ai: migrate LLM backbone from Kimi CLI to Codex CLI

Retires the Moonshot/Kimi subscription in favour of the already-paid ChatGPT
plan. Both CLI wrappers now run `codex exec`; the kimi-agent container is gone.

adolf-llm + hindsight-llm:
- runKimi -> runCodex (`codex exec --json --skip-git-repo-check`), resume via
  `codex exec resume <thread_id>`.
- MCP moves from a per-session .mcp.json (a workaround for Kimi having no
  --mcp-config-file flag) to a $CODEX_HOME/config.toml generated once at
  startup from shared-mcp.json. Field translation is load-bearing:
  bearerTokenEnvVar -> bearer_token_env_var, enabledTools -> enabled_tools.
- approval_policy="never" + sandbox_mode required, or unattended turns block
  on an approval prompt nobody can answer.

kimi-agent removed. It was the ONLY large-tier deployment behind LiteLLM, so
deleting it outright would have silently degraded every large-tier request to
the local 4B model via the existing fallbacks. tier-large, the auto_router
complex-reasoning route and their fallbacks now point at the codex-backed
adolf-llm wrapper (model_name: codex-agent).

Three environment blockers fixed along the way:
- OpenAI geo-blocks this host (403 unsupported_country_region_territory).
  Both containers now egress via the host xray proxy, with NO_PROXY keeping
  MCP and *.alogins.net traffic off the tunnel.
- node:22-slim ships no system CA store; the Rust codex binary validates TLS
  against it, so every HTTPS call failed with a generic transport error while
  Node's own fetch worked. ca-certificates added to both images.
- `codex exec resume` rejects -C/--cd (plain `codex exec` accepts it), which
  broke follow-up turns while first turns succeeded.

Known regression: Kimi's managed-usage API has no Codex equivalent, so the
/usage route returns 501 and there is no quota probe for the codex model.
The two quota plugins degrade quietly to no output.

Also: stop tracking cognee.env (live LLM + JWT secrets) and gitignore it.
The secrets remain in earlier history and should be rotated.

Verified live: plain turn, SSE streaming, session resume, MCP tool call,
bearer-token MCP call, and completions through both LiteLLM routes.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014Y5QPagv4iun1ghpwM96Ff

ai/feedback-loop-openclaw-plugin/openclaw.plugin.json

@@ -0,0 +1,74 @@
+{
+  "id": "feedback-loop",
+  "name": "Proactive Feedback Loop",
+  "description": "Logs every proactive send (kb #125) and its outcome — accepted/dismissed/irrelevant/ignored/not_sent — using the DESIGN-proactive-prioritization.md (kb #123) §5 schema. Captures feedback via short text replies (+/-/неактуально) observed on message_received, and via a best-effort peek at Matrix emoji-reaction system-event text on before_prompt_build (no dedicated reaction hook exists in OpenClaw today — see plugin README/report). Exposes log_proactive_action and get_proactive_feedback_stats tools so Adolf (and later kb #123's gate) can record sends and read back Laplace-smoothed per-class acceptance rates. No conversation-content hooks used — no allowConversationAccess/allowPromptInjection opt-in required.",
+  "activation": {
+    "onStartup": true
+  },
+  "contracts": {
+    "tools": ["log_proactive_action", "get_proactive_feedback_stats"]
+  },
+  "configSchema": {
+    "type": "object",
+    "additionalProperties": false,
+    "properties": {
+      "enabled": { "type": "boolean" },
+      "maxRecords": { "type": "integer", "minimum": 50, "maximum": 50000 },
+      "ignoreAfterMs": { "type": "integer", "minimum": 60000, "maximum": 2592000000 },
+      "replyFallbackWindowMs": { "type": "integer", "minimum": 60000, "maximum": 2592000000 },
+      "acceptedTextPatterns": { "type": "array", "items": { "type": "string" } },
+      "dismissedTextPatterns": { "type": "array", "items": { "type": "string" } },
+      "irrelevantTextPatterns": { "type": "array", "items": { "type": "string" } },
+      "acceptedEmoji": { "type": "array", "items": { "type": "string" } },
+      "dismissedEmoji": { "type": "array", "items": { "type": "string" } },
+      "irrelevantEmoji": { "type": "array", "items": { "type": "string" } },
+      "statsTrailingN": { "type": "integer", "minimum": 5, "maximum": 1000 }
+    }
+  },
+  "uiHints": {
+    "enabled": {
+      "label": "Feedback Loop",
+      "help": "Enable proactive-action feedback logging and capture."
+    },
+    "maxRecords": {
+      "label": "Max Log Records",
+      "help": "Oldest records are pruned FIFO once the log exceeds this many rows (default 5000 — homelab scale, not a hard requirement)."
+    },
+    "ignoreAfterMs": {
+      "label": "Ignore-After (ms)",
+      "help": "A sent proactive action with no response by this age is settled to outcome=ignored (weaker negative signal than an explicit dismiss). Default 24h."
+    },
+    "replyFallbackWindowMs": {
+      "label": "Reply Fallback Window (ms)",
+      "help": "When an inbound feedback reply does not quote a specific message (no replyToId), fall back to the sender's single newest pending record within this window. If more than one pending record exists, the reply is left unattributed rather than guessed. Default 24h."
+    },
+    "acceptedTextPatterns": {
+      "label": "Accepted Text Patterns",
+      "help": "Exact (case-insensitive, trimmed) reply texts that mark the correlated proactive action accepted. Default: [\"+\", \"+1\"]."
+    },
+    "dismissedTextPatterns": {
+      "label": "Dismissed Text Patterns",
+      "help": "Exact reply texts that mark the correlated action dismissed. Default: [\"-\", \"−\", \"-1\"] (both hyphen-minus and Unicode minus sign)."
+    },
+    "irrelevantTextPatterns": {
+      "label": "Irrelevant Text Patterns",
+      "help": "Exact reply texts that mark the correlated action irrelevant. Default: [\"неактуально\", \"не актуально\", \"irrelevant\", \"not relevant\"]."
+    },
+    "acceptedEmoji": {
+      "label": "Accepted Emoji",
+      "help": "Reaction emoji mapped to accepted when opportunistically matched from queued system-event text. Default: [\"👍\"]."
+    },
+    "dismissedEmoji": {
+      "label": "Dismissed Emoji",
+      "help": "Reaction emoji mapped to dismissed. Default: [\"👎\"]."
+    },
+    "irrelevantEmoji": {
+      "label": "Irrelevant Emoji",
+      "help": "Reaction emoji mapped to irrelevant. Default: [\"🤷\"]."
+    },
+    "statsTrailingN": {
+      "label": "Stats Trailing N",
+      "help": "get_proactive_feedback_stats computes each class's acceptance rate over at most this many of its most recent settled records (recency-weighted per DESIGN-proactive-prioritization.md §3.3). Default 50."
+    }
+  }
+}