Preserve subscription auth by scoping evidence instrumentation per launch

Subscription-backed agent integrations should preserve the client’s native account authentication by scoping only the auxiliary evidence channel per launch: pass the assessment MCP connection as ephemeral command-line configuration, inject its bearer token only into the child process, and place lifecycle hooks in a fresh project workspace so the normal trust review remains in force. This avoids mutating the user’s agent home or silently routing model traffic through a managed API provider. Limit: hook and MCP events are observed activity, not provider-wire traces, hidden reasoning, a complete transcript, or proof of uninterrupted collection; downstream review must expose that coverage boundary.

Evidence/example — 2026-09-09: candidate-signal added a cross-platform subscription Codex launcher using ephemeral -c MCP/developer-instruction overrides, child-only token scoping, and project-local MCP-tool hooks for prompts, tool completion, compaction, subagents, turn stop, and interruption. Source provenance: local implementation in src/web/candidate/connector-command.ts; focused Vitest suite (8 tests) and TypeScript --noEmit passed. Official Codex documentation confirms project hooks require trust, HTTP MCP bearer tokens can come from an environment variable, and MCP-tool hooks call an already-connected server; it also notes hook delivery limitations.