lossless-openclaw-orchestrator 1.2.3 → 1.2.5

package/README.md

@@ -23,7 +23,7 @@ safe action without rereading raw transcripts.
 | Approval-gated boundaries | Dry-run Codex actions and verify matching audit ids before any live control. |
 | OpenClaw/MCP tools | Use the same local-first recall and approval-bounded surfaces from agent workflows. |
 
-[Setup](docs/SETUP.md) · [Contributing](CONTRIBUTING.md) · [Agent Instructions](AGENTS.md) · [Agent Skill](skills/lossless-openclaw-orchestrator/SKILL.md) · [OpenClaw Plugin](docs/OPENCLAW_PLUGIN.md) · [Security](SECURITY.md) · [Code of Conduct](CODE_OF_CONDUCT.md) · [Vision](VISION.md) · [Privacy](docs/PRIVACY.md) · [Claude Boundary](docs/CLAUDE_ADAPTER_BOUNDARY.md) · [Claim Audit](docs/CLAIM_AUDIT.md) · [Release Notes](docs/RELEASE_NOTES_1.2.3.md) · [1.2.2 Notes](docs/RELEASE_NOTES_1.2.2.md) · [1.2.1 Notes](docs/RELEASE_NOTES_1.2.1.md) · [1.2.0 Notes](docs/RELEASE_NOTES_1.2.0.md) · [1.1.4 Notes](docs/RELEASE_NOTES_1.1.4.md) · [1.0 Notes](docs/RELEASE_NOTES_1.0.0.md) · [License](LICENSE)
+[Setup](docs/SETUP.md) · [Contributing](CONTRIBUTING.md) · [Agent Instructions](AGENTS.md) · [Agent Skill](skills/lossless-openclaw-orchestrator/SKILL.md) · [OpenClaw Plugin](docs/OPENCLAW_PLUGIN.md) · [Security](SECURITY.md) · [Code of Conduct](CODE_OF_CONDUCT.md) · [Vision](VISION.md) · [Privacy](docs/PRIVACY.md) · [Claude Boundary](docs/CLAUDE_ADAPTER_BOUNDARY.md) · [Claim Audit](docs/CLAIM_AUDIT.md) · [Release Notes](docs/RELEASE_NOTES_1.2.5.md) · [1.2.4 Notes](docs/RELEASE_NOTES_1.2.4.md) · [1.2.3 Notes](docs/RELEASE_NOTES_1.2.3.md) · [1.2.2 Notes](docs/RELEASE_NOTES_1.2.2.md) · [1.2.1 Notes](docs/RELEASE_NOTES_1.2.1.md) · [1.2.0 Notes](docs/RELEASE_NOTES_1.2.0.md) · [1.1.4 Notes](docs/RELEASE_NOTES_1.1.4.md) · [1.0 Notes](docs/RELEASE_NOTES_1.0.0.md) · [License](LICENSE)
 
 ## Why It Matters
 
@@ -325,7 +325,7 @@ The stable public product is Codex-first local orchestration: index, search,
 describe, expand, prepared-state recall, OpenClaw/MCP tools, and
 approval-gated dry-run/control boundaries.
 
-The 1.2 prepared-state and summary-leaves lane is shipped in stable `1.2.3`.
+The 1.2 prepared-state and summary-leaves lane is shipped in stable `1.2.5`.
 Current launch work is the M11 GA assurance sprint, tracked in GitHub and
 summarized in [VISION.md](VISION.md). Keep sprint and agent-operator details
 there, in [AGENTS.md](AGENTS.md), and in the packaged
@@ -376,6 +376,7 @@ loo release preflight --claim-scope codex-read-search-expand-dry-run --evidence-
 loo release demo-status --claim-scope codex-read-search-expand-dry-run --evidence-dir /Volumes/LEXAR/Codex/lossless-openclaw-orchestrator/YYYY-MM-DD/demo --strict
 loo release status --claim-scope codex-read-search-expand-dry-run --evidence-dir /Volumes/LEXAR/Codex/lossless-openclaw-orchestrator/YYYY-MM-DD/release-status --candidate-sha <release-candidate-sha> --npm-publish-approval-evidence npm-publish-approval.json --github-release-approval-evidence github-release-approval.json --github-ci-evidence github-ci.json --codeql-evidence codeql.json --strict
 loo release general-readiness --evidence-dir /Volumes/LEXAR/Codex/lossless-openclaw-orchestrator/YYYY-MM-DD/general-readiness --fresh-npm-evidence published-package-smoke.json --agent-dogfood-evidence openclaw-tool-smoke.json --strict
+loo release ga-smoke --evidence-dir /Volumes/LEXAR/Codex/lossless-openclaw-orchestrator/YYYY-MM-DD/release-ga-smoke --package-version <version> --candidate-sha <release-candidate-sha> --strict
 ```
 
 ## Development

package/VISION.md

@@ -12,11 +12,11 @@ The stable product should feel like a local orchestration cockpit: OpenClaw can
 
 The current release-readiness lane is Milestone 11: LCO 1.2.0 GA Assurance And Global Launch Readiness. GitHub tracker [#478](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/478) and children [#479](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/479)-[#493](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/493) own implementation truth; this file owns the product and eval boundary.
 
-The stable 1.0.0, 1.1.0, 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.2.0, 1.2.1, 1.2.2, and 1.2.3 packages have shipped on npm `latest` and their GitHub Releases are published. The post-GA Desktop claim-validation lane [#306](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/306) records that Desktop-visible classification and fallback readiness/status are proven, while actual Codex GUI mutation remains excluded. Desktop parity [#307](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/307) added the coherence classifier; desktop fallback [#308](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/308) added the CUA-first and Peekaboo-secondary readiness report. The 1.1 collaboration cockpit [#309](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/309) is completed proof for read-only collaboration summaries and execute-false next steps, not the current active child-work list.
+The stable 1.0.0, 1.1.0, 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.2.0, 1.2.1, 1.2.2, 1.2.3, and 1.2.4 packages have shipped on npm `latest` and their GitHub Releases are published. The 1.2.5 package is the current stable patch candidate; npm `latest` and GitHub Release finalization must be proven by release evidence before any global-ready claim treats it as published. The post-GA Desktop claim-validation lane [#306](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/306) records that Desktop-visible classification and fallback readiness/status are proven, while actual Codex GUI mutation remains excluded. Desktop parity [#307](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/307) added the coherence classifier; desktop fallback [#308](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/308) added the CUA-first and Peekaboo-secondary readiness report. The 1.1 collaboration cockpit [#309](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/309) is completed proof for read-only collaboration summaries and execute-false next steps, not the current active child-work list.
 
 The Codex Autonomy Cockpit [#254](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/254) and Eva Operating Picture [#255](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/255) P0 lanes are completed beta foundation, not the current active child-work list. Completed P0 children include shared contracts [#256](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/256), source authority [#258](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/258), watcher/resume requests [#259](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/259), visible Codex map joins [#260](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/260), deterministic GitHub operating inputs [#264](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/264)/[#265](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/265), current-lane source balancing [#269](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/269), GitHub check-state fidelity [#270](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/270), cockpit card cleanup [#271](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/271), and end-to-end Eva cockpit dogfood [#272](https://github.com/100yenadmin/Lossless-Codex-Orchestrator-LCO/issues/272). The sprint brief remains the historical handoff for that P0 work: [docs/sprints/brief-lco-codex-autonomy-cockpit-sprint-2026-07-01.md](docs/sprints/brief-lco-codex-autonomy-cockpit-sprint-2026-07-01.md).
 
-The core Codex recall, M9 handoff paths, Codex Autonomy Cockpit, Eva Operating Picture P0 paths, 1.1 Desktop collaboration cockpit paths, 1.2 prepared-state and summary-leaf paths, release metadata, package/gateway setup proof, docs truth, release gates, public-safe scorecards, post-publish fresh npm `@latest` install proof, and stable publication lanes are no longer the main product gap. The current gap is no-bug-left-behind launch assurance: prove the published `1.2.3` package is installable, discoverable, public-safe, and honest for global users before broad rollout.
+The core Codex recall, M9 handoff paths, Codex Autonomy Cockpit, Eva Operating Picture P0 paths, 1.1 Desktop collaboration cockpit paths, 1.2 prepared-state and summary-leaf paths, release metadata, package/gateway setup proof, docs truth, release gates, and public-safe scorecards are no longer the main product gap. The current gap is no-bug-left-behind launch assurance: prove the `1.2.5` stable candidate is published, installable from npm `@latest`, discoverable, public-safe, and honest for global users before broad rollout.
 
 The current target is:
 
@@ -38,7 +38,7 @@ The current target is:
 - Keep P1 source adapters, including Notion, support-control, Company Brain, Stripe, dashboard/export, and model summarization, behind separate adapters and proof gates; P0 tools report those sources as `not_configured` instead of fabricating summaries.
 - Use the [source authority profile](docs/SOURCE_AUTHORITY_PROFILE.md) to distinguish "this source returned data" from "this source owns the current truth"; unavailable or cache-only sources must degrade claims to `unknown` or low confidence.
 
-The sprint remains Codex-first, local-first, read-only-first, and public-safe by default. It does not claim full business truth, customer readiness, Claude Code parity, remote sync, generic GUI mutation, unattended desktop control, permission bypass, or enterprise/customer-ready security. npm `latest` promotion and GitHub Release creation are complete for 1.2.3. Desktop-visible classification and fallback readiness/status are proven by #307/#308; actual Codex GUI mutation remains excluded until a future action-bound proof gate records the exact backend, target, action hash, approval, and observation.
+The sprint remains Codex-first, local-first, read-only-first, and public-safe by default. It does not claim full business truth, customer readiness, Claude Code parity, remote sync, generic GUI mutation, unattended desktop control, permission bypass, or enterprise/customer-ready security. npm `latest` promotion and GitHub Release creation for 1.2.5 are release gates, not assumptions. Desktop-visible classification and fallback readiness/status are proven by #307/#308; actual Codex GUI mutation remains excluded until a future action-bound proof gate records the exact backend, target, action hash, approval, and observation.
 
 What 1.2 should let a local OpenClaw agent do next:
 
@@ -83,6 +83,7 @@ What a local OpenClaw agent can do today:
 - Classify package and gateway readiness with `loo onboard status`, `loo openclaw dogfood`, `loo openclaw tool-smoke`, and `loo openclaw published-smoke`.
 - Follow the packaged agent skill and M9 dogfood scenario to produce a public-safe recommendation from source refs, bounded expansion, detail lookups, and dry-run audit hashes.
 - Use `loo release general-readiness --strict` to decide whether fresh npm install, clean-profile OpenClaw load, clean-profile gateway readiness, and agent dogfood evidence are enough for a stable/general release claim.
+- Use `loo release ga-smoke --strict` after the individual release reports exist to aggregate the release-status, finalization, published-smoke, OpenClaw dogfood/tool-smoke, scenario, scorecard, bundle, preflight, and privacy packets into one public-safe blocker taxonomy. It is a report aggregator only; it must not publish npm, create tags, create GitHub Releases, run live control, mutate a GUI, or read raw transcripts.
 
 ## Completed Proof: Working App Runtime
 
@@ -294,7 +295,7 @@ Release candidates follow [docs/BETA_RELEASE_RUNBOOK.md](docs/BETA_RELEASE_RUNBO
 
 ## Proof Boundary
 
-Allowed stable 1.2.3 claim:
+Allowed stable 1.2.5 claim:
 
 > Collaborate with local Codex sessions through OpenClaw using local indexing, prepared-state recall, bounded expansion, and approval-gated dry-run/control boundaries.
 

package/dist/packages/cli/src/index.js

@@ -6,6 +6,7 @@ import { dirname, join, resolve } from "node:path";
 import { createReleaseBundle } from "./release-bundle.js";
 import { createReleaseDemoStatus } from "./release-demo-status.js";
 import { createReleaseFinalizationStatus } from "./release-finalization-status.js";
+import { createReleaseGaSmokeReport } from "./release-ga-smoke.js";
 import { runReleasePreflight } from "./release-preflight.js";
 import { createReleaseStatus } from "./release-status.js";
 import { createGeneralReleaseReadiness } from "./general-release-readiness.js";
@@ -636,6 +637,18 @@ async function main() {
             process.exitCode = 1;
         return;
     }
+    if (command === "release" && args[0] === "ga-smoke") {
+        if (hasHelpFlag(args.slice(1))) {
+            printReleaseGaSmokeHelp();
+            return;
+        }
+        const parsed = parseReleaseGaSmokeArgs(args.slice(1));
+        const report = createReleaseGaSmokeReport(parsed);
+        console.log(JSON.stringify(report, null, 2));
+        if (parsed.strict && !report.gaSmokeReady)
+            process.exitCode = 1;
+        return;
+    }
     if (command === "release" && args[0] === "demo-status") {
         if (hasHelpFlag(args.slice(1))) {
             printReleaseDemoStatusHelp();
@@ -855,6 +868,7 @@ function mainUsageText() {
         "  loo release status --evidence-dir path --candidate-sha sha [--claim-scope codex-live-control|codex-read-search-expand-dry-run|codex-working-app-proof] [--approved-live-control-evidence path] [--runtime-proof-dir path] [--npm-publish-approval-evidence path] [--github-release-approval-evidence path] [--github-ci-evidence path] [--codeql-evidence path] [--desktop-gui-required --desktop-gui-approval-evidence path] [--now iso] [--strict]",
         "  loo release finalization-status --evidence-dir path --candidate-sha sha --npm-publish-evidence path --git-tag-evidence path --github-release-evidence path [--package-name name] [--package-version version] [--expected-dist-tag beta|next|latest] [--expected-github-prerelease true|false] [--now iso] [--strict]",
         "  loo release general-readiness --evidence-dir path [--fresh-npm-evidence path] [--agent-dogfood-evidence path] [--now iso] [--strict]",
+        "  loo release ga-smoke --evidence-dir path --package-version version --candidate-sha sha [--release-status path] [--release-finalization-status path] [--published-smoke path] [--dogfood-report path] [--tool-smoke-report path] [--scenario-sweep path] [--scorecard-sweep path] [--release-preflight path] [--release-bundle path] [--privacy-scan path] [--claim-scope codex-live-control|codex-read-search-expand-dry-run|codex-working-app-proof] [--allow-setup-required] [--now iso] [--strict]",
         "  loo release demo-status --evidence-dir path [--claim-scope codex-live-control|codex-read-search-expand-dry-run|codex-working-app-proof] [--approved-live-control-evidence path] [--runtime-proof-dir path] [--min-sessions n] [--strict]"
     ].join("\n");
 }
@@ -1184,6 +1198,24 @@ function printGeneralReleaseReadinessHelp() {
         "  The command does not publish npm, does not move npm dist-tags, does not create a GitHub Release, does not run live Codex control, and does not perform desktop GUI mutation."
     ].join("\n"));
 }
+function printReleaseGaSmokeHelp() {
+    console.log([
+        "Usage:",
+        "  loo release ga-smoke --evidence-dir path --package-version version --candidate-sha sha [--release-status path] [--release-finalization-status path] [--published-smoke path] [--dogfood-report path] [--tool-smoke-report path] [--scenario-sweep path] [--scorecard-sweep path] [--release-preflight path] [--release-bundle path] [--privacy-scan path] [--claim-scope codex-live-control|codex-read-search-expand-dry-run|codex-working-app-proof] [--allow-setup-required] [--now iso] [--strict]",
+        "",
+        "Aggregates public-safe release evidence into one GA smoke readiness packet.",
+        "",
+        "Default evidence names:",
+        "  release-status.json, release-finalization-status.json, published-package-smoke.json, openclaw-dogfood.json, openclaw-tool-smoke.json, scenario-sweep.json, scorecard-sweep.json, release-preflight.json, release-bundle.json, and privacy-scan.json.",
+        "",
+        "Strict mode:",
+        "  --strict exits non-zero for P0-P2 package, release, safety, setup, or evidence blockers. P3 warnings remain non-blocking.",
+        "  --allow-setup-required permits a classified fresh-profile setup blocker only when package-path, configured-gateway, and finalization proof are clean.",
+        "",
+        "Safety boundary:",
+        "  This command is aggregate-only. It consumes existing sanitized evidence and does not publish npm, create tags, create GitHub Releases, run live Codex control, mutate a GUI, read raw transcripts, or store raw npm/gateway output."
+    ].join("\n"));
+}
 function printOpenClawPublishedSmokeHelp() {
     console.log([
         "Usage:",
@@ -2802,6 +2834,122 @@ function parseGeneralReleaseReadinessArgs(input) {
         throw new Error("release general-readiness requires --evidence-dir");
     return { evidenceDir, freshNpmEvidence, agentDogfoodEvidence, now, strict };
 }
+function parseReleaseGaSmokeArgs(input) {
+    let evidenceDir;
+    let packageVersion;
+    let candidateSha;
+    let claimScope;
+    let releaseStatus;
+    let releaseFinalizationStatus;
+    let publishedSmoke;
+    let dogfoodReport;
+    let toolSmokeReport;
+    let scenarioSweep;
+    let scorecardSweep;
+    let releasePreflight;
+    let releaseBundle;
+    let privacyScan;
+    let allowSetupRequired = false;
+    let now;
+    let strict = false;
+    for (let index = 0; index < input.length; index += 1) {
+        const arg = input[index];
+        if (arg === "--evidence-dir") {
+            evidenceDir = readReleaseStatusPath(input, ++index, "--evidence-dir");
+            continue;
+        }
+        if (arg === "--package-version") {
+            packageVersion = readReleaseStatusValue(input, ++index, "--package-version");
+            continue;
+        }
+        if (arg === "--candidate-sha") {
+            candidateSha = readReleaseStatusValue(input, ++index, "--candidate-sha");
+            continue;
+        }
+        if (arg === "--claim-scope") {
+            claimScope = parseReleaseClaimScope(input, ++index, "--claim-scope");
+            continue;
+        }
+        if (arg === "--release-status") {
+            releaseStatus = readReleaseStatusPath(input, ++index, "--release-status");
+            continue;
+        }
+        if (arg === "--release-finalization-status") {
+            releaseFinalizationStatus = readReleaseStatusPath(input, ++index, "--release-finalization-status");
+            continue;
+        }
+        if (arg === "--published-smoke") {
+            publishedSmoke = readReleaseStatusPath(input, ++index, "--published-smoke");
+            continue;
+        }
+        if (arg === "--dogfood-report") {
+            dogfoodReport = readReleaseStatusPath(input, ++index, "--dogfood-report");
+            continue;
+        }
+        if (arg === "--tool-smoke-report") {
+            toolSmokeReport = readReleaseStatusPath(input, ++index, "--tool-smoke-report");
+            continue;
+        }
+        if (arg === "--scenario-sweep") {
+            scenarioSweep = readReleaseStatusPath(input, ++index, "--scenario-sweep");
+            continue;
+        }
+        if (arg === "--scorecard-sweep") {
+            scorecardSweep = readReleaseStatusPath(input, ++index, "--scorecard-sweep");
+            continue;
+        }
+        if (arg === "--release-preflight") {
+            releasePreflight = readReleaseStatusPath(input, ++index, "--release-preflight");
+            continue;
+        }
+        if (arg === "--release-bundle") {
+            releaseBundle = readReleaseStatusPath(input, ++index, "--release-bundle");
+            continue;
+        }
+        if (arg === "--privacy-scan") {
+            privacyScan = readReleaseStatusPath(input, ++index, "--privacy-scan");
+            continue;
+        }
+        if (arg === "--allow-setup-required") {
+            allowSetupRequired = true;
+            continue;
+        }
+        if (arg === "--now") {
+            now = readReleaseStatusValue(input, ++index, "--now");
+            continue;
+        }
+        if (arg === "--strict") {
+            strict = true;
+            continue;
+        }
+        throw new Error(`Unknown release ga-smoke option: ${arg}`);
+    }
+    if (!evidenceDir)
+        throw new Error("release ga-smoke requires --evidence-dir");
+    if (!packageVersion)
+        throw new Error("release ga-smoke requires --package-version");
+    if (!candidateSha)
+        throw new Error("release ga-smoke requires --candidate-sha");
+    return {
+        evidenceDir,
+        packageVersion,
+        candidateSha,
+        claimScope,
+        releaseStatus,
+        releaseFinalizationStatus,
+        publishedSmoke,
+        dogfoodReport,
+        toolSmokeReport,
+        scenarioSweep,
+        scorecardSweep,
+        releasePreflight,
+        releaseBundle,
+        privacyScan,
+        allowSetupRequired,
+        now,
+        strict
+    };
+}
 function readReleaseStatusPath(input, index, flag) {
     const value = input[index];
     if (!value || value.startsWith("--"))