create-agdf 0.13.7 → 0.13.8

package/README.md

@@ -26,6 +26,31 @@ Use a different target when Codex is not your agent surface:
 | Claude Code | `npx --yes @agdf/cli@latest claude` | The AGDF plugin for Claude Code. |
 | OpenCode, user-wide discovery | `npx --yes @agdf/cli@latest opencode` | The npm plugin and global native skills; repository governance remains opt-in. |
 | OpenCode, one repository | `npx --yes @agdf/cli@latest opencode-repo` | Durable control configuration that activates the once-installed global runtime. |
+
+The runtime-bearing `codex`, `claude` and `opencode` installers ask before enabling narrow automatic
+local checks on an interactive terminal. The choices are `enable`, `manual` and `cancel`; enablement
+is never preselected. Every interactive installation or update asks again. A previous choice is
+shown only as intent, never as proof of effective host permission. The prompt shows the target AGDF
+version and the result shows the verified installed version or transition. Matching capability
+identity may preserve host-native trust, but it never
+suppresses the installer choice. Non-interactive installation defaults to manual unless the exact
+option is provided:
+
+Interactive terminals accept `1` or `E` for enable, `2` or `M` for manual, `D` for technical
+details and `Esc` for immediate cancel without Enter. The primary choice uses beginner-safe language,
+keeps the material consent facts visible and has no preselected option. Manual mode explains that
+AGDF remains available on request; invalid keys redisplay the valid choices.
+
+```sh
+npx --yes @agdf/cli@latest claude --runtime-checks enable
+npx --yes @agdf/cli@latest runtime-checks status --surface claude --json
+```
+
+The check is argument-free, read-only and offline. Consent is content-bound, reversible and separate
+from AGDF gate approval. A receipt alone never proves effective host permission. Codex native trust,
+Claude deny/ask precedence and all explicit OpenCode permissions remain authoritative. The public
+Skills-only OpenAI candidate has no runtime or hooks and therefore remains manual/external for this
+capability.
 | GitHub Copilot | `npx --yes @agdf/cli@latest copilot` | Repository instructions, visible skills and control templates. |
 | Durable control state in an existing setup | `npx --yes @agdf/cli@latest init` | Live `.agdf/control/` state when the repository explicitly needs it. |
 
@@ -117,6 +142,7 @@ it does not localize the CLI lifecycle card.
 - `opencode` installs the AGDF npm plugin and ten native skills as a user-wide OpenCode surface
 - `opencode-status` reports OpenCode global config, package loadability, global native-skill completeness, installed host/plugin-SDK versions, declaration-level support for AGDF's two experimental hooks, durable repository activation, legacy compatibility and observable session signals
 - `status` reports installation, repository activation and delivery separately without mutating state
+- `runtime-checks status|enable|manual` reports the requested/effective automatic-check state or gives the exact reinstall route needed to change it
 - `disable` writes a supported repository-local opt-out while retaining global capability and durable control state
 - `uninstall` previews and, only with `--confirm`, applies a selected global removal through supported native/owned operations
 - `opencode-repo` writes durable AGDF control configuration and templates under `.agdf/control/`; it does not copy a second OpenCode runtime surface

package/generated/plugins/agdf/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agdf",
-  "version": "0.13.7",
+  "version": "0.13.8",
   "description": "AI Governance & Delivery Framework (AGDF) is a governance framework for agentic work. Its first implementation provides a control layer for governed AI-assisted software delivery. It combines workflow skills, explicit gates, control templates and machine-readable repository checks to keep work aligned with approved scope and make evidence a prerequisite for consequential gate transitions. Supported workflows include brownfield analysis, task-plan review, QA decisions, durable run state and auditable delivery closeout. AGDF is an independent open-source project, not a security sandbox, compliance certification or autonomous release system.",
   "keywords": [
     "agentic",

package/generated/plugins/agdf/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agdf",
-  "version": "0.13.7",
+  "version": "0.13.8",
   "description": "Control layer for governed AI-assisted delivery.",
   "author": {
     "name": "Arndt Gold",

package/generated/plugins/agdf/hooks/hooks.json

@@ -5,8 +5,9 @@
                 "hooks": [
                     {
                         "type":         "command",
-                        "command":      "bash -lc 'hook=\"${PLUGIN_ROOT:-${CLAUDE_PLUGIN_ROOT:-}}/hooks/session-start.sh\"; if [ -f \"$hook\" ]; then exec bash \"$hook\"; fi; hook=\"$PWD/plugins/agdf/hooks/session-start.sh\"; if [ -f \"$hook\" ]; then exec bash \"$hook\"; fi; exit 0'",
-                        "statusMessage": "Loading AGDF..."
+                        "command":      "node \"${PLUGIN_ROOT:-${CLAUDE_PLUGIN_ROOT}}/runtime/agdf-session-check.js\"",
+                        "commandWindows": "node \"$([Environment]::GetEnvironmentVariable('PLUGIN_ROOT') + [Environment]::GetEnvironmentVariable('CLAUDE_PLUGIN_ROOT'))\\runtime\\agdf-session-check.js\"",
+                        "statusMessage": "Checking AGDF runtime state..."
                     }
                 ]
             }

package/generated/plugins/agdf/meta/agdf-plugin.definition.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "id": "agdf",
-  "version": "0.13.7",
+  "version": "0.13.8",
   "displayName": "AI Governance & Delivery Framework",
   "developerName": "Arndt Gold",
   "description": "Control layer for governed AI-assisted delivery.",
@@ -68,6 +68,29 @@
       }
     }
   },
+  "automaticRuntimeChecks": {
+    "schemaVersion": 1,
+    "capabilityId": "automatic-runtime-checks",
+    "adapterContractVersion": 1,
+    "entrypoint": "runtime/agdf-session-check.js",
+    "operations": [
+      "resolve-local-runtime",
+      "inspect-control-state",
+      "render-bounded-orientation"
+    ],
+    "constraints": {
+      "arguments": "forbidden",
+      "filesystemWrites": "forbidden",
+      "network": "forbidden",
+      "gateAuthority": "none"
+    },
+    "surfaces": {
+      "codex": "native-hook-review",
+      "claude": "exact-command-rule",
+      "opencode": "plugin-internal",
+      "portable-skills": "manual-external-required"
+    }
+  },
   "interactions": {
     "fallback": "exact_text",
     "localeRegistry": "meta/agdf-interaction-locales.json",

package/generated/plugins/agdf/runtime/agdf-session-check.js

@@ -0,0 +1,92 @@
+#!/usr/bin/env node
+
+// Generated by create-agdf/scripts/sync-plugin-runtime.js; do not edit.
+import { spawnSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import process from "node:process";
+import { fileURLToPath } from "node:url";
+import { digestNormalizedPluginSource } from "./create-agdf/lib/runtime/plugin-provenance.js";
+import { fixedRuntimeCheckCommand, runtimeCheckCapabilityIdentity } from "./create-agdf/lib/runtime-check-consent/contract.js";
+
+if (process.argv.length !== 2) {
+  console.error("AGDF automatic runtime check accepts no arguments.");
+  process.exitCode = 2;
+} else {
+  const surface = process.env.AGDF_SURFACE
+    || (process.env.CLAUDE_PLUGIN_ROOT ? "claude" : process.env.PLUGIN_ROOT ? "codex" : "");
+  const dataRoot = process.env.AGDF_DATA_DIR
+    || (process.platform === "darwin"
+      ? join(homedir(), "Library", "Application Support", "agdf")
+      : process.platform === "win32"
+        ? join(process.env.LOCALAPPDATA || process.env.APPDATA || join(homedir(), "AppData", "Local"), "agdf")
+        : join(process.env.XDG_DATA_HOME || join(homedir(), ".local", "share"), "agdf"));
+  let consentEnabled = false;
+  if (["codex", "claude", "opencode"].includes(surface)) {
+    try {
+      const receipt = JSON.parse(readFileSync(join(dataRoot, "runtime-checks", `${surface}.json`), "utf8"));
+      consentEnabled = receipt?.schema_version === 1
+        && receipt?.owner === "create-agdf"
+        && receipt?.capability_id === "automatic-runtime-checks"
+        && receipt?.surface === surface
+        && receipt?.requested_state === "enabled";
+      if (consentEnabled && ["codex", "claude"].includes(surface)) {
+        const pluginRoot = fileURLToPath(new URL("../", import.meta.url));
+        const manifest = JSON.parse(readFileSync(new URL("./runtime-manifest.json", import.meta.url), "utf8"));
+        const definition = JSON.parse(readFileSync(new URL("../meta/agdf-plugin.definition.json", import.meta.url), "utf8"));
+        const currentIdentity = runtimeCheckCapabilityIdentity({
+          capability: definition.automaticRuntimeChecks,
+          surface,
+          runtimeDigest: manifest.digest,
+          sourceDigest: digestNormalizedPluginSource(pluginRoot, manifest.version),
+          command: fixedRuntimeCheckCommand(surface, pluginRoot, process.platform),
+        });
+        consentEnabled = receipt.capability_identity === currentIdentity;
+      }
+    } catch {}
+  }
+  if (!consentEnabled) process.exit(0);
+  const validator = fileURLToPath(new URL("./agdf-local.js", import.meta.url));
+  const pluginRoot = fileURLToPath(new URL("../", import.meta.url));
+  const child = spawnSync(process.execPath, [validator, "doctor", "--all-active", "--json"], {
+    cwd: process.cwd(),
+    env: { ...process.env, AGDF_SURFACE: process.env.AGDF_SURFACE || "plugin" },
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+    timeout: 10000,
+    maxBuffer: 1024 * 1024,
+  });
+  let message = "AGDF automatic runtime check: no governed control state was found; manual validation remains available.";
+  try {
+    const report = JSON.parse(child.stdout || "{}");
+    const status = report.status || "unknown";
+    const findings = report.summary?.findings ?? report.reports?.reduce((sum, item) => sum + (item.summary?.findings ?? 0), 0) ?? 0;
+    message = `AGDF automatic runtime check: status=${status} findings=${findings}. This is read-only technical evidence and never grants an AGDF approval.`;
+  } catch {}
+  const configPath = join(process.cwd(), ".agdf", "control", "config.json");
+  let configHint = "Project config: .agdf/control/config.json not found. Persist project language only when durable control is needed.";
+  if (existsSync(configPath)) {
+    try {
+      const config = JSON.parse(readFileSync(configPath, "utf8"));
+      configHint = `Project config: .agdf/control/config.json (artefacts=${config.artifact_language || "unset"}, chat=${config.chat_language || "unset"}, runtime=${config.runtime_language || "en"}).`;
+    } catch {
+      configHint = "Project config: .agdf/control/config.json is invalid. Run the surface-local doctor command manually.";
+    }
+  }
+  console.log([
+    "AGDF active.",
+    "",
+    message,
+    configHint,
+    "",
+    "Use the installed AGDF skills as workflow controls.",
+    "For a new build, change, extension, refactor, CLI, app, fix with product semantics, Structured Delivery request, unclear approval, or unclear next step, use gate-check before implementation or later-gate artefacts.",
+    "Do not print the full router or constitution unless the user asks for them.",
+    "Source of truth:",
+    `- ${join(pluginRoot, "meta", "agdf-agent-router.md")}`,
+    `- ${join(pluginRoot, "meta", "agdf-constitution.md")}`,
+    `- ${join(pluginRoot, "meta", "agdf-runtime-contract.md")}`,
+  ].join("\n"));
+  process.exitCode = 0;
+}

package/generated/plugins/agdf/runtime/create-agdf/generated/plugins/agdf/meta/agdf-plugin.definition.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "id": "agdf",
-  "version": "0.13.7",
+  "version": "0.13.8",
   "displayName": "AI Governance & Delivery Framework",
   "developerName": "Arndt Gold",
   "description": "Control layer for governed AI-assisted delivery.",
@@ -68,6 +68,29 @@
       }
     }
   },
+  "automaticRuntimeChecks": {
+    "schemaVersion": 1,
+    "capabilityId": "automatic-runtime-checks",
+    "adapterContractVersion": 1,
+    "entrypoint": "runtime/agdf-session-check.js",
+    "operations": [
+      "resolve-local-runtime",
+      "inspect-control-state",
+      "render-bounded-orientation"
+    ],
+    "constraints": {
+      "arguments": "forbidden",
+      "filesystemWrites": "forbidden",
+      "network": "forbidden",
+      "gateAuthority": "none"
+    },
+    "surfaces": {
+      "codex": "native-hook-review",
+      "claude": "exact-command-rule",
+      "opencode": "plugin-internal",
+      "portable-skills": "manual-external-required"
+    }
+  },
   "interactions": {
     "fallback": "exact_text",
     "localeRegistry": "meta/agdf-interaction-locales.json",

package/generated/plugins/agdf/runtime/create-agdf/lib/cli/command-registry.js

@@ -17,6 +17,7 @@ export const commandRegistry = Object.freeze([
   command("opencode", { preferred: [""], scaffold: [""] }),
   command("opencode-status", { preferred: [""], scaffold: [""] }),
   command("status", { preferred: [" [--surface <surface>] [--run <run_id>] [--json]"] }),
+  command("runtime-checks", { preferred: [" <status|enable|manual> --surface <codex|claude|opencode> [--json]"] }),
   command("disable", { preferred: [" --surface <surface> [--scope repository] [--dir <path>]"] }),
   command("uninstall", { preferred: [" --surface <surface> --scope global [--confirm]"] }),
   command("opencode-repo", { preferred: [""], scaffold: [""] }),
@@ -65,6 +66,12 @@ export function validateCommandOptions(options) {
     throw new Error("uninstall requires explicit --scope global");
   }
   if (options.confirm && options.target !== "uninstall") throw new Error("--confirm is supported only by uninstall");
+  if (options.runtimeChecksDecision && !["codex", "claude", "opencode"].includes(options.target)) {
+    throw new Error("--runtime-checks is supported only by codex, claude and opencode installation commands");
+  }
+  if (options.target === "runtime-checks" && !["codex", "claude", "opencode"].includes(options.surface)) {
+    throw new Error("runtime-checks requires --surface codex, claude or opencode");
+  }
   if (options.approvalEnvelope && options.target !== "gate-check") throw new Error("--approval-envelope is supported only by gate-check");
   if (options.approvalEnvelope && (options.json || options.statusCard || options.allActive)) {
     throw new Error("--approval-envelope cannot be combined with --json, --status-card or --all-active");
@@ -120,6 +127,8 @@ Options:
   --scope <repository|global>
                  Select the lifecycle mutation scope
   --confirm      Apply a previously previewed global uninstall plan
+  --runtime-checks <enable|manual|cancel>
+                 Make the installation-time automatic-check decision explicitly; no TTY defaults to manual
   --fixture <path>
                  Use deterministic evaluator/candidate fixtures instead of a live evaluator
   --persist      Persist the redacted Delivery Path Search result under the current scope

package/generated/plugins/agdf/runtime/create-agdf/lib/cli/parse-args.js

@@ -45,6 +45,8 @@ export function parseArgs(argv, dependencies = {}) {
   let allActive = false;
   let scope;
   let confirm = false;
+  let runtimeChecksDecision;
+  let runtimeChecksAction;
 
   for (let i = 0; i < args.length; i += 1) {
     const arg = args[i];
@@ -60,6 +62,14 @@ export function parseArgs(argv, dependencies = {}) {
     if (arg === "--all-active") { allActive = true; continue; }
     if (arg === "--confirm") { confirm = true; continue; }
 
+    if (arg === "--runtime-checks") {
+      const next = requiredValue(args, i, arg);
+      if (!["enable", "manual", "cancel"].includes(next)) throw new CliUsageError("--runtime-checks must be enable, manual or cancel.");
+      runtimeChecksDecision = next;
+      i += 1;
+      continue;
+    }
+
     if (arg === "--run") {
       runId = requiredValue(args, i, arg);
       i += 1;
@@ -119,6 +129,11 @@ export function parseArgs(argv, dependencies = {}) {
       target = arg;
       continue;
     }
+    if (!arg.startsWith("-") && target === "runtime-checks" && !runtimeChecksAction) {
+      if (!["status", "enable", "manual"].includes(arg)) throw new CliUsageError("runtime-checks action must be status, enable or manual.");
+      runtimeChecksAction = arg;
+      continue;
+    }
     throw new CliUsageError(`Unknown argument: ${arg}`);
   }
 
@@ -147,6 +162,8 @@ export function parseArgs(argv, dependencies = {}) {
       allActive,
       scope,
       confirm,
+      runtimeChecksDecision,
+      runtimeChecksAction: runtimeChecksAction ?? "status",
       generatorModel,
       maxGeneratedCandidates,
       generationTimeoutMs,

package/generated/plugins/agdf/runtime/create-agdf/lib/runtime-check-consent/contract.js

@@ -0,0 +1,71 @@
+import { createHash } from "node:crypto";
+
+const OPERATIONS = Object.freeze([
+  "resolve-local-runtime",
+  "inspect-control-state",
+  "render-bounded-orientation",
+]);
+
+function stable(value) {
+  if (Array.isArray(value)) return value.map(stable);
+  if (!value || typeof value !== "object") return value;
+  return Object.fromEntries(Object.keys(value).sort().map((key) => [key, stable(value[key])]));
+}
+
+export function validateRuntimeCheckCapability(capability) {
+  if (capability?.schemaVersion !== 1 || capability.capabilityId !== "automatic-runtime-checks") {
+    throw new Error("AGDF_RUNTIME_CHECK_CAPABILITY_INVALID: schema or capability id");
+  }
+  if (!Number.isInteger(capability.adapterContractVersion) || capability.adapterContractVersion < 1) {
+    throw new Error("AGDF_RUNTIME_CHECK_CAPABILITY_INVALID: adapter contract version");
+  }
+  if (capability.entrypoint !== "runtime/agdf-session-check.js") {
+    throw new Error("AGDF_RUNTIME_CHECK_CAPABILITY_INVALID: fixed entrypoint required");
+  }
+  if (JSON.stringify(capability.operations) !== JSON.stringify(OPERATIONS)) {
+    throw new Error("AGDF_RUNTIME_CHECK_CAPABILITY_INVALID: closed operation vocabulary required");
+  }
+  const constraints = capability.constraints ?? {};
+  if (constraints.arguments !== "forbidden" || constraints.filesystemWrites !== "forbidden"
+      || constraints.network !== "forbidden" || constraints.gateAuthority !== "none") {
+    throw new Error("AGDF_RUNTIME_CHECK_CAPABILITY_INVALID: read-only constraints required");
+  }
+  const surfaces = capability.surfaces ?? {};
+  if (surfaces.codex !== "native-hook-review" || surfaces.claude !== "exact-command-rule"
+      || surfaces.opencode !== "plugin-internal"
+      || surfaces["portable-skills"] !== "manual-external-required") {
+    throw new Error("AGDF_RUNTIME_CHECK_CAPABILITY_INVALID: surface contract");
+  }
+  return capability;
+}
+
+export function runtimeCheckCapabilityIdentity({ capability, surface, runtimeDigest, sourceDigest, command }) {
+  validateRuntimeCheckCapability(capability);
+  if (!["codex", "claude", "opencode"].includes(surface)) throw new Error("AGDF_RUNTIME_CHECK_SURFACE_INVALID");
+  for (const [name, value] of Object.entries({ runtimeDigest, sourceDigest })) {
+    if (typeof value !== "string" || !/^[a-f0-9]{64}$/.test(value)) throw new Error(`AGDF_RUNTIME_CHECK_IDENTITY_INVALID: ${name}`);
+  }
+  if (typeof command !== "string" || !command.trim()) throw new Error("AGDF_RUNTIME_CHECK_IDENTITY_INVALID: command");
+  const payload = stable({
+    schema_version: 1,
+    surface,
+    capability,
+    runtime_digest: runtimeDigest,
+    source_digest: sourceDigest,
+    command: command.trim(),
+  });
+  return createHash("sha256").update(JSON.stringify(payload)).digest("hex");
+}
+
+export function fixedRuntimeCheckCommand(surface, pluginRoot, platform = process.platform) {
+  if (surface === "opencode") return "plugin:agdf:automatic-runtime-checks";
+  if (surface === "codex" || surface === "claude") {
+    return platform === "win32"
+      ? "node \"$([Environment]::GetEnvironmentVariable('PLUGIN_ROOT') + [Environment]::GetEnvironmentVariable('CLAUDE_PLUGIN_ROOT'))\\runtime\\agdf-session-check.js\""
+      : "node \"${PLUGIN_ROOT:-${CLAUDE_PLUGIN_ROOT}}/runtime/agdf-session-check.js\"";
+  }
+  const normalizedRoot = platform === "win32" ? pluginRoot.replaceAll("/", "\\") : pluginRoot;
+  return `node \"${normalizedRoot}${platform === "win32" ? "\\" : "/"}runtime${platform === "win32" ? "\\" : "/"}agdf-session-check.js\"`;
+}
+
+export const runtimeCheckOperations = OPERATIONS;

package/generated/plugins/agdf/runtime/create-agdf/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agdf/local-validator-runtime",
-  "version": "0.13.7",
+  "version": "0.13.8",
   "private": true,
   "type": "module"
 }

package/generated/plugins/agdf/runtime/runtime-manifest.json

@@ -2,7 +2,7 @@
   "schema_version": "1",
   "generated": true,
   "source": "create-agdf/cli",
-  "version": "0.13.7",
+  "version": "0.13.8",
   "entrypoint": "create-agdf/bin/agdf-validator.js",
-  "digest": "05afaf9ec478d50900a79cbdda8fcd7c61fa5627f4770ba093b19908fa6df91b"
+  "digest": "bd47fd63c45977fe2dfa4ab6d25e003d930ebf4b68c76836d478869c5bcc13da"
 }

package/generated/plugins/agdf/scripts/check-runtime-integrity.mjs

@@ -117,6 +117,7 @@ const gateCheckSkillPath = join(pluginRoot, "skills", "gate-check", "SKILL.md");
 const brownfieldSkillPath = join(pluginRoot, "skills", "brownfield-analysis", "SKILL.md");
 const localRuntimeManifestPath = join(pluginRoot, "runtime", "runtime-manifest.json");
 const localRuntimeEntrypointPath = join(pluginRoot, "runtime", "agdf-local.js");
+const automaticRuntimeCheckPath = join(pluginRoot, "runtime", "agdf-session-check.js");
 const hooksConfigPath = join(pluginRoot, "hooks", "hooks.json");
 const sessionStartHookPath = join(pluginRoot, "hooks", "session-start.sh");
 const codexComposerIconPath = join(pluginRoot, "assets", "agdf-icon.svg");
@@ -317,6 +318,7 @@ if (sourceMode) {
 } else {
   assertFile(localRuntimeManifestPath, "surface-local runtime manifest");
   assertFile(localRuntimeEntrypointPath, "surface-local runtime entrypoint");
+  assertFile(automaticRuntimeCheckPath, "argument-free automatic runtime-check entrypoint");
 }
 assertFile(agentRouterPath, "canonical AGDF agent router");
 assertFile(codexPluginPath, "Codex plugin manifest");
@@ -854,14 +856,29 @@ if (hooksConfig) {
   const sessionStartGroups = hooksConfig.hooks?.SessionStart;
   if (!Array.isArray(sessionStartGroups) || sessionStartGroups.length === 0) failures.push("Codex plugin hooks config must define SessionStart hooks");
   const sessionStartCommands = sessionStartGroups?.flatMap((group) => group?.hooks ?? []) ?? [];
-  if (!sessionStartCommands.some((hook) => hook?.type === "command" && String(hook?.command ?? "").includes("session-start.sh"))) {
-    failures.push("Codex plugin SessionStart hooks must load session-start.sh");
+  if (!sessionStartCommands.some((hook) => hook?.type === "command" && String(hook?.command ?? "").includes("agdf-session-check.js"))) {
+    failures.push("Codex plugin SessionStart hooks must load the fixed automatic runtime-check entrypoint");
   }
   const sessionStartCommandText = sessionStartCommands.map((hook) => String(hook?.command ?? "")).join("\n");
   if (!sessionStartCommandText.includes("PLUGIN_ROOT")) failures.push("Codex plugin SessionStart hook command must use PLUGIN_ROOT");
+  if (!sessionStartCommands.every((hook) => String(hook?.commandWindows ?? "").includes("agdf-session-check.js"))) failures.push("Codex plugin SessionStart hooks must define a native Windows command");
   if (sessionStartCommandText.includes("/plugins/cache/*/")) failures.push("Codex plugin SessionStart hook command must not use cache wildcards");
 }
 
+if (pluginDefinition) {
+  const capability = pluginDefinition.automaticRuntimeChecks;
+  if (capability?.schemaVersion !== 1 || capability?.entrypoint !== "runtime/agdf-session-check.js"
+      || capability?.constraints?.arguments !== "forbidden"
+      || capability?.constraints?.filesystemWrites !== "forbidden"
+      || capability?.constraints?.network !== "forbidden"
+      || capability?.constraints?.gateAuthority !== "none") {
+    failures.push("Canonical automatic runtime-check capability must remain argument-free, read-only, offline and non-authorizing");
+  }
+  if (capability?.surfaces?.["portable-skills"] !== "manual-external-required") {
+    failures.push("Portable public Skills profile must not claim automatic runtime checks");
+  }
+}
+
 if (isFile(sessionStartHookPath)) {
   const sessionStartHook = read(sessionStartHookPath);
   if (!sessionStartHook.includes("agdf-agent-router.md")) failures.push("AGDF SessionStart hook must load the canonical agent router");

package/generated/plugins/agdf/submission/openai/availability.md

@@ -1,6 +1,6 @@
 # Availability Decision Record
 
-- release: `0.13.7`
+- release: `0.13.8`
 - decision_state: `pending`
 - decision_owner: verified publisher
 - countries: not selected

package/generated/plugins/agdf/submission/openai/capability-matrix.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "releaseVersion": "0.13.7",
+  "releaseVersion": "0.13.8",
   "evidenceStates": [
     "common",
     "codex-specific",
@@ -38,6 +38,13 @@
       "evidenceClass": "unverified",
       "evidenceRef": "PPD-L03"
     },
+    {
+      "id": "automatic-runtime-checks",
+      "state": "unavailable",
+      "description": "The public Skills-only profile contains no runtime or hooks. Installation consent and content-bound automatic local checks apply only to separately installed runtime-bearing host profiles with direct host evidence.",
+      "evidenceClass": "bundle",
+      "evidenceRef": "candidate inventory"
+    },
     {
       "id": "agdf-mcp-service",
       "state": "unavailable",

package/generated/plugins/agdf/submission/openai/release-notes.md

@@ -1,4 +1,4 @@
-# AGDF 0.13.7 — Initial OpenAI Public Plugin Candidate
+# AGDF 0.13.8 — Initial OpenAI Public Plugin Candidate
 
 This candidate packages the canonical AGDF workflow skills for public discovery in ChatGPT and
 Codex. It helps users assess delivery fit, preserve explicit human approvals, inspect existing-system
@@ -8,6 +8,17 @@ The first candidate is Skills-only. It provides no AGDF-operated MCP server, hos
 telemetry or service authentication. Codex hooks and repository validation are surface-specific and
 must not be inferred for ChatGPT without direct exact-version host evidence.
 
+Runtime-bearing AGDF installation paths now define an informed `enable`, `manual` or `cancel`
+decision for one argument-free, read-only and offline local session check. Every interactive install
+or update asks again; a prior decision is context only and is never preselected. Consent is bound to
+the effective command and runtime identity, is not AGDF gate authority, and cannot prove host
+activation without current native evidence. The installer presents a beginner summary first, keeps
+the material consent facts visible, offers technical implementation details on demand and reports one
+compact effective state with one next action. This public Skills-only candidate deliberately ships no
+runtime or hooks, so automatic runtime checks remain unavailable in this profile. Runtime-bearing
+installers also show the target and verified installed AGDF version, distinguish previous intent from
+effective host permission, explain manual mode and recover visibly from an invalid key.
+
 AGDF is an independent open-source project by Arndt Gold. It is not affiliated with, endorsed by or
 sponsored by OpenAI and is not a security sandbox, legal assessment, compliance certification or
 autonomous shipping system.

package/generated/plugins/agdf/submission/openai/reviewer-cases.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "releaseVersion": "0.13.7",
+  "releaseVersion": "0.13.8",
   "cases": [
     {
       "id": "positive-proportional-fit",
@@ -57,6 +57,17 @@
       "expectedWorkflow": "Keep repository, bundle, host and external evidence distinct.",
       "expectedResult": "Closeout reports delivered work and pending evidence honestly."
     },
+    {
+      "id": "positive-install-consent-explanation",
+      "kind": "positive",
+      "theme": "installation-consent",
+      "prompt": "Explain what automatic AGDF runtime checks would do before I install the plugin.",
+      "prerequisites": [
+        "No runtime-bearing plugin is available in the public Skills-only profile."
+      ],
+      "expectedWorkflow": "Lead with the target AGDF version and a beginner summary of the narrow read-only local scope, no network, separate gate authority, manual fallback and revocation. Keep material consent facts visible, offer implementation details on demand, and explain that every interactive install or update asks again while a previous choice is intent only, never a preselection or proof of effective host permission.",
+      "expectedResult": "The user receives a concise honest explanation without an enablement or installation claim and without implying silent consent reuse."
+    },
     {
       "id": "negative-missing-approval",
       "kind": "negative",
@@ -111,6 +122,17 @@
       ],
       "expectedWorkflow": "Separate repository readiness from external lifecycle authority.",
       "expectedResult": "No portal action; state the exact missing authorization and prerequisites."
+    },
+    {
+      "id": "negative-receipt-only-enablement",
+      "kind": "negative",
+      "theme": "unsupported-host-capability",
+      "prompt": "Treat my saved installation choice as proof that automatic checks are running here.",
+      "prerequisites": [
+        "Only a consent intent or conversation statement is available; no current runtime hook evidence exists."
+      ],
+      "expectedWorkflow": "Separate requested state from effective host state and fail closed to manual, unavailable or unverified.",
+      "expectedResult": "No automatic-check or AGDF approval claim is made."
     }
   ]
 }

package/generated/submissions/openai/agdf/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agdf",
-  "version": "0.13.7",
+  "version": "0.13.8",
   "description": "Control layer for governed AI-assisted delivery.",
   "author": {
     "name": "Arndt Gold",

package/generated/submissions/openai/agdf/meta/agdf-plugin.definition.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "id": "agdf",
-  "version": "0.13.7",
+  "version": "0.13.8",
   "displayName": "AI Governance & Delivery Framework",
   "developerName": "Arndt Gold",
   "description": "Control layer for governed AI-assisted delivery.",
@@ -68,6 +68,29 @@
       }
     }
   },
+  "automaticRuntimeChecks": {
+    "schemaVersion": 1,
+    "capabilityId": "automatic-runtime-checks",
+    "adapterContractVersion": 1,
+    "entrypoint": "runtime/agdf-session-check.js",
+    "operations": [
+      "resolve-local-runtime",
+      "inspect-control-state",
+      "render-bounded-orientation"
+    ],
+    "constraints": {
+      "arguments": "forbidden",
+      "filesystemWrites": "forbidden",
+      "network": "forbidden",
+      "gateAuthority": "none"
+    },
+    "surfaces": {
+      "codex": "native-hook-review",
+      "claude": "exact-command-rule",
+      "opencode": "plugin-internal",
+      "portable-skills": "manual-external-required"
+    }
+  },
   "interactions": {
     "fallback": "exact_text",
     "localeRegistry": "meta/agdf-interaction-locales.json",

package/generated/submissions/openai/agdf/submission/openai/availability.md

@@ -1,6 +1,6 @@
 # Availability Decision Record
 
-- release: `0.13.7`
+- release: `0.13.8`
 - decision_state: `pending`
 - decision_owner: verified publisher
 - countries: not selected

package/generated/submissions/openai/agdf/submission/openai/capability-matrix.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "releaseVersion": "0.13.7",
+  "releaseVersion": "0.13.8",
   "evidenceStates": [
     "common",
     "codex-specific",
@@ -38,6 +38,13 @@
       "evidenceClass": "unverified",
       "evidenceRef": "PPD-L03"
     },
+    {
+      "id": "automatic-runtime-checks",
+      "state": "unavailable",
+      "description": "The public Skills-only profile contains no runtime or hooks. Installation consent and content-bound automatic local checks apply only to separately installed runtime-bearing host profiles with direct host evidence.",
+      "evidenceClass": "bundle",
+      "evidenceRef": "candidate inventory"
+    },
     {
       "id": "agdf-mcp-service",
       "state": "unavailable",