@@ -80,6 +80,8 @@ jq -e '.tokens.access_token and .tokens.refresh_token and .tokens.account_id' "$
 
 If this fails, run the local Codex login flow outside the gator launch. If Codex was recently reauthenticated and gateway refresh fails later, relaunch with `--reset-refresh` once.
 
+The launcher passes the non-secret host account ID as literal `CODEX_ACCOUNT_ID` for Codex's local workspace routing. The harness must not use the opaque `CODEX_AUTH_ACCOUNT_ID` credential placeholder for that comparison. Access tokens remain placeholders, and refresh material remains gateway-only.
+
 ### Step 5: Verify Gateway Is Registered And Alive
 
 Use the target gateway from the operator request or current session context. Do not assume a gateway name. If the operator did not specify one, list registered gateways and ask before launching when the correct target is ambiguous.
 
@@ -37,8 +37,10 @@ The launcher:
 - Scans `profile_paths` in manifest order and imports or updates `providers/github-gator.yaml`.
 - Creates or updates the `github-gator` provider from `gh auth token`.
 - Selects the requested harness and bakes the common runtime into the immutable sandbox payload.
+- Builds with the latest Codex CLI by default. Docker can reuse the cached install layer; rebuild with that layer's cache disabled to fetch a newer release.
 - For `--harness codex`, imports `providers/codex-gator.yaml`, creates or updates the `codex-gator` provider from `$HOME/.codex/auth.json`, and stores the refresh token as gateway-only refresh material.
 - For `--harness codex`, configures gateway-managed refresh for `CODEX_AUTH_ACCESS_TOKEN` and rotates it before launching the sandbox.
+- Passes the non-secret Codex account ID from host auth as `CODEX_ACCOUNT_ID`. The harness writes it literally into `auth.json` for local workspace discovery; access tokens remain opaque provider placeholders and refresh tokens remain gateway-only.
 - Enables `agent_policy_proposals_enabled` and `proposal_approval_mode=auto` at gateway scope.
 - Uses the gator image policy copied to `/etc/openshell/policy.yaml`.
 - Installs the gator-specific `gh` wrapper from `gator/bin/gh` as `/usr/local/bin/gh` to fail closed when same-head-SHA history cannot be checked, prevent duplicate dispositions, and require versioned review payloads.
 
@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: Apache-2.0
 
 id: gator
-payload_version: 9
+payload_version: 10
 display_name: Gator Gate Agent
 description: Validate and monitor OpenShell GitHub issues and pull requests through the gator state machine.
 
 
@@ -801,7 +801,12 @@ HARNESS_ENV_ARGS=(
 
 case "$HARNESS" in
     codex)
+        # Codex compares account IDs locally during workspace discovery. Unlike
+        # bearer tokens, this non-secret identifier must not be a placeholder.
+        [[ -n "${CODEX_AUTH_ACCOUNT_ID:-}" ]] || fail "missing Codex account ID"
+        [[ "$CODEX_AUTH_ACCOUNT_ID" != openshell:resolve:* ]] || fail "Codex account ID must be a literal identifier"
         HARNESS_ENV_ARGS+=(
+            "CODEX_ACCOUNT_ID=$CODEX_AUTH_ACCOUNT_ID"
             "CODEX_MODEL=${CODEX_MODEL:-$HARNESS_MODEL}"
             "CODEX_REASONING=${CODEX_REASONING:-$HARNESS_REASONING}"
         )
 
@@ -16,7 +16,8 @@ require_env() {
 }
 
 require_env CODEX_AUTH_ACCESS_TOKEN
-require_env CODEX_AUTH_ACCOUNT_ID
+require_env CODEX_ACCOUNT_ID
+[[ "$CODEX_ACCOUNT_ID" != openshell:resolve:* ]] || { echo "Codex account ID must be a literal identifier" >&2; exit 1; }
 require_env GITHUB_TOKEN
 
 PROMPT_FILE="$1"
@@ -58,7 +59,8 @@ fs.writeFileSync(path, JSON.stringify({
     id_token: providerValue("CODEX_AUTH_ID_TOKEN") || fallbackIdToken,
     access_token: providerValue("CODEX_AUTH_ACCESS_TOKEN"),
     refresh_token: providerValue("CODEX_AUTH_REFRESH_TOKEN") || "gateway-managed-refresh-token",
-    account_id: providerValue("CODEX_AUTH_ACCOUNT_ID"),
+    // Workspace discovery compares this non-secret identifier locally.
+    account_id: process.env.CODEX_ACCOUNT_ID,
   },
   last_refresh: new Date().toISOString(),
 }, null, 2));
 
@@ -11,6 +11,7 @@ trap 'rm -rf "$TMP_DIR"' EXIT
 
 ACCESS_PLACEHOLDER="openshell:resolve:env:s$(printf 'a%.0s' {1..64})_CODEX_AUTH_ACCESS_TOKEN"
 ACCOUNT_PLACEHOLDER="openshell:resolve:env:v42_CODEX_AUTH_ACCOUNT_ID"
+ACCOUNT_ID="test-codex-account"
 
 cat > "$TMP_DIR/codex" <<'MOCK'
 #!/usr/bin/env bash
@@ -23,8 +24,11 @@ fi
 access="$(jq -r '.tokens.access_token' "$HOME/.codex/auth.json")"
 account="$(jq -r '.tokens.account_id' "$HOME/.codex/auth.json")"
 [[ "$access" == "$EXPECTED_ACCESS_PLACEHOLDER" ]]
-[[ "$account" == "$EXPECTED_ACCOUNT_PLACEHOLDER" ]]
-printf '%s\n' 'ok - Codex auth preserves opaque provider placeholders'
+[[ "$account" == "$EXPECTED_ACCOUNT_ID" ]]
+[[ "$account" != openshell:resolve:* ]]
+[[ "$(jq -r '.tokens.refresh_token' "$HOME/.codex/auth.json")" == "gateway-managed-refresh-token" ]]
+[[ "$(node -e 'console.log((require("fs").statSync(process.env.HOME + "/.codex/auth.json").mode & 0o777).toString(8))')" == 600 ]]
+printf '%s\n' 'ok - Codex auth preserves token placeholders and uses a literal account ID'
 MOCK
 chmod +x "$TMP_DIR/codex"
 printf '%s\n' 'test prompt' > "$TMP_DIR/prompt.md"
@@ -33,7 +37,23 @@ OPENSHELL_AGENT_HOME="$TMP_DIR/home" \
 CODEX_BIN="$TMP_DIR/codex" \
 CODEX_AUTH_ACCESS_TOKEN="$ACCESS_PLACEHOLDER" \
 CODEX_AUTH_ACCOUNT_ID="$ACCOUNT_PLACEHOLDER" \
+CODEX_ACCOUNT_ID="$ACCOUNT_ID" \
 GITHUB_TOKEN="openshell:resolve:env:v42_GITHUB_TOKEN" \
 EXPECTED_ACCESS_PLACEHOLDER="$ACCESS_PLACEHOLDER" \
-EXPECTED_ACCOUNT_PLACEHOLDER="$ACCOUNT_PLACEHOLDER" \
+EXPECTED_ACCOUNT_ID="$ACCOUNT_ID" \
     bash "$SCRIPT_DIR/exec.sh" "$TMP_DIR/prompt.md"
+
+# Fail before launching Codex when the routing identity is absent or opaque.
+for invalid_account_id in "" "$ACCOUNT_PLACEHOLDER"; do
+    if OPENSHELL_AGENT_HOME="$TMP_DIR/invalid-home" \
+        CODEX_BIN="$TMP_DIR/codex" \
+        CODEX_AUTH_ACCESS_TOKEN="$ACCESS_PLACEHOLDER" \
+        CODEX_ACCOUNT_ID="$invalid_account_id" \
+        GITHUB_TOKEN="placeholder" \
+        bash "$SCRIPT_DIR/exec.sh" "$TMP_DIR/prompt.md" >"$TMP_DIR/error" 2>&1; then
+        echo "unexpected success with invalid Codex account ID" >&2
+        exit 1
+    fi
+    [[ ! -e "$TMP_DIR/invalid-home/.codex/auth.json" ]]
+done
+printf '%s\n' 'ok - missing and placeholder account IDs are rejected'