test: verify tracker MCP credential resolution works in Codex

[Lillevang]

Purpose

#17 wires tracker MCP servers into a scaffolded workspace via .mcp.json using ${env:VAR} references, with the secret living in the environment (never in the tracked .mcp.json). This works today in Claude Code for the project-management flavor (confirmed by the maintainer: as long as .mcp.json sits in the folder being worked in, the server is picked up). It has not been verified end-to-end in Codex.

This is the load-bearing prerequisite for #67 (guided credential setup): before building any "write the credential for her" UX, we must know exactly how a credential reaches the MCP client at launch in each client.

What to verify (Codex)

1. Does Codex pick up a .mcp.json placed in the workspace/working folder (the same way Claude Code does), or does it expect MCP config in a different location?
2. Does Codex resolve ${env:VAR} references in .mcp.json from the process environment?
3. Credential delivery: where must the secret actually live for Codex to see it — an environment variable in Codex's own process environment, or will a workspace-level .env file be sourced automatically? (Current strong suspicion, per the maintainer: a workspace .env is not auto-sourced, so the var must be set in the environment. Confirm this.)
4. Run through a real tracker (start with gh, since gh auth token reuse is the smoothest path) end-to-end: scaffold project-management, add-tracker gh, set the credential, and confirm Codex can make an authenticated tracker call.

Acceptance criteria

• Documented finding: does Codex read .mcp.json from the working folder? (yes/no + where if no)
• Documented finding: does Codex resolve ${env:VAR} from the environment?
• Documented finding: the exact, working credential-delivery mechanism for Codex (env var location; whether a workspace .env is auto-sourced or not).
• An end-to-end success with at least one tracker (gh) in Codex, or a precise description of what fails and where.
• Findings recorded so feat(cli): guided credential setup for non-technical users (tracker MCP on doc-collab flavors) #67's design can rely on them (and any doc updates to docs/cli.md / integration READMEs if the Codex story differs from Claude Code).

Related

• feat(cli): guided credential setup for non-technical users (tracker MCP on doc-collab flavors) #67 (guided credential setup — blocked on knowing this mechanism)
• PM flavor: secure token/secret management for MCP trackers #17 (the env-var credential plumbing being verified)