@@ -14,4 +14,12 @@
 - Commit `ccc044cde` routes CLI JSON writes and background index arguments through `cbm_json_writer_allocator`, uses `cbm_mem_strdup`/`cbm_free` for fetched tags, and reuses `application_release_text` for project identities. Baselines now record the measured lower values: CLI 128, daemon application 102, store 349, and HTTP server 25.
 - Validation after the repair: `python3 scripts/lint-memory-core.py` passed (3,211 raw sites across 102 files, none grew); `umask 022; scripts/build-dev.sh` passed; `scripts/test.sh --smart --tests cli:cli_print_tool_help_issue680` passed (1/1); `scripts/test.sh --smart --tests daemon_application:daemon_application_explicit_index_joins_running_auto_index_job,daemon_application:daemon_application_programmatic_index_injects_resource_policy` passed (2/2); strict Actions policy and `git diff --check` passed.
 - Build #86 terminated `FAILURE` at the memory-core linter with the exact raw-site and lower-baseline deltas listed above. It predates `ccc044cde` and has no archived `source-revision`; it does not qualify the repair. The original failed build and log remain preserved.
-- After #86 terminated, the existing full release-tooling job was triggered again as build #87 against the fast-forwarded local branch. It is running at the final candidate; exact checkout and archived source/checksum validation remain pending. No GitHub Actions workflow was dispatched.
+- After #86 terminated, build #87 ran the existing full release-tooling job at `8020c5bca4532ed9d2cb98b0e17bd370e500c8c7` with empty `CBM_TEST_SUITES`; it terminated `FAILURE` in CLI test shard 3. Six tests failed: OpenCode's retired-plugin expectation, Codex CODEX_HOME plan classification, legacy-block warning, and three Codex install/preflight lifecycle cases. Later stages and source-revision/checksum archival were skipped, so #87 does not qualify the final candidate.
+
+## Codex CLI surface repair
+
+- Commit `4b7ddbea7ae4ebcb62664ccdb8acde515398e707` scopes Codex instructions, skills and profiles to the asset surface, and Codex TOML/JSON hooks to the hook surface. Previously both surfaces ran hook preflight, which made broken hook configuration block independent asset installation and made hook-only install touch assets. The legacy MCP instruction warning remains read-only and runs on Codex asset dry-run/install; no MCP configuration or plugin support was restored.
+- Updated regression expectations to match the CLI-only contract: Codex assets and hooks have distinct plan entries, and OpenCode's retired MCP extension is neither installed nor planned while a user's existing file remains byte-identical. The Codex lifecycle fixture now uses a private executable and private parent directories required by the activation transaction's path checks.
+- `scripts/test.sh --smart --tests 'cli:cli_extension_leaves_user_owned_module_untouched_issue2204,cli:cli_codex_respects_codex_home,cli:cli_install_warns_about_legacy_mcp_instruction_block,cli:cli_codex_migrates_to_single_hook_representation,cli:cli_codex_instruction_block_install_ignores_broken_hook_config_issue1689,cli:cli_codex_preflight_reports_heading_and_reason'` passed (6/6, ASan/UBSan); `scripts/build-dev.sh` passed; `python3 scripts/lint-memory-core.py` passed (3,211 raw sites across 102 files, none grew); the strict Actions policy checker passed; `git diff --check` passed.
+- The incremental full local `cli` suite was also run before the repair and returned 318 passed, 25 failed, 1 skipped. Its failure log includes the six #87 cases and activation-transaction failures under the group-writable `/lump/apps/.worktrees` checkout; this run is not a passing suite result. The six Jenkins failures pass in the focused rerun above. Full Jenkins against the current committed candidate remains required to establish the complete venue result.
+- Build #88 has not yet been triggered. The existing job must run against the final source and receipt candidate, with empty `CBM_TEST_SUITES`; no GitHub Actions workflow was dispatched.
@@ -915,7 +915,8 @@
       "adaptations": [
         "Retained CLI-first identity and applied reusable Go setup for Go-wrapper smoke.",
         "Retained action/dependency updates and contributor prerequisite clarifications.",
-        "Final memory-core ratchet repair migrated new CLI and daemon JSON allocations to the memory core; baselines were lowered to measured counts."
+        "Final memory-core ratchet repair migrated new CLI and daemon JSON allocations to the memory core; baselines were lowered to measured counts.",
+        "Separated Codex asset and hook install surfaces, retained read-only legacy MCP warnings, and kept the retired OpenCode MCP plugin absent."
       ],
       "exclusions": [
         "Did not restore hosted automatic cache-warm, PR, or scorecard workflows.",
@@ -927,8 +928,8 @@
       "schema_migrations": "no persistent index/store schema change",
       "policy_gate": "passed",
       "verification": {
-        "local": "strict Actions policy, diff check, memory-core ratchet, production build, 1 CLI help test, and 2 daemon application index tests passed",
-        "jenkins": "build #86 failed in memory-core linter before repair; build #87 running at repaired candidate",
+        "local": "strict Actions policy, diff check, memory-core ratchet, production build, 1 CLI help test, 2 daemon application index tests, and 6 focused Codex/OpenCode tests passed; pre-repair incremental full cli suite had 25 failures",
+        "jenkins": "build #86 failed in memory-core linter before repair; build #87 failed six CLI tests at 8020c5bca4532ed9d2cb98b0e17bd370e500c8c7 before archive; build #88 required for current candidate",
         "windows": "not_run"
       },
       "acceptance": [
@@ -938,7 +939,7 @@
         "Focused affected-subsystem tests pass; record unavailable native Windows gates.",
         "Full Jenkins release-tooling archive qualifies the exact final candidate."
       ],
-      "next_action": "Final Jenkins qualification and independent review; keep all dependent batches unaccepted until host review.",
+      "next_action": "Run the existing full release-tooling Jenkins job against the current committed candidate; then retain independent review and host acceptance as separate gates.",
       "publication_blocker": "GitHub push unavailable: git remote requires Username in this non-interactive executor; GitHub ref API update returned not_found. No stacked draft PRs published; stale PRs #28/#29 untouched."
     }
   ],