docs(plugin): state Codex approvals and environment forwarding precisely

Codex asks for approvals according to its own settings, and doesn't forward
every shell environment variable to MCP servers by default. The README and the
skill now say that, instead of describing one run's behaviour.

packages/daemon/assets/plugins/openrig/README.md

@@ -52,10 +52,10 @@ codex plugin add openrig@openrig-app
 codex mcp add openrig --env OPENRIG_SESSION_NAME=<address> -- rig mcp serve --front-door
 ```
 
-- **A non-default OpenRig home:** Codex doesn't pass your shell's environment to MCP servers. If your team runs on a
-  non-default OpenRig home, add `--env OPENRIG_HOME=<that home>` to the `codex mcp add` line.
-- **Approvals:** Codex asks you to approve each tool that writes (create, claim, update) the first time it's used. Tools
-  that only read don't ask.
+- **A non-default OpenRig home:** Codex does not forward every shell environment variable to MCP servers by default. If
+  your team runs on a non-default OpenRig home, add `--env OPENRIG_HOME=<that home>` to the `codex mcp add` line.
+- **Approvals:** Codex may ask you to approve tools according to its approval settings. Create, claim and update change
+  team state; tools that only read are marked read-only.
 
 ## What it doesn't do
 

packages/daemon/assets/plugins/openrig/skills/working-with-an-openrig-team/SKILL.md

@@ -75,8 +75,8 @@ behave; this skill is the loop around them.
 3. Connect the app to that address, then start a new session so the MCP server starts with it:
    - **Claude Code:** set it as the plugin's OpenRig seat in the plugin's settings.
    - **Codex:** run `codex mcp add openrig --env OPENRIG_SESSION_NAME=<address> -- rig mcp serve --front-door`. Codex
-     doesn't pass the shell's environment to MCP servers, so if the team's OpenRig home isn't the default, add
-     `--env OPENRIG_HOME=<that home>` too.
+     does not forward every shell environment variable to MCP servers by default, so if the team's OpenRig home isn't the
+     default, add `--env OPENRIG_HOME=<that home>` too.
    - **Another app:** add an MCP server that runs `rig mcp serve --front-door` with `OPENRIG_SESSION_NAME` set to the
      address.
 

packages/daemon/specs/agents/shared/skills/core/working-with-an-openrig-team/SKILL.md

@@ -75,8 +75,8 @@ behave; this skill is the loop around them.
 3. Connect the app to that address, then start a new session so the MCP server starts with it:
    - **Claude Code:** set it as the plugin's OpenRig seat in the plugin's settings.
    - **Codex:** run `codex mcp add openrig --env OPENRIG_SESSION_NAME=<address> -- rig mcp serve --front-door`. Codex
-     doesn't pass the shell's environment to MCP servers, so if the team's OpenRig home isn't the default, add
-     `--env OPENRIG_HOME=<that home>` too.
+     does not forward every shell environment variable to MCP servers by default, so if the team's OpenRig home isn't the
+     default, add `--env OPENRIG_HOME=<that home>` too.
    - **Another app:** add an MCP server that runs `rig mcp serve --front-door` with `OPENRIG_SESSION_NAME` set to the
      address.
 

scripts/skill-edge-digests.generated.json

@@ -2,7 +2,7 @@
   "version": 1,
   "edges": {
     "bundle": {
-      "working-with-an-openrig-team/SKILL.md": "8c9f8aa8da5ebd9aff91c00574627e15f3ef723ee8a6b0fd3c438ebe727e90e2"
+      "working-with-an-openrig-team/SKILL.md": "4b3e6e8eecb710abdb95d604c419599566dbc77b019b49175e936e713b65cf6f"
     },
     "canonical": {
       "core/agent-starters/SKILL.md": "8e8961f44fccb812f39e01174a331dab24f153ceaba91925f1e42371836cdec0",
@@ -27,7 +27,7 @@
       "core/specification-system/SKILL.md": "5226d6e8b1362df89ba3d5afd82e4b4add355870132ca4b140d7f9f4324ffdc1",
       "core/topology-mutation-and-seat-management/SKILL.md": "527ca074432ce6513fb25cd27e8c709dabe0c91361b8999e09b272f3813abe62",
       "core/watchdog/SKILL.md": "24b2e756e3e9d067fa93a4b5fa5f48a5cce511e8b1a5b360b1c39bc09bc95d82",
-      "core/working-with-an-openrig-team/SKILL.md": "8c9f8aa8da5ebd9aff91c00574627e15f3ef723ee8a6b0fd3c438ebe727e90e2",
+      "core/working-with-an-openrig-team/SKILL.md": "4b3e6e8eecb710abdb95d604c419599566dbc77b019b49175e936e713b65cf6f",
       "pm/backlog-capture/SKILL.md": "345c2b47fc85e48c15c0d42bbb48fb27dd3b0ceec36bf59dc6ed20daaea47a84",
       "pm/context-builder/SKILL.md": "0134c9b0a9f196565109f7f51b6ec78d5c3e4b5982a0d7105a93b29952625b3c",
       "pm/exec-summary/SKILL.md": "ada0f42337920e7acdd94e24cad4f5c269b057e750f4a7fc627ea9efbc02fcb6",
@@ -132,7 +132,7 @@
       "core/specification-system/SKILL.md": "5226d6e8b1362df89ba3d5afd82e4b4add355870132ca4b140d7f9f4324ffdc1",
       "core/topology-mutation-and-seat-management/SKILL.md": "527ca074432ce6513fb25cd27e8c709dabe0c91361b8999e09b272f3813abe62",
       "core/watchdog/SKILL.md": "24b2e756e3e9d067fa93a4b5fa5f48a5cce511e8b1a5b360b1c39bc09bc95d82",
-      "core/working-with-an-openrig-team/SKILL.md": "8c9f8aa8da5ebd9aff91c00574627e15f3ef723ee8a6b0fd3c438ebe727e90e2",
+      "core/working-with-an-openrig-team/SKILL.md": "4b3e6e8eecb710abdb95d604c419599566dbc77b019b49175e936e713b65cf6f",
       "pm/backlog-capture/SKILL.md": "345c2b47fc85e48c15c0d42bbb48fb27dd3b0ceec36bf59dc6ed20daaea47a84",
       "pm/context-builder/SKILL.md": "0134c9b0a9f196565109f7f51b6ec78d5c3e4b5982a0d7105a93b29952625b3c",
       "pm/exec-summary/SKILL.md": "ada0f42337920e7acdd94e24cad4f5c269b057e750f4a7fc627ea9efbc02fcb6",

skills/_canonical/core/working-with-an-openrig-team/SKILL.md

@@ -75,8 +75,8 @@ behave; this skill is the loop around them.
 3. Connect the app to that address, then start a new session so the MCP server starts with it:
    - **Claude Code:** set it as the plugin's OpenRig seat in the plugin's settings.
    - **Codex:** run `codex mcp add openrig --env OPENRIG_SESSION_NAME=<address> -- rig mcp serve --front-door`. Codex
-     doesn't pass the shell's environment to MCP servers, so if the team's OpenRig home isn't the default, add
-     `--env OPENRIG_HOME=<that home>` too.
+     does not forward every shell environment variable to MCP servers by default, so if the team's OpenRig home isn't the
+     default, add `--env OPENRIG_HOME=<that home>` too.
    - **Another app:** add an MCP server that runs `rig mcp serve --front-door` with `OPENRIG_SESSION_NAME` set to the
      address.