feat(plugin): add Daybreak access advisory

[soyeon-oai]

Summary

Replace the connector-based Daybreak access check with a plugin-owned MCP advisory that consumes host-provided account access metadata only when the tool is invoked.

Changes

• Register a read-only, model-visible get_codex_security_daybreak_access tool that explicitly requests the cyber_trusted_access entitlement.
• Validate host metadata and expose only granted, not_granted, or unknown plus the public Daybreak Blue and Daybreak Red program names.
• Fall back to unknown for missing, malformed, stale, or unbound metadata; the result remains advisory and never authorizes or blocks a scan.
• Remove the separate Codex Security Access app dependency and update Standard and Deep Scan workflow guidance to call the plugin tool once before scan work.
• Add bundled MCP and plugin-contract coverage for valid, invalid, stale, replayed, and caller-supplied metadata.

Testing

• pnpm run test:mcp from sdk/typescript: 23 passed.
• pnpm run typecheck from plugins/codex-security/mcp-app: passed.
• python -m pytest plugins/codex-security/tests/test_plugin_contract.py -q: 5 passed.
• Ruff lint and format checks for the plugin source: passed.
• python .github/scripts/check_plugin_source_compatibility.py: passed.
• The full plugin Python suite reached 1,116 passed and 5 skipped. Its only failure came from the local PYTHONSAFEPATH=1 environment blocking an existing sibling-module import; that test passed when rerun without the variable.

Risk and rollout

Hosts that don't provide openai/entitlementContext, including API-key-only sessions, receive unknown and continue normally. The tool doesn't grant access or gate scan execution. Removing the connector means rollout should follow host support for openai/requestedEntitlements.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

Change impact

The scan workflow now asks its own MCP tool for host-verified account context instead of depending on a separate connector.

flowchart LR
  subgraph column_0["Scan workflow"]
    direction TB
    node_0["Call once before scan work<br/><code>config-preflight.md</code>"]
    node_1["Separate access app removed<br/><code>.app.json</code>"]
  end
  subgraph column_1["Plugin MCP"]
    direction TB
    node_2["Request account entitlement<br/><code>get_codex_security_daybreak_access</code>"]
    node_3["Validate host-provided context<br/><code>openai/entitlementContext</code>"]
  end
  subgraph column_2["Advisory result"]
    direction TB
    node_4["Return Blue, Red, or unknown<br/><code>structuredContent</code>"]
    node_5["Keep scan advisory-only<br/><code>scan workflow</code>"]
  end
  node_0 -->|"calls once"| node_2
  node_1 -->|"replaced by"| node_3
  node_2 -->|"returns advisory"| node_4
  node_3 -->|"falls back safely"| node_5
  class node_0 changed
  class node_1 changed
  class node_2 changed
  class node_3 changed
  class node_4 affected
  class node_5 affected
  classDef changed fill:#d7f5e5,stroke:#237a4b,color:#111
  classDef affected fill:#e6f0ff,stroke:#3569a8,color:#111
  classDef context fill:#f2f3f5,stroke:#6e7781,color:#111

Loading

Limits: Host delivery of entitlement metadata is implemented outside this OSS PR. · Tests inject synthetic metadata; they don't prove a live backend, Desktop, CLI, release, or deployment.

Source evidence (6)

• plugins/codex-security/references/config-preflight.md:L87-L89 — The scan workflow calls the plugin advisory exactly once before substantive work and continues regardless of its result.
• plugins/codex-security/.app.json:L1-L9 — The previous manifest declared a separate Codex Security Access connector; this PR removes that entry.
• plugins/codex-security/mcp-app/server.ts:L395-L410 — The bundled tool is model-visible, read-only, zero-input, and declares the account entitlement it needs.
• plugins/codex-security/mcp-app/server.ts:L51-L81 — Versioned schemas reject unsupported grant sources and inconsistent status and grant combinations.
• plugins/codex-security/mcp-app/server.ts:L405-L441 — The handler requires bound metadata, converts stale or invalid input to unknown, and maps valid grants to public program names.
• plugins/codex-security/mcp-app/tests/test_mcp_app_smoke.mjs:L1084-L1174 — The bundled-server test checks tool declaration, missing-context fallback, and successful Daybreak Blue and Red output.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-08T17:10:30.730757Z	c72fcda	New commits
🔒 Security Review	✅ Completed 2026-09-08T17:51:12.886047Z	24e09bb	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c72fcda300

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".