fix: harden dual-host QE-Court transport

MAINTAINER.md

@@ -95,7 +95,9 @@ docs/
 `docs/INSTALLATION.md`, `docs/MODELS.md`, `docs/PROVIDERS.md`, `docs/SETUP.md`,
 `docs/TROUBLESHOOTING.md`, `docs/UPGRADING.md`, `docs/CODEX-STATUSLINE.md`,
 `docs/adr/0015-managed-codex-native-statusline.md`,
-`docs/adr/0032-model-lifecycle-intelligence.md`, and
+`docs/adr/0032-model-lifecycle-intelligence.md`,
+`docs/adr/0033-retire-codex-mcp-and-bound-qe-court-participants.md`,
+`tests/live/qe-court-participant-transport.test.mjs`, and
 `docs/ddd/model-lifecycle-intelligence.md`. Generated workspace state under
 the shipped source trees is explicitly excluded. Nothing else ships — verify with
 `npm pack --dry-run` before a release if you touch `files`.
@@ -105,7 +107,8 @@ split between `integrations.hosts` (which hosts are enabled) and top-level `rout
 (`version`, `primaryHost`, and the per-activity `routes`). `routing.mjs` is pure
 (defaults, primary-host mirroring, validation, and projections to AQE
 `agentOverrides` and `ak run`); `providers.mjs` does the I/O (host/auth detection,
-environment wiring, both MCP-bridge directions, AQE router file). Seeded/healed by
+environment wiring, Codex's independent Ruflo integration, legacy MCP retirement, and the AQE
+router file). Seeded/healed by
 `setup` + `sync` + `x host pick`, surfaced by `status` + `dashboard`. Design records:
 ADRs [0001–0006](docs/adr/); user guide: `docs/PROVIDERS.md`.
 

claude/dual-mode-reference.md

@@ -9,10 +9,9 @@
 
 ## Ambidextrous dual-host mode (claude + codex)
 
-Both frontier CLIs are enabled, so `ak` runs **ambidextrous**: the same tools, memory,
-and quality gates are available whichever agent is in the driver's seat, and each host can
-reach the other. Work flows complementarily — Claude and Codex are peers, not primary and
-fallback.
+Both frontier CLIs are enabled, so `ak` runs **ambidextrous**: the same Ruflo/AQE tools,
+memory, and quality gates are available whichever agent is in the driver's seat. Work flows
+complementarily — Claude and Codex are peers, not primary and fallback.
 
 ### `ak run` — canonical activity pipelines
 
@@ -37,17 +36,21 @@ ak run refactor "extract the payment module" --dry-run
 - **`--json`** — emit machine-readable output while executing; combine it with
   `--dry-run` for a machine-readable preview.
 
-### The Claude ↔ Codex bridge (bidirectional MCP)
+### Cross-host integration
 
-The two hosts see each other as MCP servers, so either can delegate to the other mid-task:
+Managed cross-host work uses one bounded path:
 
-- **Claude → Codex** — Codex is exposed as an MCP server (`codex mcp-server`); Claude
-  reaches it through the **`mcp__codex__codex`** tool to hand a subtask to Codex.
-- **Codex → ruflo** — Codex registers ruflo's MCP via `[mcp_servers.ruflo]` in
+- **Claude-led or Codex-led execution** — use `ak run`; every worker has one absolute
+  deadline and process-tree cleanup.
+- **Codex → Ruflo/AQE tools** — Codex registers Ruflo's MCP via `[mcp_servers.ruflo]` in
   `~/.codex/config.toml`, so Codex-driven sessions get the same memory, routing, and swarm
-  tools Claude has.
+  tools Claude has. Agentic-QE owns its separate Codex MCP/platform integration.
+- **Optional Claude → Codex interactive delegation** — OpenAI's Claude Code plugin uses
+  Codex App Server and remains user-owned. Agentic-kit never silently installs it.
 
-Register (or repair) both directions with `ak sync`; inspect with `ak status`.
+OpenAI deprecated `codex mcp-server` on 2026-08-24. `ak sync` removes only the legacy
+project registration that agentic-kit owns; user-owned entries are preserved and warned.
+Inspect the effective topology with `ak status`.
 
 ### Per-activity routing + escalation ladders
 
@@ -68,6 +71,8 @@ ambidextrous experience with the roles flipped. `ak status` marks the primary an
 Two enabled hosts do not by themselves prove two inference vendors. qe-court diversity must be
 grounded in the providers that actually serve the selected roles. Prefer independently evidenced
 providers for review/security activities and treat configured host/model routes as intent, not
-vendor proof.
+vendor proof. `primaryHost` mirrors `ak run` activity routes; it does not reverse QE-Court seats.
+Until Agentic-QE ships a host-neutral court runner and complete Codex projection, the reciprocal
+live check is a **participant-transport regression**, not a court verdict.
 
 <!-- END ruflo-dual-mode-reference -->

claude/providers-reference.md

@@ -62,17 +62,17 @@ ak host off      # reset to claude-only default; strip managed env keys
 
 `pick` persists your choice to `kit.json` and applies it: it writes the ruflo backend flags
 (`ENABLE_CLAUDE_CODE` / `ENABLE_CODEX`) and `AQE_LLM_PROVIDER` into
-`.claude/settings.local.json` `env` (merge-not-clobber, backup-first), maintains the
-Claude↔Codex bridge when both hosts are enabled, and registers any API-key providers with ruflo.
+`.claude/settings.local.json` `env` (merge-not-clobber, backup-first), maintains Codex's
+independent Ruflo integration, and registers any API-key providers with ruflo.
 `ak sync` reapplies the same choice idempotently; `ak status` shows **hosts** and
 **providers** rows and flags drift. At the claude-only default nothing is written — behavior
 is unchanged until you opt in.
 
-When **both** hosts are enabled, `ak` also seeds a **per-activity routing policy** and wires a
-**two-way Claude↔Codex MCP bridge** (Claude reaches Codex via `mcp__codex__codex`; Codex reaches
-ruflo via `[mcp_servers.ruflo]`). `--primary-host claude|codex` chooses which host leads. See the
-ambidextrous dual-host reference block and `docs/PROVIDERS.md` §3.5 for the routing table and
-canonical `ak run` execution.
+When **both** hosts are enabled, `ak` also seeds a **per-activity routing policy** and gives Codex
+Ruflo access via `[mcp_servers.ruflo]`. `--primary-host claude|codex` chooses which host leads
+bounded `ak run` pipelines. OpenAI deprecated the former Claude→`codex mcp-server` projection;
+its Claude Code plugin is an optional user-owned interactive path. See the ambidextrous dual-host
+reference block and `docs/PROVIDERS.md` §3.5.
 
 ### Install & update (install-method-aware)
 

docs/HOST-SUPPORT.md

@@ -53,7 +53,7 @@ served it. See [Providers and hosts](PROVIDERS.md) for those axes in detail.
 | agentic-kit standing | Default-enabled; primary-eligible | Opt-in; primary-eligible | Opt-in; explicitly non-primary |
 | `ak run` execution | Native CLI adapter | Native CLI adapter | Managed supervised-server adapter |
 | Automatic activity routes | Yes | Yes | No; explicit routes only |
-| Ruflo support | Reference/native surface | Strong, with bridge and parity gaps | Managed compatibility layer |
+| Ruflo support | Reference/native surface | Strong, with integration and parity gaps | Managed compatibility layer |
 | AQE support | Default and fullest path | Strong platform path; one direct-provider gap in `ak` | Upstream platform assets, not an AQE inference provider |
 | RuvNet Brain | Native plugin, hooks, MCP, console | Native plugin, hooks, MCP, skills | Managed search MCP and guidance; no native Brain plugin |
 | Managed command status line | Yes | No; Codex's native built-in fields only | No |
@@ -106,14 +106,15 @@ Official extension references: [Claude hooks](https://code.claude.com/docs/en/ho
 
 | Ruflo capability | Claude Code | Codex | OpenCode |
 | --- | --- | --- | --- |
-| Upstream host orientation | **Native:** primary/reference CLI surface | **Native + managed:** upstream backend/plugin pieces plus agentic-kit bridge | **Managed:** no equivalent upstream backend flag |
+| Upstream host orientation | **Native:** primary/reference CLI surface | **Native + managed:** upstream backend/plugin pieces plus agentic-kit integration | **Managed:** no equivalent upstream backend flag |
 | Ruflo MCP tools | Native registration | Managed Ruflo MCP registration | Connected managed MCP; compact lazy `ak_ruflo_*` provider projection |
 | Shared Ruflo memory | Same project store | Same project store | Same project store when pointed at the same Ruflo server |
 | Agents and skills | Upstream Claude assets | Codex-compatible skills/plugin assets and generated guidance | Receipt-owned lazy profile catalogue through one stock `ak-specialist`; stock skills loaded on demand |
 | Lifecycle hooks | Native Claude hooks | Codex hooks/plugin surfaces | OpenCode events translated by `ruflo-hooks.js` |
 | Inference-backend flag | `ENABLE_CLAUDE_CODE` | `ENABLE_CODEX` | None |
-| Cross-host bridge | Claude can call the Codex MCP server | Codex can call Ruflo MCP | No equivalent peer bridge |
-| Upgrade convergence | `ak sync` heals managed assets | `ak sync` heals bridge/guidance | `ak sync` regenerates the embedded catalogue and repairs exact-receipted plugins/config |
+| Cross-host execution | `ak run` can lead bounded Codex workers | `ak run` can lead bounded Claude workers | Explicit `ak run` routes only |
+| Interactive peer path | Optional user-owned OpenAI Codex plugin/App Server | No supported inverse Claude plugin | None |
+| Upgrade convergence | `ak sync` heals managed assets | `ak sync` heals Ruflo/AQE access and retires owned legacy MCP | `ak sync` regenerates the embedded catalogue and repairs exact-receipted plugins/config |
 | Teardown | Managed blocks and registrations | Receipt-based managed teardown | Value- and hash-receipt teardown; user-owned values survive |
 
 Ruflo MCP access and Ruflo-backed inference are different contracts. In

docs/PROVIDERS.md

@@ -266,7 +266,7 @@ An interactive picker (or flags for scripts). Enable `codex` and `ak`:
 
 - installs it if it's missing (`npm i -g @openai/codex`) — but leaves an existing
   mise/brew/native install alone,
-- maintains the Claude↔Codex bridge and generated host guidance,
+- maintains shared Ruflo/AQE access and generated host guidance,
 - writes `ENABLE_CLAUDE_CODE` / `ENABLE_CODEX` into `.claude/settings.local.json`.
 
 > [!NOTE]
@@ -383,13 +383,30 @@ is aborted and reported as `permission_required`; `ak` never auto-approves it. O
 not written to AQE `agentOverrides`, cannot become `primaryHost`, and do not count as a separate
 AQE vendor. `ak run` is the only execution surface for an OpenCode route.
 
-**QE-Court validation stays upstream-owned.** `agentic-qe` 3.13.3 corrected its shipped
-QE-Court panel and now enforces the configured anti-collusion policy before convening.
-`ak status` and `ak host status` surface that result read-only; `ak sync` never rewrites
+**QE-Court validation stays upstream-owned.** Agentic-kit's local check proves only configured
+vendor diversity and writer/jury separation; it does not prove that provider seats or the court
+runtime are executable. `ak status` and `ak host status` state that boundary explicitly, and
+`ak sync` never rewrites
 `.claude/skills/qe-court/config.json`. If a config created by 3.13.2 or earlier still
 seats both `defense` and `jury` on Cognitum tiers, regenerate it with 3.13.3+ or change
 `defense` to `claude-code` so the jury and defense use distinct vendors.
 
+`primaryHost` controls the mirrored `ak run` activity policy, not QE-Court roles. The source-tree
+live regression exercises bounded participant transport from both directions without claiming a
+court verdict:
+
+```bash
+pnpm test:qe-court-live                    # one Claude-led + one Codex-led trial
+AK_QE_COURT_TRIALS=5 pnpm test:qe-court-live  # POSIX soak
+```
+
+Each seat performs an MCP-native Ruflo memory store→retrieve round trip, emits the exact returned
+value in a validated bounded handoff, and must terminate within its absolute deadline. The check
+independently confirms the stored project-memory value and fails on repository mutation or
+orphaned state.
+Full court parity remains blocked until Agentic-QE ships a supported host-neutral runner and a
+self-contained Codex QE-Court projection.
+
 Defaults (all overridable; your edits are marked `custom` and never re-seeded):
 
 | Activity | Host | Default model |
@@ -447,9 +464,9 @@ weigh, cleared with `ak x host refresh` if you want the newer default.
 set as authoritative. Excluding a routing host removes it from persisted routes and escalation
 ladders before AQE is reprojected; seeded entries are removed silently, while a user-pinned route
 prints a warning naming the disabled host. It also removes stale agentic-kit-curated AQE overrides
-while preserving foreign override keys. Excluding Codex additionally retires only the two
-marker-owned Codex MCP bridges; user-registered MCP servers are left alone. Re-enabling Codex
-converges those bridges again.
+while preserving foreign override keys. Excluding Codex retires only marker-owned integrations;
+user-registered MCP servers are left alone. The deprecated Claude→Codex MCP projection is retired
+even while Codex remains enabled, while the independent Ruflo-in-Codex registration converges.
 
 `routing.routes` intentionally names a host and model, not an inference provider. Provider resolution
 is a separate binding lookup; absent grounded evidence remains unknown or explicitly inferred.
@@ -467,7 +484,7 @@ The native config stores each knob below lives in — and their precedence — a
 
 | You want to…                         | `ak` way                          | The raw ruflo/aqe way it maps to                    |
 | ------------------------------------ | --------------------------------- | --------------------------------------------------- |
-| Enable claude/codex hosts            | `ak host pick`              | `ENABLE_CLAUDE_CODE` / `ENABLE_CODEX` env + managed bridge/guidance |
+| Enable claude/codex hosts            | `ak host pick`              | `ENABLE_CLAUDE_CODE` / `ENABLE_CODEX` env + shared Ruflo/AQE access and guidance |
 | Register a Ruflo LLM provider        | `--provider ollama:qwen3.6:27b`   | `ruflo providers configure -p ollama -m qwen3.6:27b -e http://127.0.0.1:11434` |
 | Select a direct Ruflo provider       | per-agent/raw setting             | agent `--provider` or `RUFLO_PROVIDER=ollama` / `openrouter` |
 | Set which LLM runs QE                | `--aqe-provider gemini`           | `AQE_LLM_PROVIDER=gemini` (env)                     |

docs/SETUP.md

@@ -74,8 +74,9 @@ versions. The table below describes the current contract.
 | Project `AGENTS.md` | Arbitrary project content is preserved. Agentic-kit only reconciles its own sentinel-delimited managed blocks, including removing stale blocks that no longer apply. | Created only when a selected integration needs managed guidance. |
 
 Project setup also reapplies enabled host/provider wiring and seeds the default
-per-activity routing policy in dual-host mode. With Codex enabled, it repairs
-both directions of the Claude/Codex–Ruflo bridge.
+per-activity routing policy in dual-host mode. With Codex enabled, it registers
+the workspace-aware Ruflo MCP in Codex and retires only agentic-kit-owned legacy
+`codex mcp-server` project entries.
 
 ## Setup trust manifest
 
@@ -117,11 +118,14 @@ is removed and setup fails instead of silently expanding project trust.
 
 ### Codex and OpenCode
 
-Codex does not need an agentic-kit auto-approve list. The manifest instead names
-the project Claude-to-Codex MCP bridge, the user-scope Codex-to-Ruflo MCP
-registration, and the AQE Codex integration that project setup will create.
+Codex does not need an agentic-kit auto-approve list. The manifest names the
+user-scope Codex-to-Ruflo MCP registration and the AQE Codex integration that
+project setup will create.
 Agentic-kit does not alter Codex's sandbox or approval policy.
 
+OpenAI's Claude Code plugin for Codex is an optional App Server-based interactive
+path. It is user-owned: setup and sync never install, enable, update, or remove it.
+
 Codex also retains exclusive ownership of third-party plugins. Agentic-kit never
 installs or enables a Codex plugin (including `security-guidance`), and setup/sync
 never rewrites Codex's plugin tables or cache. `ak status` only reads enabled

docs/UPGRADING.md

@@ -83,7 +83,7 @@ open in other terminals, here is what can actually reach them, worst first:
 What does **not** break, by design: running binaries keep executing their old code
 (replaced files don't affect a running process's open inodes). Agentic-kit's managed
 settings and guidance writers are atomic and fail closed when the one-time backup cannot
-be created or validated. Settings env keys, `~/.codex/config.toml` edits (MCP bridge,
+be created or validated. Settings env keys, `~/.codex/config.toml` edits (Ruflo/AQE MCP,
 `[tui]` status line), OpenCode wiring, `.agentic-qe/llm-config.json`, and the managed
 guidance blocks are all **read at session start** — a live session simply doesn't see
 them until its next launch. The kit's own self-update runs last and applies from the next
@@ -158,6 +158,11 @@ an agentic-qe or `ak` upgrade. If `ak status` reports `writerIsNeverJuror`, rege
 config with agentic-qe 3.13.3+ or change `routing.defense.provider` from `cognitum-low` to
 `claude-code`. `ak` reports this state read-only; `ak sync` no longer changes QE-Court roles.
 
+The local anti-collusion check is not a runtime-readiness proof. Current consumer projections can
+reference source-only referee/oracle assets, and `primaryHost` does not reverse court seats. Use
+`pnpm test:qe-court-live` in a source checkout for one bounded Claude-led and one bounded
+Codex-led **participant-transport** trial; do not record it as a court verdict.
+
 If you already have `ak` working, you almost never need `ak setup` again — it's the
 installer. Enabling a shipped-but-opt-in host feature is a `host pick` (or an `x mcp pick`,
 etc.), not a re-`setup`. Project setup calls `ruflo init --full --force`, so review the
@@ -184,7 +189,8 @@ ak host status                 # 3. verify: hosts "enabled, wired" + routing tab
 Step 1 gets the newer code onto disk. Step 2 is what actually turns dual-host on — it
 records `codex` in `kit.json` and does the wiring: writes `ENABLE_CODEX` into
 `.claude/settings.local.json`, seeds the per-activity routing policy, registers the
-Codex↔ruflo MCP bridge both ways, and generates the dual-host guidance.
+workspace-aware Ruflo MCP in Codex, retires any agentic-kit-owned legacy `codex mcp-server`
+project entry, and generates the dual-host guidance.
 Add `--primary-host codex` if you want Codex to lead (Claude becomes the alternate).
 
 > [!NOTE]
@@ -208,12 +214,12 @@ Every `ak` command ends with a best-effort, never-blocking drift nudge. It has t
 - **Version drift** (npm-managed tools; TTL-cached network check):
   `↑ ruflo 4.1.0 available (installed 4.0.0) — run: ak sync`
 - **Local artifact drift** (spawn-light file compares, evaluated on every run):
-  `↻ drifted: 2 CLAUDE.md block(s) · codex MCP unregistered — run: ak sync`
+  `↻ drifted: 2 CLAUDE.md block(s) · deprecated codex MCP registered — run: ak sync`
 
 The second half covers the artifacts `ak` *renders*: managed guidance blocks in the
 machine-wide guidance files (`~/.claude/CLAUDE.md`, and `~/.codex/AGENTS.md` on codex
-machines), the Claude↔Codex MCP bridge (both
-directions), and the statusline footer. These can drift with **no version change at all** —
+machines), Codex's independent Ruflo/AQE access, legacy MCP retirement, and the statusline
+footer. These can drift with **no version change at all** —
 a kit update (or, on an npm-linked dev checkout, merely merging a PR that edits a
 `claude/*.md` template) revises the source of truth, and the rendered copies lag until the
 next `ak sync`. The nudge closes that window, using the exact drift definitions `ak status` uses (the two

docs/adr/0001-one-routing-policy-many-projections.md

@@ -2,13 +2,15 @@
 
 - **Status:** Superseded in part by [ADR-0020](0020-ga-stable-surfaces.md)
 - **Date:** 2026-07-23
-- **Updated:** 2026-07-30
+- **Updated:** 2026-08-25
 - **Update note:** Retained the one-policy decision while retiring the compatibility projection,
   command, and persisted names for GA.
 - **Deciders:** agentic-kit maintainers
 
 > **Historical scope:** the one-policy principle remains, but the compatibility command,
 > adapter projection, and persisted field names recorded below were removed for 4.0 GA.
+> OpenAI deprecated the recorded `codex mcp-server` projection on 2026-08-24;
+> [ADR-0033](0033-retire-codex-mcp-and-bound-qe-court-participants.md) retires it.
 
 ## Context