Authentication and observability are separate contracts: subscription sign-in can remove…

Authentication and observability are separate contracts: subscription sign-in can remove credential friction, but it does not by itself expose assessment-grade request/response or token evidence. Use supported MCP/hooks for explicitly labeled best-effort live activity, reconcile with workspace checkpoints/submission, and retain a managed provider gateway when exact traces are required. Limit: this conclusion depends on the currently documented Codex surfaces; an official subscription telemetry/export API could change it.

Evidence/example (2026-09-09, local candidate-signal review): its managed Codex CLI path captures exact Responses SSE frames at the server; its existing hooks deliberately capture only tool/lifecycle metadata. Official Codex Hooks documentation identifies hooks as a logging extension but notes trust and lifecycle boundaries.