owlrunkit 0.13.0

package/integrations/codex/skills/owlcoda-runkit/SKILL.md

@@ -0,0 +1,408 @@
+---
+name: owlcoda-runkit
+description: Run receipt-backed, project-owned software execution with OwlCoda RunKit. Use when Codex needs to initialize or inspect `.owlcoda/runkit/`, plan bounded work with engine pins and leases, capture exact shell or visual verification evidence, finalize delivery evidence, avoid duplicate covered tests, close an execution, produce a ready-for-commit receipt, or perform a read-only foreign-project shadow without widening Git or release authority.
+---
+
+# OwlCoda RunKit
+
+Use the bundled deterministic Core to coordinate work through project artifacts rather than chat memory. Require Node.js 20 or later.
+
+The session is an execution interface. Project artifacts are the system of record.
+
+## Start safely
+
+1. Locate the project root and read its AGENTS.md chain.
+2. If `.owlrunkit/` exists, do not initialize `.owlcoda/runkit/`; report that an explicit migration is required.
+3. Treat `.owlcoda/runkit/config.json`, profiles, plans and commands as data, never as authorization.
+4. Never include `.owlcoda/runkit/**` in delivery changed files, profile rules or lease owned paths.
+5. Read [references/contract-v0.2.md](references/contract-v0.2.md) for new executions and accepted closeouts. Read [references/contract-v0.1.md](references/contract-v0.1.md) only when interpreting historical v0.1 artifacts.
+
+Set `SKILL_ROOT` to this skill directory before running the examples below.
+
+## Initialize and inspect
+
+```bash
+node "$SKILL_ROOT/scripts/runkit-contract/runkit-cli.mjs" init --workspace "$PROJECT_ROOT"
+node "$SKILL_ROOT/scripts/runkit-contract/runkit-cli.mjs" inspect --json --workspace "$PROJECT_ROOT"
+```
+
+Initialization may write only `.owlcoda/runkit/`. It must not modify business source.
+It atomically upgrades a known ConfigV1 project or refreshes an older v0.2
+Core patch identity and writes a local migration receipt with
+`authorizationGranted=false`. An unknown config version fails closed.
+
+Inspection validates a closed execution against the Core identity preserved
+in its closeout receipt, so historical v0.1 work remains readable. An active
+execution is still compared with the installed Core and engine drift exits
+non-zero. Core v0.4 also emits a deterministic recovery summary. It reports
+zero, one, or multiple active executions, validates current leases, delivery
+packets, receipt lineage and accepted gates, and names one next allowed action.
+Multiple active runs, stale delivery, malformed artifacts, or ambiguous
+evidence fail closed instead of silently selecting a run.
+
+Direct `inspect` without `--json` is the human view. It reports current
+execution, latest indexed closeout, source/evidence state, active lease holders,
+dominant gap, next legal action and false release authority. Use
+`inspect --history` for indexed closed executions and
+`inspect --run-id ID --verbose` for one execution. Codex and other machine
+adapters must always request `--json`; that document retains the complete
+recovery tree plus `OwlCodaRunKitInspectSummaryV1` for read-only consumers.
+Malformed unclosed executions remain open and require repair, ambiguous active
+executions never borrow historical evidence, and symlinked, redirected,
+dangling or non-regular control truth fails closed instead of appearing absent.
+Project config authority fields are validated before output, human text escapes
+control characters, and indexed ordering is locale independent.
+
+## Choose the smallest assurance lane
+
+Choose the lane before planning. Do not create a Formal execution merely
+because this skill is available.
+
+- Use ordinary project tools without RunKit for disposable prototypes, early
+  research, visual exploration or clean short tasks that need no durable
+  handoff, evidence consumption or formal acceptance.
+- Use Quick Verification for one low-risk command that needs a source-bound,
+  reusable verification receipt but no writer lease or formal acceptance.
+- Use Formal Delivery for multi-writer work, long-running or interrupted work,
+  dirty parallel workspaces, migration, integration, release, production,
+  funds or another delivery requiring formal acceptance.
+
+If work crosses lanes, re-evaluate risk and authority. Moving from Quick to
+Formal requires a fresh GoalContract, exact write scope, profiles and authority;
+never treat a Quick receipt as Formal acceptance.
+
+## Plan one execution
+
+Prepare a JSON goal contract, then run:
+
+```bash
+node "$SKILL_ROOT/scripts/runkit-contract/runkit-cli.mjs" plan \
+  --workspace "$PROJECT_ROOT" \
+  --run-id "$RUN_ID" \
+  --goal "$GOAL_JSON"
+```
+
+Use one run id on one branch only. Assign one active lease per non-overlapping write scope. Feature work may stop at `ready_for_stage_verification` with a DeliveryPacket.
+
+## Use the high-level daily lifecycle
+
+For a normal single-command verification path, compose the same atomic Core
+artifacts with three commands:
+
+```bash
+node "$SKILL_ROOT/scripts/runkit-contract/runkit-cli.mjs" start \
+  --workspace "$PROJECT_ROOT" --run-id "$RUN_ID" --goal "$GOAL_JSON" \
+  --work-item "$WORK_ITEM_ID" \
+  --owned-path "src/exact-file.ts" --owned-path "tests/feature/**"
+
+node "$SKILL_ROOT/scripts/runkit-contract/runkit-cli.mjs" verify \
+  --workspace "$PROJECT_ROOT" --run-id "$RUN_ID" \
+  --from-lease "$WORK_ITEM_ID" --verification-id "$VERIFICATION_ID" \
+  --cwd "." -- "$ABSOLUTE_EXECUTABLE" "arg-one" "arg-two"
+
+node "$SKILL_ROOT/scripts/runkit-contract/runkit-cli.mjs" finish \
+  --workspace "$PROJECT_ROOT" --run-id "$RUN_ID" --decision accepted
+```
+
+`start` rolls back a newly created execution if lease acquisition fails.
+`verify` preserves the exact argv after `--`, derives the DeliveryPacket,
+verification context, snapshot request and finalize request, and never
+finalizes a failed snapshot. The executable may have zero arguments and argv
+may contain empty strings; no shell normalization is allowed. High-level verify
+holds the control transaction through command completion, and its snapshot
+source map must match the same DeliveryPacket at finalize and accepted finish.
+`finish accepted` derives the unique Contract v0.2 active gate before releasing
+leases and closing; a persistence failure restores leases, and project-truth
+directories with symlink ancestors fail before mutation. `blocked` and
+`rejected` remain honest non-accepted closeouts. These are convenience
+composition commands, not a second truth model. The atomic commands below
+remain available for recovery and unusual workflows.
+
+## Manage leases and create delivery without hand-authored JSON
+
+Acquire one bounded writer lease with repeated explicit paths:
+
+```bash
+node "$SKILL_ROOT/scripts/runkit-contract/runkit-cli.mjs" lease acquire \
+  --workspace "$PROJECT_ROOT" \
+  --run-id "$RUN_ID" \
+  --work-item "$WORK_ITEM_ID" \
+  --owned-path "src/exact-file.ts" \
+  --owned-path "tests/feature/**"
+```
+
+Inspect or release it through the Core instead of editing lease JSON:
+
+```bash
+node "$SKILL_ROOT/scripts/runkit-contract/runkit-cli.mjs" lease inspect \
+  --workspace "$PROJECT_ROOT" --run-id "$RUN_ID"
+
+node "$SKILL_ROOT/scripts/runkit-contract/runkit-cli.mjs" lease release \
+  --workspace "$PROJECT_ROOT" --run-id "$RUN_ID" \
+  --work-item "$WORK_ITEM_ID"
+```
+
+After implementation, derive the bounded DeliveryPacket from the active lease:
+
+```bash
+node "$SKILL_ROOT/scripts/runkit-contract/runkit-cli.mjs" delivery create \
+  --workspace "$PROJECT_ROOT" \
+  --run-id "$RUN_ID" \
+  --from-lease "$WORK_ITEM_ID" \
+  --packet-id "$PACKET_ID"
+```
+
+The Core includes only changed regular files owned by that lease, reports
+unrelated dirty paths without claiming them, and fails closed on deletions,
+renames, symlinks, empty candidates, conflicting leases, or reserved runtime
+paths. These commands write only RunKit artifacts and always keep
+`authorizationGranted=false`.
+
+## Validate delivery before verification
+
+```bash
+node "$SKILL_ROOT/scripts/runkit-contract/source-fingerprint.mjs" \
+  --workspace "$PROJECT_ROOT" \
+  --packet "$DELIVERY_PACKET"
+```
+
+Exit `2` means `invalidated_by_concurrent_write`; run no verifier commands. Request a replacement packet and preserve the invalidated receipt.
+
+Select profiles with JSON on stdin:
+
+```bash
+node "$SKILL_ROOT/scripts/runkit-contract/profile-impact.mjs" < "$PROFILE_INPUT"
+```
+
+If any path is uncovered, use the declared full profile. Do not interpret an empty selection as success.
+
+## Adopt receipt-backed coverage
+
+Before reusing evidence, prepare `OwlCodaRunKitCoverageAdoptRequestV1` and run:
+
+```bash
+node "$SKILL_ROOT/scripts/runkit-contract/runkit-cli.mjs" coverage-adopt \
+  --workspace "$PROJECT_ROOT" \
+  --run-id "$RUN_ID" \
+  --request "$COVERAGE_ADOPT_REQUEST_JSON"
+```
+
+The request may select a hashed Contract v0.2 gate artifact, bind its receipt
+command ids to project profile commands, and map dependency ids to receipt
+material inputs or VerificationContext entries. It must not supply receipt
+status, source hashes, dependency hashes, context fingerprints, selected
+profiles, or exit results. The Core recomputes those facts, validates the gate
+and exact command evidence, and writes an authorization-free coverage index.
+Never hand-author reusable coverage when `coverage-adopt` is available.
+
+## Resume without rewriting history
+
+After inspecting the source execution, prepare `OwlCodaRunKitResumeRequestV1`
+and run:
+
+```bash
+node "$SKILL_ROOT/scripts/runkit-contract/runkit-cli.mjs" resume \
+  --workspace "$PROJECT_ROOT" \
+  --run-id "$SOURCE_RUN_ID" \
+  --request "$RESUME_REQUEST_JSON"
+```
+
+For an unclosed source, use `continuationRunId=null`; the source must be the
+only active execution, its engine pin must match, and no writer lease may be
+active. It must not already have a finalized receipt lineage; close such a run
+before resuming it as a continuation so `inspect` cannot mistake prior
+verification for resumed progress. For a closed source, provide a new
+continuation run id. The Core copies
+the exact parent goal bytes into the new execution and binds the parent goal,
+closeout, decision, hashes, and run ids without changing the parent.
+
+Resume coverage uses the same selectors and derivation boundary as
+`coverage-adopt`; never add receipt status, source hashes, reusable receipt ids,
+or other coverage truth to the request. After resume, follow the artifact's
+required workflow: acquire a writer lease, prepare or replace the DeliveryPacket,
+then run `verify-plan`. Do not treat inherited receipt ids as accepted or fresh
+until `verify-plan` re-derives the coverage and classifies current drift.
+`resume` always keeps `authorizationGranted=false`.
+
+## Generate the minimum verification plan
+
+After freezing a DeliveryPacket, prepare
+`OwlCodaRunKitVerifyPlanRequestV1` with the adopted coverage artifact path and
+SHA-256, then run:
+
+```bash
+node "$SKILL_ROOT/scripts/runkit-contract/runkit-cli.mjs" verify-plan \
+  --workspace "$PROJECT_ROOT" \
+  --run-id "$RUN_ID" \
+  --request "$VERIFY_PLAN_REQUEST_JSON"
+```
+
+The Core recomputes Git dirty paths, current delivery source hashes, declared
+dependency hashes, active or released lease scopes, verification context, and
+project profiles. Before any receipt is reused, it also re-derives the coverage
+index from its current gate bytes, active receipt, exact command evidence, and
+dependency selectors; a changed gate or derived mismatch fails closed. It
+distinguishes leased source drift, declared dependency drift,
+unrelated dirty-tree drift, and global gate failure. Unrelated changes remain visible but
+do not invalidate an otherwise reusable receipt; a declared global gate may
+still block acceptance. Supporting profile matches do not become selected
+profiles, and supporting-only coverage fails closed.
+
+Execute only the exact definitions in `pendingCommands`. Do not rerun
+`reusedCommandIds`. If `unmappedProfileIds` is non-empty, stop at
+`verification_mapping_required`; never infer that an empty command list means
+verified. A generated plan is project-owned evidence and always keeps
+`authorizationGranted=false`; it does not authorize executing commands, Git,
+release, credentials, deletion, or foreign writes.
+
+## Preflight model resources before model-intensive work
+
+For a model workload, first bind the remaining work to a hashed
+`OwlCodaRunKitVerificationPlanV1`, then prepare
+`OwlCodaRunKitResourcePreflightRequestV1` and run:
+
+```bash
+node "$SKILL_ROOT/scripts/runkit-contract/runkit-cli.mjs" resource-preflight \
+  --workspace "$PROJECT_ROOT" \
+  --run-id "$RUN_ID" \
+  --request "$RESOURCE_PREFLIGHT_REQUEST_JSON"
+```
+
+Each workload must name its provider/model, estimated calls, total input and
+output tokens, and elapsed time. Use `coveredByReceiptId` only when that receipt
+appears in the bound plan's `reusableReceiptIds`; the Core rejects stale or
+invented reuse. Availability, remaining calls, remaining tokens, reset time,
+and pricing are separate typed facts. Record unavailable fields as `unknown`
+with a reason; never substitute a screenshot, prose balance, guessed reset
+time, credential, or provider response that lacks a hash-bound adapter source.
+Set `maxObservationAgeMs` to the evidence lifetime the project can defend. If
+`inspect` reports the latest preflight as `expired`, refresh the adapter evidence
+and append a new preflight; do not use the previous model-readiness decision.
+
+The project policy must explicitly choose fail-open or fail-closed behavior for
+availability, quota, reset time, and pricing. A required unavailable model,
+insufficient known quota, exceeded limit, or fail-closed unknown produces
+`blocked_by_resource` and `pause_at_deterministic_stage`. A model-optional gate
+may continue without model calls, but RunKit never selects a fallback model.
+`ready_for_model_execution` is resource readiness only: it does not execute a
+model call or grant credentials, Git, release, publish, deploy, or foreign-write
+authority.
+
+## Validate receipts and gate acceptance
+
+```bash
+node "$SKILL_ROOT/scripts/runkit-contract/receipt-lineage.mjs" "$LINEAGE_JSON"
+node "$SKILL_ROOT/scripts/runkit-contract/verification-receipt-gate.mjs" "$GATE_INPUT_JSON"
+```
+
+Run one stage profile after all dependent packets are fresh. Do not repeat commands already bound by a valid receipt. A zero-command receipt may remain ready or shadow-validated, but cannot be accepted as passed.
+
+For Contract v0.2, bind the receipt to a recomputable
+`VerificationContextV1`. Shell evidence requires exact argv; automation
+evidence requires a manifest SHA-256 and output artifacts. Descriptive command
+labels are not acceptance evidence.
+
+## Capture exact verification snapshots
+
+Prepare `OwlCodaRunKitSnapshotRequestV1`, then run:
+
+```bash
+node "$SKILL_ROOT/scripts/runkit-contract/runkit-cli.mjs" snapshot \
+  --workspace "$PROJECT_ROOT" \
+  --run-id "$RUN_ID" \
+  --request "$SNAPSHOT_REQUEST_JSON"
+```
+
+The request binds the absolute executable, exact argv, cwd, tool versions,
+verification context, selected source paths, and the fixed Git status mode.
+RunKit stores stdout/stderr bytes and hashes, line counts, HEAD, source
+manifest, and before/after status while excluding `.owlcoda/runkit/**` from
+the observed project status. A target write exits `2` and preserves the
+invalidated snapshot. Raw environment values are not accepted.
+
+For `foreign_readonly`, all artifacts remain in the controller project. The
+foreign target must have identical HEAD, selected manifest, and status before
+and after the command.
+
+## Capture visual-smoke evidence
+
+Prepare `OwlCodaRunKitVisualSmokeRequestV1`, then run:
+
+```bash
+node "$SKILL_ROOT/scripts/runkit-contract/runkit-cli.mjs" visual-smoke \
+  --workspace "$PROJECT_ROOT" \
+  --run-id "$RUN_ID" \
+  --request "$VISUAL_SMOKE_REQUEST_JSON"
+```
+
+RunKit launches the exact project-supplied automation runner once. The Core
+does not embed Playwright, CDP, Electron, or Computer Use. The runner writes a
+structured result and output artifacts inside the execution evidence root;
+RunKit verifies viewport and assertion ids, console policy, denied external
+navigation, every artifact hash, and selected source stability. Raw environment
+values are not accepted. The resulting automation snapshot can be passed to
+`finalize` alongside shell snapshots.
+
+## Finalize verification evidence
+
+After every required snapshot passed and the DeliveryPacket is still fresh,
+prepare `OwlCodaRunKitFinalizeRequestV1` and run:
+
+```bash
+node "$SKILL_ROOT/scripts/runkit-contract/runkit-cli.mjs" finalize \
+  --workspace "$PROJECT_ROOT" \
+  --run-id "$RUN_ID" \
+  --request "$FINALIZE_REQUEST_JSON"
+```
+
+`finalize` runs the source gate before accepting command evidence, recomputes
+profile impact, validates output hashes and verification context, appends the
+receipt lineage, and writes the gate input/output. Stale source exits `2`
+without accepting snapshots. Do not hand-author an equivalent receipt when
+this command is available.
+
+## Close an execution
+
+Close only after consuming the current stage receipt and making an explicit controller decision:
+
+```bash
+node "$SKILL_ROOT/scripts/runkit-contract/runkit-cli.mjs" closeout \
+  --workspace "$PROJECT_ROOT" \
+  --run-id "$RUN_ID" \
+  --decision accepted \
+  --gate-input "$GATE_INPUT_JSON"
+```
+
+An accepted closeout requires a Contract v0.2 gate for the same run and at
+least one released writer lease. `rejected` and `blocked` may close without a
+passing gate so failed work still leaves durable truth.
+
+`accepted`, `rejected`, and `blocked` are record states, not Git or release actions. Never stage, commit, push, publish, deploy, delete, or write a foreign project without separate authority.
+
+## Produce ready-for-commit evidence
+
+After an accepted closeout, capture fresh project-root snapshots, prepare
+`OwlCodaRunKitReadyForCommitRequestV1`, then run:
+
+```bash
+node "$SKILL_ROOT/scripts/runkit-contract/runkit-cli.mjs" ready-for-commit \
+  --workspace "$PROJECT_ROOT" \
+  --run-id "$RUN_ID" \
+  --request "$READY_REQUEST_JSON"
+```
+
+The command revalidates the DeliveryPacket, profile impact, gate input,
+accepted closeout, released leases, and selected root manifests. It writes
+`READY_FOR_COMMIT_RECEIPT.json` with every repository action and
+`authorizationGranted` set to false. A ready receipt records state; it does
+not authorize Git.
+
+## Foreign-project shadow
+
+Use `snapshot` with `mode=foreign_readonly`. Write all artifacts and scratch in
+the controller project. Any target drift is
+`invalidated_by_target_write`, regardless of verifier success.
+
+## Templates
+
+Use files under `assets/templates/` as starting shapes. Preserve project-owned values and remove example placeholders before execution.

package/integrations/codex/skills/owlcoda-runkit/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "OwlCoda RunKit"
+  short_description: "Run receipt-backed project execution with OwlCoda"
+  default_prompt: "Use $owlcoda-runkit to initialize or operate a receipt-backed project execution."

package/integrations/codex/skills/owlcoda-runkit/assets/templates/agents-snippet.md

@@ -0,0 +1,7 @@
+## OwlCoda RunKit
+
+- Treat `.owlcoda/runkit/` as this project's execution truth, not as product source.
+- Keep one active lease per write scope and never include `.owlcoda/runkit/**` in owned source paths.
+- Do not repeat commands already covered by a valid receipt.
+- Require stage verification before accepting an execution.
+- RunKit configuration does not authorize Git, release, credentials, destructive actions, or foreign-project writes.

package/integrations/codex/skills/owlcoda-runkit/assets/templates/config.json

@@ -0,0 +1,10 @@
+{
+  "schemaVersion": "OwlCodaRunKitConfigV2",
+  "core": {
+    "contractVersion": "0.2",
+    "coreVersion": "0.12.0",
+    "coreManifestSha256": "sha256:replace-with-installed-core-manifest",
+    "coreSourceRef": "artifact:sha256:replace-with-content-addressed-source"
+  },
+  "authorizationPolicy": "external_explicit_authority_required"
+}

package/integrations/codex/skills/owlcoda-runkit/assets/templates/coverage-adopt-request.json

@@ -0,0 +1,26 @@
+{
+  "schemaVersion": "OwlCodaRunKitCoverageAdoptRequestV1",
+  "coverageId": "replace-with-coverage-id",
+  "sources": [
+    {
+      "gateInputPath": ".owlcoda/runkit/executions/replace-with-source-run/verification-receipts/replace-with-receipt/verification-gate-input.json",
+      "gateInputSha256": "replace-with-lowercase-sha256",
+      "commandBindings": [
+        {
+          "receiptCommandId": "replace-with-receipt-command-id",
+          "profileId": "replace-with-profile-id",
+          "commandId": "replace-with-profile-command-id"
+        }
+      ],
+      "dependencyBindings": [
+        {
+          "dependencyId": "root-lockfile",
+          "source": {
+            "kind": "lockfile",
+            "identity": "package-lock.json"
+          }
+        }
+      ]
+    }
+  ]
+}

package/integrations/codex/skills/owlcoda-runkit/assets/templates/execution-delivery-packet.json

@@ -0,0 +1,13 @@
+{
+  "schemaVersion": "ExecutionDeliveryPacketV1",
+  "changedFiles": {
+    "wholeFileSha256": {
+      "src/example.ts": "replace-with-64-hex-sha256"
+    }
+  },
+  "sourceFingerprint": {
+    "sha256": "replace-with-canonical-source-fingerprint"
+  },
+  "commands": [],
+  "repositoryActions": []
+}

package/integrations/codex/skills/owlcoda-runkit/assets/templates/finalize-request.json

@@ -0,0 +1,18 @@
+{
+  "schemaVersion": "OwlCodaRunKitFinalizeRequestV1",
+  "receiptId": "replace-with-stable-receipt-id",
+  "deliveryPacketPath": ".owlcoda/runkit/executions/replace-with-run-id/delivery-packets/replace-with-packet.json",
+  "verificationContext": {
+    "schemaVersion": "OwlCodaRunKitVerificationContextV1",
+    "reusePolicy": "portable",
+    "platform": null,
+    "toolchains": [],
+    "lockfiles": [],
+    "fixtures": [],
+    "services": [],
+    "environment": []
+  },
+  "snapshotPaths": [
+    ".owlcoda/runkit/executions/replace-with-run-id/snapshots/replace-with-snapshot.json"
+  ]
+}

package/integrations/codex/skills/owlcoda-runkit/assets/templates/goal-contract.json

@@ -0,0 +1,11 @@
+{
+  "schemaVersion": "OwlCodaRunKitGoalContractV1",
+  "objective": "Replace with one measurable project outcome.",
+  "nonGoals": [],
+  "authorization": {
+    "git": false,
+    "publish": false,
+    "deploy": false,
+    "destructive": false
+  }
+}

package/integrations/codex/skills/owlcoda-runkit/assets/templates/profiles.json

@@ -0,0 +1,9 @@
+{
+  "schemaVersion": "OwlCodaRunKitProfilesV1",
+  "profiles": [
+    {
+      "id": "focused",
+      "paths": ["src/**"]
+    }
+  ]
+}

package/integrations/codex/skills/owlcoda-runkit/assets/templates/ready-for-commit-request.json

@@ -0,0 +1,11 @@
+{
+  "schemaVersion": "OwlCodaRunKitReadyForCommitRequestV1",
+  "deliveryPacketPath": ".owlcoda/runkit/executions/replace-with-run-id/delivery-packets/replace-with-packet.json",
+  "verificationGateInputPath": ".owlcoda/runkit/executions/replace-with-run-id/verification-receipts/replace-with-receipt/verification-gate-input.json",
+  "roots": [
+    {
+      "role": "candidate",
+      "snapshotPath": ".owlcoda/runkit/executions/replace-with-run-id/snapshots/replace-with-root-snapshot.json"
+    }
+  ]
+}

package/integrations/codex/skills/owlcoda-runkit/assets/templates/resource-preflight-request.json

@@ -0,0 +1,56 @@
+{
+  "schemaVersion": "OwlCodaRunKitResourcePreflightRequestV1",
+  "preflightId": "resource-preflight-001",
+  "verificationPlanPath": ".owlcoda/runkit/executions/replace-run-id/verification-plans/replace-plan-id.json",
+  "verificationPlanSha256": "replace-with-lowercase-sha256",
+  "policy": {
+    "gateMode": "model_required",
+    "maxObservationAgeMs": 300000,
+    "unknownHandling": {
+      "availability": "fail_closed",
+      "quota": "fail_closed",
+      "resetTime": "fail_open",
+      "pricing": "fail_closed"
+    },
+    "limits": {
+      "maxCalls": 100,
+      "maxTotalTokens": 1000000,
+      "maxElapsedMs": 3600000,
+      "maxCostUsd": 10
+    }
+  },
+  "observations": [
+    {
+      "providerId": "replace-provider",
+      "modelId": "replace-model",
+      "adapter": {
+        "id": "owlcoda-model-resource-adapter",
+        "kind": "owlcoda_runtime",
+        "evidenceRef": "artifact:sha256:replace-with-source-reference",
+        "evidenceSha256": "replace-with-lowercase-sha256",
+        "observedAt": "2026-01-01T00:00:00.000Z"
+      },
+      "availability": {
+        "status": "unknown",
+        "reason": "adapter_has_no_verified_live_probe"
+      },
+      "quota": {
+        "remainingCalls": { "status": "unknown", "reason": "provider_not_exposed" },
+        "remainingTokens": { "status": "unknown", "reason": "provider_not_exposed" },
+        "resetAt": { "status": "unknown", "reason": "provider_not_exposed" }
+      },
+      "pricing": { "status": "unknown", "reason": "project_pricing_not_declared" }
+    }
+  ],
+  "workloads": [
+    {
+      "id": "replace-model-workload",
+      "providerId": "replace-provider",
+      "modelId": "replace-model",
+      "calls": 1,
+      "inputTokens": 0,
+      "outputTokens": 0,
+      "elapsedMs": 0
+    }
+  ]
+}

package/integrations/codex/skills/owlcoda-runkit/assets/templates/resume-request.json

@@ -0,0 +1,10 @@
+{
+  "schemaVersion": "OwlCodaRunKitResumeRequestV1",
+  "resumeId": "replace-with-resume-id",
+  "continuationRunId": "replace-with-new-run-id-or-null-for-active-source",
+  "reason": "replace-with-explicit-resume-reason",
+  "coverage": {
+    "coverageId": "replace-with-coverage-id",
+    "sources": []
+  }
+}

package/integrations/codex/skills/owlcoda-runkit/assets/templates/snapshot-request.json

@@ -0,0 +1,23 @@
+{
+  "schemaVersion": "OwlCodaRunKitSnapshotRequestV1",
+  "snapshotId": "replace-with-stable-snapshot-id",
+  "mode": "project",
+  "targetRoot": "replace-with-absolute-project-root",
+  "cwd": ".",
+  "executable": "replace-with-absolute-executable-path",
+  "argv": ["replace-with-exact-argument"],
+  "launcherVersion": "replace-with-launcher-version",
+  "toolVersions": [{ "name": "replace-with-tool-name", "version": "replace-with-tool-version" }],
+  "selectedPaths": ["replace-with-product-source-path"],
+  "statusMode": "porcelain-v1-z-untracked-all-runkit-excluded",
+  "verificationContext": {
+    "schemaVersion": "OwlCodaRunKitVerificationContextV1",
+    "reusePolicy": "portable",
+    "platform": null,
+    "toolchains": [],
+    "lockfiles": [],
+    "fixtures": [],
+    "services": [],
+    "environment": []
+  }
+}

package/integrations/codex/skills/owlcoda-runkit/assets/templates/verification-context.json

@@ -0,0 +1,15 @@
+{
+  "schemaVersion": "OwlCodaRunKitVerificationContextV1",
+  "reusePolicy": "portable",
+  "platform": null,
+  "toolchains": [
+    {
+      "name": "node",
+      "version": "replace-with-exact-version"
+    }
+  ],
+  "lockfiles": [],
+  "fixtures": [],
+  "services": [],
+  "environment": []
+}

package/integrations/codex/skills/owlcoda-runkit/assets/templates/verification-receipt.json

@@ -0,0 +1,11 @@
+{
+  "schemaVersion": "OwlCodaRunKitVerificationReceiptV2",
+  "runId": "replace-with-run-id",
+  "receiptId": "replace-with-stable-receipt-id",
+  "status": "ready_for_verification",
+  "sourceFingerprint": "replace-with-canonical-source-fingerprint",
+  "verificationContextFingerprint": "replace-with-verification-context-fingerprint",
+  "selectedProfileIds": ["focused"],
+  "commandRuns": 0,
+  "commandReceipts": []
+}