Add project-scoped Codex execution over a private socket

README.md

@@ -28,3 +28,35 @@ Google OAuth 的授权回调地址为 `https://api.foundry.entroia.com/auth/goog
 ## 验收
 
 用同一个 Google 测试账号分别登录两个项目，确认用户 ID 不同。用 A 的会话请求 B 的 `me` 应返回 401。验证兑换码重放被拒绝，并确认退出 A 后 B 的会话仍有效。
+
+## Codex execution
+
+When enabled, `POST /projects/{project}/codex/exec` accepts a JSON object
+containing only a nonempty `prompt` string and returns `{"result":"…"}`.
+Use `Authorization: Bearer <token>` with a dedicated 32-byte random token
+encoded as 64 hex characters. Ordinary OAuth sessions cannot execute Codex.
+Missing, unknown and revoked tokens return 401. A valid token for a different
+project returns 403. Requests are limited to 32 KiB, CLI output to 512 KiB,
+and each execution to 90 seconds. The worker accepts one execution at a time
+and returns 429 when busy.
+
+On the deployment host, provision `/opt/endoleap-infra/foundry/codex` with:
+
+- `grants/projects.json` containing a JSON object mapping lowercase hex SHA-256
+  digests of the **decoded** token bytes to configured project names. Use mode
+  0700 for the directory and 0600 for the file, readable by UID 1000. Rotate or
+  revoke tokens by atomically replacing the file within the mounted directory.
+  A revocation applies to subsequent requests.
+- `home` owned by UID 1000 with an isolated Codex login in `auth.json`.
+  Keep this home dedicated to the worker. Supply the login only and keep user
+  configuration, MCP servers, skills, and other workload files out of it.
+
+Start the single worker with `bash deploy/codex-worker.sh /absolute/path/to/foundry`
+using the Linux binary built by ces-control. To replace the worker, stop and remove
+the existing `foundry-codex-worker` container first. The next normal Foundry
+deployment mounts the worker socket and grants directory read-only. The worker
+runs the installed Codex CLI with fixed read-only, no-approval arguments and
+disables command execution tools. It receives prompts via stdin and returns
+the final agent message. The worker has no published port and Foundry receives
+neither the Codex home nor the Docker socket. Keep both containers on the same
+host for Unix socket access.