codex-cloud: remove pinned Task version and SHA launcher; update Taskfile, README, and tests

[max-sixty]

Motivation

• Simplify Codex Cloud bootstrapping by removing a pinned task version and the inline SHA verification from the README launcher commands.
• Make mise only bootstrap task and install a globally available task executable under /root/.local/bin, and align the cargo wrapper PATH with that change.

Description

• Update scripts/codex-cloud/README.md to replace the long SHA/pinned-version launchers with mise x task -- task -t scripts/codex-cloud/Taskfile.yaml <task> and adjust explanatory text to note that Mise only bootstraps Task.
• Modify scripts/codex-cloud/Taskfile.yaml to remove the TASK_VERSION variable and MISE_* env vars, use mise use --global task, create a symlink from $(mise which task) to /root/.local/bin/task, and remove references to the mise install path from the cargo wrapper PATH; also update the runtime check to test -x /root/.local/bin/task.
• Adjust tests/integration_tests/readme_sync.rs to stop computing a SHA and extracting a pinned task version, and to assert the new simplified launcher string appears in the README.

Testing

• Ran the test suite with cargo test, including the README sync integration test and launcher checks, and the tests passed.

---

Codex Task

[worktrunk-bot]

Reviewing as a draft — flagging anything that looks worth a quick fix. Mark ready for a full review.

Two in-tree docs now describe the removed gate. CLAUDE.md:10 reads "Codex Cloud: use the checksum-gated setup in scripts/codex-cloud/README.md" — no longer true after this PR. And .claude/skills/running-tend/SKILL.md (Weekly Maintenance: CI Pin Bumps) instructs the weekly job: "scripts/codex-cloud/Taskfile.yaml pins Task through mise … update changed archive checksums, then copy the Taskfile's new digest into both README launchers." Both clauses are now unsatisfiable, so the next tend-weekly run will either try to re-add a digest that has no home or burn a session reconciling. Suggested edits: drop "checksum-gated" from the CLAUDE.md line, and drop "pins Task through mise," plus the trailing digest clause from the SKILL.md bullet.

Task is now the only unpinned, unverified tool in the file. mise use --global task and mise x task both resolve latest, while pre-commit, cargo-insta, cargo-nextest, Nushell, and PowerShell all stay pinned with SHA-256 checksums a few lines below. A Task 4.x release changes the environment with no diff in the repo to point at, and the launcher and the global install can resolve different versions across the caching window. If dropping the pin is the point, that's your call — but it's worth saying so in the README next to "Mise only bootstraps Task", since the rest of the file establishes the opposite convention.

The deleted README sentence stated an invariant the new text doesn't answer. "The hash prevents a task branch from changing code run as root" — Codex Cloud runs the setup command against the task's branch checkout, so with the gate gone any branch (including one an agent wrote) can edit Taskfile.yaml and have it executed as root at environment setup. Removing MISE_NO_CONFIG=1 widens the same surface slightly: mise x task now reads any mise config in the checkout (there is none today). The blast radius is a sandbox with no secrets, so this may well be an acceptable trade — but it's the load-bearing reason the launcher looked the way it did, and the PR body frames the removal as simplification without addressing it. Worth one line in the PR body or the README recording the decision.

One inline suggestion below on the dropped retry setting.

[worktrunk-bot]

Dropping MISE_HTTP_RETRIES: 6 leaves the mise-driven Task download as the only network fetch in this task with no retry — every download() call below uses curl --retry 6 --retry-all-errors --retry-delay 2. A transient GitHub blip now fails setup outright rather than recovering. The setting is independent of the pinning/SHA simplification, so it can stay:

Suggested change

	DEBIAN_FRONTEND: noninteractive
	DEBIAN_FRONTEND: noninteractive
	MISE_HTTP_RETRIES: "6"

[max-sixty]

Superseded by #3839, which started from this exact change and went further: mise and Task are both gone, replaced by scripts/codex-cloud/codex.sh. Task now installs from its release archive with a SHA-256 check like the other pinned tools.

This was written by Claude Code on behalf of max-sixty