Ecosystem Update - 2026-07-05

July 5, 2026 · generated by the ecosystem-update Claude Skill

TL;DR

No safe Quick Win was retained today: the only patch candidate exposed a larger legacy-profile migration issue and was reverted cleanly.
Current Codex docs say --profile now loads ~/.codex/<profile>.config.toml; this setup still has legacy [profiles.*] tables, so profile migration is the top Build Queue item.
Today's research signal is bounded autonomy: loop termination, agent dependency graphs, skill composition, and budgeted source collection are all directly relevant to /auto and planning-gate.

Quick Wins

Item	Source	Type	Impact	Effort	Action
None retained	Daily crawl plus validation	config	-	-	One profile-hardening candidate failed smoke because legacy profile tables are rejected by current `--profile`; reverted the edit and queued the migration instead.

Auto-Implemented

Backed up config.toml, hooks.json, and agent TOMLs under /Users/chadsimon/.codex/backups/2026-07-05/.
Tried adding allow_login_shell = false to [profiles.review], then ran codex --profile review debug prompt-input; Codex rejected the legacy [profiles.review] table and instructed migration to ~/.codex/review.config.toml.
Reverted the one-line edit. cmp confirmed /Users/chadsimon/.codex/config.toml matches the pre-run backup.
Verification after revert passed: TOML parse for config.toml, JSON parse for hooks.json, and python3 ~/.codex/bin/codex_config_posture.py --mode warn returned ok: true with one pre-existing CLI split-brain warning.

Build Queue

Profile-file migration for legacy profiles (config) - OpenAI profile docs - Move [profiles.conservative], [profiles.conservative-auto-review], and [profiles.review] into ~/.codex/conservative.config.toml, ~/.codex/conservative-auto-review.config.toml, and ~/.codex/review.config.toml; then remove legacy tables from config.toml and validate all profiles.
SessionStart clear-mode hook budget audit (hook) - codex-cli-best-practice, OpenAI hook matcher docs - Current hooks already use source matchers, but clear still runs readiness and posture hooks; measure timing before removing clear from any hook.
Agentic loop bound scanner for /auto packets (research) - When Agents Do Not Stop - Add a lightweight static/contract check for unbounded model/tool/handoff loops in local autonomous task definitions before dispatch.
Agent dependency graph intake (research) - AgentFlow - Evaluate whether planning-gate packet metadata can expose enough model/tool/memory/handoff dependency structure for static review without adding a new orchestration layer.
Skill-composition eval for local skill routing (skill) - Generative Skill Composition for LLM Agents - Build a small offline eval over installed skills to test whether skill selection/order improves outcomes versus single-skill invocation.
Budgeted crawl evidence adapter (research) - BaRA - Adapt the provenance and liveness-check idea to ecosystem-update source crawling so reports distinguish fetched, skipped, dead, and citation-backed sources.

Research

When Agents Do Not Stop: Uncovering Infinite Agentic Loops in LLM Agents - Directly relevant to /auto loop bounds, retry caps, handoff limits, and side-effect idempotency.
AgentFlow: Building Agent Dependency Graphs for Static Analysis of Agent Programs - Useful for reasoning about agent dependencies that are not visible in ordinary code control flow.
BaRA: Budget-constrained and Reliable Web Data Collection Agent - Reinforces source-crawl budgets, dead-link checks, and provenance validation for digest generation.
Generative Skill Composition for LLM Agents - Matches this setup's large skill library; the claim to test locally is whether ordered skill plans beat ad hoc single-skill triggers.
Libra: self-evolving repository catalogs - Interesting for RLM/catalog maintenance, but should stay in research until it can be evaluated without an autonomous catalog-rewriter.

Already Have

OpenAI developer docs MCP, live web search, features.hooks = true, hook statusMessage and timeout usage, SessionStart source matchers, UserPromptSubmit route classification, Bash PreToolUse safety guard, Bash PostToolUse verification and failure-context hooks, Stop completion evidence gate, omni-mem Stop/PreCompact hooks, read-only explorer/planner/reviewer/validator agents, Python and TypeScript reviewers, scoped worker and chad-twin agents, agent nickname metadata, bounded agent depth/thread/runtime caps, conservative/review profile intent, destructive app actions disabled, prompt telemetry off, plugin_hooks = false, OpenAI Developers/Browser/Chrome/Computer Use/Documents/Spreadsheets/Presentations/Gmail/PDF plugins, omni-mem default memory workflow, codex-skill-audit, rlm-scan, planning-gate, /auto, govern, orchestrate-local, bug-miner, codex-security, security-audit, skills-janitor, and daily ecosystem state tracking.

Rejected

Auto-migrate legacy profiles as today's Quick Win - rejected because it creates new runtime profile files and removes existing config tables; needs an explicit migration slice with validation for every profile.
Change approvals_reviewer = "guardian_subagent" to auto_review directly - rejected because prior local evidence showed the active PATH CLI expected guardian_subagent; resolve CLI split-brain and profile migration first.
Auto-enable native Codex memories - rejected because this setup intentionally uses omni-mem and keeps features.memories = false.
Auto-import community skill catalogs from Awesome Claude/Codex lists - rejected because external skills require codex-skill-audit --strict and this setup already has a broad curated skill library.
Auto-wire formatter or secret-scan hooks from community tips - rejected because no existing reviewed formatter/secret-scan hook script was identified; the ecosystem-update hard limit forbids wiring new hooks that require new scripts.
Adopt Boris-style dynamic workflow orchestration wholesale - rejected as overengineering; current /auto, planning-gate, Wren, subagents, and route contracts already cover the recurring need without a new workflow runtime.

Sources checked: https://github.com/hesreallyhim/awesome-claude-code, https://howborisusesclaudecode.com/, https://github.com/shanraisshan/codex-cli-best-practice, https://arxiv.org/search/?searchtype=all&query=LLM+agent+coding&order=-announced_date_first, https://developers.openai.com/codex/hooks#matcher-patterns, https://developers.openai.com/codex/config-advanced#profiles, GitHub search for Codex new hooks agents skills site:github.com 2026, web search for arxiv.org LLM agent coding autonomous 2026 site:arxiv.org. Tier 2 fetched: yes. Tier 3 fetched: no - skipped by 7-day cadence; last run was 2026-07-01T06:33:31-04:00. omni-mem write: saved memory c543a4aa-b6bc-4e6f-83dd-0a779e92b3e3. Run at: 2026-07-05T06:34:15-04:00.