diff --git a/.codex-sso/config.toml b/.codex-sso/config.toml
index 6d502ed..bee9195 100644
--- a/.codex-sso/config.toml
+++ b/.codex-sso/config.toml
@@ -25,13 +25,13 @@ trust_level = "trusted"
 
 sandbox_mode = "workspace-write"
 personality = "pragmatic"
-model_reasoning_effort = "high"
+model_reasoning_effort = "low"
 
 
 notify = ["/Users/jetpac/.codex-sso/computer-use/Codex Computer Use.app/Contents/SharedSupport/SkyComputerUseClient.app/Contents/MacOS/SkyComputerUseClient", "turn-ended"]
 # approvals_reviewer = "guardian_subagent"
 approvals_reviewer  = "auto_review"
-plan_mode_reasoning_effort = "xhigh"
+plan_mode_reasoning_effort = "high"
 
 
 [features]
@@ -144,8 +144,9 @@ SLACK_MCP_ENABLE_WRITES = "true"
 # Kavya Nair DM (D08G5NZAN2C), Jacob Paul DM (D090RLVUCUV),
 # Owen Roberts DM (DEPU4A2QM), Colin Kavanagh DM (D02CNJ53H8X),
 # C0A71SCTQRM for Codex Slack MCP setup instructions,
-# and C05RJJ18EAF for corparch-core-srv replies.
-SLACK_MCP_WRITE_CHANNEL_ALLOWLIST = "D7PT0SXMK,D9CF41WHG,DFYAKGQFL,D08G5NZAN2C,D090RLVUCUV,DEPU4A2QM,D02CNJ53H8X,C0A71SCTQRM,C05RJJ18EAF"
+# C05RJJ18EAF for corparch-core-srv replies,
+# and D03AY0JMFDZ for this approved setup thread.
+SLACK_MCP_WRITE_CHANNEL_ALLOWLIST = "D7PT0SXMK,D9CF41WHG,DFYAKGQFL,D08G5NZAN2C,D090RLVUCUV,DEPU4A2QM,D02CNJ53H8X,C0A71SCTQRM,C05RJJ18EAF,D03AY0JMFDZ"
 
 [mcp_servers.slack.tools.conversations_add_message]
 approval_mode = "approve"
@@ -337,7 +338,7 @@ approval_mode = "approve"
 [mcp_servers.grt.tools."grt.search_entries"]
 approval_mode = "approve"
 
-[mcp_servers.grt]
+[mcp_servers.grt.env]
 GRT_ENABLE_WRITE_TOOLS = "true"
 
 [mcp_servers.webrti]
@@ -1027,6 +1028,27 @@ trust_level = "trusted"
 [projects."/Users/jetpac/Documents/ips"]
 trust_level = "trusted"
 
+[projects."/Users/jetpac/Documents/esu"]
+trust_level = "trusted"
+
+[projects."/private/tmp/pr"]
+trust_level = "trusted"
+
+[projects."/private/etc/codex"]
+trust_level = "trusted"
+
+[projects."/private/tmp/gemma"]
+trust_level = "trusted"
+
+[projects."/private/tmp/pr/oci-desktop-service-shepherd"]
+trust_level = "trusted"
+
+[projects."/Users/jetpac/PycharmProjects/akidr-version/solaris/akidr"]
+trust_level = "trusted"
+
+[projects."/Users/jetpac/Documents/OSD/calico-scm"]
+trust_level = "trusted"
+
 [marketplaces.openai-bundled]
 last_updated = "2026-05-28T10:46:49Z"
 source_type = "local"
@@ -1062,6 +1084,9 @@ global = "iterm2"
 "/Users/jetpac/Documents/codex-worktrees/mail" = "iterm2"
 "/Users/jetpac/Documents/OSD/tigera-v1.40.9/tigera-operator-new" = "iterm2"
 
+[apps.connector_4aaab2856305417b993eca9a216aaf6e.tools."microsoft outlook email_send_email"]
+approval_mode = "approve"
+
 # [projects."/Users/jetpac/Documents/codex-tools/MCPs/ident-scm-mcp"]
 # trust_level = "trusted"
 
@@ -1293,6 +1318,24 @@ approval_mode = "approve"
 [mcp_servers.mcp_gateway.tools.devops__list_shepherd_release_changes]
 approval_mode = "approve"
 
+[mcp_servers.mcp_gateway.tools.jirasd__jira_get_issue_comments]
+approval_mode = "approve"
+
+[mcp_servers.mcp_gateway.tools.bitbucket__clone_repository]
+approval_mode = "approve"
+
+[mcp_servers.mcp_gateway.tools.devops__get_security_tasks_for_team]
+approval_mode = "approve"
+
+[mcp_servers.mcp_gateway.tools.devops__get_security_findings]
+approval_mode = "approve"
+
+[mcp_servers.mcp_gateway.tools.devops__get_property_overrides]
+approval_mode = "approve"
+
+[mcp_servers.mcp_gateway.tools.devops__get_property_defaults]
+approval_mode = "approve"
+
 [mcp_servers.node_repl]
 args = []
 command = "/Applications/Codex.app/Contents/Resources/node_repl"
diff --git a/.zshrc b/.zshrc
index e5a095b..2049030 100644
--- a/.zshrc
+++ b/.zshrc
@@ -204,6 +204,7 @@ if [[ "$OSTYPE" == darwin* ]]; then
     }
 
     export BITBUCKET_TOKEN=$(keychain_token BITBUCKET_TOKEN)
+    export HF_TOKEN=$(keychain_token HF_TOKEN)
 
     export LSCOLORS=gxfxbEaEBxxEhEhBaDaCaD
     export MANPAGER='col -bx | view -c ":set ft=man nonu nolist nomod nolist" -'
@@ -278,3 +279,7 @@ fi
 
 unset _profile_interactive _profile_emacs _profile_terminal _profile_plugin _profile_cache_root _profile_launchctl_ssh_auth_sock
 unset -f _profile_add_plugin _profile_add_plugin_if_command_exists 2>/dev/null || true
+
+### MANAGED BY RANCHER DESKTOP START (DO NOT EDIT)
+export PATH="/Users/jetpac/.rd/bin:$PATH"
+### MANAGED BY RANCHER DESKTOP END (DO NOT EDIT)