• Original failure: git rev-parse --verify origin/main failed in GitHub Actions checkout.
• Root cause: the scope-guard test assumed origin/main exists as a local remote-tracking ref, which Actions checkout does not guarantee.
• Additional CI-like evidence showed Actions pull request checkout may be a shallow refs/pull/<n>/merge checkout, where the PR merge ref itself must be deepened before Git can calculate a merge-base.

Fix Summary

• Added a CI-safe comparison base resolver inside the scope-guard test.
• Resolution behavior:
  • use existing origin/main when available;
  • otherwise use GITHUB_BASE_REF and explicitly fetch origin/<base>;
  • when running on GITHUB_REF=refs/pull/<n>/merge, deepen the current PR merge ref before calculating merge-base;
  • for non-CI/default local mode, fetch origin/main;
  • fetch base/head history at bounded depths until the merge-base is available;
  • fail closed with a clear CI checkout/base-ref setup error if the base cannot be resolved.
• The scope guard was not disabled.
• The allowlist was not weakened.
• Product/runtime paths remain blocked.

Files Changed In This Fix Wave

• tests/app/solocrew-codex-ops-foundation-scope-guard.test.ts

Validation

• git diff --check: PASS.
• Targeted scope-guard test: PASS.
• scripts/codex/repo-truth-first.sh: PASS.
• wc -c AGENTS.md: 4806 AGENTS.md.
• diff -qr .codex/skills .agents/skills: PASS / no drift.
• npm run typecheck: PASS.
• npm run test: PASS, 2077/2077.
• CI missing-origin-main simulation:
  • temporary shallow single-branch clone initially had no origin/main;
  • old git rev-parse --verify origin/main condition reproduced fatal: Needed a single revision;
  • with GITHUB_BASE_REF=main and GITHUB_HEAD_REF=codex/latest-ops-foundation-final-main-pr-01, targeted scope-guard test passed.
• GitHub PR merge-ref simulation:
  • temporary checkout of real GitHub refs/pull/2/merge at fetch-depth=1 initially had no origin/main and no parent object available through normal verification;
  • with GITHUB_REF=refs/pull/2/merge, GITHUB_BASE_REF=main, and GITHUB_HEAD_REF=codex/latest-ops-foundation-final-main-pr-01, targeted scope-guard test passed;
  • helper fetched origin/main, deepened the PR merge ref, and resolved merge-base successfully.
• Remote Runtime Production Baseline on final head 026025bdb4444f1a4b91430899e22fcb21173a89: SUCCESS.

Scope Boundaries

• Scope guard weakened: NO.
• Allowed file paths broadened beyond Codex ops infra: NO.
• Product/runtime behavior changed: NO.
• Package versions changed: NO.
• Registry mutation: NO.
• Git tag/release seal: NO.
• PR chore: prepare final Codex ops foundation PR #2 merged: NO.

Forbidden Actions Confirmation

No npm publish, npm deprecate, dist-tag mutation, PyPI mutation, git tag, release seal, package version bump, schema object intake, external registry mutation, product/runtime behavior change, public-claim change, or PR merge was performed.

Verdict

SOLOCREW_CODEX_OPS_SCOPE_GUARD_CI_BASE_REF_FIX_READY_FOR_RECHECK

Skill Mirror Relationship

• .agents/skills is the agent-facing mirror.
• .codex/skills is retained as the Codex compatibility/internal copy.