[pwya]

Summary

• recognize Codex Desktop's actual FREEFORM apply_patch payloads and shell_command events
• keep Claude Code support through an allowlisted shell-neutral Python runner for the existing PowerShell hooks
• update installers, static verification, cross-harness guidance, and isolate the two live-probe actions

Validation

• full portable CI command set passes locally
• verify_hooks.ps1: 6/6 green from both release and local skill trees
• installed Codex policy self-test passes; deployed/local/release policy hashes match
• all 9 CC Switch Claude provider templates use the canonical runner

Runtime note

The new Codex md-paper hook definition still requires explicit Trust in /hooks and a new Codex task before the current-session live probe can pass. The task used to install it correctly reports both actions as not denied because its hook snapshot predates the new definition.