docs(configuration): document the multi_agent_v2 decision

Recorded why it is not configured: it does not appear in the current
documented Codex schema, only in upstream issue titles describing an
internal/experimental flag. [agents].enabled already covers enabling
multi-agent tools; the schema's separate [features].multi_agent toggle
would be redundant alongside it.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -9,7 +9,7 @@ jobs:
   linux:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Build
         run: ./scripts/build.sh
       - name: Doctor
@@ -29,7 +29,7 @@ jobs:
   windows:
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Build
         shell: powershell
         run: .\scripts\build.ps1

docs/configuration.md

@@ -4,7 +4,9 @@ Codex receives a generated global `AGENTS.md`, agent TOML files, skills, rule fi
 
 Claude's rule loading differs from Codex's by design: `general.md` is the only rule shipped as a plain, always-applied file (its text is also embedded directly in `CLAUDE.md`). Every technology- or situation-specific rule in `shared/rules/` is instead generated as a skill under `skills/rules/`, driven by `adapters/claude/rule-skills.tsv` (rule file, skill name, trigger description). Only a skill's name and description are ever permanently in context; Claude loads the full rule text only when it invokes the skill. Codex is unaffected — it keeps receiving every rule as a plain file and is told to load the matching one by path, exactly as before.
 
-Neither current client configuration model exposes a supported global `max_depth` setting. The repository does not emit an unsupported key that would be ignored or cause configuration validation errors.
+Codex's current configuration schema has no `agents.max_depth` or other agent-recursion-depth key. The only `max_depth`-shaped setting in the schema is `network_proxy.glob_scan_max_depth`, which bounds glob-pattern expansion for the network proxy feature and is unrelated to agents; Claude Code's settings likewise expose no comparable key. The repository does not emit either as an invented key.
+
+`[agents].enabled = true` (set explicitly, matching its own documented default) is the current, documented way to enable Codex's multi-agent tools. A separate `[features].multi_agent` toggle exists in the schema but is not set here, since `[agents].enabled` already covers it and setting both would be redundant. `multi_agent_v2` does not appear in the current documented schema at all — it surfaced only in upstream issue titles describing an internal/experimental flag — so it is deliberately not configured.
 
 Client settings remain thin adapters. Shared semantics remain in `shared/`.
 

scripts/build.ps1

@@ -173,3 +173,4 @@ $leftoverPlaceholders = @(Get-ChildItem $output -File -Recurse | ForEach-Object
 if ($leftoverPlaceholders.Count) { throw "Unresolved template placeholders in: $($leftoverPlaceholders -join ', ')" }
 
 Write-Output 'PASS build: codex-windows, claude-windows, codex-linux, claude-linux'
+exit 0

scripts/doctor.ps1

@@ -66,3 +66,4 @@ foreach ($path in @('shared/rules','shared/skills','shared/agents','shared/hooks
 
 if ($fail) { exit 1 }
 Write-Output 'PASS doctor'
+exit 0

scripts/install.ps1

@@ -50,3 +50,4 @@ foreach ($item in $targets) {
 
 Install-ConfiguredPlugins -RepositoryRoot $root -Client $Client -DryRun:$DryRun -Update:$UpdatePlugins
 Write-Output ($(if ($DryRun) { 'PASS install dry-run' } else { 'PASS install' }))
+exit 0

scripts/lib/manifest.ps1

@@ -5,13 +5,15 @@ function Get-ManagedManifestPath {
 
 function Get-Sha256Hash {
     param([Parameter(Mandatory=$true)][string]$Path)
-    return (Get-FileHash -LiteralPath $Path -Algorithm SHA256).Hash
+    # Lowercase to match sha256sum's output, since the manifest must be readable by
+    # both this module and its Bash equivalent regardless of which one wrote it.
+    return (Get-FileHash -LiteralPath $Path -Algorithm SHA256).Hash.ToLowerInvariant()
 }
 
 function Get-Sha256HashOfBytes {
     param([Parameter(Mandatory=$true)][byte[]]$Bytes)
     $sha256 = [System.Security.Cryptography.SHA256]::Create()
-    try { return ([System.BitConverter]::ToString($sha256.ComputeHash($Bytes))).Replace('-', '') }
+    try { return ([System.BitConverter]::ToString($sha256.ComputeHash($Bytes))).Replace('-', '').ToLowerInvariant() }
     finally { $sha256.Dispose() }
 }
 
@@ -19,7 +21,8 @@ function Read-ManagedManifest {
     param([Parameter(Mandatory=$true)][string]$ManifestPath)
     $entries = @{}
     if (Test-Path -LiteralPath $ManifestPath) {
-        Import-Csv -LiteralPath $ManifestPath -Delimiter ([char]9) | ForEach-Object { $entries[$_.path] = $_.sha256 }
+        # Lowercase to tolerate an older manifest written before hashes were normalized.
+        Import-Csv -LiteralPath $ManifestPath -Delimiter ([char]9) | ForEach-Object { $entries[$_.path] = $_.sha256.ToLowerInvariant() }
     }
     return $entries
 }
@@ -29,7 +32,12 @@ function Write-ManagedManifest {
     $lines = @("path`tsha256")
     foreach ($path in ($Entries.Keys | Sort-Object)) { $lines += "$path`t$($Entries[$path])" }
     New-Item (Split-Path $ManifestPath -Parent) -ItemType Directory -Force | Out-Null
-    Set-Content -LiteralPath $ManifestPath -Value $lines -Encoding UTF8
+    # Windows PowerShell 5.1's -Encoding UTF8 always prepends a BOM, which Bash's plain
+    # `read` would otherwise fold into the first field of the header line. Write UTF-8
+    # without BOM and with LF line endings so either implementation can read the file
+    # regardless of which one wrote it.
+    $content = ($lines -join "`n") + "`n"
+    [System.IO.File]::WriteAllText($ManifestPath, $content, (New-Object System.Text.UTF8Encoding($false)))
 }
 
 function Sync-ManagedDestination {

scripts/lib/manifest.sh

@@ -24,8 +24,14 @@ read_managed_manifest() {
   [ -f "$path" ] || return 0
   local rel hash first=1
   while IFS=$'\t' read -r rel hash; do
-    if [ "$first" = 1 ]; then first=0; [ "$rel" = path ] && continue; fi
+    hash=${hash%$'\r'} # tolerate a CRLF-terminated manifest (read only strips the trailing \n)
+    if [ "$first" = 1 ]; then
+      first=0
+      rel=${rel#$'\xef\xbb\xbf'} # tolerate a UTF-8 BOM on the header line
+      [ "$rel" = path ] && continue
+    fi
     [ -n "$rel" ] || continue
+    hash=$(printf '%s' "$hash" | tr '[:upper:]' '[:lower:]') # tolerate uppercase hashes from older manifests
     out_ref[$rel]=$hash
   done < "$path"
 }

scripts/test-build-validation.ps1

@@ -49,3 +49,4 @@ Test-BuildFails 'leftover template placeholder' {
 
 Remove-Item $work -Recurse -Force -ErrorAction SilentlyContinue
 Write-Output 'PASS build validation: invalid JSON, duplicate agent, duplicate plugin, and leftover placeholders are all rejected'
+exit 0

scripts/test-managed-install.ps1

@@ -48,3 +48,4 @@ try {
 } finally {
     Remove-Item $work -Recurse -Force -ErrorAction SilentlyContinue
 }
+exit 0

scripts/test-platform-packages.ps1

@@ -49,4 +49,5 @@ foreach ($platformSelection in @('1','2')) {
     }
 }
 Write-Output 'PASS four platform packages and six PowerShell selections'
+exit 0