codex-orchestrator 0.1.50 → 2.0.0

package/CHANGELOG.md

@@ -6,6 +6,33 @@ The format is based on Keep a Changelog, and this project follows SemVer.
 
 ## [Unreleased]
 
+## [2.0.0] - 2026-07-17
+
+### Changed
+- Replaced the compatibility and experimental runtimes with one public V2 CLI,
+  one strict configuration contract, and one `runIssue` lifecycle shared by
+  direct runs and the serial daemon.
+- Reduced the default live release smoke to package install, normal default
+  Codex, browser proof, and safety-negative scenarios; broader policy scenarios
+  remain opt-in.
+
+### Removed
+- Removed the Legacy CLI, bridge manifest, bundled workflow prompts, alternate
+  planning/scoped execution paths, and their compiled/test assets from the npm
+  package.
+
+### Security
+- Contained tool environments exclude GitHub, SSH, npm, and cloud publication
+  credentials while preserving the explicitly accepted shared Codex-auth and
+  same-user local-read behavior. Proof rejects credentials in every text
+  artifact and applies public-only host-identity restrictions to evidence.
+
+## [0.1.51] - 2026-07-15
+
+### Fixed
+- Bridge publication normalizes the package CLI executable mode before hashing,
+  so installed-package verification matches npm's required `bin` mode.
+
 ## [0.1.50] - 2026-07-15
 
 ### Added

package/README.md

@@ -1,431 +1,87 @@
-# codex-orchestrator
+# Codex Orchestrator
 
-## About
+Codex Orchestrator is a runner-owned GitHub Issue loop for Codex. The public runtime has one path: select an issue carrying the configured `auto` label, execute bounded implementation cycles in an isolated worktree, run configured checks, obtain independent Acceptance Proof, and publish a review-ready branch and draft pull request.
 
-`codex-orchestrator` turns GitHub Issues and project work into isolated,
-autonomous Codex implementation runs, allowing maintainers to manage work
-instead of supervising coding agents.
+## Requirements
 
-Instead of starting a new Codex chat for every issue, you label the work you
-want automated. The runner creates an isolated workspace, gives Codex the issue
-and your repo rules, checks the result, and hands it back as a draft pull
-request.
+- Node.js 18 or newer
+- `git`, `gh`, and the configured Codex CLI
+- an authenticated parent Codex installation and GitHub CLI
 
-For bigger features, it can start from one parent issue, ask Codex to plan the
-work, create or update child issues, run the safe children in order, and open
-one integration draft PR.
+GitHub, SSH, npm, and cloud publication credentials remain in the trusted Runner and are not forwarded through the child environment. Ordinary Codex execution and native Codex subagents may use the same user-owned Codex authentication and may read files available to the same local OS user; this is an explicit accepted local-read risk, not an external-publication grant.
 
-The package is installed into any repository. The reusable runner lives in this
-npm package; each target repository keeps its own rules in
-`.codex-orchestrator/`.
-
-For a technical walkthrough of the runner lifecycle, policy model, review
-gates, and recovery behavior, see [docs/deep-dive.md](docs/deep-dive.md).
-
-## Why This Exists
-
-Codex can write useful code, but running it manually gets messy fast:
-
-- every small issue needs a new chat and repeated context;
-- large features need planning, child issues, triage, execution, and final
-  integration;
-- parallel agent work can conflict when tasks touch the same files;
-- someone still needs to decide what is allowed, what is blocked, and what needs
-  review;
-- branches, commits, checks, PRs, and labels should follow one project policy.
-
-`codex-orchestrator` is the coordination layer.
-
-GitHub Issues become the work queue. Labels decide what Codex may run. Isolated
-worktrees keep runs separate. Review gates check the result. Draft PRs return
-control to humans before anything is merged.
-
-## What You Get
-
-- A repeatable way to send selected GitHub Issues to Codex.
-- One-off autonomous runs for scoped implementation tasks.
-- Parent planning for larger features, with child issues executed in safe waves.
-- Project-owned rules for what Codex may run, how results are checked, and when
-  a human must step in.
-- Adaptive Acceptance Proof for runner-owned verification of UI, API, worker,
-  CLI, browser, mobile, and live-smoke behavior before draft PR handoff.
-- Logs, summaries, and proof artifacts when available.
-- Recovery for interrupted runner handoff when Codex finished locally but the
-  draft PR was not created yet.
-- Draft PR handoff by default. No auto-merge.
-
-## How It Works
-
-At a high level, GitHub Issues are the queue, labels authorize work, isolated
-worktrees keep runs separate, and the runner owns validation and publication.
-
-```mermaid
-flowchart TD
-  A["Target repo"] --> B["codex-orchestrator setup"]
-  B --> C[".codex-orchestrator/config.json + prompts"]
-  C --> D["GitHub Issue gets agent:auto or agent:plan-auto"]
-  D --> E["status / daemon / run"]
-  E --> R{"Recover interrupted handoff?"}
-  R -- "yes" --> L
-  R -- "no" --> F{"Eligible?"}
-  F -- "no" --> G["Skipped with reason"]
-  F -- "yes" --> H["Runner claims issue: agent:running"]
-  H --> I["Create isolated branch + worktree"]
-  I --> J["Build Codex prompt from issue + repo policy"]
-  J --> K["Run Codex CLI"]
-  K --> AAP{"Adaptive Acceptance Proof required?"}
-  AAP -- "no" --> L["Runner validates the full changeset"]
-  AAP -- "yes" --> AP["Run proof phase and collect artifacts"]
-  AP --> APR{"Proof result"}
-  APR -- "passed" --> L
-  APR -- "needs rework" --> J
-  APR -- "blocked" --> N
-  L --> M{"Gates pass?"}
-  M -- "no" --> N["Mark blocked, preserve evidence"]
-  M -- "yes" --> O["Push branch"]
-  O --> P["Open draft PR"]
-  P --> Q["Move issue to agent:review + post report"]
-```
-
-The important boundary is simple: Codex writes code, but the runner decides
-whether that code can be handed to humans. The runner owns checks, acceptance
-proof, labels, comments, branch pushes, and draft PR creation.
-
-### Adaptive Acceptance Proof
-
-Adaptive Acceptance Proof is the runner-owned verification phase for work that
-needs observable product proof. After implementation, the runner can start a
-separate proof phase that inspects the issue, changed files, and acceptance
-criteria; runs focused browser, mobile, API, worker, CLI, or live-smoke checks;
-and writes a machine-readable proof report with artifact links.
-
-A result can reach draft PR handoff only when every required criterion maps to
-high-confidence artifact evidence. If proof finds missing behavior, it returns a
-concrete rework request and the runner loops back through implementation within
-the configured iteration limit. If proof is malformed, low-confidence, lacks
-artifacts, or changes product code during verification, the runner blocks
-publication and preserves the evidence.
-
-Implementation rework is decided by one runner policy: each blocked attempt is
-classified as `retry`, `exhausted`, or `hard-block`. Fixable machine-checkable
-blockers, including missing quality-gate proof and optional Figma MCP failures,
-can retry within the configured budget. Denied paths, runner-owned publication
-violations, destructive or production actions, unknown Codex exits, and required
-Figma MCP failures hard-block publication.
-
-For UI proof, screenshots and UI dumps must also satisfy the UI Evidence
-Contract: exact workflow, viewport coverage, current artifact freshness, layout
-review, copy review, and source inputs. Screenshot-only proof cannot pass.
-
-There are two main ways to run work.
-
-### `agent:auto`
-
-Use `agent:auto` for one clear standalone implementation issue.
-
-The runner:
-
-1. Checks that the issue is allowed to run.
-2. Claims the issue so another runner does not start it too.
-3. Creates a branch and isolated git worktree.
-4. Runs Codex with the issue context and repo policy.
-5. Validates the full local change set.
-6. Pushes the branch and opens a draft PR only after the gates pass.
-7. Moves the issue to review and posts the run report.
-
-When the daemon runs more than one `agent:auto` issue at once, it only batches
-issues whose declared ownership does not overlap. Issues without ownership
-metadata still run, but conservatively.
-
-### `agent:plan-auto`
-
-Use `agent:plan-auto` for larger work that should be planned before
-implementation.
-
-The runner asks Codex to plan the parent issue, break it into child issues,
-run safe children in dependency order, merge successful child branches into one
-integration branch, validate that integration branch, and then open one draft
-PR.
-
-Child issues created by this flow use `agent:child`, not `agent:auto`. They are
-owned by the parent run and are not picked up as standalone daemon work.
-
-If a runner stops after Codex finished locally but before draft PR handoff, the
-runner can recover from its local state and completed report without rerunning
-Codex. See [docs/deep-dive.md](docs/deep-dive.md) for the recovery rules.
-
-## Basic Workflow
-
-1. Install the package.
-2. Run `setup` in the repository you want to automate.
-3. Commit the generated `.codex-orchestrator/` policy.
-4. Add `agent:auto` or `agent:plan-auto` to a GitHub Issue.
-5. Run `status` to see what is eligible or blocked.
-6. Run one selected issue with `run`, or let `daemon` poll for eligible work.
-7. Review the draft PR created by the runner.
-
-The runner never auto-merges.
-
-For behavior-changing work, completion reports can include structured TDD proof
-inside each `validation[]` item with `evidence.kind: "tdd-red-green"`. The
-runner still accepts legacy validation summaries, but structured red failed /
-green passed evidence is the preferred proof. The focused live smoke for the
-tree-child quality rework path is:
-
-```sh
-npm run smoke:live -- --scenario tree-child-quality-rework --cleanup
-```
-
-## Agent Memory
-
-Repo-local Dreaming-lite memory lives in `docs/agents/memory/`. It is a small
-curated lessons cache for repeated runner/debug/agent-workflow patterns, not a
-replacement for `AGENTS.md`, ADRs, `docs/deep-dive.md`, or package prompts.
-
-## Install
-
-Requirements:
-
-- Node.js 18 or newer;
-- `git`;
-- GitHub CLI `gh`, authenticated for the target repository;
-- Codex CLI, installed and authenticated;
-- write access to the target GitHub repository.
-
-Install globally:
-
-```sh
-npm install -g codex-orchestrator
-```
-
-Check the CLI:
-
-```sh
-codex-orchestrator --version
-codex-orchestrator health
-```
-
-You can also run it with `npx`:
-
-```sh
-npx codex-orchestrator --help
-```
-
-## Set Up A Repository
-
-Open the repository that should receive autonomous Codex work:
-
-```sh
-cd /path/to/your/repo
-```
-
-Run setup and create missing labels:
-
-```sh
-codex-orchestrator setup --prepare-labels
-```
-
-### Prepare A Consumer For Skill Runtime V2
-
-The bridge release adds a fail-closed activity fence without changing prompt
-execution. After that exact bridge package is installed, stop every runner for
-the target and prepare canonical migration evidence:
+## Install and configure
 
 ```sh
-codex-orchestrator setup --target . --prepare-skill-runtime-v2
+npm install --save-dev codex-orchestrator
+npx codex-orchestrator setup --target "$PWD"
+npx codex-orchestrator setup --target "$PWD" --prepare-labels
+npx codex-orchestrator doctor --target "$PWD"
 ```
 
-Preparation succeeds only when no daemon, targeted claim, setup, local
-nonterminal run, or open GitHub issue with the running label can overlap it.
-It writes `skill-runtime-v2/prepared-generation.json` below the configured
-runner state directory and records the verified bridge package hash. Relative
-or otherwise ambiguous daemon process identities block preparation. This
-command does not migrate config, switch the Codex transport, publish a package,
-or start work; those actions belong to a separately authorized structural
-release.
+`setup` writes the exact V2 policy to `.codex-orchestrator/config.json`. Use `--github-owner` and `--github-repo` together only when repository inference is unavailable. Existing recognized pre-V2 state is detect-only; migrate it explicitly with `setup --fresh` while all old activity is stopped.
 
-For normal setup, commit the repository-owned config and prompt policy files
-under `.codex-orchestrator/`. Do not commit `prepared-generation.json`; it is
-runtime migration evidence beneath the ignored runner state directory.
+## Run
 
-By default, setup reads the GitHub owner and repo from `git remote origin`. Use
-`--target`, `--github-owner`, or `--github-repo` only when you need to override
-that.
-
-## Run Work
-
-Check what the runner can see:
+Run one authorized issue:
 
 ```sh
-codex-orchestrator status --target .
-codex-orchestrator doctor --target .
+npx codex-orchestrator run --target "$PWD" --issue 123
 ```
 
-Run one issue:
+Poll and run matching issues serially:
 
 ```sh
-codex-orchestrator run --target . --issue 123
+npx codex-orchestrator daemon --target "$PWD"
 ```
 
-Run the daemon:
+Perform one polling pass:
 
 ```sh
-codex-orchestrator daemon --target .
+npx codex-orchestrator daemon --target "$PWD" --once
 ```
 
-Run up to three independent scoped issues at once:
+All commands require an absolute target. `doctor`, `status`, `run`, and `daemon` read the same strict config and use the same `runIssue` lifecycle.
 
-```sh
-codex-orchestrator daemon --target . --concurrency 3
-```
+## Lifecycle
 
-`status` and `doctor` are read-only. `run` executes one selected issue.
-`daemon` polls for eligible work and starts safe runs according to the policy in
-`.codex-orchestrator/config.json`.
+1. Read the issue and confirm the exact `auto` authorization label.
+2. Acquire runner ownership and create or resume one issue worktree.
+3. Invoke the package-owned `agent-auto` skill in a contained Codex process.
+4. Validate the structured implementation report and the complete worktree diff.
+5. Run the configured finite checks.
+6. Freeze the checked change and invoke package-owned `acceptance-proof` in a separate contained process.
+7. Validate fresh proof artifacts and criterion coverage.
+8. Publish through runner-owned Git and GitHub adapters, then mark the issue review-ready.
 
-## Agent-Assisted Setup
-
-You do not need a long prompt. You can ask an agent:
-
-```text
-Set up codex-orchestrator for this repo.
-```
+Implementation and proof retries are bounded. Crashes resume from durable intents instead of repeating already-confirmed external effects. Ambiguous ownership, process quiescence, repository identity, credentials, denied paths, or publication state fails closed with a typed result.
 
-The agent should inspect the repository, confirm it has a GitHub `origin`
-remote, and run:
+## Acceptance Proof
 
-```sh
-codex-orchestrator setup --prepare-labels
-```
-
-If needed, the agent can discover the exact setup behavior from:
-
-```sh
-codex-orchestrator --help
-```
+Proof is independent from implementation. The proof process receives a frozen description of the checked change and may write only under its proof artifact root. It cannot publish, mutate issue state, or reuse implementation authority.
 
-The package also ships a setup prompt in `prompts/setup-skill.md`. Setup copies
-that prompt into `.codex-orchestrator/prompts/setup-skill.md`, so future agents
-working in the repository can find repository-local setup guidance.
+Artifacts always receive size, hash, UTF-8, path-containment, and credential checks. Public artifacts have the stricter publication contract: screenshots or sanitized generated summaries only, with host identity removed. Local command output may retain machine paths because it is never published, but credentials remain forbidden everywhere.
 
-Use `--dry-run` only when you want a preview without writing files or creating
-labels.
+Browser and mobile proof additionally require current workflow evidence. Mobile proof uses runner-owned Android or iOS leases and refuses to take over a user-owned device or app session.
 
-## What The Runner Checks
+## Package boundary
 
-Before a result becomes a draft PR, the runner checks the whole local result:
+The npm package ships only:
 
-- committed changes;
-- staged changes;
-- unstaged changes;
-- untracked files;
-- the completion report Codex was required to write;
-- configured commands such as tests or type checks;
-- review gates such as TDD evidence, changed tests, cleanup review, code review,
-  or acceptance proof when enabled;
-- blocked paths and unsafe actions.
+- the compiled V2 runtime and adapter closure;
+- package-owned `agent-auto` and `acceptance-proof` skills;
+- this README, the architecture deep dive, changelog, and license.
 
-If the result passes, the runner pushes the branch and opens a draft PR. If it
-does not pass, the runner marks the issue blocked, keeps the useful local
-evidence, and explains what needs attention.
-
-Acceptance proof is runner-owned. Codex can change product behavior, but the
-runner runs proof afterwards and attaches screenshots, UI dumps, logs, smoke
-outputs, or other artifacts to the PR and issue report. The proof phase must
-produce a structured report that maps each required criterion to high-confidence
-evidence. UI artifacts must include UI Evidence Contract mapping, and legacy
-visual proof config only supplies migration inputs for report-producing proof.
-
-## Repository Policy
-
-Every installed repository owns its automation policy in:
-
-```sh
-.codex-orchestrator/config.json
-```
-
-That config controls labels, branch names, checks, review gates, blocked paths,
-prompt files, child concurrency, and PR titles. The package provides defaults;
-the target repository decides how strict they should be.
-
-For the full config surface and technical behavior, see
-[docs/deep-dive.md](docs/deep-dive.md).
-
-## Safety Model
-
-The package is PR-first and human-reviewed. The important guardrails are:
-
-- no automatic merge;
-- draft PRs only;
-- Codex may change files, but the runner owns remote publication and GitHub
-  state changes;
-- only explicitly authorized issues run;
-- child issues are never inferred from ordinary links or references;
-- committed and uncommitted changes are checked;
-- missing or malformed completion reports block publication;
-- secret files, destructive data/cache actions, and production deploy or release
-  actions are blocked by default.
-
-## Labels
-
-Default labels:
-
-- `agent:auto` - run one scoped issue;
-- `agent:plan-auto` - plan and run a parent issue tree;
-- `agent:child` - child issue in an autonomous tree; this is not a standalone
-  authorization label;
-- `agent:running` - runner is working;
-- `agent:blocked` - maintainer input needed;
-- `agent:manual` - reserved for human work;
-- `agent:review` - ready for human review.
-
-`setup --prepare-labels` creates missing labels through `gh`.
-
-## CLI Reference
-
-```sh
-codex-orchestrator --help
-codex-orchestrator --version
-codex-orchestrator health
-codex-orchestrator doctor --target <path> [--json]
-codex-orchestrator setup [--target <path>] [--github-owner <owner>] \
-  [--github-repo <repo>] [--dry-run] [--prepare-labels]
-codex-orchestrator status --target <path> [--dry-run] [--json]
-codex-orchestrator run --target <path> --issue <number>
-codex-orchestrator visual-proof auto --issue <number> [--target <path>]
-codex-orchestrator visual-proof browser --issue <number> [--target <path>] \
-  [--scenario <path>] [--base-url <url>]
-codex-orchestrator visual-proof mobile --issue <number> [--target <path>]
-codex-orchestrator visual-proof android --issue <number> [--target <path>]
-codex-orchestrator visual-proof ios --issue <number> [--target <path>]
-codex-orchestrator daemon --target <path> [--once] \
-  [--interval-seconds <seconds>] [--max-runs <count>] \
-  [--concurrency <count>]
-```
-
-Use `codex-orchestrator <command> --help` for command-specific flags.
-Browser proof prefers an explicit or locally installed Chrome/Chromium/Edge
-browser before falling back to Playwright's Chromium download.
-
-## Current Scope
-
-The package focuses on local runner workflows: one-off runs, daemon polling,
-project-local configuration, and runner-owned worktree cleanup. Hosted
-infrastructure is not part of this package today.
-
-Non-GitHub trackers and non-Codex agents are also out of scope for the current
-version, although the code keeps adapter boundaries for future expansion.
+There are no bundled workflow prompts, compatibility bridge, alternate public runtime, parent-planning mode, or Legacy CLI export.
 
 ## Development
 
 ```sh
-npm test
-npm run build
 npm run typecheck
+npm test
+npm pack --dry-run --json
 ```
 
-Publishing is configured through GitHub Actions. A push to `main` runs tests and
-publishes the package to npm only when the current package version is not already
-published. The repository must provide the GitHub secret `NPM_KEY`.
+`npm test` starts from a clean `dist` directory. `npm run smoke:live` packs the current package and mutates the configured scratch GitHub repository; run it only with explicit authorization. The default `core-release` profile contains the four external release proofs: package installation, real Codex, browser proof, and a safety-negative case.
 
-See `CHANGELOG.md` for release-by-release notes.
+See [docs/deep-dive.md](docs/deep-dive.md) for the trust and durability model and [docs/live-smoke-checklist.md](docs/live-smoke-checklist.md) for live validation.

package/dist/src/index.d.ts

@@ -1,47 +1,17 @@
-export type { CodexOrchestratorConfig, ConfigValidationResult, CodexPhase, CodexProfileConfig } from './config/schema.js';
-export { validateConfig, codexPhaseKeys } from './config/schema.js';
-export { CodexCommandAdapter, buildCodexProcessEnv, resolveCodexProfile } from './codex/command-adapter.js';
-export type { CodexCommandRunInput, CodexCommandRunResult, EffectiveCodexProfile } from './codex/command-adapter.js';
-export { GhCliPullRequestAdapter } from './github/gh-pull-request-adapter.js';
-export type { CloseIssueEvidenceInput, CloseIssueEvidenceReason, GitHubIssue, GitHubIssueAdapter, GitHubIssueComment, GitHubIssueLabel, GitHubPullRequestLink, IssueState, PullRequestState, } from './github/issues.js';
-export { CloseIssueEvidenceError, closeIssueWithEvidence, formatIssueClosureEvidenceComment, hasIssueClosureEvidence, InMemoryGitHubIssueAdapter, isIssueClosureEvidenceComment, } from './github/issues.js';
-export type { CreateDraftPullRequestInput, GitHubPullRequest, GitHubPullRequestAdapter } from './github/pull-requests.js';
-export { InMemoryGitHubPullRequestAdapter } from './github/pull-requests.js';
-export { GitWorktreeManager, renderBranchTemplate } from './git/worktree.js';
-export { applyClarificationGate, applyCodexSessionResult, claimIssue, clearClarificationGate, discoverIssueWork, hasMaintainerResponseAfterLatestClarification, } from './runner/issue-state-machine.js';
-export type { ClarificationQuestion, CodexSessionActionResult, CodexSessionResult, IssueDiscoveryDecision, RunnerMode, SkipReasonCode, } from './runner/issue-state-machine.js';
-export { ensureAutonomousChildBody, isAutonomousChildOfParent, renderAutonomousChildMarker, validatePlanGraph, } from './runner/issue-tree.js';
-export type { PlanChildNode, PlanDependencyEdge, PlanGraph, PlanGraphValidationResult } from './runner/issue-tree.js';
-export { RunnerStateStore } from './runner/local-state.js';
-export type { RunnerProcessMetadata, RunnerStateFile, RunnerStateFileV1, RunnerStateFileV2, } from './runner/local-state.js';
-export { buildBridgeRuntimeManifest, readBridgeRuntimeManifest, verifyBridgeRuntimeManifest, writeBridgeRuntimeManifest, } from './bridge-runtime.js';
-export type { BridgeRuntimeFileV1, BridgeRuntimeManifestV1 } from './bridge-runtime.js';
-export { runLocalExecutionSession } from './runner/local-execution-session.js';
-export type { LocalExecutionPhaseExecutor, LocalExecutionPhaseInput, LocalExecutionPhaseResult, LocalExecutionSessionInput, LocalExecutionSessionResult, } from './runner/local-execution-session.js';
-export { readPlanAutoCompletionReport, readScopedCompletionReport, } from './runner/completion-report.js';
-export type { PlanAutoCompletionReport, ReviewHandoffFlow, ReviewHandoffRisk, ScopedCompletionReport, } from './runner/completion-report.js';
-export { buildPlanAutoPrompt, buildScopedImplementationPrompt, sessionPromptPath, sessionReportPath, writeDurablePrompt, } from './runner/prompt.js';
-export type { PlanAutoPromptInput, ScopedPromptInput, } from './runner/prompt.js';
-export { runDaemonCommand } from './runner/daemon-command.js';
-export type { DaemonCommandOptions, DaemonCommandResult } from './runner/daemon-command.js';
-export { runHygieneCleanup } from './runner/hygiene-cleanup.js';
-export type { HygieneCleanupResult, RunHygieneCleanupInput } from './runner/hygiene-cleanup.js';
-export { cleanupMergedWorktrees } from './runner/worktree-cleanup.js';
-export type { CleanupMergedWorktreesInput, WorktreeCleanupEntry, WorktreeCleanupResult, WorktreeCleanupSkip, } from './runner/worktree-cleanup.js';
-export { reconcileRunnerState } from './runner/recovery.js';
-export type { ReconcileRunnerStateInput, RecoveryEntry, RecoveryStatus } from './runner/recovery.js';
-export { runPlanAutoCommand } from './runner/plan-auto-command.js';
-export type { PlanAutoCommandOptions, PlanAutoCommandResult } from './runner/plan-auto-command.js';
-export { runScopedAutoCommand } from './runner/scoped-auto-command.js';
-export type { ScopedAutoCommandOptions, ScopedAutoCommandResult } from './runner/scoped-auto-command.js';
-export { validateChangedPaths, validateCompletionReportSafety, validateNoAgentOwnedGitPublication, } from './runner/safety.js';
-export type { SafetyViolation, SafetyViolationCode } from './runner/safety.js';
-export { runStatusCommand } from './runner/status-command.js';
-export type { StatusCommandOptions, StatusCommandResult } from './runner/status-command.js';
-export { runDoctorCommand } from './runner/doctor-command.js';
-export type { DoctorCheckResult, DoctorCommandOptions, DoctorCommandResult, DoctorJson } from './runner/doctor-command.js';
-export { RunnerLifecycleEventStore } from './runner/lifecycle-events.js';
-export type { LifecycleArtifact, RunnerLifecycleEvent } from './runner/lifecycle-events.js';
-export type { SetupCommandOptions, SetupCommandResult } from './setup/setup-command.js';
-export { runSetupCommand } from './setup/setup-command.js';
+export { AcceptanceProof, ProofQuiescenceError } from './v2/acceptance-proof.js';
+export type { FrozenCriterion, IssueSnapshot, ProveChangeResult, ProofAgent, ProofAgentResult } from './v2/acceptance-proof.js';
+export { createCheckedChangeCapabilities, checkedChangeFreshnessMatches, checkedChangePayloadSha256 } from './v2/checked-change.js';
+export type { CheckedChange, CheckedChangeFreshness, CheckedChangePayloadV1 } from './v2/checked-change.js';
+export { parseAgentAutoConfig } from './v2/config.js';
+export type { AgentAutoConfigV1 } from './v2/config.js';
+export { validateImplementationReport } from './v2/implementation-report.js';
+export type { ImplementationReportV1 } from './v2/implementation-report.js';
+export { validateProofReport } from './v2/proof-report.js';
+export type { ProofReceipt, ProofReportV1 } from './v2/proof-report.js';
+export { RunIssue } from './v2/run-issue.js';
+export type { RunIssueDependencies, RunIssueResult } from './v2/run-issue.js';
+export { createV2Runtime } from './v2/runtime.js';
+export type { V2Runtime } from './v2/runtime.js';
+export { Setup } from './v2/setup.js';
+export type { SetupIntent, SetupOutcome } from './v2/setup.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/src/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC1H,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAC5G,YAAY,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACrH,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAC9E,YAAY,EACV,uBAAuB,EACvB,wBAAwB,EACxB,WAAW,EACX,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,qBAAqB,EACrB,UAAU,EACV,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,iCAAiC,EACjC,uBAAuB,EACvB,0BAA0B,EAC1B,6BAA6B,GAC9B,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,2BAA2B,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAC1H,OAAO,EAAE,gCAAgC,EAAE,MAAM,2BAA2B,CAAC;AAC7E,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAC7E,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,UAAU,EACV,sBAAsB,EACtB,iBAAiB,EACjB,6CAA6C,GAC9C,MAAM,iCAAiC,CAAC;AACzC,YAAY,EACV,qBAAqB,EACrB,wBAAwB,EACxB,kBAAkB,EAClB,sBAAsB,EACtB,UAAU,EACV,cAAc,GACf,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,2BAA2B,EAC3B,iBAAiB,GAClB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,aAAa,EAAE,kBAAkB,EAAE,SAAS,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACtH,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,YAAY,EACV,qBAAqB,EACrB,eAAe,EACf,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,2BAA2B,EAC3B,0BAA0B,GAC3B,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AACxF,OAAO,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,YAAY,EACV,2BAA2B,EAC3B,wBAAwB,EACxB,yBAAyB,EACzB,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,+BAA+B,CAAC;AACvC,YAAY,EACV,wBAAwB,EACxB,iBAAiB,EACjB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,mBAAmB,EACnB,+BAA+B,EAC/B,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,YAAY,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAC5F,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,YAAY,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAChG,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AACtE,YAAY,EACV,2BAA2B,EAC3B,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,YAAY,EAAE,yBAAyB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACrG,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,YAAY,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACnG,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACvE,YAAY,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AACzG,OAAO,EACL,oBAAoB,EACpB,8BAA8B,EAC9B,kCAAkC,GACnC,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,YAAY,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAC5F,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,YAAY,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC3H,OAAO,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AACzE,YAAY,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAC5F,YAAY,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACxF,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AACjF,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,iBAAiB,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAChI,OAAO,EAAE,+BAA+B,EAAE,6BAA6B,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACpI,YAAY,EAAE,aAAa,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAC5G,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,YAAY,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AAC7E,YAAY,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,YAAY,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,YAAY,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtC,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC"}

package/dist/src/index.js

@@ -1,25 +1,9 @@
-export { validateConfig, codexPhaseKeys } from './config/schema.js';
-export { CodexCommandAdapter, buildCodexProcessEnv, resolveCodexProfile } from './codex/command-adapter.js';
-export { GhCliPullRequestAdapter } from './github/gh-pull-request-adapter.js';
-export { CloseIssueEvidenceError, closeIssueWithEvidence, formatIssueClosureEvidenceComment, hasIssueClosureEvidence, InMemoryGitHubIssueAdapter, isIssueClosureEvidenceComment, } from './github/issues.js';
-export { InMemoryGitHubPullRequestAdapter } from './github/pull-requests.js';
-export { GitWorktreeManager, renderBranchTemplate } from './git/worktree.js';
-export { applyClarificationGate, applyCodexSessionResult, claimIssue, clearClarificationGate, discoverIssueWork, hasMaintainerResponseAfterLatestClarification, } from './runner/issue-state-machine.js';
-export { ensureAutonomousChildBody, isAutonomousChildOfParent, renderAutonomousChildMarker, validatePlanGraph, } from './runner/issue-tree.js';
-export { RunnerStateStore } from './runner/local-state.js';
-export { buildBridgeRuntimeManifest, readBridgeRuntimeManifest, verifyBridgeRuntimeManifest, writeBridgeRuntimeManifest, } from './bridge-runtime.js';
-export { runLocalExecutionSession } from './runner/local-execution-session.js';
-export { readPlanAutoCompletionReport, readScopedCompletionReport, } from './runner/completion-report.js';
-export { buildPlanAutoPrompt, buildScopedImplementationPrompt, sessionPromptPath, sessionReportPath, writeDurablePrompt, } from './runner/prompt.js';
-export { runDaemonCommand } from './runner/daemon-command.js';
-export { runHygieneCleanup } from './runner/hygiene-cleanup.js';
-export { cleanupMergedWorktrees } from './runner/worktree-cleanup.js';
-export { reconcileRunnerState } from './runner/recovery.js';
-export { runPlanAutoCommand } from './runner/plan-auto-command.js';
-export { runScopedAutoCommand } from './runner/scoped-auto-command.js';
-export { validateChangedPaths, validateCompletionReportSafety, validateNoAgentOwnedGitPublication, } from './runner/safety.js';
-export { runStatusCommand } from './runner/status-command.js';
-export { runDoctorCommand } from './runner/doctor-command.js';
-export { RunnerLifecycleEventStore } from './runner/lifecycle-events.js';
-export { runSetupCommand } from './setup/setup-command.js';
+export { AcceptanceProof, ProofQuiescenceError } from './v2/acceptance-proof.js';
+export { createCheckedChangeCapabilities, checkedChangeFreshnessMatches, checkedChangePayloadSha256 } from './v2/checked-change.js';
+export { parseAgentAutoConfig } from './v2/config.js';
+export { validateImplementationReport } from './v2/implementation-report.js';
+export { validateProofReport } from './v2/proof-report.js';
+export { RunIssue } from './v2/run-issue.js';
+export { createV2Runtime } from './v2/runtime.js';
+export { Setup } from './v2/setup.js';
 //# sourceMappingURL=index.js.map

package/dist/src/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAE5G,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAY9E,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,iCAAiC,EACjC,uBAAuB,EACvB,0BAA0B,EAC1B,6BAA6B,GAC9B,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,gCAAgC,EAAE,MAAM,2BAA2B,CAAC;AAC7E,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAC7E,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,UAAU,EACV,sBAAsB,EACtB,iBAAiB,EACjB,6CAA6C,GAC9C,MAAM,iCAAiC,CAAC;AASzC,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,2BAA2B,EAC3B,iBAAiB,GAClB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAO3D,OAAO,EACL,0BAA0B,EAC1B,yBAAyB,EACzB,2BAA2B,EAC3B,0BAA0B,GAC3B,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AAQ/E,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,+BAA+B,CAAC;AAOvC,OAAO,EACL,mBAAmB,EACnB,+BAA+B,EAC/B,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAK5B,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAE9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAEhE,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAOtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAE5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAEnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAEvE,OAAO,EACL,oBAAoB,EACpB,8BAA8B,EAC9B,kCAAkC,GACnC,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAE9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAE9D,OAAO,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAGzE,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAEjF,OAAO,EAAE,+BAA+B,EAAE,6BAA6B,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAEpI,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAEtD,OAAO,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AAE7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAE3D,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC"}