refine(codemap): anchor paths at git root, add guards

- Anchor every codemap index and log path at the git toplevel instead of the process working directory, across the provider and all four consumer plugins: queries from a repository subdirectory previously compared subdirectory-relative paths against root-relative index entries (permanent stale, self-heal every call) or derived a different index path than the writer (false no_index), and log shards split across two directories so session joins returned nothing. Provider-side this covers the staleness git anchoring, the memoized single git SHA query, the stale_undetermined verdict when git fails inside a repository, and the log-root resolver; consumer-side it rewrites cc_develop's resolver/scanner/gate and skill bash blocks, cc_foundry's six agent files, and cc_oss's review-mode context block.
- Report the index file a query actually loaded as index.index_path, captured at load time rather than recomputed at emission; the codex-rig adapter records it per query, tolerates absence as null for older providers, and reports disagreement with the probe's resolver-derived path as evidence under index_path_divergence instead of reconciling it (structural-context artifact schema version 3).
- Compose coexisting codex-rig caveats into stale+degraded instead of letting a stale index mask a coverage gap, and let a targetless standard batch omit target-requiring queries so analysis without --target can report an honest status.
- Add fail-closed cache freshness to cc_oss's codemap cache via an index_stamp field (size plus mtime), and read the index under a shared rwgate lease in check-index-currency while raising the helper size ceilings from 50 MB to the engine's 512 MB — the old ceiling reported no_index for any index above 50 MB, measured against this repository's own 131 MB index.
- Canonicalize module names from the index instead of sed-based path guessing: resolve_centrality.py gains --modules-only and ordered_modules(), the cc_oss review and dispatch modes query it, and consumer project-name sanitization is dropped for the provider's raw-basename rule.
- Add guard infrastructure: new check_codemap_guard.py (MANIFEST-managed vs registry-declared vs provider-CLI taxonomy, wired into audit_static.py and a new check-codemap-guard pre-commit hook), a canonical codemap-context snippet for cc_foundry, and check_cli_flag_drift.py extended to validate flags in a script's own docstring Usage block against its argparse surface with origin tracking.
- Align the shared codemap-gates contract with reality: the build route is codemap-py index (the scan-index alias leases in-engine and is a deprecated shim, not ungated as four prose sites claimed), consumer wrappers drop their now-redundant override clauses, and the inject-preamble hook's stale ungated-scan comment and model-facing directive are corrected.
- Consolidate the five codemap-py hooks onto a shared _hookutil module for project_name and session_key so path derivation cannot silently diverge between the writer and reader of a session sentinel.
- Port setup_scan_env.sh to stdlib-only setup_scan_env.py (Windows-safe, no python3-on-PATH dependency, shared format_scan_args() quoting) with the .sh kept as a deprecated exec shim, and convert claude-skills dispatcher invocations to bare PATH-literal codemap-py form.
- Gate new codemap-py code on complexity limits (C901, PLR0911/0912/0915) from the root pyproject.toml via a negated per-file-ignore, refactor check_currency under the gate, and enumerate the six pre-existing offenders as accepted debt.
- Correct the codex usage-aggregation docstring to what the README literally claims and record the audit of all 401 captured real turns (exactly one usage event per turn, so max() and sum() are indistinguishable on real data), and add benchmarks/conftest.py so doctest collection can import _bench_common.
- Record per-skill codemap route selection in the codex-rig contract with a drift test, and bump plugin versions (codemap-py 0.30.0, codex-rig 0.7.5, cc_foundry 0.46.1, cc_develop 0.22.1, cc_oss 0.28.1, cc_research) with matching CHANGELOG and README updates.

---
Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
Co-authored-by: OpenAI Codex <codex@openai.com>

Author: 3 people

.github/codex-harness.sh

@@ -28,17 +28,51 @@ case "${1:-}" in
 esac
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd)"
-TMP_PARENT="${RUNNER_TEMP:-${TMPDIR:-/tmp}}"
+
+# Git Bash on windows runners: bash keeps POSIX paths, but the child Python is a native
+# Windows build that cannot resolve them. Convert at every bash/native boundary.
+NATIVE_WINDOWS_PATHS=0
+case "$(uname -s)" in
+  MINGW*|MSYS*|CYGWIN*)
+    if command -v cygpath >/dev/null 2>&1; then
+      NATIVE_WINDOWS_PATHS=1
+    fi
+    ;;
+esac
+
+to_child_path() {
+  if [[ "$NATIVE_WINDOWS_PATHS" -eq 1 ]]; then
+    cygpath -w "$1"
+  else
+    printf '%s\n' "$1"
+  fi
+}
+
+to_host_path() {
+  if [[ "$NATIVE_WINDOWS_PATHS" -eq 1 ]]; then
+    cygpath -u "$1"
+  else
+    printf '%s\n' "$1"
+  fi
+}
+
+TMP_PARENT="$(to_host_path "${RUNNER_TEMP:-${TMPDIR:-/tmp}}")"
 TMP_HOME="$(mktemp -d "$TMP_PARENT/codex-offline-home.XXXXXX")"
 TMP_BIN="$TMP_HOME/bin"
 RESULTS_DIR="${CODEX_HARNESS_RESULTS_DIR:-$ROOT/.github/codex-harness-results}"
 REAL_GIT="$(command -v git || true)"
+PYTHON="$(command -v python3 || command -v python || true)"
 
 if [[ -z "$REAL_GIT" ]]; then
   echo "missing-command:git" >&2
   exit 2
 fi
 
+if [[ -z "$PYTHON" ]]; then
+  echo "missing-command:python3" >&2
+  exit 2
+fi
+
 cleanup() {
   rm -rf "$TMP_HOME"
 }
@@ -107,23 +141,54 @@ esac
 EOF
 chmod +x "$TMP_BIN/git"
 
+# env -i also strips the Windows variables a native Python needs to seed hash randomization
+# (SystemRoot) and to spawn cmd/pwsh (ComSpec, PATHEXT); without them the child aborts with
+# _Py_HashRandomization_Init. Windows spells them mixed-case and bash is case-sensitive, so read
+# both spellings and emit both for SystemRoot. Empty on POSIX, where the env line is unchanged.
+CHILD_ENV=()
+if [[ "$(uname -s)" == MINGW* || "$(uname -s)" == MSYS* || "$(uname -s)" == CYGWIN* ]]; then
+  WIN_SYSROOT="${SYSTEMROOT:-${SystemRoot:-}}"
+  WIN_COMSPEC="${COMSPEC:-${ComSpec:-}}"
+  if [[ -n "$WIN_SYSROOT" ]]; then
+    CHILD_ENV+=("SystemRoot=$WIN_SYSROOT" "SYSTEMROOT=$WIN_SYSROOT")
+  fi
+  if [[ -n "$WIN_COMSPEC" ]]; then
+    CHILD_ENV+=("COMSPEC=$WIN_COMSPEC")
+  fi
+  if [[ -n "${PATHEXT:-}" ]]; then
+    CHILD_ENV+=("PATHEXT=$PATHEXT")
+  fi
+  # HOME alone isolates nothing here: ntpath.expanduser reads USERPROFILE, then HOMEDRIVE plus
+  # HOMEPATH, and never HOME, so `~` would either escape to the runner's real profile or raise
+  # RuntimeError once env -i drops all three. Point the Windows spelling at the same temp home.
+  CHILD_ENV+=("USERPROFILE=$(to_child_path "$TMP_HOME")")
+fi
+
 set +e
 CALIBRATION_OUTPUT="$(env -i \
-  HOME="$TMP_HOME" \
-  CODEX_HOME="$TMP_HOME/.codex" \
-  TMPDIR="$TMP_PARENT" \
+  ${CHILD_ENV[@]+"${CHILD_ENV[@]}"} \
+  HOME="$(to_child_path "$TMP_HOME")" \
+  CODEX_HOME="$(to_child_path "$TMP_HOME/.codex")" \
+  TMPDIR="$(to_child_path "$TMP_PARENT")" \
   PATH="$TMP_BIN:$PATH" \
   CI="true" \
   CODEX_OFFLINE_HARNESS="1" \
-  "$ROOT/plugins/codex-rig/runtime/calibration/run.py" --layout plugin --root "$ROOT" 2>&1)"
+  "$PYTHON" "$(to_child_path "$ROOT/plugins/codex-rig/runtime/calibration/run.py")" \
+  --layout plugin --root "$(to_child_path "$ROOT")" 2>&1)"
 CALIBRATION_EXIT=$?
 set -e
 
 if [[ -n "$CALIBRATION_OUTPUT" ]]; then
   printf '%s\n' "$CALIBRATION_OUTPUT"
 fi
 
-RESULT_PATH="$(printf '%s\n' "$CALIBRATION_OUTPUT" | awk '/\/result\.json$/ { path = $0 } END { print path }')"
+# A native Windows Python prints a backslashed path, so accept either separator (the separator
+# itself stays required — it is what keeps prose lines from matching), then bring it back to a
+# POSIX path for the bash-side -f/dirname/cp below.
+RESULT_PATH="$(printf '%s\n' "$CALIBRATION_OUTPUT" | awk '$0 ~ "[/\\\\]result\\.json$" { path = $0 } END { print path }')"
+if [[ -n "$RESULT_PATH" ]]; then
+  RESULT_PATH="$(to_host_path "$RESULT_PATH")"
+fi
 if [[ -z "$RESULT_PATH" || ! -f "$RESULT_PATH" ]]; then
   echo "missing-result-artifact: expected calibration run to print a result.json path" >&2
   exit 1
@@ -137,7 +202,7 @@ for artifact in result.json behavioral.json recommendations.md checks.txt leaks.
 done
 
 STATUS="$(
-  python3 - "$RESULT_PATH" "$RESULTS_DIR/summary.md" <<'PY'
+  "$PYTHON" - "$(to_child_path "$RESULT_PATH")" "$(to_child_path "$RESULTS_DIR/summary.md")" <<'PY'
 import json
 import sys
 from pathlib import Path

.github/workflows/ci-harness.yml

@@ -19,9 +19,17 @@ on:
 permissions:
   contents: read
 
+defaults:
+  run:
+    shell: bash
+
 jobs:
   offline-harness:
-    runs-on: ubuntu-latest
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: ["ubuntu-latest", "macos-latest", "windows-latest"]
     timeout-minutes: 10
     env:
       CODEX_HARNESS_RESULTS_DIR: ".github/codex-harness-results"

.github/workflows/ci-manifests.yml

@@ -0,0 +1,58 @@
+name: CI manifests
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    paths:
+      - "plugins/**"
+      - "benchmarks/**"
+      - "pyproject.toml"
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  manifests:
+    name: manifest ${{ matrix.manifest }} (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: ["ubuntu-latest", "macos-latest", "windows-latest"]
+        manifest: ["provider-parity-methodology", "codex-integration", "codex-agentic"]
+    timeout-minutes: 10
+    env:
+      UV_PYTHON: "3.12"
+    steps:
+      - name: 📥 Checkout
+        uses: actions/checkout@v4
+
+      # The job-level UV_PYTHON is uv's own equivalent of --python, so no uv run below
+      # repeats the version; the action input installs that interpreter.
+      - name: 📦 Install uv and Python
+        uses: astral-sh/setup-uv@v5
+        with:
+          python-version: ${{ env.UV_PYTHON }}
+
+      # Manifests are gitignored generated artifacts, so a fresh checkout has none to
+      # compare against: build first, then --check that a rebuild is byte-identical.
+      # The builders form a chain — codex-agentic hashes codex-integration.json, and both
+      # Codex builders read provider-parity-methodology.json — so a job builds every
+      # manifest its own target depends on before verifying that target alone.
+      # Bytes are Python-version independent but embed an OS-resolved scan root, so the
+      # matrix covers operating systems, not interpreter versions.
+      - name: 🔨 Build provider-parity-methodology
+        run: uv run --only-group test python benchmarks/build-provider-parity-methodology-manifest.py
+
+      - name: 🔨 Build codex-integration
+        if: matrix.manifest != 'provider-parity-methodology'
+        run: uv run --only-group test python benchmarks/build-codex-integration-manifest.py
+
+      - name: 🔨 Build codex-agentic
+        if: matrix.manifest == 'codex-agentic'
+        run: uv run --only-group test python benchmarks/build-codex-agentic-manifest.py
+
+      - name: 🔒 Verify ${{ matrix.manifest }} rebuilds byte-identically
+        run: uv run --only-group test python "benchmarks/build-${{ matrix.manifest }}-manifest.py" --check

.github/workflows/ci-tests.yml

@@ -10,51 +10,71 @@ on:
       - "pyproject.toml"
       - "sync.sh"
 
-defaults:
-  run:
-    shell: bash
-
 jobs:
-  tests:
+  codex-rig:
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
       matrix:
         os: ["ubuntu-latest", "macos-latest", "windows-latest"]
-        python-version: ["3.10", "3.11", "3.12", "3.13"]
     timeout-minutes: 10
-
+    env:
+      UV_PYTHON: "3.12"
+      # Bytecode written beside a packaged file changes what the manifest checks hash over.
+      PYTHONDONTWRITEBYTECODE: "1"
     steps:
       - name: 📥 Checkout
         uses: actions/checkout@v4
 
-      - name: 🐍 Set up Python
-        uses: actions/setup-python@v5
+      # The job-level UV_PYTHON is uv's own equivalent of --python, so no uv run below
+      # repeats the version; the action input installs that interpreter.
+      - name: 📦 Install uv and Python
+        uses: astral-sh/setup-uv@v5
         with:
-          python-version: ${{ matrix.python-version }}
+          python-version: ${{ env.UV_PYTHON }}
+
+      - name: 🐧 Verify Codex Rig entrypoints
+        if: runner.os != 'Windows'
+        shell: bash
+        run: |
+          uv run --only-group test python plugins/codex-rig/scripts/build_package.py --check
+          uv run --only-group test python plugins/codex-rig/scripts/validate_package.py
+          uv run --only-group test python plugins/codex-rig/shared/collect_pr.py --help
+
+      # Native pwsh, not the Git Bash the job default supplies: it is the shell a Windows user
+      # actually invokes these entrypoints from, and the one that surfaced the path defects.
+      - name: 🪟 Verify native Codex Rig entrypoints
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          uv run --only-group test python plugins/codex-rig/scripts/build_package.py --check
+          uv run --only-group test python plugins/codex-rig/scripts/validate_package.py
+          uv run --only-group test python plugins/codex-rig/shared/collect_pr.py --help
+
+  tests:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: ["ubuntu-latest", "macos-latest", "windows-latest"]
+        python-version: ["3.10", "3.11", "3.12", "3.13"]
+    timeout-minutes: 25
+
+    steps:
+      - name: 📥 Checkout
+        uses: actions/checkout@v4
 
       - name: 🟢 Set up Node
         uses: actions/setup-node@v4
         with:
           node-version: "20"
 
-      - name: 📦 Install uv
+      # The action's python-version input sets UV_PYTHON, uv's equivalent of --python,
+      # so the pytest run below does not repeat the matrix version.
+      - name: 📦 Install uv and Python
         uses: astral-sh/setup-uv@v5
-
-      - name: 🔒 Verify deterministic benchmark manifests
-        run: |
-          uv run --only-group test --python ${{ matrix.python-version }} python benchmarks/build-provider-parity-methodology-manifest.py --check
-          uv run --only-group test --python ${{ matrix.python-version }} python benchmarks/build-codex-integration-manifest.py --check
-          uv run --only-group test --python ${{ matrix.python-version }} python benchmarks/build-codex-agentic-manifest.py --check
+        with:
+          python-version: ${{ matrix.python-version }}
 
       - name: 🧪 Run plugin tests (Python bin/ + JS hooks)
-        run: uv run --only-group test --python ${{ matrix.python-version }} pytest -W error::DeprecationWarning
-
-      - name: 🪟 Verify native Codex Rig entrypoints
-        if: runner.os == 'Windows'
-        shell: pwsh
-        run: |
-          $env:PYTHONDONTWRITEBYTECODE = "1"
-          uv run --only-group test --python ${{ matrix.python-version }} python plugins/codex-rig/scripts/build_package.py --check
-          uv run --only-group test --python ${{ matrix.python-version }} python plugins/codex-rig/scripts/validate_package.py
-          uv run --only-group test --python ${{ matrix.python-version }} python plugins/codex-rig/shared/collect_pr.py --help
+        run: uv run --only-group test pytest -W error::DeprecationWarning --durations=100

.pre-commit-config.yaml

@@ -259,6 +259,13 @@ repos:
         pass_filenames: false
         always_run: true
 
+      - id: check-codemap-guard
+        name: 🗺️ unmanaged codemap index-guard copy
+        language: system
+        entry: python3 plugins/cc_foundry/bin/check_codemap_guard.py
+        pass_filenames: false
+        always_run: true
+
       - id: check-bash-persistence
         name: 🫙 shell var persistence across Bash blocks
         language: system

AGENTS.md

@@ -18,6 +18,19 @@ Simplicity and reliability come first. Understand the affected flow and root cau
 
 Verification is part of implementation. Work is not complete until relevant checks pass and failures, residual risks, and deliberately deferred scope are reported accurately.
 
+## Multi-OS Executables
+
+Scripts, hooks, `bin/` entry points, and CI steps all run on Linux, macOS, and native Windows. A POSIX-only assumption is a defect to fix at the source, never a reason to skip the platform.
+
+- `pathlib`; `Path(p).is_absolute()` not a leading-slash check; `PurePath(p).as_posix()` before hashing, serializing, or comparing a path — native separators change the digest.
+- POSIX-absolute literals are not portable fixtures: `/host/x` resolves to `D:\host\x` on Windows.
+- Byte-asserted or hashed writes use `newline="\n"` or bytes; text mode emits CRLF on Windows.
+- Sanitized subprocess `env=` keeps `SystemRoot`, `SYSTEMROOT`, `COMSPEC`, `PATHEXT`, `TEMP`, `TMP` on win32, else the child Python aborts before running; temp dirs via `os.environ.get("TMPDIR") or tempfile.gettempdir()`, never `/tmp`.
+- A workflow `run:` step invoking `.sh` needs explicit `shell: bash` — the Windows default shell dot-sources it and exits zero, a false green.
+- Symlinks, file modes, and uid checks are capabilities: degrade in production code first.
+- Skips are the last resort: never a blanket `skipif(sys.platform == "win32")`, always a capability probe skipping on `OSError`, with each surviving skip documented and re-audited.
+- Green macOS is absence of regression, not Windows support: prove Windows semantics with `PureWindowsPath` or `ntpath`, since monkeypatching `os.name` does not change `pathlib`.
+
 ## Benchmark Isolation
 
 Benchmark task IDs, target repositories, prompt wording, expected answers, and task-specific source or symbol examples are test evidence, not production content. Never copy them into shipped plugins, Skills, templates, or user-facing docs; use neutral generic examples and encode the generalized contract in a regression test instead.
@@ -39,6 +52,6 @@ Plugin-specific authoring, installability, cross-reference, versioning, and veri
 - Python minimum: 3.10. The repository root is an environment anchor, not an installable package.
 - Bootstrap test tooling with `uv sync --only-group test`; benchmark-only dependencies use `uv sync --only-group bench`.
 - Run focused tests with `.venv/bin/python -m pytest <paths>` and broaden to the affected suite before completion.
-- Lint/format Python edits via the pinned pre-commit hooks, never the bare tool: `pre-commit run ruff-check --files <changed-python-paths>` and `pre-commit run ruff-format --files <changed-python-paths>`; direct `ruff` invocation drifts from the version/config pinned in `.pre-commit-config.yaml`.
+- Lint/format edits via the pinned pre-commit hooks, never the bare tool: `pre-commit run ruff-check --files <changed-python-paths>`, `pre-commit run ruff-format --files <changed-python-paths>`, and `pre-commit run mdformat --files <changed-markdown-paths>`; direct `ruff` or `mdformat` invocation drifts from the version/config pinned in `.pre-commit-config.yaml`.
 - Use `pre-commit run --all-files` only when the task requires the repository-wide gate; preserve unrelated working-tree changes.
 - Release and build entry points are plugin-specific; follow `plugins/AGENTS.md` and the owning plugin's scripts and README. Remote publication remains human-owned.

CLAUDE.md

@@ -42,6 +42,19 @@ Hook ids (from `.pre-commit-config.yaml`): `ruff-check`, `ruff-format`, `eslint`
 - Bootstrap test tooling with `uv sync --only-group test`; benchmark-only dependencies use `uv sync --only-group bench`.
 - Run tests with `.venv/bin/python -m pytest <paths>` — **not** `uv run pytest` or a bare `pytest`; the project venv is the pinned environment. Start focused, broaden to the affected suite before completion.
 
+## Multi-OS Executables — POSIX Assumption = Defect
+
+Scripts, hooks, `bin/`, CI steps all run Linux + macOS + native Windows. Fix at source; skip never.
+
+- `pathlib`; `Path(p).is_absolute()` not `startswith("/")`; `PurePath(p).as_posix()` before hash/serialize/compare — separators change digests
+- POSIX-absolute literals unportable as fixtures: `/host/x` → `D:\host\x` on Windows
+- Byte-asserted or hashed writes: `newline="\n"` or bytes — text mode emits CRLF
+- Sanitized subprocess `env=` keeps `SystemRoot`, `SYSTEMROOT`, `COMSPEC`, `PATHEXT`, `TEMP`, `TMP` on win32 — else child Python aborts: `_Py_HashRandomization_Init: failed to get random numbers`; temp dir via `os.environ.get("TMPDIR") or tempfile.gettempdir()`, never `/tmp`
+- CI `run:` calling `.sh` needs explicit `shell: bash` — Windows pwsh dot-sources it, exits 0, runs nothing (false green)
+- Symlink/mode/uid = capabilities: degrade in production code first
+- Skip last resort: never blanket `skipif(sys.platform == "win32")` — probe capability, skip on `OSError`; document + re-audit each surviving skip
+- Green macOS ≠ Windows support: prove with `PureWindowsPath`/`ntpath`; monkeypatching `os.name` does not change `pathlib`
+
 ## Benchmark Isolation
 
 Benchmark task IDs, target repositories, prompt wording, expected answers, and task-specific source or symbol examples are test evidence, not production content. Never copy them into shipped plugins, skills, templates, or user-facing docs; use neutral generic examples and encode the generalized contract in a regression test instead.

benchmarks/AGENTS.md

@@ -1,11 +1,12 @@
 # Benchmark Instructions
 
+Root `AGENTS.md` applies here and is not restated: benchmark isolation, the test/lint workflow, multi-OS executables, and Markdown no-wrap. Below is benchmark-specific only.
+
 - Use Fire for every Python CLI. Add a study to an existing provider runner when it shares transport or isolation; keep stage-specific contracts and scorers in focused modules rather than creating a second launcher.
 - Interactive A/B/C result rows are a CLI contract: persist plain rows to a stage run log when that stage has one, and always route terminal output through the existing shared Rich arm renderer. Do not add direct `print()` paths for arm rows; redirected output must remain ANSI-free. Add a focused renderer-forwarding regression for every new stage or rescore path.
 - Never run paid models. Give the user the exact command emitted by a fresh dry run with its 16-character `--paid-approval` token; retain the complete SHA-256 in benchmark provenance, then analyze only the artifact they provide.
 - Treat task suites, manifests, frozen repositories, indexes, and input snapshots as immutable benchmark coordinates. Regenerate generated manifests after contract or consumer changes; do not edit result artifacts.
-- Convert benchmark findings into generic production contracts; never copy benchmark task IDs, target repositories, prompt wording, expected answers, or task-specific source/symbol examples into shipped plugins, Skills, templates, or user-facing docs.
 - Keep A/B/C arms symmetric except for the documented treatment supplement. State Codemap's static-graph boundary: use it for compact symbol/dependency/importer/caller facts, not runtime validation, test execution, or edits.
 - Treat A_plain versus C_strict as the decision-grade comparison. B_auto is an optional-use canary: if it costs more than A_plain, recommend the installed integration rather than treating that as a failure of the strict treatment.
 - Executable tasks require benchmark-owned disposable worktrees, canonical diff capture, a second clean scoring worktree, ordinary patch application, independent behavior oracle, and verified cleanup. `--recount` is diagnostic-only.
-- Run focused `pytest` for behavior, then invoke the exact pre-commit hooks for changed files: `pre-commit run ruff-check --files <python-files>`, `pre-commit run ruff-format --files <python-files>`, and `pre-commit run mdformat --files <markdown-files>`. For a changed runner execute its relevant `--dry-run` and scope-resolution command; no-model checks may be run by Codex.
+- For a changed runner execute its relevant `--dry-run` and scope-resolution command; no-model checks may be run by Codex.