Docs: record Codex MCP baseline PASS

docs/DOCS.md

@@ -35,6 +35,7 @@ This page is the navigation map for Relmote documentation. The root README is th
 - `docs/HUB.md` — optional self-hosted Hub role, co-location model, inventory, updates, rendezvous, and relay direction.
 - `docs/AGENT-HOST-VALIDATION.md` — reproducible Controller → Agent Host → Target validation runbook.
 - `docs/validation/AGENT-HOST-BASELINE-2026-09-26.md` — redacted real-machine PASS evidence for the baseline Agent Host path.
+- `docs/validation/MCP-CODEX-BASELINE-2026-09-27.md` — redacted real-machine PASS evidence for Codex → MCP → Relmote Target authority/revocation behavior.
 - `docs/USE-CASES-CODEX.md` — Codex-oriented use cases; treat implementation-status claims here as subordinate to `STATUS.md`.
 
 ## Screen and transports

docs/MCP-AGENT-HOST.md

@@ -144,4 +144,4 @@ The first real Codex test should repeat the already-validated CLI boundary:
 9. A subsequent Codex tool call fails.
 10. Disabling Agent Access removes target reachability.
 
-Do not promote the MCP/Codex adapter to exercised status until this is observed on a real Agent Host.
+A redacted real-machine PASS is recorded in [validation/MCP-CODEX-BASELINE-2026-09-27.md](validation/MCP-CODEX-BASELINE-2026-09-27.md).

docs/ROADMAP.md

@@ -163,8 +163,8 @@ The repository-wide documentation reconciliation has landed. The next gate is re
 - [x] Update current-status claims from observed validation evidence.
 - [x] Cut the next coherent development snapshot if warranted.
 - [x] Implement the first MCP/Codex adapter on top of the paired-target service.
-- [ ] Connect a real Codex instance to the local MCP adapter.
-- [ ] Re-run read/exec/revocation boundaries through Codex itself.
+- [x] Connect a real Codex instance to the local MCP adapter.
+- [x] Re-run read/exec/revocation boundaries through Codex itself.
 
 The MCP adapter should not precede the baseline authority/revocation validation. It must not broaden target capabilities or expose profile bearer material.
 

docs/STATUS.md

@@ -18,6 +18,7 @@ This document is the canonical high-level implementation-status snapshot. Detail
 - Cross-machine Agent Host pairing and paired-target status/list/read/allowlisted-exec operations.
 - Target-side Agent revocation invalidating already-paired Agent Host credentials.
 - Agent Host capability discovery.
+- Local stdio MCP/Codex Agent Host adapter with explicit Agent Host/Target role semantics, read-only target access, constrained execution, structured denial reasons, and target-side revocation enforcement exercised through a real Codex client.
 - Target-home workspace defaults, scope warnings, and home-confined path suggestions.
 
 ## Implemented, actively experimental
@@ -26,7 +27,6 @@ This document is the canonical high-level implementation-status snapshot. Detail
 - Wayland ScreenCast portal integration.
 - Screen-provider discovery/selection architecture.
 - Browser Agent Access UI and modular JavaScript migration.
-- Local stdio MCP/Codex Agent Host adapter exposing paired-target status/list/read and constrained exec operations; real Codex validation is pending.
 
 These paths are under active real-machine validation and may change between development snapshots.
 

docs/validation/MCP-CODEX-BASELINE-2026-09-27.md

@@ -0,0 +1,130 @@
+# MCP / Codex Agent Host baseline validation — 2026-09-27
+
+**Result: PASS**
+
+This record captures a real-machine validation of a Codex client using Relmote's local stdio MCP adapter on an Agent Host to access a separately paired Relmote Target.
+
+It is intentionally redacted for public documentation.
+
+No personal hostnames, usernames, private network addresses, tailnet details, pairing codes, bearer credentials, or private local filesystem paths are included.
+
+## Environment
+
+| Field | Observed value |
+| --- | --- |
+| Date | 2026-09-27 |
+| Codex client | Codex CLI 0.144.6 |
+| Agent Host | Linux / x86_64 |
+| Target | Linux / x86_64 |
+| MCP transport | local stdio |
+| Relmote MCP build | repository build containing MCP role-context and structured-denial support |
+| Target transport | direct private Tailscale |
+| Workspace | disposable Git test directory |
+| Initial capabilities | `workspace.list`, `workspace.read` |
+| Expanded capabilities | `workspace.list`, `workspace.read`, `terminal.exec` |
+
+The Codex process and `relmote-mcp` ran on the Agent Host. The paired Relmote Target was a separate machine.
+
+## Observed role semantics
+
+Codex was instructed through Relmote MCP server instructions and the `relmote_context` tool that:
+
+- it was running on an Agent Host;
+- `target=` named a separately paired Relmote Target;
+- target workspace paths belonged to the Target rather than the Agent Host filesystem;
+- a Relmote denial must not be bypassed through local shell, SSH, Tailscale, or another path.
+
+Codex correctly described the paired machine as a separate Target and identified returned workspace paths/content as belonging to that Target.
+
+## Read-only operations
+
+With only `workspace.list` and `workspace.read` granted:
+
+- Codex discovered the paired target through Relmote MCP;
+- live target/session status succeeded;
+- listing the approved workspace succeeded;
+- reading a harmless text file succeeded;
+- Codex reported those paths and contents as remote Target data;
+- no execution was attempted during the read-only test.
+
+Only Relmote MCP tools were used for Target access.
+
+## Execution denied without capability
+
+Codex was asked to call `relmote_exec` with the named `git_status` operation while the Target did not grant `terminal.exec`.
+
+Observed result:
+
+- Relmote returned a structured `ok=false` result;
+- the error kind was `denied`;
+- the target-side reason identified `terminal.exec` as not granted;
+- Codex reported the denial;
+- Codex did not attempt local shell, SSH, direct Tailscale, or another route.
+
+This validates the MCP no-bypass authority behavior for the exercised client.
+
+## Explicit execution grant
+
+A new narrow Target grant was created for the same disposable workspace with `terminal.exec` explicitly added.
+
+Codex then:
+
+- fetched live status for the newly paired exec-enabled Target profile;
+- observed the expected capability set;
+- called `relmote_exec` with `git_status`;
+- received `ok=true`;
+- received structured context identifying `execution_location: target`;
+- received `cwd_location: target_workspace`;
+- received successful `git status` output from the Target workspace;
+- reported that execution occurred on the remote Target rather than the local Agent Host.
+
+Only Relmote MCP tools were used for Target access.
+
+## Revocation
+
+The exec-enabled Agent session was revoked on the Target while transport remained available.
+
+Codex then requested live status for the same paired target profile.
+
+Observed result:
+
+- Relmote returned `ok=false`;
+- the error kind was `denied`;
+- the reason stated that the Agent session was not active;
+- Codex stopped immediately;
+- `git_status` was not attempted after the failed live-status check;
+- no alternate route was used.
+
+This confirms that target-side revocation invalidates authority for an already configured Codex/MCP client.
+
+## Baseline criteria
+
+- [x] Codex connects to the local stdio Relmote MCP server;
+- [x] Agent Host vs Target roles are understood correctly;
+- [x] target workspace paths are not confused with Agent Host paths;
+- [x] paired-target discovery works;
+- [x] live target status works;
+- [x] target workspace list/read works;
+- [x] execution is denied when `terminal.exec` is absent;
+- [x] denial reason remains visible through MCP;
+- [x] Codex does not bypass a Relmote denial through another route;
+- [x] execution succeeds after an explicit narrow `terminal.exec` grant;
+- [x] execution context identifies the remote Target;
+- [x] target-side revocation invalidates the Codex/MCP authority;
+- [x] Codex stops after revocation without attempting a second route;
+- [x] no bearer credentials are exposed in normal MCP tool results.
+
+## Remaining follow-up
+
+This PASS validates the exercised Codex CLI + Linux Agent Host + Linux Target path. It does not establish:
+
+- behavior of every MCP host/client;
+- cross-platform Agent Host parity;
+- production secret/keyring storage;
+- general write capability;
+- arbitrary shell access;
+- screen control;
+- Hub/rendezvous behavior;
+- ChatGPT mobile access to a local stdio MCP server.
+
+Those remain separate milestones.