HT-018: Ollama 0.24+ Codex App Bridge Validation

Atlantis ITS — May 2026
Version: 1.1
Status: ✅ Validated — Lab Confirmed May 19, 2026
Owner: Shane Hardin
Governance Lane: Jimmy
Squad Credit: Mercy (runbook), Scout (verification), Ozzy (synthesis + HT format)
Scope: Trunks WSL2 + Windows host + atlantis-labs only — NOT production
Local Path: C:\AtlantisITS\knowledge
Forgejo Path: atlantis-docs/how-to/HT-018-Ollama-Codex-Bridge-Validation.md
Supersedes: HT-018 v1.0

What Changed in v1.1

Purpose

Validate the Ollama 0.24+ Codex App bridge inside the Atlantis lab environment.

This runbook verifies whether OpenAI Codex App can connect to local Ollama models for private, data-sovereign coding workflows — without touching production Atlantis repositories, credentials, .env files, customer data, or live infrastructure.

Why this matters for Atlantis: - Cooper and Mercy-Codex gain a visual coding interface with GitHub + Linear integration - All tokens stay on Trunks GPU — zero cloud ingestion - Aligns with SOP-008 v0.4 data privacy requirements - Zero additional cost — fully local

Safety Rules (Non-Negotiable)

Do NOT use this runbook against production repos. Do NOT expose:

• .env files or API keys of any kind
• Customer, guest, rental, or lead data
• Internal financial data
• Production Nova / n8n / Forgejo credentials
• Live Atlantis website repos
• Cloudflare, Vercel, Namecheap, banking, or admin sessions

Authorized workspace only:

~/atlantis/atlantis-labs
~/atlantis/atlantis-labs/experiments/

SOP-008 gate applies. Any promotion of Codex App to production workflows requires SOP-008 v0.4 review and Shane sign-off.

Architecture: Dual Ollama Install on Trunks

This is the key insight discovered during the May 19 session. Ollama must be installed in TWO places on Trunks for the full stack to work.

Both bind to :11434. Windows Ollama owns the tray icon and handles GUI routing. WSL2 Ollama handles Nova and squad services. They coexist — Windows side takes priority for GUI apps since the Codex App runs on the Windows host.

Background & Context

What happened (May 19, 2026)

The Atlantis Council received a briefing claiming Ollama 0.24.0 had shipped with native Codex App support. The briefing contained legitimate core information mixed with fabricated technical details (fake version numbers, invalid command syntax, non-existent model tags). Council process caught the discrepancies:

• Ozzy flagged as potential prompt injection — overcalled, but correct instinct
• Scout verified via real-time search — confirmed Ollama 0.24.0 is real, released May 14, 2026
• Mercy synthesized all inputs and issued balanced verdict

Council verdict: Not a confirmed hostile injection. Real capability. Unsafe "run this now" framing. Safe path required before execution.

What Ollama 0.24.0 actually adds

• ollama launch codex-app — connects OpenAI Codex desktop app to local Ollama models
• Built-in browser with page annotation for local staging sites
• Inline code review and git/worktree integration
• /api/show response caching — ~6.7x latency improvement for VS Code integrations
• Also supports: ollama launch claude, ollama launch opencode

Known issues at time of validation

• WSL2 limitation: ollama launch codex-app fails in WSL2 with error "codex-app is only supported on macOS and Windows". Must run from Windows PowerShell — not WSL terminal.
• Windows Ollama required: Codex App needs a native Windows Ollama install. WSL2 Ollama alone is not sufficient.
• Codex App separate installer: Ollama does not bundle Codex App. Must install from https://developers.openai.com/codex/quickstart separately.
• WindowsApps permissions: Windows Store apps install to C:\Program Files\WindowsApps\ which is locked by default. Some installs require manual ownership takeover before first launch.
• 4K resolution annotation bug: CSS selectors inaccurate at high DPI. GitHub issue #8127. Fix expected in 0.24.1 patch end of May 2026.

Prerequisites

• [ ] Trunks WSL2 (Ubuntu 24.04) running
• [ ] Ollama WSL2 install confirmed (/usr/local/bin/ollama)
• [ ] atlantis-labs repo initialized with experiments/ directory
• [ ] Nova's Llama 3.1 8B confirmed on :11434
• [ ] No production sessions open during upgrade
• [ ] SOP-008 v0.4 loaded and understood
• [ ] Windows PowerShell available (for Windows-side steps)

PART A — WSL2 Ollama Upgrade

Step 1 — Baseline Verification (WSL2)

cd ~/atlantis/atlantis-labs

# Confirm version
ollama --version
# Expected starting baseline: ollama version is 0.21.0

# Confirm binary location
which ollama
# Expected: /usr/local/bin/ollama

# Snapshot current models before upgrade
ollama list > /tmp/ollama-models-pre-upgrade.txt
cat /tmp/ollama-models-pre-upgrade.txt
# Llama 3.1 8B must be present — Nova's brain

# Confirm local API responding
curl http://localhost:11434/api/tags

# Confirm PM2 services healthy
pm2 status

Do not proceed if: API not responding or PM2 shows failures.

Step 2 — Gated Installer Inspection (WSL2)

Never pipe curl directly to sh. Download first, inspect, then execute. No exceptions.

# Download installer to staging file
curl -fsSL https://ollama.com/install.sh -o /tmp/ollama-install.sh

# Optional: capture checksum fingerprint
sha256sum /tmp/ollama-install.sh

# Open for inspection
less /tmp/ollama-install.sh

What to look for: - All downloads from ollama.com only — no third-party domains - No secondary curl/wget chains - No writes outside /usr/local/bin and /usr/local/lib - Standard useradd, usermod, systemd service creation - No credential prompts, no phone-home logic

Press q to exit. Stop if anything looks suspicious.

Step 3 — Execute WSL2 Upgrade

sh /tmp/ollama-install.sh

# Verify
ollama --version
# Expected: ollama version is 0.24.0 or higher

# Confirm API still responding
curl http://localhost:11434/api/tags

# Confirm Nova's model survived
ollama list
# Llama 3.1 8B must still be present
# If missing: ollama pull llama3.1:8b

Stop if: Version didn't update or Nova's model is missing.

PART B — Windows Ollama Install

Required for Codex App. WSL2 Ollama alone cannot launch GUI apps.

Step 4 — Windows ↔ WSL2 Connectivity Check

Before touching firewall rules, test if Windows can already reach WSL2 Ollama.

In Windows PowerShell (not WSL):

curl http://localhost:11434/api/tags

• Response returned → connectivity confirmed, skip Step 5
• Fails → proceed to Step 5

Step 5 — Conditional Firewall Exception

Only if Step 4 failed. Do NOT expose Ollama to Public networks.

1. Win + R → wf.msc → Enter
2. Inbound Rules → New Rule → Port → TCP
3. Specific local ports: 11434
4. Allow the connection
5. Apply to Private profile ONLY — uncheck Public and Domain
6. Name: Atlantis-Ollama-Inbound-Gate → Finish

Verify in PowerShell:

netsh advfirewall firewall show rule name="Atlantis-Ollama-Inbound-Gate"

Trunks note: Rule was NOT pre-existing. Created May 19, 2026 during this session.

Step 6 — Gated Windows Ollama Install

Same SOP-008 rule applies on Windows. No blind irm | iex piping.

# Download installer to staging file
Invoke-WebRequest https://ollama.com/install.ps1 -OutFile $env:TEMP\ollama-install.ps1

# Inspect in Notepad before running
notepad $env:TEMP\ollama-install.ps1

What to look for in the PowerShell script: - All downloads from ollama.com/download only - Test-Signature function verifies .exe is signed by O=Ollama Inc. via DigiCert — this is built into the script and is a strong trust signal - No secondary payload downloads - No credential prompts

Once satisfied:

& $env:TEMP\ollama-install.ps1

# Verify
ollama --version
# Expected: ollama version is 0.24.0

Step 7 — Install Codex App (Windows)

Codex App is a separate installer from Ollama. Must be installed independently.

1. Go to: https://developers.openai.com/codex/quickstart
2. Download the Windows installer
3. Run it — inspect before running per SOP-008

WindowsApps permissions gotcha: Codex App installs to C:\Program Files\WindowsApps\ which Windows locks by default. If you get "Windows cannot access the specified device, path, or file" on first launch: - Try: Win → search Codex → Right-click → Run as administrator - If that fails: navigate to C:\Program Files\WindowsApps\OpenAI.Codex_* → right-click folder → Properties → Security → Advanced → Take Ownership → Apply - Reboot after taking ownership — app should launch normally after reboot

PART C — Model Setup

Step 8 — Pull Correct Coder Model

Critical lesson from May 19: qwen3-coder without a tag pulls latest which is 18GB — exceeds Trunks 12GB VRAM and WSL2 4GB RAM cap. qwen3-coder:8b tag does not exist. Use the verified alternative below.

Run in WSL2:

# Verified lightweight coder model — confirmed working on Trunks May 19
ollama pull qwen2.5-coder:7b-instruct-q4_K_M

# Confirm
ollama list

Confirm it works before touching Codex App:

ollama run qwen2.5-coder:7b-instruct-q4_K_M "Say hello from the Atlantis lab in one sentence."
# Expected: clean single sentence response, no memory errors

VRAM guidance for Trunks RTX 3060 (12GB) / WSL2 4GB RAM cap:

Confirmed clean model registry on Trunks (May 19, 2026):

qwen2.5-coder:7b-instruct-q4_K_M    4.7 GB   ← Codex bridge
llama3.1:8b                          4.9 GB   ← Nova's brain — do not remove

PART D — Bridge Launch & Validation

Step 9 — Create Lab Workspace

mkdir -p ~/atlantis/atlantis-labs/experiments/codex-ollama-bridge
cd ~/atlantis/atlantis-labs/experiments/codex-ollama-bridge

cat > README.md <<'EOF'
# Codex Ollama Bridge Test

This is a lab-only test repo for validating local Ollama + Codex App integration.
No production secrets, customer data, or live Atlantis code allowed.
EOF

Step 10 — Activate Ollama Bridge

Run in Windows PowerShell (NOT WSL2):

ollama launch codex-app --model qwen2.5-coder:7b-instruct-q4_K_M

Expected output:

Codex App profile changed to Ollama.
To restore your usual Codex profile, run: ollama launch codex-app --restore

Do not run from WSL2 — will fail with: Error: Codex App launch is only supported on macOS and Windows

Invalid syntax — never use:

ollama launchcodex app    ← WRONG — not a real command

Step 11 — Validate Inside Codex App

When Codex App opens, confirm:

• [ ] Ollama tag visible in bottom-right of input bar ✅
• [ ] GitHub connected (green checkmark) ✅
• [ ] Linear connected (green checkmark) ✅
• [ ] Model shows as Custom / Medium (Ollama routing)

Point the workspace at:

\\wsl.localhost\Ubuntu-24.04\home\shane\atlantis\atlantis-labs\experiments\codex-ollama-bridge

Or on Windows side if you've cloned there.

First safe prompt — structure test:

Review this lab README and suggest a simple folder structure for testing 
local AI coding workflows. Do not access any parent directories. 
Do not create production code. Do not use secrets or environment variables.

Second safe prompt — code generation test:

Create a simple mock JavaScript function that validates a fake social signal 
payload. Use fake data only. Do not call external APIs.

Verify responses generate locally — no OpenAI API calls should fire.

Step 12 — Restore Codex App If Needed

ollama launch codex-app --restore

Pass Criteria

Confirmed ✅ May 19, 2026 on Trunks

• [x] WSL2 Ollama upgraded to 0.24.0
• [x] Windows Ollama installed and confirmed 0.24.0
• [x] WSL2 reaches http://localhost:11434/api/tags
• [x] Windows PowerShell reaches http://localhost:11434/api/tags
• [x] Nova's Llama 3.1 8B survived upgrade
• [x] ollama launch codex-app confirmed from PowerShell
• [x] Codex App shows Ollama tag — local model routing confirmed
• [x] GitHub connected inside Codex App
• [x] Linear connected inside Codex App
• [ ] Test prompts validated inside lab workspace ← complete this
• [ ] No production repo opened
• [ ] No .env file accessed
• [ ] No secrets or credentials exposed
• [ ] No customer/rental/lead/personal data used
• [ ] No direct commit to main

Stop / Fail Criteria

Stop immediately if:

• Installer downloads from non-ollama.com or non-openai.com domains
• Ollama version does not update cleanly on either WSL2 or Windows
• Nova's Llama 3.1 8B missing after upgrade
• Memory error when running model (requires more system memory than is available)
• Codex App cannot restore via --restore
• Any command requests credentials unexpectedly
• Any model attempts external API calls
• Codex App requests access to production folders
• Firewall rule requires Public network exposure
• Token, key, .env, or private repo data appears in session

Post-Validation Next Steps

• [ ] Complete test prompts in lab workspace
• [ ] Log results in atlantis-labs/experiments/codex-ollama-bridge/
• [ ] Update updates.md with full session findings (entry below)
• [ ] Squad debrief: Cooper and Mercy-Codex assess workflow fit
• [ ] SOP-008 v0.4 review before promotion to production workflows
• [ ] Shane sign-off required before Codex App touches any live Atlantis repo
• [ ] Push HT-018 v1.1 to Forgejo atlantis-docs/how-to/
• [ ] Update V24 memory with Codex App bridge confirmed

Promotion path (if validated):

atlantis-labs validation ✅
→ SOP-008 review + Shane sign-off
→ Cooper/Mercy-Codex production workflow
→ V24/V25 memory update

Future integrations to evaluate (same pattern):

ollama launch claude      ← Claude Desktop local routing
ollama launch opencode    ← OpenCode IDE local routing

updates.md Entry

### May 19, 2026 — Ollama 0.24.0 + Codex App Bridge
- Ollama WSL2 baseline confirmed: v0.21.0 at /usr/local/bin/ollama
- Ollama v0.24.0 verified — released May 14, 2026 (Scout real-time verification)
- WSL2 Ollama upgraded to 0.24.0 via gated installer inspection (SOP-008 compliant)
- Windows Ollama installed separately — required for GUI app routing
- Both WSL2 and Windows Ollama confirmed at 0.24.0
- Codex App installed from developers.openai.com/codex/quickstart
- WindowsApps permissions gotcha — required manual ownership takeover before launch
- Firewall rule created: Atlantis-Ollama-Inbound-Gate (TCP :11434, Private only)
- qwen3-coder:latest = 18GB — exceeded Trunks VRAM + WSL2 RAM cap. Removed.
- qwen3-coder:8b tag does not exist in Ollama library
- Confirmed working model: qwen2.5-coder:7b-instruct-q4_K_M (4.7GB, Q4_K_M)
- Test confirmed: ollama run qwen2.5-coder:7b-instruct-q4_K_M "Say hello" → clean response
- Codex App bridge confirmed: Ollama tag visible, GitHub + Linear connected
- Dual Ollama strategy locked: Windows = GUI apps, WSL2 = Nova brain + squad services
- Council disagreement resolved — briefing not hostile, but unsafe framing caught correctly
- HT-018 v1.1 created and pushed to atlantis-docs/how-to/
- /api/show caching confirmed real in v0.24.0 (~6.7x VS Code latency improvement)
- Codex App bridge promotion pending: SOP-008 review + Shane sign-off before production use

Troubleshooting

Related Documents

References

• Ollama v0.24.0 Release Notes — github.com/ollama/ollama/releases/tag/v0.24.0
• Ollama Launch Blog — ollama.com/blog/launch
• Codex App Quickstart — developers.openai.com/codex/quickstart
• SOP-008 v0.4 — AI Production Risk Review
• ATLANTIS_AI_MEMORY.md V23 (May 14, 2026)
• updates.md May 19, 2026
• CIS Docker Benchmark v1.8.0
• HT-013 v1.1: PM2 Service Management
• Council session transcript: May 19, 2026

HT-018 v1.1 generated by Ozzy — May 19, 2026
Supersedes HT-018 v1.0
Squad credit: Mercy (runbook architecture), Scout (real-time verification), Jimmy (governance lane)
Store at: C:\AtlantisITS\knowledge\HT-018-Ollama-Codex-Bridge-Validation-v1.1.md
Push to Forgejo: atlantis-docs/how-to/HT-018-Ollama-Codex-Bridge-Validation.md