Complete procedures with a way back.

npm reports UNABLE_TO_GET_ISSUER_CERT_LOCALLY or SELF_SIGNED_CERT_IN_CHAIN when Node.js cannot build a trusted certificate path for the configured registry or an HTTPS-intercepting proxy. This guide restores an explicit trust chain without disabling TLS verification.

Combine codex exec, the TypeScript Codex SDK, and openai/codex-action@v1 into bounded maintenance workflows with read-only defaults, scoped credentials, structured artifacts, explicit write jobs, human review gates, and resumable failure handling.

Build a two-job GitHub Actions workflow where untrusted pull-request tests run without secrets and a trusted base-branch Agent SDK harness reviews only a bounded diff with no tools, no target-code execution, explicit time and cost limits, structured evidence, and a mandatory human decision.

Create one concise canonical project policy, accurate adapters and path scopes for Codex, Claude Code, Gemini CLI and GitHub Copilot, then secure, test, version and roll back the resolved bundle.