Remove Codex CLI version validation

README.md

@@ -124,9 +124,6 @@ cargo run -p decodex --bin decodex -- serve --listen-address 127.0.0.1:8912
 
 Project-scoped commands accept `--config <PROJECT_DIR>` after the subcommand when the
 operator wants to override registry-based project resolution for that command.
-Use `--allow-unverified-codex` on `run`, `serve`, or `probe` only when deliberately
-dogfooding a Codex build outside the locally verified app-server range; the default
-guard remains fail-closed.
 `decodex status` prints the local runtime snapshot without refreshing live
 tracker, pull-request, or Codex account usage observers. Use `decodex status --live`
 when the operator needs fresh Linear/GitHub readback before acting; use the Accounts

apps/decodex-app/README.md

@@ -14,11 +14,9 @@ bundled Rust app helper so account UI stays on the same CLI-owned files even whe
 long-running local `decodex serve` is older than the app bundle. On launch the app also
 connects to an existing `decodex serve` on the default local endpoint when one is
 available; otherwise it starts the bundled Decodex binary as a normal scheduler with
-`decodex serve --allow-unverified-codex --listen-address 127.0.0.1:8192`. The override
-only downgrades unverified Codex app-server identity to a warning; other preflight
-blockers remain fail-closed. The CLI owns the default scheduler interval, currently
-15 seconds. App-started servers load the enabled project registry and own the same
-operator listener as a manually started `decodex serve`. The helper owns account
+`decodex serve --listen-address 127.0.0.1:8192`. The CLI owns the default scheduler
+interval, currently 15 seconds. App-started servers load the enabled project registry
+and own the same operator listener as a manually started `decodex serve`. The helper owns account
 operations and interactive login flows that need streamed command output:
 
 - list accounts without printing token material
@@ -77,10 +75,9 @@ swift run --package-path apps/decodex-app DecodexApp
 
 Use hidden `decodex serve --dev` only when manually testing local account APIs, the app
 snapshot API, or dashboard routes while deliberately avoiding scheduler activity. The
-normal app fallback is `decodex serve --allow-unverified-codex --listen-address
-127.0.0.1:8192` so development Codex app-server builds can still run through the local
-operator surface. Do not use `--dev` to validate project registration, Linear polling,
-queue intake, or retained-lane execution; use ordinary `decodex serve` for those paths.
+normal app fallback is `decodex serve --listen-address 127.0.0.1:8192`. Do not use
+`--dev` to validate project registration, Linear polling, queue intake, or retained-lane
+execution; use ordinary `decodex serve` for those paths.
 
 The staging script follows the local Rsnap-style signing path: it writes
 `target/decodex-app/Decodex.app`, signs the bundle with an Apple Development

apps/decodex-app/Sources/DecodexApp/DecodexServerBridge.swift

@@ -237,7 +237,6 @@ actor DecodexServerBridge {
 	static func bundledServerArguments(listenAddress: String) -> [String] {
 		[
 			"serve",
-			"--allow-unverified-codex",
 			"--listen-address", listenAddress,
 		]
 	}

apps/decodex-app/Tests/DecodexAppTests/DecodexServerBridgeTests.swift

@@ -2,12 +2,11 @@
 import XCTest
 
 final class DecodexServerBridgeTests: XCTestCase {
-	func testBundledServerArgumentsAllowUnverifiedCodex() {
+	func testBundledServerArgumentsStartServeOnListenAddress() {
 		XCTAssertEqual(
 			DecodexServerBridge.bundledServerArguments(listenAddress: "127.0.0.1:8192"),
 			[
 				"serve",
-				"--allow-unverified-codex",
 				"--listen-address",
 				"127.0.0.1:8192",
 			]