Ecosystem Update - 2026-07-04

July 4, 2026 · generated by the ecosystem-update Claude Skill

TL;DR

One safe harness Quick Win was implemented: removed 17 stale trusted project entries for deleted temp/scratch directories from ~/.codex/config.toml.
Today's strongest ecosystem signal is context/harness linting: AGENTS/SKILL/hooks/MCP validators are maturing, but they should be audited before adoption.
Dynamic workflows, broad skill catalogs, native memories, and automatic Codex upgrades remain useful signals but fail the automatic Quick Win safety gate for this setup.

Quick Wins

Item	Source	Type	Impact	Effort	Action
Stale trusted project cleanup	Local config hygiene plus OpenAI config reference	config	2	1	Removed 17 deleted temp/scratch `[projects]` trust blocks from `~/.codex/config.toml`; backup written to `~/.codex/backups/2026-07-04/`.

Auto-Implemented

Removed stale trust entries for deleted /private/tmp, macOS $TMPDIR, ~/tmp*, ~/wren_*, and ~/.openclaw/tmp/wren-research-* paths from ~/.codex/config.toml.
Verification passed:
python3 TOML parse of ~/.codex/config.toml
trusted project existence check: missing_projects 0
python3 -m json.tool ~/.codex/hooks.json

Build Queue

Agent context linter adapter (skill/tooling) - awesome-claude-code now highlights AGENTS/SKILL/hooks/MCP linting tools such as agnix, Ctxlint, and agents-md-cookbook; build a read-only audit wrapper first, then run codex-skill-audit --strict before trusting any external package.
approvals_reviewer profile normalization check (config) - official docs list approvals_reviewer as user | auto_review, while the inactive conservative-auto-review profile still uses guardian_subagent; needs a deterministic strict-config validation path before changing behavior.
Existing-script secret-scan expansion (hook) - Agent Guard reinforces real-time secret-leak guardrails; only build this by extending existing Codex-owned guard scripts or adding a reviewed script first, never by wiring an unbuilt hook.
Codex MCP-server interop smoke (mcp) - codex-cli-best-practice documents Codex as an MCP server; useful for Wren/Claude interop, but it needs a smoke test and explicit boundary before any daemon or persistent route is added.

Research

No Tier 2 arXiv fetch this run. The last Tier 2 run was 2026-07-03T06:33:50-04:00; this run started at 2026-07-04T06:30:47-04:00, still inside the 24-hour skip window.

Already Have

Lifecycle hooks with statusMessage and timeout, UserPromptSubmit route classifier, Bash PreToolUse guard, PostToolUse verification/failure context hooks, Stop completion evidence gate, omni-mem Stop/PreCompact hooks, read-only explorer/planner/reviewer/validator agents, scoped worker agent, Python/TypeScript reviewers, installed audit/security/refactor/bug-miner/rlm-scan/playwright/openai-docs skills, OpenAI developer docs MCP, selective MCP parallel calls, plugin/app destructive-action controls, config schema header, prompt telemetry off, check_for_update_on_startup, and direct /auto-first autonomous runtime posture.

Rejected

Wholesale community skill catalog import - external skills are not trusted without codex-skill-audit --strict, and this setup already has a large curated local skill set.
Auto-wire PreSkillUse/PostSkillUse or other unsupported hook events - no confirmed local support and no existing target script; violates the no-new-hook-without-script Quick Win limit.
Auto-enable native Codex memories - conflicts with the current deliberate features.memories = false posture and omni-mem default workflow.
Auto-upgrade Codex CLI daily - too high-risk for automatic mutation; current config already checks for updates on startup.
Add AGENTS.override.md or edit AGENTS policy as a Quick Win - conflicts with the byte-identical global/project AGENTS contract and the skill's hard policy-doc limit.
Enable plugin_hooks or global MCP parallel calls - adds broad behavior without server-by-server proof.

Sources checked: https://github.com/hesreallyhim/awesome-claude-code, https://howborisusesclaudecode.com/, https://github.com/shanraisshan/codex-cli-best-practice, https://github.com/RoggeOhta/awesome-codex-cli, https://developers.openai.com/codex/config-reference#configtoml, GitHub search for Codex new hooks agents skills site:github.com 2026. Tier 2 fetched: no - skipped by 24-hour cadence. Tier 3 fetched: no - skipped by 7-day cadence. Run at: 2026-07-04T06:30:47-04:00.