aevatar-codex-exec-workflow-samplelisted

# Verify Aevatar codex_exec ## Choose exactly one proof Mount this skill from Ornn and run one bundled workflow for the configured target: - `codex-exec-check`: canonical managed chrono-sandbox/gVisor proof with no caller routing. - `codex-exec-private-ssh-check`: private NyxID node-backed SSH proof with only service and principal routing. Configuration, health, UserService, node-online, and direct SDK/SSH checks are prerequisites, not completion evidence. Report `codex_exec` as usable only after the selected Aevatar workflow returns exact `CODEX_EXEC_READY` under that target's result contract. ## Guardrails - Fetch the public skill from Ornn. Do not validate only a local workflow copy. - Keep the fixed probe prompt. Do not replace it with a real task. - Never place tokens, keys, `auth.json`, `CODEX_HOME`, local paths, model flags, images, providers, or sandbox flags in workflow input. - Do not mix target fields. Managed requires `target.kind=managed_sandbox` plus `workspace.kind=empty_git`; private requires nested `target.private_ssh` and no workspace. - Managed callers cannot choose a repository, workspace path, image, model, provider, credential, shell, Codex profile, approval policy, or sandbox flags. - Run through Aevatar as the native NyxID account being verified. Never pass a raw token. Before the managed proof, use the explicit authenticated credential lifecycle: `POST /api/managed-codex/credential`, then `GET /api/managed-codex/credential`. Continue only wh