README: Codex is wired up by the installer now

It was written when --runtime codex refused outside a project, so it told
people to run the whole thing per project. The skill and hooks are
machine-wide now; only the AGENTS.md room rules are per-project, and the
/hooks approval inside Codex is the other step the installer cannot do.

Signed-off-by: disqualifier <dev@disqualifier.me>

README.md

@@ -31,23 +31,28 @@ already set up prints status and changes nothing.
 | --- | --- |
 | `--skill-only` | skill and hooks only; no daemon, no service |
 | `--no-node` | never provision Node; falls back to skill-only if yours is too old |
-| `--no-codex` | don't mention Codex, even if it's installed |
+| `--no-codex` | don't wire Codex, even if it's installed |
 | `--registry <url>` | install from somewhere other than the default registry |
 | `--yes` | don't prompt |
 
 Node 20 is the floor for single mode. The daemon needs 22.13 or newer, because
 it uses `node:sqlite` without a flag.
 
-Claude Code gets wired up machine-wide here. **Codex is per-project** — one of
-the things it writes is a block in the project's own `AGENTS.md` — so the
-installer can't do it for you. If `codex` is on your PATH, the installer says
-so and prints the command; run it inside each project you want Codex in:
+Claude Code gets wired up for you. **Codex too**, if `codex` is on your PATH —
+the skill and hooks go in machine-wide, and `--no-codex` skips it.
+
+Two things Codex needs that the installer can't do for you:
 
 ```sh
+# 1. in Codex, approve the hooks it just installed
+/hooks
+
+# 2. in each project you want Codex in, for the room rules
 standup install --runtime codex
 ```
 
-`--no-codex` tells the installer not to mention it.
+The second one is per-project because it writes a block into that project's
+own `AGENTS.md`.
 
 Windows uses the same flags with PowerShell spelling: `-SkillOnly`, `-NoNode`,
 `-NoCodex`, `-Registry <url>`, `-Yes`.

install.ps1

@@ -243,6 +243,15 @@ if (-not $serviceOnly) {
   & standup install --runtime claude
   if ($LASTEXITCODE -ne 0) { Warn 'runtime install reported a problem; see doctor below' }
 
+  # Codex where its binary exists. Machine-wide: the skill and the hooks. The
+  # AGENTS.md step needs a project and is skipped here -- named in the closing
+  # lines instead. Not run at all without codex, so no marked blocks are left
+  # for a tool that is not installed; -NoCodex opts out where it is.
+  if (-not $NoCodex -and $codexBin) {
+    & standup install --runtime codex
+    if ($LASTEXITCODE -ne 0) { Warn 'codex runtime install reported a problem; see doctor below' }
+  }
+
   if ($probe -and -not $probe.HasExited) { Stop-Process -Id $probe.Id -Force -ErrorAction SilentlyContinue }
   Remove-Item -Recurse -Force $probeDir -ErrorAction SilentlyContinue
 }
@@ -300,13 +309,11 @@ Write-Host ''
 & standup code
 Write-Host ''
 Write-Host 'Next: cd <your project>; standup create'
-# Codex's runtime is per-project -- one of its three targets is the project's
-# own AGENTS.md -- so the installer cannot wire it from here: there is no
-# project yet, and the runtime step's throwaway is deleted. Name the command
-# instead, only where codex exists and the user has not opted out.
 if (-not $NoCodex -and $codexBin) {
   Write-Host ''
-  Write-Host 'Codex is installed here. In each project you want it in:'
-  Write-Host '  standup install --runtime codex    # hooks, skill, a block in AGENTS.md'
+  Write-Host 'Codex: the skill and hooks are wired machine-wide. Codex must TRUST them:'
+  Write-Host '  run /hooks inside Codex and approve.'
+  Write-Host 'Per project, for the room rules in AGENTS.md:'
+  Write-Host '  standup install --runtime codex'
 }
 }

install.sh

@@ -426,6 +426,13 @@ if [ "$SERVICE_ONLY" = 0 ]; then
     done
   fi
   standup install --runtime claude || warn "runtime install reported a problem; see doctor below"
+  # Codex where its binary exists. Machine-wide: the skill and the hooks. The
+  # AGENTS.md step needs a project and is skipped here -- named in the closing
+  # lines instead. Not run at all without codex, so no marked blocks are left
+  # for a tool that is not installed; --no-codex opts out where it is.
+  if [ "$NO_CODEX" = 0 ] && [ -n "$CODEX_BIN" ]; then
+    standup install --runtime codex || warn "codex runtime install reported a problem; see doctor below"
+  fi
   [ -n "$PROBE_PID" ] && { kill "$PROBE_PID" 2>/dev/null || true; wait "$PROBE_PID" 2>/dev/null || true; PROBE_PID=""; }
   rm -rf "$PROBE_DIR"; PROBE_DIR=""
 fi
@@ -471,9 +478,12 @@ if [ -n "$DAEMON_NODE" ]; then
     service_as_operator start >/dev/null 2>&1 \
       || warn "service installed but did not start; see 'standup service status'"
   elif printf '%s' "$SVC_OUT" | grep -qi 'connect to bus'; then
+    # By hand on the unit's home, `standup daemon` is operator-only once a
+    # code exists (P8-06), so the hint carries the flag (R213 C1).
     warn "no systemd --user bus here, so the unit was written but not enabled.
          If this is WSL2: add [boot] systemd=true to /etc/wsl.conf, then 'wsl --shutdown'.
-         Until then run 'standup daemon' yourself; single mode needs nothing."
+         Until then run 'standup daemon --code <operator code>' yourself ('standup code'
+         prints it); single mode needs nothing."
   else
     warn "service install failed; single mode still works. See 'standup service status'."
   fi
@@ -494,12 +504,10 @@ say ""
 standup code 2>/dev/null || say "  (run 'standup code' for the operator code)"
 say ""
 say "Next: cd <your project> && standup create"
-# Codex's runtime is per-project -- one of its three targets is the project's
-# own AGENTS.md -- so the installer cannot wire it from here: there is no
-# project yet, and step 7's throwaway is deleted. Name the command instead,
-# only where codex exists and the user has not opted out.
 if [ "$NO_CODEX" = 0 ] && [ -n "$CODEX_BIN" ]; then
   say ""
-  say "Codex is installed here. In each project you want it in:"
-  say "  standup install --runtime codex    # hooks, skill, a block in AGENTS.md"
+  say "Codex: the skill and hooks are wired machine-wide. Codex must TRUST them:"
+  say "  run /hooks inside Codex and approve."
+  say "Per project, for the room rules in AGENTS.md:"
+  say "  standup install --runtime codex"
 fi