RFC: Codex Integration

Nobody has claimed this yet.

### Summary

This RFC proposes adding first-party Codex CLI governance to AGT as a new package, `agent-governance-codex-cli`. It's a thin host adapter over the existing Claude Code governance core. Codex's hook system (SessionStart, UserPromptSubmit, PreToolUse) mirrors Claude Code's contract, so the governance logic is reused unchanged and only host wiring is new, following the same derivation used for the OpenCode integration (#2658). I originally [fork and extended it to govern my own Codex agent](https://github.com/thatjosh/agent-governance-toolkit), so it's already implemented and verified, with policy deny/allow/audit working e2e. I'm happy to contribute it back upstream and help maintain this going forward.

Working fork: https://github.com/thatjosh/agent-governance-toolkit

### Motivation

AGT ships governance integrations for Claude Code, Copilot CLI, OpenCode, and Antigravity, but not for the OpenAI Codex CLI, which is becoming more popular with GPT 5.6.

### Detailed Design

Codex's hook system (SessionStart, UserPromptSubmit, PreToolUse) mirrors Claude Code's contract, so the governance logic is reused unchanged and only host wiring is new, following the same derivation used for the OpenCode integration (https://github.com/microsoft/agent-governance-toolkit/pull/2658).

### Enforcement surface

| Codex event | AGT behavior |
|---|---|
| `SessionStart` | inject governance context |
| `UserPromptSubmit` | prompt inspection, fail-closed block |
| `PreToolUse` | allow / deny / ask via policy |

Decision mapping onto Codex's hook response schema:

```jsonc
// policy deny ->
{ "hookSpecificOutput": { "hookEventName": "PreToolUse",
"permissionDecision": "deny", "permissionDecisionReason": "…AGT policy…" } }
// policy review -> "permissionDecision": "ask"
// policy allow -> no permissionDecision
```

### Alternatives Considered

N/A

### Security Implications

Trust model / cryptographic boundaries are unchanged. This package does not modify the policy engine, trust scoring, cryptographic choices, or the audit format. It reuses the existing Claude Code governance core unchanged and only translates Codex's hook payloads
to and from that core.

### Migration / Backward Compatibility

_No response_

### Scope

Single package

### Target Placement

Integration (integrations/ directory)

### Prior Art

https://github.com/microsoft/agent-governance-toolkit/pull/2658

### Checklist

- [x] I have searched existing issues and RFCs for duplicates
- [x] I have read the ADR index (adr/index.md) for related decisions
- [x] I am willing to implement this RFC or help review an implementation

Start with the integrations/ directory and the ADR index at adr/index.md, then compare the existing OpenCode integration from pull request #2658 with the working fork linked in this RFC. Verify that the Codex package covers SessionStart, UserPromptSubmit, and PreToolUse with the stated allow, deny, and ask mappings, and that end-to-end policy behavior matches the described scope.

Written by the indexing model from the issue text.