feat(bridge): replace legacy Codex integration

Changes:
- Keep three deliberately distinct names: bridge as the installed plugin identifier, skill namespace, marketplace registration, and MCP server key, matching the single-word names of the other plugins; bridge_CC-Codex as the human brand in descriptions, display metadata, and site navigation; and plugins/bridge_cc-codex as the source directory. Bump the bridge from 0.1.0 to 0.2.0.
- Keep the two host payloads named symmetrically as claude-skills/ and codex-skills/, matching the repository's other dual-host plugin, and update manifests, MCP metadata, package validation, build contracts, changelog, and operator documentation.
- Migrate cc_foundry, cc_oss, cc_develop, and cc_research from the legacy Codex rescue plugin to self-contained bridge implement, advise, and review calls with explicit unavailable and disabled behavior; bump each consumer minor version.
- Replace flat installed-plugin detection with the actual nested registry contract, update bridge telemetry, propagate shared Foundry policy, and add regressions rejecting legacy selectors and placeholder-only briefs.
- Install bridge_CC-Codex through Claude and Codex synchronization paths, and retire plugins the rig no longer uses through a PURGE_PLUGINS list whose uninstall failures are reported but never fatal; codex@openai-codex is the one conditional entry, purged only after a successful bridge installation in the same run.
- Bump Codex Rig to 0.9.0 for managed bridge synchronization, setup discovery across both skill layouts, package metadata, and executable sync scenarios.
- Update repository catalogs and documentation, group the four Claude Code Rig plugins under compact nested navigation, and expose bridge_CC-Codex as its own exact public label.
- Open a grouped navigation tab's children on hover or keyboard focus through a Material tabs-item override, because the site hides the primary sidebar on wide screens and the stock partial links only a section's first child, leaving the rest unreachable on desktop.
- Drop paint containment from the tab list so that submenu can actually appear. The theme sets `contain: content` on the list, which clips descendants to the list box regardless of the overflow rule beside it, so the submenu markup rendered and painted nowhere; only the paint component is dropped, keeping the theme's layout and style containment.
- Replace the runtime-specific accent palette with a vendor-neutral slate and cyan theme, renaming the stylesheet accordingly, because the site documents both Claude Code and Codex packages.

Adversarial review of the migration found eleven defects, all fixed here:
- Repoint four availability gates that still probed the retired integration while their dispatch had already moved to the bridge: the vitality mode searched for a file the purge step deletes, the investigate gate filtered a flat registry shape that the real nested file never matches, and the audit adversarial mode and research hypothesis pipeline both accepted the Codex CLI on PATH as proof the bridge was installed. Each one silently disabled its own bridge step.
- Ship the availability detector in every consumer plugin instead of reaching across plugins for it. The shared pre-pass resolved the script under the calling plugin's root, and only Foundry carried a copy, so every develop-side Codex pre-pass resolved to a missing path that the absent-status fallback swallowed. The four copies are byte-identical and manifested for drift enforcement.
- Rename the detector to check_bridge.py, derive its selector and cache path from an overridable marketplace constant, require a registry entry that carries an install path before reporting installed, and stop treating a leftover cache directory as proof of installation; cache directories outlive uninstall, so that path reported available for a plugin the host had already removed.
- Collapse the parallel detection family onto that single detector: eight skill gates and the resolve preflight previously parsed plugin-list text, which cannot distinguish an installed plugin from one the user disabled, and the preflight additionally reused a cache key whose meaning had changed under it.
- Restore the review-comment fallback dispatch, which had been replaced by an unconditional bridge call while the surrounding step still documented a fallback agent, and record what the resolve routing marker is actually consumed by.
- Accept the task from a file through bridge_call.py --task-file, mutually exclusive with --task, so a consumer forwarding text it did not author never has to embed that text in a command line it composes.
- Report a failed managed install in the exit status instead of ending every run with unconditional success.
- Extend the migration regression to the probes the retired integration was detected by, not only its selectors; that widening is what surfaced two of the gates above.

Impact:
- Claude Code and Codex consumers now use one bidirectional bridge contract for implementation, advice, and review without a legacy dispatch fallback.
- Every delegated consumer brief carries concrete task context, paths, permissions, verification, stop conditions, and expected output instead of leaking plan shorthand or private notation.
- Existing legacy installations are retired safely during the first successful post-push Claude sync; a failed bridge install cannot strand the user without the prior integration.
- Bridge availability now resolves identically for every consumer and agrees with what the installer considers installed, so a disabled, uninstalled, or never-installed bridge degrades each skill along its documented path instead of dispatching into a plugin the host cannot resolve.
- Documentation navigation remains compact while the human brand, machine identifier, and underscore source path are kept deliberately distinct.

Verification:
- Canonical Codex Rig gate passed lint, format, tests, and review; types were explicitly not applicable for the edited mixed-language plugin surfaces.
- Integrated affected suites across the bridge, Codex Rig, all four consumers, and the marketplace benchmark: 3978 passed with one pre-existing SciPy warning, including nine regressions added by the review pass.
- Bridge source validation passed at 0.2.0; strict manifest validation passed for both the bridge and the marketplace; shell syntax, doctests, and shared-copy propagation all clean.
- Pre-commit passed and was idempotent on a second run; it regenerated four consumer blueprint manifests and the Codex Rig package manifest, which is what keeps each recorded command hash matching its source.
- The navigation submenu was verified in headless Chrome at 1400x700 against two builds differing only in the containment rule: without it the submenu is absent from the render, with it every child paints below its tab. A second run drove the shipped focus path with no style overrides and confirmed that focusing a section tab opens its submenu and places the children in the keyboard sequence; a third confirmed the panel renders legibly in the dark scheme.
- The sync script itself was not executed; its install, purge, and setup-dispatch paths are covered by extracted-block tests and shell syntax checking only.

Residual limits:
- The commit must be pushed before the sync script can install this revision; repository policy makes the remote the installation source.
- Provider-backed Claude and Codex smoke calls were not rerun because provider credits and paid execution are environment-owned; the deterministic runtime protocol suite remains green.
- Native Windows execution was unavailable; cross-platform Windows semantics are covered by deterministic tests but not a native-host run.
- Two files in this commit were written by a concurrent session rather than by this work: the oss patch version bump and the review agent-prompts note directing the challenger to skip its own Codex pre-flight. They were included at the author's explicit direction.

---

Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
Co-authored-by: Codex <codex@openai.com>

Author: 3 people

.claude-plugin/marketplace.json

@@ -31,7 +31,7 @@
       "source": "./plugins/codemap-py"
     },
     {
-      "description": "Implement, advise, and review across Claude Code and Codex with bounded execution and compact results.",
+      "description": "bridge_CC-Codex: implement, advise, and review across Claude Code and Codex with bounded execution and compact results.",
       "name": "bridge",
       "source": "./plugins/bridge_cc-codex"
     }

.claude/README.md

@@ -1,13 +1,14 @@
 # 🤖 Codex plugins in Borda's AI-Rig
 
-← [Back to the project overview](../README.md) · [Codex Rig reference](../plugins/codex-rig/README.md) · [Codemap-py reference](../plugins/codemap-py/README.md)
+← [Back to the project overview](../README.md) · [Codex Rig reference](../plugins/codex-rig/README.md) · [Codemap-py reference](../plugins/codemap-py/README.md) · [bridge_CC-Codex reference](../plugins/bridge_cc-codex/README.md)
 
-AI-Rig gives Codex two independently installable products:
+AI-Rig gives Codex three independently installable products:
 
 - **Codex Rig** turns common engineering work into evidence-first workflows with shared gates, specialist role cards, and comparable reports.
 - **Codemap-py** answers unresolved structural questions about Python imports, callers, coupling, renames, and affected tests from a local static index.
+- **bridge_CC-Codex** sends bounded implementation, advice, and review requests from Codex to Claude Code through a host-launched MCP transport.
 
-Install Codex Rig when you want a disciplined workflow. Add Codemap-py when Python structure is part of the uncertainty; skip it when the task already names a sufficient edit surface.
+Install Codex Rig when you want a disciplined workflow. Add Codemap-py when Python structure is part of the uncertainty. Add bridge_CC-Codex when a task benefits from an independent Claude Code implementation, answer, or adversarial review.
 
 <details>
 <summary><strong>Contents</strong></summary>
@@ -36,10 +37,11 @@ Prerequisite: a current Codex release with plugin support. The commands below ma
 codex plugin marketplace add Borda/AI-Rig
 codex plugin add codex-rig@borda-ai-rig
 codex plugin add codemap-py@borda-ai-rig
+codex plugin add bridge@borda-ai-rig
 codex plugin list
 ```
 
-`codemap-py` is optional. Start a fresh Codex session after installation. To pin an immutable marketplace revision, add it with `--ref <release-tag>` rather than relying on a copied "latest" tag.
+`codemap-py` and `bridge` are optional for direct installation. The repository synchronization path manages all three Codex plugins. Start a fresh Codex session after installation. To pin an immutable marketplace revision, add it with `--ref <release-tag>` rather than relying on a copied "latest" tag.
 
 Direct plugin installation changes only Codex's plugin configuration and cache. It does not copy this repository's `.codex/config.toml`, personal policy, or global `AGENTS.md` into your Codex home.
 
@@ -69,6 +71,14 @@ $codemap-py:query-code rdeps mypackage.auth
 $codemap-py:test-impact mypackage.auth::validate_token
 ```
 
+Check the reverse bridge before sending a request:
+
+```text
+$bridge:setup
+$bridge:advise explain the smallest safe next step without editing files
+$bridge:review review the current diff for correctness and missing tests
+```
+
 When passing an invocation from a shell, quote it so `$` is not expanded:
 
 ```bash
@@ -81,14 +91,16 @@ codex '$codemap-py:query-code rdeps mypackage.auth'
 <details>
 <summary><strong>Show package identity, architecture, and health behavior</strong></summary>
 
-Codex Rig is the independently packaged `codex-rig` product. The current manifest identifies version `0.8.0`, fourteen capabilities (thirteen workflow skills plus `agent-shims`), fifteen role cards, parallel blank-agent injection, inline fallback, quality gates, optional Codemap-py context, authenticated cleanup for prior shims, and an optional SessionStart diagnostic. The manifest does not register native persistent agents or an MCP server.
+Codex Rig is the independently packaged `codex-rig` product. The current manifest identifies version `0.9.0`, fourteen capabilities (thirteen workflow skills plus `agent-shims`), fifteen role cards, parallel blank-agent injection, inline fallback, quality gates, optional Codemap-py context, authenticated cleanup for prior shims, and an optional SessionStart diagnostic. The manifest does not register native persistent agents or an MCP server.
 
 Its shipped tree is organized as `.codex-plugin/plugin.json`, `skills/`, `roles/`, `shared/`, `runtime/calibration/`, `hooks/`, `scripts/`, `tests/`, and `package-manifest.json`. The installed cache is immutable input: workflows resolve their own installed root and do not patch the cache or copy repository source into it.
 
 `hooks/hooks.json` declares a read-only `SessionStart` command for `startup|resume`. It invokes the package's shim-health diagnostic with `python3` on POSIX and `python` on Windows, and does not install, update, or remove files. Declining hook trust leaves the diagnostic inactive without disabling skills.
 
 Codemap-py is a separate `codemap-py` package. Its current Codex manifest identifies version `0.30.1`, the `codex-skills/` entry point, and six structural-analysis capabilities. Codex receives those skills but no Codemap hook manifest: there is no ambient preamble, hook-seeded session correlation, or redundant-scan guard. Codemap remains optional and Codex Rig starts without it.
 
+bridge_CC-Codex is a separate `bridge` package shared by Claude Code and Codex. Its Codex half contributes four skills and a stdio MCP declaration. The MCP server is mandatory for Codex → Claude Code because it runs in the host context that owns normal Claude authentication; it does not accept model-controlled workspace, background, or session authority.
+
 </details>
 
 ## 🔧 Full Codex Rig skill contracts
@@ -198,6 +210,19 @@ Codemap-py exposes the same six capabilities in Codex and Claude Code:
 
 Codex does not add the plugin's `bin/` directory to PATH and does not receive the optional Claude hook manifest. Use the `$codemap-py:*` skills unless you deliberately resolve the installed plugin root.
 
+### bridge_CC-Codex skills
+
+bridge_CC-Codex exposes four Codex skills:
+
+| Skill               | Capability                                                                               |
+| ------------------- | ---------------------------------------------------------------------------------------- |
+| `$bridge:implement` | Ask Claude Code to make one bounded write-capable change and return a compact envelope.  |
+| `$bridge:advise`    | Ask Claude Code for a read-only answer with explicit model, effort, and budget controls. |
+| `$bridge:review`    | Ask Claude Code for a read-only adversarial review with actionable findings.             |
+| `$bridge:setup`     | Check the local Claude CLI and bridge transport; paid live probing remains opt-in.       |
+
+The reverse bridge keeps detailed provider output in a workspace-relative transcript. Decision-critical verdicts, findings, files touched, remaining work, and blockers stay in the compact response.
+
 ## 🗺️ Choosing the right workflow
 
 | Situation                                                      | Route                                                            |
@@ -301,16 +326,16 @@ Codex Rig's `implement`, `investigate`, and `optimize` routes may probe the publ
 
 Direct marketplace installation is the public path and leaves global/project instructions alone.
 
-From this source checkout, `bash sync.sh codex` performs a broader managed restore: it installs or updates Codex Rig and Codemap, projects selected repository model defaults and personal policy, and manages one authenticated Codex Rig block in `CODEX_HOME/AGENTS.md` unless `--no-codex-global-agents` is supplied. Read the [Codex Rig managed-instructions section](../plugins/codex-rig/README.md#managed-global-instructions) before using it.
+From this source checkout, `bash sync.sh codex` performs a broader managed restore: it installs or updates Codex Rig, Codemap-py, and bridge_CC-Codex, projects selected repository model defaults and personal policy, and manages one authenticated Codex Rig block in `CODEX_HOME/AGENTS.md` unless `--no-codex-global-agents` is supplied. Read the [Codex Rig managed-instructions section](../plugins/codex-rig/README.md#managed-global-instructions) before using it.
 
 `sync.sh` installs from the pushed GitHub remote, not a dirty local tree. Commit and push first when you intentionally want a checkout change to become installable.
 
 <details>
 <summary><strong>Show sync scope and cleanup boundaries</strong></summary>
 
-Direct installation changes only the Codex plugin configuration/cache. Repository sync additionally installs or updates both managed plugins, projects the root `model` and `review_model` defaults plus the authenticated personal policy, and manages one marked Codex Rig global-instructions block unless opted out. It does not overwrite project-owned `AGENTS.md` files or unrelated user configuration.
+Direct installation changes only the Codex plugin configuration/cache. Repository sync additionally installs or updates all three managed plugins, projects the root `model` and `review_model` defaults plus the authenticated personal policy, and manages one marked Codex Rig global-instructions block unless opted out. It does not overwrite project-owned `AGENTS.md` files or unrelated user configuration.
 
-`bash sync.sh codex --no-codex-global-agents` leaves the global file unchanged while still projecting model defaults. `bash sync.sh clear codex` removes this marketplace's Codex plugins and the managed block while preserving user-owned bytes; marketplace registrations and external plugins remain. The native `plugins/codex-rig/scripts/sync_codex.py` path manages the Codex plugins and block but does not project repository model defaults or personal policy.
+`bash sync.sh codex --no-codex-global-agents` leaves the global file unchanged while still projecting model defaults. `bash sync.sh clear codex` removes Codex Rig, Codemap-py, bridge_CC-Codex, and the managed block while preserving user-owned bytes; marketplace registrations remain. The native `plugins/codex-rig/scripts/sync_codex.py` path manages the Codex plugins and block but does not project repository model defaults or personal policy.
 
 </details>
 
@@ -322,6 +347,7 @@ Direct installation changes only the Codex plugin configuration/cache. Repositor
 codex plugin marketplace upgrade borda-ai-rig
 codex plugin add codex-rig@borda-ai-rig
 codex plugin add codemap-py@borda-ai-rig
+codex plugin add bridge@borda-ai-rig
 ```
 
 Use `codex plugin remove <plugin>@borda-ai-rig` to remove a plugin. If old Codex Rig shims exist, run `$codex-rig:agent-shims remove` before removing Codex Rig; removing the plugin first can make authenticated cleanup unavailable.
@@ -360,5 +386,7 @@ For Codex Rig, remove authenticated legacy shims first, then remove the plugin.
 - [Codemap-py runtime executables](../plugins/codemap-py/bin/README.md)
 - [Codemap-py packaging and install probes](../plugins/codemap-py/scripts/README.md)
 - [Codemap-py manifest](../plugins/codemap-py/.codex-plugin/plugin.json)
+- [bridge_CC-Codex product and transport reference](../plugins/bridge_cc-codex/README.md)
+- [bridge_CC-Codex manifest](../plugins/bridge_cc-codex/.codex-plugin/plugin.json)
 
 License: [Apache-2.0](../LICENSE).