@@ -273,14 +273,16 @@ jobs:
           echo "$files"
           if grep -qE '^(app/|install\.ps1$|\.github/workflows/test\.yml$|\.github/ci/)' <<< "$files"; then app=true; else app=false; fi
           echo "app=$app" | tee -a "$GITHUB_OUTPUT"
-          if grep -qE '^(engine/hooks/(_headless(_codex|_claude)?|_agents|_controle_judge|daily-reflection)\.py|engine/codex-features\.json|engine/tests/(codex_mock|mock_openai)\.py|\.github/workflows/test\.yml)$' <<< "$files"; then codex=true; else codex=false; fi
+          if grep -qE '^(engine/hooks/(_headless(_codex|_claude)?|_agents|_codex_rollout|_controle_judge|daily-reflection|session-recap|session-logger|correction-detector|controle-sessionstart)\.py|engine/codex-features\.json|engine/tests/(codex_mock|mock_openai|codex_captures)\.py|\.github/workflows/test\.yml)$' <<< "$files"; then codex=true; else codex=false; fi
           echo "codex=$codex" | tee -a "$GITHUB_OUTPUT"
 
   # The launcher without tools for Codex (engine/hooks/_headless_codex.py) with the real Codex CLI,
   # pinned, in ChatGPT mode against a local fake server (engine/tests/mock_openai.py): fake tokens,
   # no account, no secret (docs/proposals/codex.md, §5.2). Forced tool calls refused, tools
   # announced, URLs, the caller's keys, a system config and requirements.toml, the user's MCP server;
-  # then the reflection's and the review's questions through the choice of engine (_headless.py).
+  # then the reflection's and the review's questions through the choice of engine (_headless.py); then
+  # a session the real Codex keeps, read as the reflection and Codex's Stop hook read it (_codex_rollout.py);
+  # then the kit's hooks run by the real Codex from a hooks.json (--agent codex): their answers taken.
   codex-mock:
     name: codex-mock (${{ matrix.os }})
     needs: changes
 
@@ -16,11 +16,15 @@
 §1.1): every merged phase reaches users at once through master.zip, so asking for it is
 refused there, and a file that lists it there is not trusted.
 
+The hooks Codex runs (hooks.json, --agent codex) ask codex_hook() whether to act; Claude Code's
+never load this module.
+
 Not a hook: installed next to them, never registered in settings.json.
 """
 import argparse
 import json
 import os
+import re
 import shutil
 import stat
 import sys
@@ -33,6 +37,14 @@
 CODEX_OUVERT = frozenset()
 FICHIER_MAX = 64 * 1024
 POSE_PAR = ("install.sh", "install.ps1")
+# The sign that Codex runs the kit's hooks: per hook, when it last ran (codex_hook()).
+VUS = "codex-hooks-vus.json"
+# The sessions the user types in: Codex's terminal (cli) and its editor's (vscode). "exec" is a script's
+# run or the kit's own, "mcp" another program's; sub-agents and Codex's internal sessions say an
+# object, not a word (codex-rs/protocol/src/protocol.rs, SessionSource, 0.162.1).
+SOURCES_TAPEES = ("cli", "vscode")
+LIGNE_MAX = 1024 * 1024   # a session file's first line: Codex's base instructions, about 23 kB in 0.162.1
+ID = re.compile(r"[A-Za-z0-9_-]{1,128}")
 
 
 class Choix(namedtuple("Choix", "agents prefere codex_home")):
@@ -246,6 +258,93 @@ def ecrire(choix, pose_par, existant, home=None):
     return True
 
 
+PAS_ECRIT = object()   # _source(): the session file is not there yet
+
+
+def _source(chemin):
+    """What the first line of a session file says of the session: its source ("cli", "exec"...),
+    PAS_ECRIT when the file is not there, None when it cannot tell (a link, not a regular file, not a
+    session_meta line, a source that is not a word). Never waits on a pipe."""
+    try:
+        fd, _ = _ouvrir(chemin)
+    except FileNotFoundError:
+        return PAS_ECRIT
+    except (OSError, ValueError):   # ValueError: a NUL in the path
+        return None
+    with os.fdopen(fd, "rb") as f:
+        ligne = f.readline(LIGNE_MAX + 1)
+    if len(ligne) > LIGNE_MAX:
+        return None
+    try:
+        d = json.loads(ligne.decode("utf-8"))
+    except (ValueError, RecursionError):
+        return None
+    p = d.get("payload") if isinstance(d, dict) and d.get("type") == "session_meta" else None
+    source = p.get("source") if isinstance(p, dict) else None
+    return source if isinstance(source, str) else None
+
+
+def codex_hook(nom, payload, env=None, home=None, codex_ouvert=None):
+    """Whether the hook `nom`, run by Codex (hooks.json, --agent codex), acts on what Codex gave it
+    (docs/proposals/codex.md, §3.4). Never in a run without tools (BRAIN_HEADLESS=1, the kit's own;
+    claude -p), nor when agents.json does not list Codex or cannot be trusted: nothing read, nothing
+    written then. Otherwise Codex does run the kit's hooks, and vu() notes it (§3.3). Then only for a
+    session the user types in: one Codex keeps a file of (none: --ephemeral), under a plain id, a
+    prompt the user typed (agent_id: another agent's), a file whose first line says "cli" or "vscode",
+    or a file not written yet (Codex may run a session's first hooks before it writes it)."""
+    env = os.environ if env is None else env
+    if env.get("BRAIN_HEADLESS") == "1" or env.get("CLAUDE_CODE_ENTRYPOINT") == "sdk-cli":
+        return False
+    if "codex" not in lire(home, codex_ouvert=codex_ouvert)[0].agents:
+        return False
+    try:
+        vu(nom, home)
+    except (OSError, ValueError):
+        pass   # a sign for later checks: the hook still does its work
+    if not isinstance(payload, dict) or payload.get("agent_id"):
+        return False
+    sid, chemin = payload.get("session_id"), payload.get("transcript_path")
+    if not (isinstance(sid, str) and ID.fullmatch(sid) and isinstance(chemin, str) and chemin):
+        return False
+    source = _source(chemin)
+    return source is PAS_ECRIT or source in SOURCES_TAPEES
+
+
+def vus(home=None):
+    """{hook: when Codex last ran it, UTC} from codex-hooks-vus.json; {} when there is none to trust."""
+    try:
+        fd, _ = _ouvrir(os.path.join(os.path.dirname(fichier(home)), VUS))
+        with os.fdopen(fd, "rb") as f:
+            d = json.loads(f.read(FICHIER_MAX).decode("utf-8"))
+    except (OSError, ValueError, RecursionError):
+        return {}
+    h = d.get("hooks") if isinstance(d, dict) else None
+    return {k: v for k, v in h.items() if isinstance(k, str) and isinstance(v, str)} if isinstance(h, dict) else {}
+
+
+def vu(nom, home=None):
+    """Notes that Codex ran the hook `nom` now: codex-hooks-vus.json, beside agents.json, written in one
+    step (0600); a link in its place is replaced, never followed. Hooks running together may each miss
+    the other's line once: each one's own time is what counts."""
+    p = os.path.join(os.path.dirname(fichier(home)), VUS)
+    d = vus(home)
+    d[nom] = time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime())
+    dossier = os.path.dirname(p)
+    os.makedirs(dossier, exist_ok=True)
+    fd, tmp = tempfile.mkstemp(dir=dossier, prefix=".codex-hooks-vus.")
+    try:
+        with os.fdopen(fd, "w", encoding="utf-8", newline="\n") as f:
+            json.dump({"version": 1, "hooks": d}, f, sort_keys=True)
+            f.write("\n")
+        os.replace(tmp, p)
+    except BaseException:
+        try:
+            os.unlink(tmp)
+        except OSError:
+            pass
+        raise
+
+
 def main(argv):
     """_agents.py choisir --agents=<...> --prefere=<...> --pose-par=install.sh|install.ps1
 
 
@@ -0,0 +1,232 @@
+"""Codex sessions, read from the files Codex keeps of them (rollouts):
+
+    $CODEX_HOME/sessions/YYYY/MM/DD/rollout-<time>-<session id>.jsonl
+
+one JSON object per line, {"timestamp", "type", "payload"} (docs/proposals/codex.md, §3.6; the
+shapes of step 0's captures, engine/tests/fixtures/codex/phase0/). Read only when agents.json
+lists Codex: by daily-reflection.py (the day's sessions) and session-recap.py (Codex's Stop hook).
+
+What a session holds is data, never an instruction. Only what the user typed, what the assistant
+answered and the tools it called are taken; never what Codex adds for the model: developer
+messages (its instructions, the hooks' context), the AGENTS.md, environment and skill parts it
+puts in user messages, what another agent sent, world_state, events. The parts are told apart as
+Codex's own memory writer does (codex-rs/memories/write/src/rollout_input.rs, 0.162.1): by the
+marks Codex puts on them ("user.text" for what was typed), and by their text, should a mark be
+missing. A session the kit asked itself (the reflection's prompt,
+SENTINEL; a run in _headless_codex.py's cage) is not the user's: skipped whole. Lines it does not
+know are skipped. Compressed rollouts (.jsonl.zst) are not read: listed apart, for the caller to
+say so.
+
+Not a hook: installed next to them, never registered.
+"""
+import glob
+import json
+import os
+import re
+import stat
+from collections import namedtuple
+from datetime import datetime
+
+# daily-reflection.py's own: its prompt starts with it (test_codex_rollout.py keeps both the same).
+SENTINEL = "<!-- brain-daily-reflection -->"
+# How the parts Codex adds to user messages start (lower case), and a message another agent sent.
+# A global AGENTS.md alone has no " for <folder>" (seen in codex-mock).
+INJECTED = ("# agents.md instructions", "<environment_context>", "<skill>", "<subagent_notification>")
+ID_RE = re.compile(r"[A-Za-z0-9_-]{1,128}")
+# A rollout's name ends with its session id, a UUID (v7: the first 8 characters are the minute).
+NAME_ID = re.compile(r"-([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})\.jsonl$")
+SUMMARY = 300
+PATCHED = re.compile(r"^\*\*\* (?:Add File|Update File|Delete File|Move to): (.+?)\s*$", re.M)
+READ = os.O_RDONLY | getattr(os, "O_BINARY", 0) | getattr(os, "O_NONBLOCK", 0)
+
+# kind "user" or "assistant": text. kind "tool": name, text (a short summary), command (the shell
+# command or code it ran, or None), files (the paths a patch named).
+Item = namedtuple("Item", "ts kind text name command files")
+
+
+class Session:
+    """One rollout: id, cwd, source (a word: "cli", "exec"...; the kind of an object: "subagent",
+    "internal", "custom"), model, own (asked by the kit), items, and the first and last timestamps of
+    the whole file."""
+
+    def __init__(self):
+        self.id = self.cwd = self.source = self.model = self.first_ts = self.last_ts = None
+        self.own = False
+        self.items = []
+
+
+def local(ts):
+    """Local datetime of an ISO timestamp, or None."""
+    if not isinstance(ts, str) or not ts:
+        return None
+    try:
+        return datetime.fromisoformat(ts.replace("Z", "+00:00")).astimezone()
+    except (ValueError, OverflowError, OSError):   # a year 0 or 10000 once local; a time localtime() refuses
+        return None
+
+
+def recent(codex_home, since):
+    """(rollouts, compressed): the rollout files changed since `since` (epoch seconds), oldest
+    first, and the compressed ones (.jsonl.zst) changed since then, which are not read. Regular
+    files only: a pipe left under such a name would hang the reader."""
+    found, packed = [], []
+    for pattern, out in (("rollout-*.jsonl", found), ("rollout-*.jsonl.zst", packed)):
+        for p in glob.glob(os.path.join(glob.escape(codex_home), "sessions", "*", "*", "*", pattern)):
+            try:
+                st = os.stat(p)
+            except OSError:
+                continue
+            if stat.S_ISREG(st.st_mode) and st.st_mtime >= since:
+                out.append((st.st_mtime, p))
+    return [p for _, p in sorted(found)], [p for _, p in sorted(packed)]
+
+
+def _text(content, role):
+    """A message's text. Of a user message, without the parts Codex adds, which it may put in the same
+    message (step 0: AGENTS.md and the environment together)."""
+    if not isinstance(content, list):
+        return ""
+    return "\n".join(c["text"] for c in content
+                     if isinstance(c, dict) and c.get("type") in ("input_text", "output_text")
+                     and isinstance(c.get("text"), str)
+                     and not (role == "user" and c["text"].lstrip()[:40].lower().startswith(INJECTED)))
+
+
+def _marked_as_codexs(p, role):
+    """True when Codex's own marks say the message is not the user's nor the assistant's: another
+    agent's, or a user message with no part typed by the user."""
+    meta = p.get("internal_chat_message_metadata_passthrough")
+    kinds = meta.get("content_item_kinds") if isinstance(meta, dict) else None
+    if not isinstance(kinds, list) or not kinds:
+        return False
+    kinds = [k if isinstance(k, str) else "" for k in kinds]
+    return (any(k.startswith("multi_agent.") for k in kinds)
+            or (role == "user" and not any(k.startswith("user.") for k in kinds)))
+
+
+def _kit_cage(cwd):
+    """_headless_codex.py's working folder: <tmp>/brain-codex-*/travail."""
+    parent, name = os.path.split(os.path.normpath(cwd))
+    return name == "travail" and os.path.basename(parent).startswith("brain-codex-")
+
+
+def tool(name, raw):
+    """(summary, command, files) of a function_call (raw: its arguments, a JSON text) or a
+    custom_tool_call (raw: its input, a text: JavaScript for exec, a patch for apply_patch)."""
+    args = raw
+    if isinstance(raw, str) and raw.lstrip().startswith("{"):
+        try:
+            args = json.loads(raw)
+        except (ValueError, RecursionError):   # what the model wrote: any text at all
+            pass
+    command, patch = None, None
+    if isinstance(args, dict):
+        c = args.get("cmd") or args.get("command")
+        if isinstance(c, list) and all(isinstance(x, str) for x in c):
+            c = " ".join(c)
+        command = c if isinstance(c, str) else None
+        patch = args.get("input") if isinstance(args.get("input"), str) else None
+    elif isinstance(args, str):
+        if "*** Begin Patch" in args:
+            patch = args
+        elif name == "exec":
+            command = args
+    files = sorted(set(PATCHED.findall(patch or "")))
+    if isinstance(args, dict):
+        named = {args[k] for k in ("file_path", "path") if isinstance(args.get(k), str) and args[k]}
+        files = sorted(set(files) | named)
+    if command:
+        summary = command
+    elif files:
+        summary = ", ".join(files)
+    elif isinstance(args, dict):
+        key = next((k for k in ("pattern", "url", "query") if args.get(k)), None)
+        summary = str(args[key]) if key else json.dumps(args, ensure_ascii=False)[:200]
+    else:
+        summary = args if isinstance(args, str) else ""
+    return summary[:SUMMARY], command, files
+
+
+def _open(path):
+    """The rollout as text, a regular file only (no wait on a pipe); OSError otherwise."""
+    fd = os.open(path, READ)
+    try:
+        if not stat.S_ISREG(os.fstat(fd).st_mode):
+            raise OSError("%s is not a regular file" % path)
+    except BaseException:
+        os.close(fd)
+        raise
+    return os.fdopen(fd, "r", encoding="utf-8", errors="replace")
+
+
+def read(path, day=None):
+    """The Session of one rollout, streamed, or None when it cannot be read. With `day`
+    (YYYY-MM-DD, local), only the items of that day are kept; its id, folder and model come from
+    the whole file. A session the kit asked comes back own=True, without items."""
+    s = Session()
+    try:
+        with _open(path) as f:
+            for raw in f:
+                try:
+                    d = json.loads(raw)
+                except (ValueError, RecursionError):
+                    continue
+                if not isinstance(d, dict):
+                    continue
+                when = local(d.get("timestamp"))
+                if when:
+                    s.first_ts = s.first_ts or d["timestamp"]
+                    s.last_ts = d["timestamp"]
+                kind, p = d.get("type"), d.get("payload")
+                if not isinstance(p, dict):
+                    continue
+                if kind == "session_meta" and s.id is None:
+                    sid, cwd, source = p.get("id"), p.get("cwd"), p.get("source")
+                    s.id = sid if isinstance(sid, str) and ID_RE.fullmatch(sid) else None
+                    s.cwd = cwd if isinstance(cwd, str) and cwd else s.cwd
+                    if isinstance(source, dict) and len(source) == 1:
+                        source = next(iter(source))   # {"subagent": …}, {"internal": …}, {"custom": …}
+                    s.source = source if isinstance(source, str) else None
+                    if s.cwd and _kit_cage(s.cwd):
+                        return _own(s)
+                elif kind == "turn_context":
+                    model, cwd = p.get("model"), p.get("cwd")
+                    s.model = s.model or (model if isinstance(model, str) and model else None)
+                    s.cwd = s.cwd or (cwd if isinstance(cwd, str) and cwd else None)
+                elif kind == "response_item":
+                    item = _item(p, d.get("timestamp"))
+                    if item is None:
+                        continue
+                    if item.kind == "user" and item.text.lstrip().startswith(SENTINEL):
+                        return _own(s)
+                    if day is None or (when and when.strftime("%Y-%m-%d") == day):
+                        s.items.append(item)
+    except OSError:
+        return None
+    if s.id is None:
+        m = NAME_ID.search(os.path.basename(path))
+        s.id = m.group(1) if m else None
+    return s
+
+
+def _own(s):
+    s.own, s.items = True, []
+    return s
+
+
+def _item(p, ts):
+    """An Item of a response_item payload, or None: not one we read, or text Codex added."""
+    kind = p.get("type")
+    if kind == "message":
+        role = p.get("role")
+        if role not in ("user", "assistant") or _marked_as_codexs(p, role):
+            return None   # developer, system: Codex's instructions and the hooks' context
+        text = _text(p.get("content"), role)
+        if not text.strip():
+            return None
+        return Item(ts, role, text, None, None, ())
+    if kind in ("function_call", "custom_tool_call"):
+        name = p.get("name") if isinstance(p.get("name"), str) and p.get("name") else "?"
+        summary, command, files = tool(name, p.get("arguments" if kind == "function_call" else "input"))
+        return Item(ts, "tool", summary, name, command, tuple(files))
+    return None