@awak-app/simy-cli 0.5.15 → 0.5.16

package/src/orchestrator/pr-preparation.js

@@ -0,0 +1,420 @@
+import { createHash } from "node:crypto";
+
+import { cleanString, stringArray } from "./shared.js";
+
+export const PR_PREPARATION_CONTRACT_VERSION = 2;
+const LEGACY_PR_PREPARATION_CONTRACT_VERSION = 1;
+
+const BASE_PR_PREPARATION_CHECKS = Object.freeze([
+  { id: "current_base_and_head", label: "Latest base is integrated into the reported head" },
+  { id: "current_ci_and_skips", label: "Current-head CI passed and every skip is disclosed" },
+  { id: "exact_revision_integration", label: "Companion revisions and combined-path evidence are exact and current" },
+  { id: "e2e_outcome_and_cleanup", label: "E2E outcomes passed and cleanup left no residual fixtures" },
+  { id: "security_and_privacy", label: "Security and privacy boundaries were checked at the changed surface" },
+  { id: "ui_and_i18n", label: "Applicable browser, layout, console, and localization checks passed" },
+  { id: "final_diff_and_scope", label: "The final diff is scoped and reviewed against the request" },
+  { id: "residual_status_disclosure", label: "Skipped gates, residual risk, and post-merge work are disclosed" },
+]);
+
+const CONDITIONAL_PR_PREPARATION_CHECKS = Object.freeze([
+  { id: "official_checklist_ownership", label: "Generated checklist-like output cannot duplicate or impersonate the controller checklist", conditional: true },
+  { id: "deployment_target_mapping", label: "The release target and deployed-revision observation method come from an authoritative topology source", conditional: true },
+  { id: "live_data_safety", label: "Live verification has an explicit write policy and leaves no residual test data", conditional: true },
+  { id: "resume_compatibility", label: "Applicable saved-run and checkpoint paths recompute derived views without losing artifacts", conditional: true },
+]);
+
+export const PR_PREPARATION_CHECKS = Object.freeze([
+  ...BASE_PR_PREPARATION_CHECKS,
+  ...CONDITIONAL_PR_PREPARATION_CHECKS,
+]);
+
+export function defaultPrPreparationContract() {
+  return {
+    version: PR_PREPARATION_CONTRACT_VERSION,
+    checks: PR_PREPARATION_CHECKS.map(({ id, label, conditional = false }) => ({
+      id,
+      label,
+      conditional,
+    })),
+  };
+}
+
+export function normalizePrPreparation(value) {
+  const rows = Array.isArray(value) ? value : [];
+  return rows.map((row) => {
+    const source = record(row);
+    return {
+      id: cleanString(source.id),
+      applicability:
+        source.applicability === "not_applicable" ? "not_applicable" : "required",
+      passed: source.passed === true,
+      observation: cleanString(source.observation) || null,
+      evidence_refs: stringArray(source.evidence_refs),
+      bound_revisions: stringArray(source.bound_revisions),
+      reason: cleanString(source.reason) || null,
+      authoritative_source: cleanString(source.authoritative_source) || null,
+      companion_revisions: normalizeCompanionRevisions(source.companion_revisions),
+      manifest_revisions: normalizeManifestRevisions(source.manifest_revisions),
+      cleanup_residual_count: Number.isInteger(source.cleanup_residual_count)
+        ? source.cleanup_residual_count
+        : null,
+      security_privacy_checks: normalizeSecurityPrivacyChecks(source.security_privacy_checks),
+      browser_artifacts: stringArray(source.browser_artifacts),
+      locales_checked: stringArray(source.locales_checked),
+      console_error_count: Number.isInteger(source.console_error_count)
+        ? source.console_error_count
+        : null,
+      network_failure_count: Number.isInteger(source.network_failure_count)
+        ? source.network_failure_count
+        : null,
+      heading_levels_checked: integerArray(source.heading_levels_checked),
+      leading_space_checked: source.leading_space_checked === true,
+      trailing_hash_checked: source.trailing_hash_checked === true,
+      single_official_checklist: source.single_official_checklist === true,
+      unverified_model_output_labeled: source.unverified_model_output_labeled === true,
+      deployment_target: cleanString(source.deployment_target) || null,
+      deployment_target_source: cleanString(source.deployment_target_source) || null,
+      revision_observation_method: cleanString(source.revision_observation_method) || null,
+      live_write_policy: normalizeLiveWritePolicy(source.live_write_policy),
+      resume_paths_checked: stringArray(source.resume_paths_checked),
+      paid_resume_support: normalizePaidResumeSupport(source.paid_resume_support),
+      paid_resume_support_source: cleanString(source.paid_resume_support_source) || null,
+      derived_views_recomputed: source.derived_views_recomputed === true,
+      artifact_content_preserved: source.artifact_content_preserved === true,
+    };
+  }).filter((row) => row.id);
+}
+
+export function normalizeSkippedChecks(value) {
+  const rows = Array.isArray(value) ? value : [];
+  return rows.map((row) => {
+    const source = record(row);
+    return {
+      name: cleanString(source.name),
+      reason: cleanString(source.reason) || null,
+      impact: cleanString(source.impact) || null,
+    };
+  }).filter((row) => row.name);
+}
+
+export function evaluatePrPreparation(charter, attempt) {
+  const contract = record(charter?.pr_preparation_contract);
+  if (!contract.version) {
+    return {
+      applicable: false,
+      passed: true,
+      checks: [],
+      detail: "Legacy charter has no structured PR preparation contract.",
+    };
+  }
+  const expectedChecks = contract.version === PR_PREPARATION_CONTRACT_VERSION
+    ? PR_PREPARATION_CHECKS
+    : contract.version === LEGACY_PR_PREPARATION_CONTRACT_VERSION
+      ? BASE_PR_PREPARATION_CHECKS
+      : null;
+  if (!expectedChecks) {
+    return {
+      applicable: true,
+      passed: false,
+      checks: [check(
+        "supported_pr_preparation_contract",
+        "PR preparation contract version is supported",
+        false,
+        `Unsupported PR preparation contract version: ${contract.version}.`,
+      )],
+      detail: "Unsupported PR preparation contract versions fail closed.",
+    };
+  }
+
+  const rows = normalizePrPreparation(attempt?.pr_preparation);
+  const byId = new Map(rows.map((row) => [row.id, row]));
+  const duplicateIds = rows
+    .map((row) => row.id)
+    .filter((id, index, all) => all.indexOf(id) !== index);
+  const unknownIds = rows
+    .map((row) => row.id)
+    .filter((id) => !expectedChecks.some((expected) => expected.id === id));
+  const headSha = cleanString(attempt?.commit_sha);
+  const verifiedRefs = new Set(
+    (attempt?.observed_evidence?.pr_preparation_refs || [])
+      .filter((item) => item?.verified === true)
+      .map((item) => cleanString(item.ref)),
+  );
+  const verifiedRefRecords = new Map(
+    (attempt?.observed_evidence?.pr_preparation_refs || [])
+      .filter((item) => item?.verified === true)
+      .map((item) => [cleanString(item.ref), item]),
+  );
+  const checks = expectedChecks.map((expected) => {
+    const row = byId.get(expected.id);
+    if (!row) {
+      return check(expected.id, expected.label, false, "Required preparation check is missing.");
+    }
+    if (row.applicability === "not_applicable") {
+      const currentRevisionBound = Boolean(headSha && row.bound_revisions.includes(headSha));
+      const evidenceVerified = row.evidence_refs.length > 0 &&
+        row.evidence_refs.every((ref) => verifiedRefs.has(ref));
+      const valid = Boolean(
+        row.reason && row.authoritative_source && currentRevisionBound && evidenceVerified
+      );
+      return check(
+        expected.id,
+        expected.label,
+        valid,
+        valid
+          ? "Not-applicable boundary is current-head-bound and supported by verified local/controller evidence."
+          : "Not-applicable claims require a reason, an authoritative source, verified evidence references, and the current head SHA binding.",
+      );
+    }
+    const currentRevisionBound = Boolean(headSha && row.bound_revisions.includes(headSha));
+    const evidenceVerified = row.evidence_refs.length > 0 &&
+      row.evidence_refs.every((ref) => verifiedRefs.has(ref));
+    const rowSpecific = rowSpecificValidation(row, verifiedRefRecords);
+    const valid = Boolean(
+      row.passed &&
+      row.observation &&
+      evidenceVerified &&
+      currentRevisionBound &&
+      rowSpecific.passed
+    );
+    return check(
+      expected.id,
+      expected.label,
+      valid,
+      valid
+        ? "Required preparation proof is current-head-bound, structurally complete, and backed by verified local/controller evidence."
+        : `Required checks need passed=true, a concrete observation, verified evidence references, the current head SHA in bound_revisions, and row-specific proof. ${rowSpecific.detail}`,
+    );
+  });
+  if (duplicateIds.length > 0) {
+    checks.push(check(
+      "unique_pr_preparation_ids",
+      "Preparation check IDs are unique",
+      false,
+      `Duplicate preparation check IDs were submitted (count: ${new Set(duplicateIds).size}).`,
+    ));
+  }
+  if (unknownIds.length > 0) {
+    checks.push(check(
+      "known_pr_preparation_ids",
+      "Preparation check IDs are recognized",
+      false,
+      `Unrecognized preparation check IDs were submitted (count: ${new Set(unknownIds).size}).`,
+    ));
+  }
+  return {
+    applicable: true,
+    passed: checks.every((item) => item.passed),
+    checks,
+    detail: checks.every((item) => item.passed)
+      ? "All applicable PR preparation checks have current revision-bound evidence."
+      : "PR preparation evidence is missing, stale, failed, or unjustifiably marked not applicable.",
+  };
+}
+
+export function independentAuditEvidenceIdentity(attempt) {
+  const local = record(attempt?.observed_evidence?.local);
+  const github = record(attempt?.observed_evidence?.github);
+  const payload = {
+    head_sha: cleanString(local.head_sha || attempt?.commit_sha),
+    fetched_base_sha: cleanString(local.base_sha),
+    github_base_sha: cleanString(github.base_sha),
+    github_head_sha: cleanString(github.head_sha),
+    github_checks: normalizeIdentityChecks(github.checks),
+    skipped_checks: normalizeSkippedChecks(attempt?.skipped_checks),
+    pr_preparation: normalizePrPreparation(attempt?.pr_preparation),
+    verified_pr_preparation_refs: (attempt?.observed_evidence?.pr_preparation_refs || [])
+      .map((item) => ({
+        ref: cleanString(item?.ref),
+        verified: item?.verified === true,
+        kind: cleanString(item?.kind),
+        sha256: cleanString(item?.sha256),
+      }))
+      .sort((a, b) => a.ref.localeCompare(b.ref)),
+    minimum_matrix_sha256: cleanString(
+      attempt?.observed_evidence?.minimum_completion?.matrix_sha256,
+    ),
+  };
+  return createHash("sha256").update(stableStringify(payload)).digest("hex");
+}
+
+export function skippedChecksDisclosure(githubChecks, reportedChecks) {
+  const observed = (Array.isArray(githubChecks) ? githubChecks : [])
+    .filter((item) => item?.state === "skipped")
+    .map((item) => cleanString(item.name))
+    .filter(Boolean);
+  const reported = normalizeSkippedChecks(reportedChecks);
+  const missing = observed.filter((name) => !reported.some((item) =>
+    item.name === name && item.reason && item.impact
+  ));
+  return {
+    passed: missing.length === 0,
+    observed_count: observed.length,
+    missing_count: missing.length,
+    detail: missing.length === 0
+      ? observed.length > 0
+        ? `All ${observed.length} skipped check(s) include reason and impact disclosure.`
+        : "No skipped PR checks were observed."
+      : `${missing.length} skipped check(s) need reason and impact disclosure.`,
+  };
+}
+
+function check(id, label, passed, detail) {
+  return { id, label, passed: Boolean(passed), detail };
+}
+
+function record(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+
+function normalizeCompanionRevisions(value) {
+  return (Array.isArray(value) ? value : []).map((item) => {
+    const source = record(item);
+    return {
+      repository: cleanString(source.repository),
+      sha: cleanString(source.sha),
+      evidence_ref: cleanString(source.evidence_ref),
+    };
+  }).filter((item) => item.repository || item.sha || item.evidence_ref);
+}
+
+function normalizeManifestRevisions(value) {
+  return (Array.isArray(value) ? value : []).map((item) => {
+    const source = record(item);
+    return {
+      manifest: cleanString(source.manifest),
+      sha256: cleanString(source.sha256),
+      evidence_ref: cleanString(source.evidence_ref),
+    };
+  }).filter((item) => item.manifest || item.sha256 || item.evidence_ref);
+}
+
+function normalizeSecurityPrivacyChecks(value) {
+  return (Array.isArray(value) ? value : []).map((item) => {
+    const source = record(item);
+    return {
+      boundary: cleanString(source.boundary),
+      result: cleanString(source.result),
+      evidence_ref: cleanString(source.evidence_ref),
+    };
+  }).filter((item) => item.boundary || item.result || item.evidence_ref);
+}
+
+function rowSpecificValidation(row, verifiedRefs) {
+  if (row.id === "exact_revision_integration") {
+    const companionsValid = row.companion_revisions.every(
+      (item) => item.repository && /^[a-f0-9]{40}$/i.test(item.sha) &&
+        item.evidence_ref && row.evidence_refs.includes(item.evidence_ref),
+    );
+    const manifestsValid = row.manifest_revisions.every(
+      (item) => item.manifest && /^[a-f0-9]{64}$/i.test(item.sha256) &&
+        item.evidence_ref && row.evidence_refs.includes(item.evidence_ref) &&
+        verifiedRefs.get(item.evidence_ref)?.sha256 === item.sha256.toLowerCase(),
+    );
+    const valid = row.companion_revisions.length + row.manifest_revisions.length > 0 &&
+      companionsValid && manifestsValid;
+    return { passed: valid, detail: "Exact-revision integration needs a companion repository/full commit SHA or manifest/SHA-256 with a matching evidence reference; use not_applicable when neither exists." };
+  }
+  if (row.id === "e2e_outcome_and_cleanup") {
+    return {
+      passed: row.cleanup_residual_count === 0,
+      detail: "E2E cleanup must report cleanup_residual_count=0.",
+    };
+  }
+  if (row.id === "security_and_privacy") {
+    return {
+      passed: row.security_privacy_checks.length > 0 && row.security_privacy_checks.every(
+        (item) => item.boundary && item.result === "passed" &&
+          item.evidence_ref && row.evidence_refs.includes(item.evidence_ref),
+      ),
+      detail: "Security/privacy proof must name the checked boundaries; use not_applicable only with verified boundary evidence.",
+    };
+  }
+  if (row.id === "ui_and_i18n") {
+    return {
+      passed: row.browser_artifacts.length > 0 && row.browser_artifacts.every((ref) =>
+        row.evidence_refs.includes(ref) && verifiedRefs.has(ref)
+      ) && row.locales_checked.length > 0 &&
+        row.console_error_count === 0 && row.network_failure_count === 0,
+      detail: "UI/i18n proof needs browser artifacts, checked locales, and zero console/network failures; use not_applicable for non-UI changes.",
+    };
+  }
+  if (row.id === "official_checklist_ownership") {
+    const levels = [...new Set(row.heading_levels_checked)].sort((a, b) => a - b);
+    return {
+      passed: levels.join(",") === "1,2,3,4,5,6" && row.leading_space_checked &&
+        row.trailing_hash_checked && row.single_official_checklist &&
+        row.unverified_model_output_labeled,
+      detail: "Checklist ownership proof must cover heading levels 1-6, leading spaces, trailing hashes, one controller-owned official table, and explicit labeling of model-generated lookalikes.",
+    };
+  }
+  if (row.id === "deployment_target_mapping") {
+    return {
+      passed: Boolean(
+        row.deployment_target && row.deployment_target_source &&
+        row.revision_observation_method &&
+        row.evidence_refs.includes(row.deployment_target_source) &&
+        verifiedRefs.has(row.deployment_target_source)
+      ),
+      detail: "Deployment mapping proof needs a target, a verified authoritative-source reference, and an exact-revision observation method.",
+    };
+  }
+  if (row.id === "live_data_safety") {
+    return {
+      passed: Boolean(row.live_write_policy && row.cleanup_residual_count === 0),
+      detail: "Live verification needs an explicit no-persistence, scoped-fixture, or authorized-production-write policy and cleanup_residual_count=0.",
+    };
+  }
+  if (row.id === "resume_compatibility") {
+    const paidSupportVerified = Boolean(
+      row.paid_resume_support && row.paid_resume_support_source &&
+      row.evidence_refs.includes(row.paid_resume_support_source) &&
+      verifiedRefs.has(row.paid_resume_support_source)
+    );
+    const paidPathSatisfied = row.paid_resume_support === "not_supported" ||
+      row.resume_paths_checked.includes("paid");
+    return {
+      passed: row.resume_paths_checked.includes("normal") &&
+        row.resume_paths_checked.includes("checkpoint") &&
+        paidSupportVerified && paidPathSatisfied &&
+        row.derived_views_recomputed && row.artifact_content_preserved,
+      detail: "Resume compatibility needs normal and checkpoint paths, a verified paid-resume support classification (and the paid path when supported), derived-view recomputation, and artifact-content preservation.",
+    };
+  }
+  return { passed: true, detail: "" };
+}
+
+function integerArray(value) {
+  return (Array.isArray(value) ? value : []).filter(Number.isInteger);
+}
+
+function normalizeLiveWritePolicy(value) {
+  const policy = cleanString(value);
+  return ["no_persistence", "scoped_fixture", "authorized_production_write"].includes(policy)
+    ? policy
+    : null;
+}
+
+function normalizePaidResumeSupport(value) {
+  const support = cleanString(value);
+  return ["supported", "not_supported"].includes(support) ? support : null;
+}
+
+function normalizeIdentityChecks(value) {
+  return (Array.isArray(value) ? value : []).map((item) => ({
+    name: cleanString(item?.name),
+    state: cleanString(item?.state),
+    status: cleanString(item?.status),
+    conclusion: cleanString(item?.conclusion),
+  })).sort((a, b) => a.name.localeCompare(b.name));
+}
+
+function stableStringify(value) {
+  if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
+  if (value && typeof value === "object") {
+    return `{${Object.keys(value).sort().map((key) =>
+      `${JSON.stringify(key)}:${stableStringify(value[key])}`
+    ).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}

package/src/orchestrator/result.js

@@ -3,6 +3,10 @@ import { minimumContext } from "../codex-plugins/simy/skills/agentic-delivery-lo
 import { contextDigest } from "../codex-plugins/simy/skills/agentic-delivery-loop/scripts/check-acceptance.mjs";
 import { cleanString, stringArray } from "./shared.js";
 import { normalizeProblemSolving } from "./problem-solving.js";
+import {
+  normalizePrPreparation,
+  normalizeSkippedChecks,
+} from "./pr-preparation.js";
 import {
   normalizeCriterionEvidence,
   normalizeUncertaintyVerification,
@@ -43,6 +47,8 @@ export function buildAttempt({ attemptNumber, charter, instruction, promptInterv
     ),
     criterion_evidence: normalizeCriterionEvidence(result.criterion_evidence),
     visual_review: normalizeVisualReview(result.visual_review),
+    pr_preparation: normalizePrPreparation(result.pr_preparation),
+    skipped_checks: normalizeSkippedChecks(result.skipped_checks),
     prompt_interventions: promptInterventions,
     work_log_signals: [],
     work_log_interventions: [],

package/src/runner.js

@@ -19,6 +19,7 @@ import {
   redactExecutionText,
 } from "./orchestrator/execution-io.js";
 import { summarizeCodingLoopEvent } from "./orchestrator/presentation.js";
+import { PR_PREPARATION_CHECKS } from "./orchestrator/pr-preparation.js";
 import { increaseProviderTokenBudget, refreshBudgetState } from "./orchestrator/budget.js";
 import { appendEvent } from "./orchestrator/shared.js";
 import {
@@ -73,6 +74,7 @@ const INTERRUPTED_STATES = new Set([
   "re_instructing",
 ]);
 const RESTORABLE_STATES = new Set([...RESUMABLE_STATES, ...INTERRUPTED_STATES]);
+const PR_PREPARATION_IDS = new Set(PR_PREPARATION_CHECKS.map((row) => row.id));
 
 export { LocalRunRegistry };
 
@@ -1007,9 +1009,90 @@ function redactedAttemptForLedger(attempt, attachments) {
     },
     raw_output: structuredResultForLedger(attempt.raw_output),
     observed_evidence: observedEvidenceForLedger(attempt.observed_evidence),
+    pr_preparation: prPreparationForLedger(attempt.pr_preparation),
+    skipped_checks: skippedChecksForLedger(attempt.skipped_checks),
   };
 }
 
+function prPreparationForLedger(value) {
+  return (Array.isArray(value) ? value : []).map((row) => ({
+    id: PR_PREPARATION_IDS.has(row?.id) ? row.id : "unrecognized",
+    applicability: row?.applicability || null,
+    passed: row?.passed === true,
+    observation_present: Boolean(row?.observation),
+    reason_present: Boolean(row?.reason),
+    authoritative_source_present: Boolean(row?.authoritative_source),
+    evidence_ref_count: Array.isArray(row?.evidence_refs) ? row.evidence_refs.length : 0,
+    bound_revisions: validatedHashesForLedger(row?.bound_revisions, 40),
+    companion_revisions: (Array.isArray(row?.companion_revisions) ? row.companion_revisions : [])
+      .map((item) => ({
+        repository_present: Boolean(item?.repository),
+        sha: validatedHashForLedger(item?.sha, 40),
+      })),
+    manifest_revisions: (Array.isArray(row?.manifest_revisions) ? row.manifest_revisions : [])
+      .map((item) => ({
+        manifest_present: Boolean(item?.manifest),
+        sha256: validatedHashForLedger(item?.sha256, 64),
+      })),
+    cleanup_residual_count: Number.isInteger(row?.cleanup_residual_count)
+      ? row.cleanup_residual_count
+      : null,
+    security_privacy_check_count: Array.isArray(row?.security_privacy_checks)
+      ? row.security_privacy_checks.length
+      : 0,
+    browser_artifact_count: Array.isArray(row?.browser_artifacts)
+      ? row.browser_artifacts.length
+      : 0,
+    locale_count: Array.isArray(row?.locales_checked) ? row.locales_checked.length : 0,
+    console_error_count: Number.isInteger(row?.console_error_count)
+      ? row.console_error_count
+      : null,
+    network_failure_count: Number.isInteger(row?.network_failure_count)
+      ? row.network_failure_count
+      : null,
+    heading_levels_checked: (Array.isArray(row?.heading_levels_checked)
+      ? row.heading_levels_checked
+      : []).filter((item) => Number.isInteger(item) && item >= 1 && item <= 6),
+    leading_space_checked: row?.leading_space_checked === true,
+    trailing_hash_checked: row?.trailing_hash_checked === true,
+    single_official_checklist: row?.single_official_checklist === true,
+    unverified_model_output_labeled: row?.unverified_model_output_labeled === true,
+    deployment_target_present: Boolean(row?.deployment_target),
+    deployment_target_source_present: Boolean(row?.deployment_target_source),
+    revision_observation_method_present: Boolean(row?.revision_observation_method),
+    live_write_policy: ["no_persistence", "scoped_fixture", "authorized_production_write"]
+      .includes(row?.live_write_policy) ? row.live_write_policy : null,
+    resume_paths_checked: (Array.isArray(row?.resume_paths_checked)
+      ? row.resume_paths_checked
+      : []).filter((item) => ["normal", "paid", "checkpoint"].includes(item)),
+    paid_resume_support: ["supported", "not_supported"].includes(row?.paid_resume_support)
+      ? row.paid_resume_support
+      : null,
+    paid_resume_support_source_present: Boolean(row?.paid_resume_support_source),
+    derived_views_recomputed: row?.derived_views_recomputed === true,
+    artifact_content_preserved: row?.artifact_content_preserved === true,
+  }));
+}
+
+function skippedChecksForLedger(value) {
+  return (Array.isArray(value) ? value : []).map((row) => ({
+    name_present: Boolean(row?.name),
+    reason_present: Boolean(row?.reason),
+    impact_present: Boolean(row?.impact),
+  }));
+}
+
+function validatedHashesForLedger(value, length) {
+  return stringArrayForLedger(value)
+    .map((item) => validatedHashForLedger(item, length))
+    .filter(Boolean);
+}
+
+function validatedHashForLedger(value, length) {
+  const candidate = typeof value === "string" ? value.trim().toLowerCase() : "";
+  return new RegExp(`^[a-f0-9]{${length}}$`).test(candidate) ? candidate : null;
+}
+
 function redactedEventDetail(value, lifecycleState, attachments) {
   const detail = value && typeof value === "object" ? value : {};
   const result = {};
@@ -1070,7 +1153,7 @@ function observedEvidenceForLedger(value) {
       head_branch: github.head_branch || null,
       head_sha: github.head_sha || null,
       base_branch: github.base_branch || null,
-      checks: Array.isArray(github.checks) ? github.checks : [],
+      checks: githubChecksForLedger(github.checks),
       checks_present: github.checks_present === true,
       checks_passing: github.checks_passing === true,
       required_checks_present: github.required_checks_present === true,
@@ -1082,6 +1165,14 @@ function stringArrayForLedger(value) {
   return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
 }
 
+function githubChecksForLedger(value) {
+  const allowedStates = new Set(["success", "skipped", "failure", "pending"]);
+  return (Array.isArray(value) ? value : []).map((item) => ({
+    name_present: Boolean(item?.name),
+    state: allowedStates.has(item?.state) ? item.state : "pending",
+  }));
+}
+
 export function toCompatibleCodingLoopState(state) {
   switch (state) {
     case "risk_classifying":

package/src/sqm/agent-skill.js

@@ -104,8 +104,12 @@ export async function installSqmAgentSkill({ home = homedir(), platforms = Objec
 }
 
 export async function inspectCodexPlugin({ home = homedir() } = {}) {
-  const manifest = await bundledPluginManifest();
-  const expectedDigest = await directoryDigest(BUNDLED_CODEX_PLUGIN_ROOT, { manifest });
+  const overrides = await installedPluginOverrides();
+  const manifest = await bundledPluginManifest({ overrides });
+  const expectedDigest = await directoryDigest(BUNDLED_CODEX_PLUGIN_ROOT, {
+    manifest,
+    overrides,
+  });
   const target = codexPluginPath(home);
   const installedDigest = await directoryDigest(target, { missing: null });
   const marketplacePath = codexMarketplacePath(home);
@@ -152,8 +156,12 @@ async function installCodexPlugin({ home }) {
   await rm(staged, { recursive: true, force: true });
   await rm(backup, { recursive: true, force: true });
   await cp(BUNDLED_CODEX_PLUGIN_ROOT, staged, { recursive: true, errorOnExist: true });
+  const overrides = await installedPluginOverrides();
+  for (const [relative, content] of overrides) {
+    await writeFile(path.join(staged, relative), content);
+  }
   await writeFile(path.join(staged, ".codex-plugin", "plugin.json"),
-    `${JSON.stringify(await bundledPluginManifest(), null, 2)}\n`);
+    `${JSON.stringify(await bundledPluginManifest({ overrides }), null, 2)}\n`);
   let backedUp = false;
   try {
     if (await pathExists(target)) {
@@ -303,14 +311,36 @@ async function fileDigest(target) {
   }
 }
 
-async function bundledPluginManifest() {
+async function bundledPluginManifest({ overrides = new Map() } = {}) {
   const manifest = JSON.parse(await readFile(path.join(BUNDLED_CODEX_PLUGIN_ROOT, ".codex-plugin", "plugin.json"), "utf8"));
   // A stable content-derived version refreshes Codex's cache only when the bundle changes.
-  const digest = await directoryDigest(BUNDLED_CODEX_PLUGIN_ROOT);
+  const digest = await directoryDigest(BUNDLED_CODEX_PLUGIN_ROOT, { overrides });
   return { ...manifest, version: `${manifest.version.split("+")[0]}+codex.${digest}` };
 }
 
-async function directoryDigest(root, { missing = "throw", manifest } = {}) {
+async function installedPluginOverrides() {
+  const relative = "hooks/hooks.json";
+  const source = JSON.parse(await readFile(path.join(BUNDLED_CODEX_PLUGIN_ROOT, relative), "utf8"));
+  const commandPrefix = "node ";
+  const runtime = shellQuote(process.execPath);
+  for (const groups of Object.values(source.hooks || {})) {
+    for (const group of groups || []) {
+      for (const hook of group.hooks || []) {
+        if (typeof hook.command === "string" && hook.command.startsWith(commandPrefix)) {
+          hook.command = `${runtime} ${hook.command.slice(commandPrefix.length)}`;
+        }
+      }
+    }
+  }
+  return new Map([[relative, `${JSON.stringify(source, null, 2)}\n`]]);
+}
+
+function shellQuote(value) {
+  if (process.platform === "win32") return `"${value.replaceAll('"', '""')}"`;
+  return `'${value.replaceAll("'", "'\\''")}'`;
+}
+
+async function directoryDigest(root, { missing = "throw", manifest, overrides = new Map() } = {}) {
   let rootStat;
   try {
     rootStat = await lstat(root);
@@ -336,7 +366,9 @@ async function directoryDigest(root, { missing = "throw", manifest } = {}) {
       if (!entry.isFile()) throw new Error(`${target} must be a regular file.`);
       const content = manifest && relative === ".codex-plugin/plugin.json"
         ? `${JSON.stringify(manifest, null, 2)}\n`
-        : await readFile(target);
+        : overrides.has(relative)
+          ? overrides.get(relative)
+          : await readFile(target);
       hash.update(relative).update("\0").update(content).update("\0");
     }
   };