Extending Codex

Take a repo in good shape by every measure this course uses: import-bank-csv sits in .agents/skills/, so the import procedure fires on recognition (the skills chapter built that); facts live in AGENTS.md, repeating procedures became skills, one-offs stay in the prompt; and the money path is hard - app/importers/csv.py converts amounts through Decimal, never a float, with a green suite pinning it (ten tests in the course’s labeled continuation).

Two gaps are left, and they are different in kind. The first is reach: a handful of transactions are in euros and pounds, recorded at whatever rate you guessed when you typed them in, and nothing anywhere in the repo can fetch a live rate. There is no fx module in budgetcli (the course’s running example, a small self-hosted personal-finance API in Python and FastAPI) and never has been - the rate feature is this course’s constructed next ticket, the same labeled scenario approvals & sandbox met at the network wall.

The second gap is a guarantee. The float parse survived for six chapters while AGENTS.md stated the opposite rule, in context, on every single session - nothing argued it away, and nothing stopped it. A rules file informs; it never enforces. The hardening eventually landed because you drove it there, turn by turn. What did not exist at any point was a check that fires whether or not anyone remembers.

Two arguments, not one

This chapter is two separate arguments, and they don’t share a mechanism, so don’t read them as one long one:

• Reach. Connecting the rate API as an MCP server gives Codex a tool the repo cannot provide - at a real, recurring price that current Codex only sometimes charges up front.
• The gate. Wiring hooks on the money path takes a door away and adds a check nothing can argue with - and then the last lesson works out exactly when a hook is the right tool instead of a rule or a permission.

The only thing the two share is what they’re not: neither one is a line in AGENTS.md. Reach isn’t something you can write into a rule - the model can’t call an API that isn’t wired up, no matter how clearly you describe it. And “never rewrite a raw statement” is exactly the kind of promise a rule keeps until the one session it doesn’t.

One expectation to correct before it forms: this chapter is not a replay of the approvals chapter’s network wall. That wall governs programs the agent’s shell commands spawn - sandbox_workspace_write.network_access is the dial that opened it. An MCP server connection is a separate wiring and approval surface, and the reach lesson teaches that split instead of assuming one wall covers both.

What you’ll do this chapter

• Connect the exchange-rate API as an MCP server - register it, learn which surface actually governs its reach, and price what a connected tool costs with schema deferral stated honestly.
• Gate the money path with hooks - block rewrites of the raw statements, and run the money tests automatically after every edit under app/importers/ and app/services/, including a direct edit to ledger.py mid-session.
• When a hook beats a rule or a permission - three guarantee strengths, and the one question that tells you which one a given constraint actually needs.

Start by connecting the rate API.