Integration: OpenAI Codex (autonomous compliance agent)

[aanishs]

What

Support running em-dash compliance workflows via OpenAI Codex as an autonomous agent.

v2 Architecture

em-dash v2 stores all state in SQLite (~/.em-dash/projects/{slug}/compliance.db). The skills are framework-agnostic (/comply-auto, /comply-scan, etc.) and process one NIST 800-53 control at a time.

For Codex integration:

1. bin/comply-db already works as a standalone CLI — Codex can call it directly:

   comply-db init --framework hipaa
   comply-db status
   comply-db update-scan AC-2 PASS emdash aws-iam-wildcard "output"
   comply-db sign AC-2 "I attest this is accurate"
   comply-db summary

2. The NIST catalog is a JSON file Codex can read to understand what each control requires.

3. Tool bindings tell Codex which checks to run per control.

4. Autonomous workflow: Codex reads NIST control → runs checks from tool-bindings → writes results to SQLite → moves to next control. No Claude Code dependency.

What's needed

• A Codex-compatible agent configuration (.agents/ directory or equivalent)
• Wrapper script that feeds one NIST control at a time to Codex
• Codex sandbox permissions for: aws CLI, grep, file system, SQLite

Why

Autonomous compliance scans on every PR via CI/CD. Schedule nightly, wake up to a fresh compliance report.

[aanishs]

Update (v3.2): Partially addressed. bin/comply-orchestrate now runs 8 tools in parallel, normalizes findings to 800-53 controls, writes to SQLite, and tags with CIS Benchmark refs. The autonomous agent workflow (run on every PR via CI) still needs work — the GitHub Actions job exists but doesn't run the full comply-orchestrate scan flow yet.

[aanishs]

Shipped: Codex host support landed in #42 (merged to main 2026-04-06) — ./setup --host codex generates Codex wrappers in .agents/skills/ and links them into ~/.codex/skills/. Docs for the Codex install path are in PR #45. Closing.