fix(codex): digest the whole skill directory, not SKILL.md alone

[imran-siddique]

The bypass, still live here

#63 closed this for Claude Code. The Codex engine had the identical hole: _skill_fingerprints hashed SKILL.md and nothing else, so a payload swapped into a skill's scripts/ directory left the digest byte-identical and the report said "nothing added, nothing subtracted".

Wider blast radius than the Claude Code case. Codex resolves skills from three roots rather than one:

• ~/.agents/skills
• ~/.codex/skills
• per-workspace .agents/skills

That last one means a repo you clone can carry a skill, so the undetected surface included content arriving over the network rather than only content already on your machine. There is a test covering the workspace root specifically.

What changed

_skill_tree_digest hashes every behavioural file in the skill tree, binding relative paths alongside contents so a rename or a move is drift too. Symlinks are skipped, matching the existing _plugin_digest, so a link out of the tree cannot drag unrelated content into the fingerprint.

Exclusions are a tool-controlled denylist: state/, .cache/, __pycache__/, .git/, .pytest_cache/, node_modules/, plus .log, .tmp, .pyc, .pyo. Skills write state as they run and alarming on ordinary use would train the user to dismiss the next real alarm.

The list lives in the engine rather than in a per-skill ignore file on purpose. An ignore file would let the thing being measured decide what gets measured, so a hostile skill could ship a rule exempting its own payload. A test asserts the denylist is engine-side.

Measurement scope versioning, matching #63. Widening the digest makes older fingerprints incomparable, so a scope-1 baseline would otherwise report every skill as changed on upgrade. diff() reports the widening once as "re-approve to compare on the new scope" and drops skills from that comparison. An alarm the user knows is false is worse than no alarm.

Not needed here: Codex already fingerprints instructions and policy files per file, unlike Claude Code before #63, so that half of #63 has no analogue.

Test plan

• plugins/agentrust-codex/tests: 25 passed, 12 new.
• Payload swap into scripts/ detected; manifest change still detected; new file detected; rename detected.
• Workspace-root skills (.agents/skills) covered, since those can arrive by clone.
• state/ churn and .log / .pyc / .tmp artifacts produce no alarm.
• Migration path: a scope-1 baseline yields one scope line and zero phantom skill changes.

One existing fixture needed scope declared, since it models two snapshots from the same engine version.

Pre-existing failure, not from this PR. test_signed_outputs_verify_and_pass_trace_level_zero fails on main; I verified it failing with this change stashed on the same base. It is a TRACE conformance check on generated records and fix/codex-trace-pins is the branch addressing it, so it is untouched here.

Why this shape, for the next surface

Three engines now carry the same skill-digest logic written three times, and this is the second time the same bug had to be fixed independently. Extracting a shared core is the next piece of work, and it is what makes a Copilot integration a path list rather than a fourth thousand-line engine. Copilot Agent Skills use the same SKILL.md plus supporting-folder shape, so this exact bypass applies there too.