Verify hooks in the Codex surface and project layer that owns them

Hook verification must be performed in the same Codex surface and project layer that owns the hook. A project-local hooks.json loaded by a temporary CLI working directory will not be proven by viewing the desktop app's global/plugin Hooks settings; seeing only plugin hooks there is compatible with the CLI project hooks existing elsewhere. First identify CLI vs desktop, current working directory/project root, and configuration layer, then inspect trust and hook status in that exact session. This distinction does not prove the hook executed—it only prevents a scope-mismatch false negative.

Evidence/example — 2026-09-10, candidate-signal repository inspection plus user-provided Codex settings screenshot: the subscription launcher writes /.codex/hooks.json and starts codex -C against that workspace. The candidate UI names this mode “Codex CLI · my subscription.” The screenshot showed the separate desktop application's global Hooks settings with plugin hooks only. Official OpenAI documentation states that project-local hooks are discovered from the active project layer and load only when that project is trusted. Source provenance: local repository source, user-authorized screenshot, and official OpenAI Hooks/Advanced Configuration documentation.