Setup codex pre-check

You install (and verify) a codex "double-check" gate into the current project only: a PreToolUse hook that pipes every proposed Edit/Write/MultiEdit to the codex CLI for an independent review before it is written. codex returns VERDICT: APPROVE (edit proceeds) or VERDICT: BLOCK (edit denied, concerns fed back to Claude). It fails open — if codex is missing/logged-out/erroring, edits are allowed with a warning, never blocked.

This skill bundles the canonical hook and an idempotent installer. Do not hand-write the hook — always install the bundled copy so it stays consistent.

What it installs (into the current project)

• .claude/hooks/codex-precheck.py — the hook (copied from this skill's directory).
• .claude/settings.json — a PreToolUse entry (matcher: "Edit|Write|MultiEdit"), merged in without clobbering existing settings/hooks.
• CLAUDE.md — a short policy section (appended only if not already present).

At runtime (not install time) the hook also creates, inside the project's .claude/:

• codex-precheck.log — an append-only audit trail; one tab-separated line per gated edit: <timestamp> <OUTCOME> <tool> <file> <detail>, where OUTCOME is APPROVE, BLOCK, CACHE_HIT, or SKIP (any fail-open reason). Tell users they can tail -f it to watch the gate, or to confirm whether a given edit was actually reviewed.
• .codex-cache — sha256 digests of already-approved changes, so an identical re-write is a CACHE_HIT and isn't re-sent to codex (avoids redundant reviews and loops).

The bundled hook scans only stderr on a non-zero exit to detect a logged-out codex, so a file that legitimately contains auth strings (e.g. the hook itself) no longer trips a false "logged out" skip.