[haolpku]

CLI, HTTP, browser UI, and root launchers now use the same official Codex host for ingestion and retrieval. DataMind supplies validated data tools; Codex performs planning, SQL generation, extraction, and answer synthesis. This completes the migration started in #31 and removes the StoreAgent/RetrieveAgent classes, role prompts, assembly, and Claude SDK/CCR adapter.

This is a breaking 2.0 change. CodexHost replaces the old Python facade; build_data_plane supports deterministic model-free operations. Migration notes, configuration examples, public API docs, browser assets, and benchmark entry points are updated together.

Read requests bind profile/session, read-only permissions, and one published revision at admission. Request-scoped MCP traces preserve actual evidence and write receipts even when SDK Code Mode wraps tool calls. Publication, checkpoint recovery, source evidence, optional database providers, and bounded read recovery remain covered. The coordinator still uses local, single-host storage; application authentication and tenant isolation remain host responsibilities.

Validation:

• Local full regression: 473 passed, 40 optional/provider skips; real Dolt enabled.
• Official SDK gateway smoke: CLI returns pong; HTTP graph + SQL query returns Bob and total revenue 300 from one pinned revision, with actual evidence/traces.
• HTTP ingestion saves one synthetic profile Memory, with durable receipt carrying request/session identity and ingestion Skill 1.2.0.
• Real local Hugging Face embedding KB + SQL + graph publication preserves old/new pinned readers.
• SQLite demo, Python compilation, wheel/resource smoke, and browser JavaScript syntax pass.
• GitHub CI run 39410538756: all seven checks passed, including Python 3.11/3.12, official SDK/MCP and host contracts, optional versioning, real MySQL/Dolt integration, installed-wheel checks, and the CI gate. Network model calls are separate deployment checks, not required CI fixtures.

The test gateway completed real tool-use turns but was slow (roughly 4–8 minutes); this validation establishes functionality, not a production latency or scalability guarantee. No deployment credentials or runtime data are included.