@hasna/skills 0.10.62 → 0.10.64

package/README.md

@@ -560,6 +560,47 @@ the managed policy, so the witness is a tripwire, not a security boundary. See
 A stronger witness for plugins outside receipt-backed admission is planned and
 not yet implemented.
 
+Captured review catalogs are immutable evidence, while configuration and plugin
+files remain live discovery inputs. To retain a captured Codex native catalog,
+explicitly add `reviewArtifacts` to its Codex entry in `--discovery-inputs`:
+
+```json
+"reviewArtifacts": [{
+  "kind": "codex-native-catalog",
+  "path": "/absolute/private/reviewed-catalog.json",
+  "sha256": "<exact original file SHA-256>"
+}]
+```
+
+The same path and digest must already be a full byte witness in `sources`.
+The normal read-only install plan validates the catalog using its owning schema;
+apply retains its exact bytes privately under the resolved Skills data directory
+at `agent-discovery/artifacts/<sha256>/catalog.json` before changing the policy.
+The stored witness includes the original path, byte digest and projected catalog
+digest. Later hooks verify the retained bytes and permissions, so removal of the
+original scratch copy cannot break discovery. Live native roots, configuration,
+plugin files and trust still require their original witnesses; retention does
+not refresh or exempt them. No artifact is inferred from a filename.
+
+For an existing reviewed policy, plan one exact legacy witness migration:
+
+```bash
+skills hook retain-review-artifact --kind codex-native-catalog \
+  --source /absolute/private/reviewed-catalog.json \
+  --expected-policy-sha256 <current-policy-byte-sha256> \
+  --expected-source-sha256 <original-reviewed-byte-sha256> --json
+```
+
+Run from the same reviewed project directory; add `--apply` to execute that
+guarded transaction. It requires the original bytes to exist and all current
+bridge, discovery and trust checks to pass. Missing originals need exact recovery
+first; this command never captures a replacement catalog or rehashes a changed
+source. Apply preserves and reads back the old policy, leaves the original source
+and session pins intact, and records retention lineage in the transaction
+receipt. Existing sources without an explicit declaration keep their live-path
+semantics. Immutable files left by a compensated transaction are retained and
+may be reused only after exact verification.
+
 When `hook install` omits `--discovery-inputs`, it reuses an existing reviewed
 binding only after rechecking its sources, directory membership, configuration
 coverage, managed bridge and native trust. Unchanged reviews need no new input
@@ -2718,3 +2759,29 @@ capture as well, so the re-pinned review must bind the catalog another way, such
 as an exact `bytes` witness, until a reviewed version of this mode covers the
 key. There is no bypass, ignore list or relaxed mode. See
 [marketplace plugin entry witness](docs/plugin-admission.md#marketplace-plugin-entry-witness).
+
+
+`codex-settings-v5` explicitly projects only schema-valid string vectors at the
+document-root `tui.status_line` field, including empty, unknown and future display
+IDs, additions, removal and reordering. OpenAI Codex 0.162.1 declares this field
+as `Option<Vec<String>>`: its UI parser displays known items and ignores/warns
+about unknown strings, without executing commands or loading discovery inputs.
+There is no ID whitelist or entry-count cap; existing whole-file and parser
+resource guards still apply. Malformed values, nonstrings, profile/nested fields,
+other TUI fields and discovery controls remain bound. This verified upstream
+contract does not approve a different native consumer's interpretation.
+V5 retains V4's availability-count contract and V3's supported ordinary local MCP
+projection. Existing byte/V1/V2/V3/V4 reviews retain their exact meaning.
+
+Capture with `skills hook witness --kind codex-settings-v5 --path <config.toml>`.
+Upgrade with `skills hook rebind-settings --agent codex --codex-witness-version 5
+--reviewed-preimage <preserved-config.toml> --expected-policy-sha256 <policy-hash>
+--expected-settings-sha256 <settings-hash>`. Review before adding `--apply`. The
+preserved config must first match its original digest under its original mode;
+all changes outside V5 refuse. The guarded upgrade changes policy only, preserves
+native settings, other witnesses and session pins, and revalidates before apply.
+
+
+Codex cache witnesses migrate separately through `skills hook rebind-cache --agent codex`. Preview requires the exact current policy and configuration SHA-256 values. Name each reviewed remote app-only parent with `--app-only-parent`; skill-bearing parents must already have enrolled qualified-name denies and semantic capability controls. The complete cache census refuses unknown parents, cache-member aliases, new skills, direct hooks selecting cache inputs, and changed app/MCP/receipt capabilities. Reviewed whole Codex root aliases keep their existing identity/CAS guards; hook selection through either the alias or canonical cache path is refused. Commands containing the direct `plugins/cache` selector are conservatively refused, including HOME, tilde and relative spellings; no shell evaluation is performed. App-only bootstrap verifies the old full manifest and receipt sources, then explicitly reviews current app capabilities; it does not claim those app bytes were historically witnessed.
+
+Review the returned semantic cache digest, then repeat with `--expected-cache-witness-sha256 <digest> --apply`. The owning apply path preserves/readbacks the original policy, recomputes the whole plan, compares policy/config/cache preimages, writes only the Skills policy, and verifies the resulting consumer. Historical directory hashes and source rows remain retained as provenance; this command cannot reconstruct an unavailable old directory tree or waive an ancestor directory containing unrelated inputs. Equivalent version materializations and inert assets then leave the new Codex-specific witness unchanged. Every other discovery source, directory, settings witness, native control and session pin stays under its existing contract. Settings and cache upgrades remain independent; neither silently repairs drift in the other.