Ecosystem Update - 2026-06-28

TL;DR

• No automatic harness Quick Win passed the safety gate today; report/state/backup files were updated, but config, hooks, agents, rules, and skills were not mutated.
• Official Codex sources show 0.142.3 as the latest stable maintenance patch and 0.143.0-alpha.29 as today's prerelease; the app-bundled binary is already 0.142.3, while PATH still resolves to 0.142.1.
• OpenAI's skill-installer guidance changed upstream: installed skills are available on the next turn, not after a restart. Both local skill-installer copies still say to restart, but automatic skill-body edits are forbidden by this skill's hard limits.

Quick Wins

Auto-Implemented

• Backed up config.toml, hooks.json, and all agent TOMLs to /Users/chadsimon/.codex/backups/2026-06-28/.
• Wrote this report to /Users/chadsimon/.codex/reports/ecosystem/2026-06-28.md.
• Updated the ecosystem-update state file.
• No website deployment was performed.

Build Queue

• OpenAI skill-installer next-turn guidance (skill) - https://github.com/openai/skills/pull/507 - Upstream removed the obsolete "Restart Codex" instruction because Codex refreshes skills between turns. Local copies at .codex/skills/.system/skill-installer/SKILL.md and .agents/skills/skill-installer/SKILL.md still contain the stale wording. Impact 2 / Effort 1, but explicit direction is required because daily Quick Wins must not rewrite skill bodies.
• Codex PATH/app version reconciliation (Codex-md) - https://github.com/openai/codex/releases/tag/rust-v0.142.3 - App-bundled Codex is 0.142.3, PATH codex is 0.142.1, and 0.142.3 is maintenance-only since 0.142.2. Impact 2 / Effort 2. Do as an explicit runtime task with rollback notes and smoke checks.
• Stop-time existing profile hook wiring smoke (hook) - https://howborisusesclaudecode.com/ and https://github.com/shanraisshan/codex-cli-best-practice - The local hook_profile.py already names what_would_chad_do, codex_review_gate, and checkpoint_session, and matching scripts exist, but hooks.json does not wire them. Impact 2 / Effort 2. Smoke output shape, cost, and block behavior before wiring globally.
• Plugin-era skill catalog posture review (skill/plugin) - https://github.com/openai/skills/pull/496 - OpenAI is steering users from the standalone skills repo toward the Plugins directory for skills and apps. Local plugin support and marketplaces are already enabled, so this should be a selective posture review, not a migration.
• Litmus-style metric-spec adapter for eval harnesses (research/agent-pattern) - https://arxiv.org/abs/2606.23403 - autoconfig and planning-gate already run evals, but Litmus suggests deriving metric portfolios from code and explicit evaluation intent before choosing measurements. Impact 2 / Effort 2.
• EDV memory-promotion verifier spike (research/agent-pattern) - https://arxiv.org/abs/2606.24428 - Execute-Distill-Verify is directly relevant to omni-mem/Wren consolidation: separate executor traces, distillation, and verifier consensus before durable memory promotion. Impact 2 / Effort 2.

Research

• ReM-MoA: Reasoning Memory Sustains Mixture-of-Agents Scaling - Relevant to multi-agent reviewer memory: ranking successful and failed traces before reusing them may improve deeper agent pipelines without raising subagent depth blindly.
• Escaping the Self-Confirmation Trap: An Execute-Distill-Verify Paradigm for Agentic Experience Learning - Strong fit for memory lifecycle work because it explicitly avoids executor-only self-reflection before writing experience.
• Litmus: Zero-Label, Code-Driven Metric Specification for Evaluating AI Systems - Useful for making harness metrics explainable before adding more benchmarks or optimization loops.
• AutoSpec: Safety Rule Evolution for LLM Agents via Inductive Logic Programming - Good research direction for rule false-positive/false-negative analysis; too heavy for automatic adoption.
• Codex Remote reaches general availability - Useful product context, but this local setup already has remote/control plugins and does not need a harness mutation.

Already Have

Native ~/.codex/config.toml with schema header, model = "gpt-5.5", review_model = "gpt-5.4", approval_policy = "never", sandbox_mode = "danger-full-access", service_tier = "fast", live web search, hooks enabled, goals enabled, plugins enabled, plugin hooks disabled, native memories disabled in favor of omni-mem, prompt telemetry off, app destructive actions disabled, OpenAI Developer Docs MCP, omni-mem MCP, Wren MCP, node_repl MCP, Browser/Chrome/Computer Use plugins, OpenAI Developers plugin, marketplace/plugin support, .codex/rules/default.rules, read-only explorer/planner/reviewer/validator agents, Python and TypeScript reviewers, workspace-write worker and chad-twin, bounded max_threads, max_depth, and worker runtime, project_doc_fallback_filenames = ["AGENTS.md"], codex-session-search, strict codex-skill-audit, planning-gate, /auto, /drive, /build, /govern, what-would-chad-do, rlm-scan, PreToolUse Bash guard, PostToolUse verification/failure-context hooks, SessionStart RLM/runtime/config posture checks, UserPromptSubmit route classifier, Stop omni-mem save and completion-evidence gate, PreCompact memory capture, config posture checker, AgentOps contract checker, and a large local skill library. Boris-style plan mode, subagent roles, PostToolUse validation, profiles, rules, and progressive skill disclosure are already covered.

Rejected

• Auto-edit skill-installer wording as a Quick Win - rejected: it is a small useful fix, but it rewrites skill bodies, which the ecosystem-update hard limits forbid.
• Wire what_would_chad_do, codex_review_gate, or checkpoint_session into Stop immediately - rejected: scripts exist, but wiring them globally changes turn-closing behavior and may add blocking or model-call cost; do a focused smoke task first.
• Upgrade or symlink PATH codex automatically - rejected: binary/path changes require explicit rollback notes and smoke tests even when the app bundle is newer.
• Adopt 0.143.0-alpha.29 globally - rejected: alpha releases are under-development features; current runtime policy says not to enable them globally.
• Enable native Codex memories - rejected: current memory policy uses omni-mem and keeps prompt telemetry opt-in.
• Enable plugin_hooks globally - rejected: expands trust surface without a specific trusted plugin hook need.
• Install or migrate community skill/plugin catalogs wholesale - rejected: outside skills require strict audit and a domain-specific need.
• Add universal auto-format hooks - rejected: repo formatters vary; current PostToolUse hooks record verification and failure context without enforcing project-specific formatters.
• Adopt AutoSpec/ReM-MoA/EDV wholesale - rejected: useful research, but each needs a scoped eval or memory-lifecycle spike before changing the live harness.

Sources checked: https://github.com/hesreallyhim/awesome-claude-code, https://howborisusesclaudecode.com/, https://github.com/shanraisshan/codex-cli-best-practice, https://arxiv.org/search/?searchtype=all&query=LLM+agent+coding&order=-announced_date_first, https://developers.openai.com/codex/changelog, https://github.com/openai/codex/releases, https://github.com/openai/codex/releases/tag/rust-v0.142.3, https://github.com/openai/codex/releases/tag/rust-v0.143.0-alpha.29, https://github.com/openai/skills/pull/507, https://github.com/openai/skills/pull/496, https://github.com/openai/skills, web search: "Codex new hooks agents skills site:github.com 2026", web search: "arxiv.org LLM agent coding autonomous 2026 site:arxiv.org", OpenAI Developer Docs MCP search for Codex hooks/skills/CLI guidance Tier 2 fetched: yes Tier 3 fetched: partial - official Codex/OpenAI sources fetched; weekly community toolkit skipped because it was fetched on 2026-06-27 Run at: 2026-06-28T06:30:46-04:00