pi-oracle 0.7.12 → 0.7.13

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 ## Unreleased
 
+## 0.7.13 - 2026-06-15
+
+### Added
+- added a release-blocking ChatGPT preset proof gate (`npm run release:proof:chatgpt-presets`) so publishing requires fresh loaded-extension evidence for every canonical ChatGPT preset
+
+### Fixed
+- fixed compact ChatGPT Intelligence menu handling so selected thinking tiers that close back to `Medium`, `High`, or `Extra High` composer pills are accepted only after an intentional matching menu click instead of falling through to the removed legacy effort dropdown
+- fixed `instant_auto_switch` under the compact ChatGPT UI, where the legacy auto-switch control is absent after selecting the compact `Instant` tier
+- made ChatGPT model-configuration opening tolerate slower compact-UI hydration before reporting UI drift
+- stabilized archive creation when the compression subprocess exits before tar, so the worker terminates upstream tar immediately instead of waiting for the archive timeout
+- surfaced provider rate-limit/outage modals explicitly during ChatGPT model setup, upload, send, and response waits instead of reporting generic UI drift
+
 ## 0.7.12 - 2026-06-15
 
 ### Changed

package/README.md

@@ -382,7 +382,7 @@ npm test
 npm run verify:oracle
 ```
 
-`npm publish` is guarded by `prepublishOnly`, which runs `npm run release:check`. That release gate requires doctor-first macOS, Ubuntu, and Windows native Crabbox evidence. The required Crabbox runtime suite uses packed-install proof, not source-tree `pi -e` loading.
+`npm publish` is guarded by `prepublishOnly`, which runs `npm run release:check`. That release gate now blocks unless fresh live ChatGPT preset proof exists for every canonical preset, then requires doctor-first macOS, Ubuntu, and Windows native Crabbox evidence. The required Crabbox runtime suite uses packed-install proof, not source-tree `pi -e` loading.
 
 Use the narrowest validation workflow that proves the change:
 
@@ -391,6 +391,7 @@ Use the narrowest validation workflow that proves the change:
 | Everyday local iteration | `npm run verify:oracle` |
 | Platform-sensitive changes | `npm run smoke:platform:doctor`, then a focused `node scripts/platform-smoke.mjs run --target <target> --suite <suite>` |
 | Platform matrix proof | `npm run smoke:platform:all` |
+| ChatGPT preset release proof | `npm run release:proof:chatgpt-presets` |
 | Publish/release gate | `npm run release:check` |
 
 For macOS, Ubuntu, and Windows native package/build plus packed runtime validation, use [`docs/platform-smoke.md`](docs/platform-smoke.md). The full release gate is:
@@ -399,9 +400,19 @@ For macOS, Ubuntu, and Windows native package/build plus packed runtime validati
 npm run release:check
 ```
 
+Before a release, run live jobs through the loaded extension for every ChatGPT preset in `ORACLE_SUBMIT_PRESETS`. Each prompt must make the saved response contain exact markers `PRESET <preset> OK` and `PACKAGE pi-oracle`. After every job has completed, save the job ids/job directories in `.artifacts/chatgpt-preset-proof/latest.json`; `validatedAt` must be later than the completed jobs. Start from the checked, intentionally non-valid template:
+
+```bash
+mkdir -p .artifacts/chatgpt-preset-proof
+node scripts/oracle-chatgpt-preset-proof.mjs template > .artifacts/chatgpt-preset-proof/latest.json
+npm run release:proof:chatgpt-presets
+```
+
+The proof checker is intentionally part of `release:check`; it fails if the proof is missing, stale, tied to a different package version/git head, references jobs that completed before the current commit, or lacks actual persisted ChatGPT `.tar.zst` job state and response text for any canonical preset.
+
 The real runtime suite defaults to deterministic installed-tool execution so platform proof stays bounded. Provider/model defaults remain `zai/glm-5.2` for doctor/config and for optional model-agent debugging; override with `PI_ORACLE_REAL_TEST_PROVIDER` and `PI_ORACLE_REAL_TEST_MODEL` when needed. For inner-loop source loading only, use `npm run smoke:real:source`; it is not release proof. Set `PI_ORACLE_REAL_TEST_MODEL_AGENT=1` only when debugging the slower model-agent path. The optional second real-agent negative symlink check is opt-in via `PI_ORACLE_REAL_TEST_NEGATIVE_SYMLINK=1`; `npm run sanity:oracle` covers archive/symlink rejection by default without adding another model-agent turn to the platform release gate.
 
-For manual end-to-end local-extension smoke testing, use [`docs/ORACLE_ISOLATED_PI_VALIDATION.md`](docs/ORACLE_ISOLATED_PI_VALIDATION.md). That workflow launches isolated `pi` coding-agent sessions against this checkout and uses `instant` or `thinking_light`, as required by the project validation policy.
+For manual end-to-end local-extension smoke testing, use [`docs/ORACLE_ISOLATED_PI_VALIDATION.md`](docs/ORACLE_ISOLATED_PI_VALIDATION.md). Ordinary pre-commit smoke runs can still use `instant` or `thinking_light`, but release proof must cover every canonical ChatGPT preset through the loaded extension.
 
 ## Project map
 

package/docs/ORACLE_DESIGN.md

@@ -608,7 +608,7 @@ Live-validated after the concurrency redesign:
 
 Still to verify live after this pivot:
 
-- model-selection verification against the current ChatGPT UI under additional real-world variation
+- full ChatGPT preset release matrix evidence must be refreshed before any release; `npm run release:proof:chatgpt-presets` blocks release without one completed loaded-extension ChatGPT job for every canonical preset
 - optional richer terminal semantics for partial artifact failure (`complete_with_artifact_errors`) in more live scenarios
 
 ## Production readiness criteria
@@ -629,7 +629,7 @@ This architecture is now live-validated for the core release path:
 ### Current readiness summary
 
 Current release blockers for the validated scope:
-- none currently known
+- release is blocked until fresh loaded-extension ChatGPT preset proof passes `npm run release:proof:chatgpt-presets` for every canonical `ORACLE_SUBMIT_PRESETS` id
 
 Remaining non-blocking hardening work:
 - broaden live proof of the new lifecycle/state-machine model across more degraded paths
@@ -653,4 +653,4 @@ Recent proof points:
 - repo-owned sanity harness: `npm run sanity:oracle`
 - real installed-extension smoke source of truth: `scripts/oracle-real-smoke.mjs`; required release proof runs packed-install mode (`npm run smoke:real:packed`) and executes installed-package `oracle_submit` deterministically, with optional slower model-agent debugging via `PI_ORACLE_REAL_TEST_MODEL_AGENT=1`; source mode (`npm run smoke:real:source`) is inner-loop/debug only
 - macOS, Ubuntu, and Windows native package/build/runtime smoke source of truth: `docs/platform-smoke.md`; use `npm run verify:oracle` for everyday local iteration, `npm run smoke:platform:doctor` plus a focused target/suite run for platform-sensitive changes, `npm run smoke:platform:all` for doctor-first platform matrix evidence, and `npm run release:check` for the full local-plus-platform release gate
-- release gate: `npm run release:check`, also used by `prepublishOnly`, combines static verification and all required Crabbox platform smokes
+- release gate: `npm run release:check`, also used by `prepublishOnly`, combines static verification, fresh loaded-extension ChatGPT preset proof via `npm run release:proof:chatgpt-presets`, and all required Crabbox platform smokes

package/docs/ORACLE_ISOLATED_PI_VALIDATION.md

@@ -35,15 +35,34 @@ Do not add `https://github.com/fitchmultz/pi-oracle` to this repository's `.pi/s
 
 `oracle_submit` now preflights missing, unreadable, or unverified auth seed profiles before it creates an archive or persists a job. For archive-inspection smoke tests that intentionally run without real auth, use `oracle_preflight` for the blocker path or create a test seed only in a purpose-built fixture that includes the `.oracle-seed-generation` marker.
 
-## Preset requirement
+## Preset requirements
 
-Use either:
+For ordinary pre-commit isolated smoke tests, use either:
 
 - `instant`
 - `thinking_light`
 
 The examples below use `instant` because it is the fastest smoke-test preset.
 
+For any release, and for any change that touches ChatGPT model selection, run live loaded-extension jobs for every canonical ChatGPT preset from `ORACLE_SUBMIT_PRESETS`:
+
+- `pro_standard`
+- `pro_extended`
+- `thinking_light`
+- `thinking_standard`
+- `thinking_extended`
+- `thinking_heavy`
+- `instant`
+- `instant_auto_switch`
+
+Use prompts that make each saved response contain exact markers `PRESET <preset> OK` and `PACKAGE pi-oracle`. Save the completed job ids/job directories in `.artifacts/chatgpt-preset-proof/latest.json` only after every job completes; `validatedAt` must be later than those completed jobs. The checker reads the actual persisted `job.json`, worker log, and response files. Then run:
+
+```bash
+npm run release:proof:chatgpt-presets
+```
+
+`npm run release:check` runs that proof gate before release. This is intentional: publishing is blocked until every ChatGPT preset has fresh loaded-extension evidence.
+
 ## Prerequisites
 
 - `pi` installed locally

package/docs/platform-smoke.md

@@ -49,7 +49,8 @@ Use the narrowest workflow that proves the change. Do not run the full platform
 | Everyday local iteration | `npm run verify:oracle` | Syntax, bundle, platform-smoke invariants, type checks, oracle sanity, and package dry-run pass locally. |
 | Platform-sensitive change | `npm run smoke:platform:doctor`, then `node scripts/platform-smoke.mjs run --target <target> --suite <suite>` | Target setup is ready and the affected platform/suite works without paying for unrelated targets. |
 | Platform matrix proof | `npm run smoke:platform:all` | Doctor-first packed-install proof passes on every required target and suite. |
-| Publish/release gate | `npm run release:check` | Local verification (`verify:oracle`) passes, then the doctor-first platform matrix passes. |
+| ChatGPT preset release proof | `npm run release:proof:chatgpt-presets` | Fresh loaded-extension proof exists for every canonical ChatGPT preset. |
+| Publish/release gate | `npm run release:check` | Local verification (`verify:oracle`) passes, fresh ChatGPT preset proof exists, then the doctor-first platform matrix passes. |
 
 Platform-sensitive changes include archive behavior, process cleanup, runtime/browser profile handling, package metadata, Crabbox harness code, or anything that may differ across macOS/Linux/Windows.
 
@@ -77,7 +78,7 @@ Full release gate:
 npm run release:check
 ```
 
-`release:check` runs `verify:oracle` before `smoke:platform:all`, matching the Crabbox doctor-first release order: cheap harness checks, doctor, full matrix, then artifact review. `prepublishOnly` runs `npm run release:check`.
+`release:check` runs `verify:oracle`, then `release:proof:chatgpt-presets`, then `smoke:platform:all`, matching the release order: cheap harness checks, fresh live ChatGPT preset proof, doctor, full matrix, then artifact review. `prepublishOnly` runs `npm run release:check`.
 
 ## What `platform-build` proves
 

package/extensions/oracle/lib/archive.ts

@@ -578,11 +578,13 @@ async function writeNonWindowsTarArchiveFile(
       (code) => {
         targetCode = code;
         targetDone = true;
+        if (code !== 0 && tarCode === undefined) terminateChildren();
         finish();
       },
       (error) => {
         targetError = error instanceof Error ? error : new Error(String(error));
         targetDone = true;
+        if (tarCode === undefined) terminateChildren();
         finish();
       },
     );

package/extensions/oracle/lib/jobs.ts

@@ -4,9 +4,11 @@
 // Usage: Imported by oracle commands, tools, queue logic, poller flows, and runtime cleanup/reconciliation paths.
 // Invariants/Assumptions: Job mutations happen under per-job locks, worker identity checks defend against PID reuse, and persisted jobs remain the source of truth.
 import { createHash, randomUUID } from "node:crypto";
+import { execFileSync } from "node:child_process";
 import { existsSync, readdirSync, readFileSync, realpathSync } from "node:fs";
 import { chmod, mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { isAbsolute, join, relative as relativePath, resolve, sep } from "node:path";
+import { fileURLToPath } from "node:url";
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
 import {
   ACTIVE_ORACLE_JOB_STATUSES,
@@ -117,6 +119,14 @@ export interface OracleArtifactRecord {
   matchesUploadedArchive?: boolean;
 }
 
+export interface OracleExtensionProvenance {
+  schemaVersion: 1;
+  packageName: string;
+  packageVersion: string;
+  sourcePath: string;
+  gitHead?: string;
+}
+
 export interface OracleJob {
   id: string;
   status: OracleJobStatus;
@@ -135,6 +145,7 @@ export interface OracleJob {
   originSessionFile?: string;
   requestSource: "command" | "tool";
   selection: OracleResolvedSelection;
+  extensionProvenance?: OracleExtensionProvenance;
   followUpToJobId?: string;
   chatUrl?: string;
   conversationId?: string;
@@ -452,8 +463,8 @@ export async function cleanupJobResources(
 
 function getCleanupRetentionMs(job: OracleJob): { complete: number; failed: number } {
   return {
-    complete: job.config.cleanup?.completeJobRetentionMs ?? ORACLE_COMPLETE_JOB_RETENTION_MS,
-    failed: job.config.cleanup?.failedJobRetentionMs ?? ORACLE_FAILED_JOB_RETENTION_MS,
+    complete: job.config?.cleanup?.completeJobRetentionMs ?? ORACLE_COMPLETE_JOB_RETENTION_MS,
+    failed: job.config?.cleanup?.failedJobRetentionMs ?? ORACLE_FAILED_JOB_RETENTION_MS,
   };
 }
 
@@ -899,6 +910,39 @@ export async function cancelOracleJob(id: string, reason = "Cancelled by user"):
   });
 }
 
+function readExtensionProvenance(cwd: string): OracleExtensionProvenance {
+  const sourcePath = resolve(fileURLToPath(new URL("../../../", import.meta.url)));
+  let packageName = "pi-oracle";
+  let packageVersion = "unknown";
+  try {
+    const packageJson = JSON.parse(readFileSync(join(sourcePath, "package.json"), "utf8")) as { name?: string; version?: string };
+    packageName = packageJson.name || packageName;
+    packageVersion = packageJson.version || packageVersion;
+  } catch {
+    // Keep provenance present even when package metadata is unavailable in an
+    // unusual loader; release proof rejects unknown versions.
+  }
+
+  let gitHead: string | undefined;
+  try {
+    gitHead = execFileSync("git", ["rev-parse", "HEAD"], { cwd: sourcePath, encoding: "utf8" }).trim();
+  } catch {
+    try {
+      gitHead = execFileSync("git", ["rev-parse", "HEAD"], { cwd, encoding: "utf8" }).trim();
+    } catch {
+      gitHead = undefined;
+    }
+  }
+
+  return {
+    schemaVersion: 1,
+    packageName,
+    packageVersion,
+    sourcePath,
+    gitHead,
+  };
+}
+
 export async function createJob(
   id: string,
   input: OracleSubmitInput,
@@ -946,6 +990,7 @@ export async function createJob(
     originSessionFile: sessionFile,
     requestSource: input.requestSource,
     selection: input.selection,
+    extensionProvenance: readExtensionProvenance(cwd),
     followUpToJobId: input.followUpToJobId,
     chatUrl: input.chatUrl,
     conversationId,

package/extensions/oracle/worker/chatgpt-ui-helpers.d.mts

@@ -13,10 +13,12 @@ export declare function buildAllowedChatGptOrigins(chatUrl: string, authUrl?: st
 export declare function stripChatGptResponseChrome(value: string | undefined): string;
 export declare function matchesModelFamilyLabel(label: string | undefined, family: OracleUiModelFamily): boolean;
 export declare function matchesRequestedModelControlLabel(label: string | undefined, selection: OracleUiSelection): boolean;
+export declare function matchesCompactIntelligenceControlLabel(label: string | undefined): boolean;
 export declare function matchesCompactIntelligenceOpenerLabel(label: string | undefined): boolean;
 export declare function requestedEffortLabel(selection: OracleUiSelection): string | undefined;
 export declare function effortSelectionVisible(snapshot: string, effortLabel: string | undefined): boolean;
 export declare function thinkingChipVisible(snapshot: string): boolean;
+export declare function snapshotHasClosedCompactSelection(snapshot: string, selection: OracleUiSelection): boolean;
 export declare function snapshotHasModelConfigurationUi(snapshot: string): boolean;
 export declare function snapshotHasUsableComposerControls(snapshot: string): boolean;
 export declare function snapshotHasModelOpener(snapshot: string): boolean;

package/extensions/oracle/worker/chatgpt-ui-helpers.mjs

@@ -248,9 +248,29 @@ function hasLegacyEffortCombobox(entries) {
   });
 }
 
-function compactSelectionFromEntry(entry, _entries, _options = {}) {
-  if (entry.disabled || !COMPACT_INTELLIGENCE_CONTROL_KINDS.has(entry.kind || "")) return undefined;
-  return parseCompactIntelligenceSelection(entry.label);
+function compactSelectionFromEntry(entry, _entries, options = {}) {
+  if (entry.disabled) return undefined;
+  const kind = entry.kind || "";
+  if (COMPACT_INTELLIGENCE_CONTROL_KINDS.has(kind)) return parseCompactIntelligenceSelection(entry.label);
+  if (options.allowClosedButtons && kind === "button" && !/\bexpanded=true\b/.test(String(entry.line || ""))) {
+    return parseCompactIntelligenceSelection(entry.label);
+  }
+  return undefined;
+}
+
+export function matchesCompactIntelligenceControlLabel(label) {
+  return Boolean(parseCompactIntelligenceSelection(label));
+}
+
+export function snapshotHasClosedCompactSelection(snapshot, selection) {
+  /** @type {SnapshotEntry[]} */
+  const entries = parseSnapshotEntries(snapshot);
+  if (hasRemovableComposerModelChip(entries) || hasLegacyEffortCombobox(entries) || hasCompactIntelligenceMenuContext(entries)) return false;
+  return entries.some((entry) => {
+    if (entry.kind !== "button" || entry.disabled) return false;
+    const compactSelection = compactSelectionFromEntry(entry, entries, { allowClosedButtons: true });
+    return compactSelectionMatchesRequestedInSnapshot(snapshot, selection, compactSelection);
+  });
 }
 
 function compactSelectionMatchesRequested(selection, compactSelection) {

package/extensions/oracle/worker/run-job.mjs

@@ -23,12 +23,14 @@ import { extractArtifactLabels, FILE_LABEL_PATTERN_SOURCE, GENERIC_ARTIFACT_LABE
 import {
   buildAllowedChatGptOrigins,
   deriveAssistantCompletionSignature,
+  matchesCompactIntelligenceControlLabel,
   matchesCompactIntelligenceOpenerLabel,
   matchesModelFamilyLabel,
   matchesRequestedModelControlLabel,
   requestedEffortLabel,
   effortSelectionVisible,
   snapshotCanSafelySkipModelConfiguration,
+  snapshotHasClosedCompactSelection,
   snapshotHasModelConfigurationUi,
   snapshotHasModelOpener,
   snapshotHasUsableComposerControls,
@@ -78,6 +80,7 @@ const ARTIFACT_DOWNLOAD_TIMEOUT_MS = 90_000;
 const ARTIFACT_DOWNLOAD_MAX_ATTEMPTS = 2;
 const AGENT_BROWSER_CLOSE_TIMEOUT_MS = 10_000;
 const PROFILE_CLONE_TIMEOUT_MS = 120_000;
+const MODEL_CONFIGURATION_OPEN_TIMEOUT_MS = 45_000;
 const MODEL_CONFIGURATION_SETTLE_TIMEOUT_MS = 20_000;
 const MODEL_CONFIGURATION_SETTLE_POLL_MS = 250;
 const MODEL_CONFIGURATION_CLOSE_RETRY_MS = 1_000;
@@ -1091,15 +1094,9 @@ function classifyChatPage({ job, url, snapshot, body, probe }) {
     return { state: "challenge_blocking", message: "ChatGPT is showing a challenge/verification page" };
   }
 
-  const outagePatterns = [
-    /something went wrong/i,
-    /a network error occurred/i,
-    /an error occurred while connecting to the websocket/i,
-    /try again later/i,
-    /rate limit/i,
-  ];
-  if (outagePatterns.some((pattern) => pattern.test(text))) {
-    return { state: "transient_outage_error", message: "ChatGPT is showing a transient outage/error page" };
+  const outageText = detectProviderTransientErrorText(text);
+  if (outageText) {
+    return { state: "transient_outage_error", message: `ChatGPT is showing a transient outage/rate-limit page: ${outageText}` };
   }
 
   const allowedOrigins = buildAllowedChatGptOrigins(job.config.browser.chatUrl, job.config.browser.authUrl);
@@ -1162,8 +1159,9 @@ function classifyGrokPage({ url, snapshot, body }) {
   if (/captcha|cloudflare|verify you are human|unusual activity|suspicious activity/i.test(text)) {
     return { state: "challenge_blocking", message: "Grok is showing a challenge/verification page" };
   }
-  if (/something went wrong|network error|try again later|rate limit/i.test(text)) {
-    return { state: "transient_outage_error", message: "Grok is showing a transient outage/error page" };
+  const outageText = detectProviderTransientErrorText(text);
+  if (outageText) {
+    return { state: "transient_outage_error", message: `Grok is showing a transient outage/rate-limit page: ${outageText}` };
   }
   const onGrokOrigin = typeof url === "string" && url.startsWith("https://grok.com");
   if (onGrokOrigin && hasGrokLoginCta(text)) {
@@ -1250,6 +1248,42 @@ function detectUploadErrorText(text) {
   return patterns.find((pattern) => text.toLowerCase().includes(pattern.toLowerCase()));
 }
 
+function detectProviderTransientErrorText(text) {
+  const patterns = [
+    "Too many requests",
+    "rate limit",
+    "try again later",
+    "Something went wrong",
+    "A network error occurred",
+    "An error occurred while connecting to the websocket",
+  ];
+  return patterns.find((pattern) => text.toLowerCase().includes(pattern.toLowerCase()));
+}
+
+function detectProviderVisibleBlockerText(text) {
+  const patterns = [
+    "Too many requests",
+    "rate limit",
+  ];
+  return patterns.find((pattern) => text.toLowerCase().includes(pattern.toLowerCase()));
+}
+
+function formatProviderTransientErrorMessage(job, errorText, context) {
+  const providerLabel = isGrokJob(job) ? "Grok" : "ChatGPT";
+  return `${providerLabel} is showing a transient outage/rate-limit page${context ? ` while ${context}` : ""}: ${errorText}`;
+}
+
+function providerTransientErrorMessage(job, text, context) {
+  const errorText = detectProviderVisibleBlockerText(text);
+  if (!errorText) return "";
+  return formatProviderTransientErrorMessage(job, errorText, context);
+}
+
+function throwIfProviderTransientError(job, text, context) {
+  const message = providerTransientErrorMessage(job, text, context);
+  if (message) throw new Error(message);
+}
+
 function detectResponseFailureText(text) {
   const patterns = [
     "Message delivery timed out",
@@ -1289,6 +1323,7 @@ async function waitForUploadConfirmed(job, fileLabel, baselineCount) {
   while (Date.now() < timeoutAt) {
     await heartbeat();
     const [snapshot, body] = await Promise.all([snapshotText(job), pageText(job).catch(() => "")]);
+    throwIfProviderTransientError(job, snapshot, "uploading the archive");
 
     const errorText = detectUploadErrorText(`${snapshot}\n${body}`);
     if (errorText) {
@@ -1323,6 +1358,7 @@ async function waitForSendReady(job) {
     await heartbeat();
     const snapshot = await snapshotText(job);
     const body = await pageText(job).catch(() => "");
+    throwIfProviderTransientError(job, snapshot, "waiting for send readiness");
     const errorText = detectUploadErrorText(`${snapshot}\n${body}`);
     if (errorText) {
       throw new Error(`Upload error detected: ${errorText}`);
@@ -1366,6 +1402,7 @@ async function sendAcceptanceState(job, baselineAssistantCount) {
     urlKnown: urlResult.ok,
     assistantCount: Math.max(baselineAssistantCount, messages.length),
     stopStreaming: isGrokJob(job) ? snapshot.includes(GROK_LABELS.stop) : snapshot.includes("Stop streaming"),
+    transientErrorText: detectProviderVisibleBlockerText(snapshot) || "",
   };
 }
 
@@ -1386,6 +1423,7 @@ async function waitForSendAccepted(job, beforeSend, options = {}) {
   while (Date.now() < timeoutAt) {
     await heartbeat();
     const afterSend = await sendAcceptanceState(job, beforeSend.assistantCount || 0);
+    if (afterSend.transientErrorText) throw new Error(formatProviderTransientErrorMessage(job, afterSend.transientErrorText, "waiting for send acceptance"));
     if (providerSendAccepted(beforeSend, afterSend)) return true;
     await sleep(500);
   }
@@ -1420,12 +1458,13 @@ async function dismissProFeedbackModal(job, snapshot) {
 }
 
 async function openModelConfiguration(job) {
-  const timeoutAt = Date.now() + 15_000;
+  const timeoutAt = Date.now() + MODEL_CONFIGURATION_OPEN_TIMEOUT_MS;
   let lastSnapshot = "";
 
   while (Date.now() < timeoutAt) {
     const initialSnapshot = await snapshotText(job);
     lastSnapshot = initialSnapshot;
+    throwIfProviderTransientError(job, initialSnapshot, "opening model configuration");
     if (snapshotHasModelConfigurationUi(initialSnapshot)) return initialSnapshot;
     if (await dismissProFeedbackModal(job, initialSnapshot)) continue;
 
@@ -1438,6 +1477,7 @@ async function openModelConfiguration(job) {
       await agentBrowser(job, "wait", "800");
       const after = await snapshotText(job);
       lastSnapshot = after;
+      throwIfProviderTransientError(job, after, "opening model configuration");
       if (snapshotHasModelConfigurationUi(after)) return after;
       if (canUseOpenModelMenuForSelection(after, job.selection)) return after;
 
@@ -1451,6 +1491,7 @@ async function openModelConfiguration(job) {
         await agentBrowser(job, "wait", "1200");
         const postConfigure = await snapshotText(job);
         lastSnapshot = postConfigure;
+        throwIfProviderTransientError(job, postConfigure, "opening model configuration");
         if (snapshotHasModelConfigurationUi(postConfigure)) return postConfigure;
         if (canUseOpenModelMenuForSelection(postConfigure, job.selection)) return postConfigure;
       }
@@ -1544,22 +1585,28 @@ async function configureModel(job) {
     throw new Error(`Could not find model family control for ${job.selection.modelFamily}`);
   }
 
+  let compactSelectionVerifiedAfterClick = false;
   if (!alreadyConfiguredInUi && !familyAlreadySelectedInUi && familyEntry) {
+    const clickedCompactControl = matchesCompactIntelligenceControlLabel(familyEntry.label);
     await clickRef(job, familyEntry.ref);
     await agentBrowser(job, "wait", "800");
     familySnapshot = await snapshotText(job);
     verificationSnapshot = familySnapshot;
+    compactSelectionVerifiedAfterClick = clickedCompactControl && snapshotHasClosedCompactSelection(familySnapshot, job.selection);
+    if (compactSelectionVerifiedAfterClick) {
+      await log(`Verified compact ChatGPT selection after menu close for family=${job.selection.modelFamily} effort=${job.selection?.effort || "(none)"}`);
+    }
     const postClickControlOptions = {
       ignoreCompactTierButtons: snapshotHasCompactIntelligenceMenuControls(familySnapshot),
       ignoreCompactOnlyButtons: snapshotHasLegacyEffortCombobox(familySnapshot),
     };
     familyEntry = findEntry(familySnapshot, (candidate) => matchesRequestedModelControl(candidate, job.selection, postClickControlOptions));
-    if (!familyEntry && !snapshotStronglyMatchesRequestedModel(familySnapshot, job.selection)) {
+    if (!compactSelectionVerifiedAfterClick && !familyEntry && !snapshotStronglyMatchesRequestedModel(familySnapshot, job.selection)) {
       throw new Error(`Requested model family did not remain selected: ${job.selection.modelFamily}`);
     }
   }
 
-  if (job.selection.modelFamily === "thinking" || job.selection.modelFamily === "pro") {
+  if ((job.selection.modelFamily === "thinking" || job.selection.modelFamily === "pro") && !compactSelectionVerifiedAfterClick) {
     const effortLabel = requestedEffortLabel(job.selection);
     if (effortLabel && !effortSelectionVisible(familySnapshot, effortLabel)) {
       const opened = await openEffortDropdown(job);
@@ -1589,7 +1636,8 @@ async function configureModel(job) {
   if (job.selection.modelFamily === "instant") {
     const desiredAutoSwitchState = job.selection.autoSwitchToThinking === true;
     const currentAutoSwitchState = autoSwitchToThinkingSelectionVisible(familySnapshot);
-    const compactInstantAlreadyVerified = desiredAutoSwitchState && currentAutoSwitchState === undefined && snapshotStronglyMatchesRequestedModel(familySnapshot, job.selection);
+    const compactInstantAlreadyVerified = compactSelectionVerifiedAfterClick
+      || (desiredAutoSwitchState && currentAutoSwitchState === undefined && snapshotStronglyMatchesRequestedModel(familySnapshot, job.selection));
     if (!compactInstantAlreadyVerified && currentAutoSwitchState !== desiredAutoSwitchState && (desiredAutoSwitchState || currentAutoSwitchState === true)) {
       await clickAutoSwitchToThinkingControl(job);
       await agentBrowser(job, "wait", "400");
@@ -1598,7 +1646,7 @@ async function configureModel(job) {
     }
   }
 
-  const stronglyVerified = snapshotStronglyMatchesRequestedModel(verificationSnapshot, job.selection);
+  const stronglyVerified = compactSelectionVerifiedAfterClick || snapshotStronglyMatchesRequestedModel(verificationSnapshot, job.selection);
   if (!stronglyVerified) {
     throw new Error(`Could not verify requested model settings in configuration UI for ${job.selection.modelFamily}`);
   }
@@ -1793,6 +1841,7 @@ async function waitForChatCompletion(job, baselineAssistantCount) {
     const hasStopStreaming = isGrokJob(job) ? snapshot.includes(GROK_LABELS.stop) : snapshot.includes("Stop streaming");
     const hasRetryButton = snapshot.includes('button "Retry"');
     const copyResponseCount = isGrokJob(job) ? (snapshot.match(/button "Copy"/g) || []).length : (snapshot.match(/Copy response/g) || []).length;
+    throwIfProviderTransientError(job, snapshot, "waiting for response completion");
     const responseFailureText = detectResponseFailureText(`${snapshot}\n${body}`);
     const messages = await assistantMessages(job);
     const targetMessage = messages[baselineAssistantCount];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-oracle",
-  "version": "0.7.12",
+  "version": "0.7.13",
   "description": "ChatGPT and Grok web-oracle extension for pi with isolated browser auth, async jobs, and project-context archives.",
   "private": false,
   "license": "MIT",
@@ -36,7 +36,8 @@
     "platform-smoke.config.mjs",
     "scripts/platform-smoke.mjs",
     "scripts/platform-smoke",
-    "scripts/oracle-real-smoke.mjs"
+    "scripts/oracle-real-smoke.mjs",
+    "scripts/oracle-chatgpt-preset-proof.mjs"
   ],
   "pi": {
     "extensions": [
@@ -49,7 +50,7 @@
     "typecheck:worker-helpers": "tsc --noEmit -p tsconfig.worker-helpers.json",
     "sanity:oracle": "node scripts/oracle-sanity-runner.mjs",
     "pack:check": "npm pack --dry-run",
-    "verify:oracle": "npm run check:oracle-extension && npm run check:platform-smoke && npm run check:oracle-real-smoke && npm run typecheck && npm run typecheck:worker-helpers && npm run sanity:oracle && npm run pack:check",
+    "verify:oracle": "npm run check:oracle-extension && npm run check:platform-smoke && npm run check:oracle-real-smoke && npm run check:oracle-release-proof && npm run typecheck && npm run typecheck:worker-helpers && npm run sanity:oracle && npm run pack:check",
     "test": "npm run verify:oracle",
     "prepublishOnly": "npm run release:check",
     "check:platform-smoke": "node --check scripts/platform-smoke.mjs && node --check scripts/platform-smoke/assertions.mjs && node --check scripts/platform-smoke/artifacts.mjs && node --check scripts/platform-smoke/crabbox-runner.mjs && node --check scripts/platform-smoke/doctor.mjs && node --check scripts/platform-smoke/targets.mjs && node scripts/platform-smoke/invariants.mjs",
@@ -61,12 +62,14 @@
     "smoke:platform:windows-native": "node scripts/platform-smoke.mjs run --target windows-native",
     "smoke:real": "npm run smoke:real:packed",
     "smoke:real:doctor": "node scripts/oracle-real-smoke.mjs doctor",
-    "release:check": "npm run verify:oracle && npm run smoke:platform:all",
+    "release:check": "npm run verify:oracle && npm run release:proof:chatgpt-presets && npm run smoke:platform:all",
     "check:oracle-real-smoke": "node --check scripts/oracle-real-smoke.mjs",
+    "check:oracle-release-proof": "node --check scripts/oracle-chatgpt-preset-proof.mjs",
+    "release:proof:chatgpt-presets": "node scripts/oracle-chatgpt-preset-proof.mjs check",
     "smoke:real:packed": "node scripts/oracle-real-smoke.mjs run --mode packed",
     "smoke:real:source": "node scripts/oracle-real-smoke.mjs run --mode source",
     "sanity:oracle:platform": "node scripts/oracle-sanity-runner.mjs --mode platform",
-    "verify:oracle:platform": "npm run check:oracle-extension && npm run check:platform-smoke && npm run check:oracle-real-smoke && npm run sanity:oracle:platform && npm run pack:check"
+    "verify:oracle:platform": "npm run check:oracle-extension && npm run check:platform-smoke && npm run check:oracle-real-smoke && npm run check:oracle-release-proof && npm run sanity:oracle:platform && npm run pack:check"
   },
   "dependencies": {
     "@steipete/sweet-cookie": "^0.3.0"

package/platform-smoke.config.mjs

@@ -23,7 +23,7 @@ export default {
       commands: ["npm run smoke:platform:all"],
     },
     release: {
-      description: "Full release gate: local verification plus the doctor-first platform matrix.",
+      description: "Full release gate: local verification, fresh ChatGPT preset proof, plus the doctor-first platform matrix.",
       commands: ["npm run release:check"],
     },
   },

package/scripts/oracle-chatgpt-preset-proof.mjs

@@ -0,0 +1,352 @@
+#!/usr/bin/env node
+// Purpose: Release-blocking proof gate for live ChatGPT preset selection.
+// Responsibilities: Validate that a fresh manual/live oracle job matrix covered every canonical ChatGPT preset before publish.
+// Scope: Maintainer release safety only; the script does not submit jobs or touch provider accounts.
+// Usage: npm run release:proof:chatgpt-presets, or `node scripts/oracle-chatgpt-preset-proof.mjs template`.
+
+import { execFileSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const SCRIPT_DIR = dirname(fileURLToPath(import.meta.url));
+const REPO_ROOT = resolve(SCRIPT_DIR, "..");
+const DEFAULT_PROOF_PATH = ".artifacts/chatgpt-preset-proof/latest.json";
+const PROOF_PATH_ENV = "PI_ORACLE_CHATGPT_PRESET_PROOF";
+const JOBS_DIR_ENV = "PI_ORACLE_JOBS_DIR";
+const MAX_AGE_HOURS_ENV = "PI_ORACLE_CHATGPT_PRESET_PROOF_MAX_AGE_HOURS";
+const DEFAULT_MAX_AGE_HOURS = 72;
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const ZERO_UUID = "00000000-0000-0000-0000-000000000000";
+
+function usage() {
+  console.log(`Usage: node scripts/oracle-chatgpt-preset-proof.mjs <check|template>
+
+Commands:
+  check      Validate release-blocking live ChatGPT preset proof. Default.
+  template   Print a non-valid proof-file template for the current package version/git head.
+
+Environment:
+  ${PROOF_PATH_ENV}                 Proof JSON path (default: ${DEFAULT_PROOF_PATH})
+  ${JOBS_DIR_ENV}                            Oracle jobs root for job lookup (default also checks /tmp)
+  ${MAX_AGE_HOURS_ENV}       Freshness window in hours (default: ${DEFAULT_MAX_AGE_HOURS})
+
+Proof file contract:
+  The proof must reference live oracle job state produced by the loaded extension
+  after the current git HEAD. It must include one completed ChatGPT job per
+  canonical ORACLE_SUBMIT_PRESETS id. Shape-only proof is rejected.
+`);
+}
+
+function fail(message) {
+  console.error(message);
+  process.exitCode = 1;
+}
+
+function readJson(path) {
+  return JSON.parse(readFileSync(path, "utf8"));
+}
+
+function git(args) {
+  return execFileSync("git", args, { cwd: REPO_ROOT, encoding: "utf8" }).trim();
+}
+
+function packageMetadata() {
+  const pkg = readJson(resolve(REPO_ROOT, "package.json"));
+  return { name: pkg.name, version: pkg.version };
+}
+
+function currentGitHead() {
+  return git(["rev-parse", "HEAD"]);
+}
+
+function currentGitHeadCommittedAt() {
+  return git(["show", "-s", "--format=%cI", "HEAD"]);
+}
+
+function currentGitStatus() {
+  return git(["status", "--short"]);
+}
+
+function canonicalPresets() {
+  const configSource = readFileSync(resolve(REPO_ROOT, "extensions/oracle/lib/config.ts"), "utf8");
+  const registryMatch = configSource.match(/export const ORACLE_SUBMIT_PRESETS = \{([\s\S]*?)\n\} as const;/);
+  if (!registryMatch) throw new Error("Could not locate ORACLE_SUBMIT_PRESETS registry in extensions/oracle/lib/config.ts");
+  const entries = [...registryMatch[1].matchAll(
+    /^\s{2}([a-z0-9_]+):\s*\{\s*label:\s*"[^"]+",\s*modelFamily:\s*"([a-z]+)"\s+as const(?:,\s*effort:\s*"([a-z]+)"\s+as const)?,\s*autoSwitchToThinking:\s*(true|false)\s*\}/gm,
+  )];
+  if (entries.length === 0) throw new Error("Could not parse ORACLE_SUBMIT_PRESETS registry entries");
+  return Object.fromEntries(entries.map((match) => [match[1], {
+    modelFamily: match[2],
+    effort: match[3],
+    autoSwitchToThinking: match[4] === "true",
+  }]));
+}
+
+function canonicalPresetIds() {
+  return Object.keys(canonicalPresets());
+}
+
+function proofPath() {
+  return resolve(REPO_ROOT, process.env[PROOF_PATH_ENV] || DEFAULT_PROOF_PATH);
+}
+
+function maxAgeHours() {
+  const raw = process.env[MAX_AGE_HOURS_ENV];
+  if (!raw) return DEFAULT_MAX_AGE_HOURS;
+  const parsed = Number(raw);
+  if (!Number.isFinite(parsed) || parsed <= 0) throw new Error(`${MAX_AGE_HOURS_ENV} must be a positive number of hours`);
+  return parsed;
+}
+
+function isIsoDate(value) {
+  if (typeof value !== "string" || !value.trim()) return false;
+  const millis = Date.parse(value);
+  return Number.isFinite(millis) && new Date(millis).toISOString() === value;
+}
+
+function parseIsoMillis(value) {
+  return isIsoDate(value) ? Date.parse(value) : undefined;
+}
+
+function unique(values) {
+  return [...new Set(values.filter(Boolean))];
+}
+
+function candidateJobJsonPaths(jobId, proofJob) {
+  const paths = [];
+  if (typeof proofJob.jobJsonPath === "string" && proofJob.jobJsonPath.trim()) {
+    paths.push(resolve(REPO_ROOT, proofJob.jobJsonPath));
+  }
+  if (typeof proofJob.jobDir === "string" && proofJob.jobDir.trim()) {
+    paths.push(resolve(REPO_ROOT, proofJob.jobDir, "job.json"));
+  }
+  if (process.env[JOBS_DIR_ENV]) {
+    paths.push(resolve(process.env[JOBS_DIR_ENV], `oracle-${jobId}`, "job.json"));
+  }
+  paths.push(resolve("/tmp", `oracle-${jobId}`, "job.json"));
+  return unique(paths);
+}
+
+function loadOracleJobState(jobId, proofJob) {
+  const candidates = candidateJobJsonPaths(jobId, proofJob);
+  for (const candidate of candidates) {
+    if (!existsSync(candidate)) continue;
+    return { path: candidate, state: readJson(candidate) };
+  }
+  return { path: undefined, state: undefined, candidates };
+}
+
+function requireActualJobEvidence({ preset, canonicalPreset, proofJob, packageName, packageVersion, gitHead, gitHeadCommittedAtMs, proofValidatedAtMs, errors }) {
+  if (!proofJob || typeof proofJob !== "object" || Array.isArray(proofJob)) {
+    errors.push(`missing jobs.${preset}`);
+    return;
+  }
+  if (proofJob.preset !== preset) errors.push(`jobs.${preset}.preset must be ${preset}`);
+  if (proofJob.provider !== "chatgpt") errors.push(`jobs.${preset}.provider must be chatgpt`);
+
+  const jobId = proofJob.jobId;
+  if (typeof jobId !== "string" || !UUID_PATTERN.test(jobId) || jobId === ZERO_UUID) {
+    errors.push(`jobs.${preset}.jobId must be a real oracle UUID job id, not a placeholder`);
+    return;
+  }
+
+  const loaded = loadOracleJobState(jobId, proofJob);
+  if (!loaded.state) {
+    errors.push(`jobs.${preset} could not find actual oracle job.json for ${jobId}; checked ${loaded.candidates.join(", ")}`);
+    return;
+  }
+
+  const state = loaded.state;
+  const responsePath = typeof state.responsePath === "string" ? state.responsePath : undefined;
+  const workerLogPath = typeof state.workerLogPath === "string" ? state.workerLogPath : undefined;
+  const response = responsePath && existsSync(responsePath) ? readFileSync(responsePath, "utf8") : "";
+  const workerLog = workerLogPath && existsSync(workerLogPath) ? readFileSync(workerLogPath, "utf8") : "";
+  const completedAtMs = parseIsoMillis(state.completedAt || state.phaseAt);
+
+  if (state.id !== jobId) errors.push(`jobs.${preset} job.json id mismatch: expected ${jobId}, got ${state.id || "<missing>"}`);
+  if (state.status !== "complete") errors.push(`jobs.${preset} actual job status must be complete, got ${state.status || "<missing>"}`);
+  if (state.phase !== "complete") errors.push(`jobs.${preset} actual job phase must be complete, got ${state.phase || "<missing>"}`);
+  if (state.selection?.provider !== "chatgpt") errors.push(`jobs.${preset} actual provider must be chatgpt`);
+  if (state.selection?.preset !== preset) errors.push(`jobs.${preset} actual preset must be ${preset}, got ${state.selection?.preset || "<missing>"}`);
+  if (state.selection?.modelFamily !== canonicalPreset.modelFamily) errors.push(`jobs.${preset} actual modelFamily must be ${canonicalPreset.modelFamily}, got ${state.selection?.modelFamily || "<missing>"}`);
+  if ((state.selection?.effort || undefined) !== canonicalPreset.effort) errors.push(`jobs.${preset} actual effort must be ${canonicalPreset.effort || "<unset>"}, got ${state.selection?.effort || "<unset>"}`);
+  if (state.selection?.autoSwitchToThinking !== canonicalPreset.autoSwitchToThinking) errors.push(`jobs.${preset} actual autoSwitchToThinking must be ${canonicalPreset.autoSwitchToThinking}`);
+  if (state.cwd !== REPO_ROOT) errors.push(`jobs.${preset} actual cwd must be this repo (${REPO_ROOT}), got ${state.cwd || "<missing>"}`);
+  if (state.projectId !== REPO_ROOT) errors.push(`jobs.${preset} actual projectId must be this repo (${REPO_ROOT}), got ${state.projectId || "<missing>"}`);
+  if (state.requestSource !== "tool" && state.requestSource !== "command") errors.push(`jobs.${preset} actual requestSource must be tool or command`);
+  if (typeof state.sessionId !== "string" || !state.sessionId.trim()) errors.push(`jobs.${preset} actual job must record sessionId`);
+  if (typeof state.originSessionFile !== "string" || !existsSync(state.originSessionFile)) errors.push(`jobs.${preset} actual originSessionFile must exist`);
+  if (typeof state.promptPath !== "string" || !existsSync(state.promptPath)) errors.push(`jobs.${preset} actual promptPath must exist`);
+  if (typeof state.logsDir !== "string" || !existsSync(state.logsDir)) errors.push(`jobs.${preset} actual logsDir must exist`);
+  if (typeof state.runtimeId !== "string" || !state.runtimeId.trim()) errors.push(`jobs.${preset} actual job must record runtimeId`);
+  if (typeof state.runtimeSessionName !== "string" || !state.runtimeSessionName.trim()) errors.push(`jobs.${preset} actual job must record runtimeSessionName`);
+  if (!state.config?.browser || !state.config?.worker || !state.config?.cleanup) errors.push(`jobs.${preset} actual job must include persisted oracle config with browser, worker, and cleanup sections`);
+  const lifecycleKinds = new Set(Array.isArray(state.lifecycleEvents) ? state.lifecycleEvents.map((event) => event?.kind) : []);
+  const lifecyclePhases = new Set(Array.isArray(state.lifecycleEvents) ? state.lifecycleEvents.map((event) => event?.phase) : []);
+  if (!lifecycleKinds.has("created")) errors.push(`jobs.${preset} lifecycle events must include job creation`);
+  if (!lifecyclePhases.has("configuring_model")) errors.push(`jobs.${preset} lifecycle events must include configuring_model phase`);
+  if (!lifecyclePhases.has("complete")) errors.push(`jobs.${preset} lifecycle events must include complete phase`);
+  if (state.extensionProvenance?.schemaVersion !== 1) errors.push(`jobs.${preset} actual job must record extensionProvenance.schemaVersion=1`);
+  if (state.extensionProvenance?.packageName !== packageName) errors.push(`jobs.${preset} actual extension packageName must be ${packageName}`);
+  if (state.extensionProvenance?.packageVersion !== packageVersion) errors.push(`jobs.${preset} actual extension packageVersion must be ${packageVersion}`);
+  if (state.extensionProvenance?.gitHead !== gitHead) errors.push(`jobs.${preset} actual extension gitHead must be ${gitHead}`);
+  if (state.extensionProvenance?.sourcePath !== REPO_ROOT) errors.push(`jobs.${preset} actual extension sourcePath must be this repo (${REPO_ROOT}), got ${state.extensionProvenance?.sourcePath || "<missing>"}`);
+  if (typeof state.archivePath !== "string" || !state.archivePath.endsWith(".tar.zst")) errors.push(`jobs.${preset} actual archivePath must end with .tar.zst`);
+  if (typeof state.archiveSha256 !== "string" || !/^[0-9a-f]{64}$/i.test(state.archiveSha256)) errors.push(`jobs.${preset} actual job must record archiveSha256`);
+  if (typeof state.conversationId !== "string" || !state.conversationId.trim()) errors.push(`jobs.${preset} actual job must record conversationId`);
+  if (typeof state.chatUrl !== "string" || !state.chatUrl.startsWith("https://chatgpt.com/c/")) errors.push(`jobs.${preset} actual job must record a ChatGPT conversation URL`);
+  if (!responsePath || !existsSync(responsePath)) errors.push(`jobs.${preset} actual responsePath must exist`);
+  if (!workerLogPath || !existsSync(workerLogPath)) errors.push(`jobs.${preset} actual workerLogPath must exist`);
+  if (!response.includes(`PRESET ${preset} OK`)) errors.push(`jobs.${preset} actual response must include PRESET ${preset} OK`);
+  if (!response.includes(`PACKAGE ${packageName}`)) errors.push(`jobs.${preset} actual response must include PACKAGE ${packageName}`);
+  if (!workerLog.includes(`Configuring model family=${state.selection?.modelFamily}`) && !workerLog.includes("Model already appears configured")) {
+    errors.push(`jobs.${preset} worker log must show model configuration or an explicit already-configured skip`);
+  }
+  if (!workerLog.includes("Job completed successfully") && !workerLog.includes(`Job ${jobId} complete`)) errors.push(`jobs.${preset} worker log must show successful completion`);
+
+  if (completedAtMs === undefined) {
+    errors.push(`jobs.${preset} actual completedAt/phaseAt must be an ISO timestamp`);
+  } else {
+    if (completedAtMs <= gitHeadCommittedAtMs) errors.push(`jobs.${preset} must complete after current git HEAD commit time`);
+    if (proofValidatedAtMs !== undefined && completedAtMs > proofValidatedAtMs) errors.push(`jobs.${preset} completed after proof validatedAt`);
+    const maxAgeMs = maxAgeHours() * 60 * 60 * 1000;
+    if (Date.now() - completedAtMs > maxAgeMs) errors.push(`jobs.${preset} completedAt is older than ${maxAgeHours()} hours`);
+  }
+
+  if (typeof proofJob.conversation === "string" && proofJob.conversation.trim() && proofJob.conversation !== state.conversationId && proofJob.conversation !== state.chatUrl) {
+    errors.push(`jobs.${preset}.conversation does not match actual conversationId/chatUrl`);
+  }
+}
+
+function validateProof(proof, path) {
+  const errors = [];
+  const { name, version } = packageMetadata();
+  const gitHead = currentGitHead();
+  const gitHeadCommittedAt = currentGitHeadCommittedAt();
+  const gitHeadCommittedAtMs = Date.parse(gitHeadCommittedAt);
+  const gitStatus = currentGitStatus();
+  const presetRegistry = canonicalPresets();
+  const requiredPresets = Object.keys(presetRegistry);
+  const allowedPresets = new Set(requiredPresets);
+
+  if (gitStatus) {
+    errors.push(`working tree must be clean before release proof is accepted; current changes:\n${gitStatus}`);
+  }
+
+  if (!proof || typeof proof !== "object" || Array.isArray(proof)) {
+    errors.push("proof root must be a JSON object");
+    return errors;
+  }
+
+  if (proof.schemaVersion !== 1) errors.push("schemaVersion must be 1");
+  if (proof.packageName !== name) errors.push(`packageName must be ${name}`);
+  if (proof.packageVersion !== version) errors.push(`packageVersion must match package.json version ${version}`);
+  if (proof.gitHead !== gitHead) errors.push(`gitHead must match current HEAD ${gitHead}`);
+  if (proof.provider !== "chatgpt") errors.push('provider must be "chatgpt"');
+  if (proof.extensionUnderTest !== "loaded-extension") errors.push('extensionUnderTest must be "loaded-extension"');
+
+  let proofValidatedAtMs;
+  if (!isIsoDate(proof.validatedAt)) {
+    errors.push("validatedAt must be an ISO-8601 UTC timestamp from new Date().toISOString()");
+  } else {
+    proofValidatedAtMs = Date.parse(proof.validatedAt);
+    const ageMs = Date.now() - proofValidatedAtMs;
+    const maxAgeMs = maxAgeHours() * 60 * 60 * 1000;
+    if (ageMs < 0) errors.push("validatedAt must not be in the future");
+    if (ageMs > maxAgeMs) errors.push(`validatedAt is older than ${maxAgeHours()} hours`);
+    if (proofValidatedAtMs <= gitHeadCommittedAtMs) errors.push("validatedAt must be after current git HEAD commit time");
+  }
+
+  const jobs = proof.jobs;
+  if (!jobs || typeof jobs !== "object" || Array.isArray(jobs)) {
+    errors.push("jobs must be an object keyed by canonical preset id");
+    return errors;
+  }
+
+  for (const preset of requiredPresets) {
+    requireActualJobEvidence({
+      preset,
+      canonicalPreset: presetRegistry[preset],
+      proofJob: jobs[preset],
+      packageName: name,
+      packageVersion: version,
+      gitHead,
+      gitHeadCommittedAtMs,
+      proofValidatedAtMs,
+      errors,
+    });
+  }
+
+  for (const preset of Object.keys(jobs)) {
+    if (!allowedPresets.has(preset)) errors.push(`jobs.${preset} is not a canonical ORACLE_SUBMIT_PRESETS id`);
+  }
+
+  if (errors.length === 0) {
+    console.log(`ChatGPT preset release proof accepted: ${path}`);
+    console.log(`Validated presets: ${requiredPresets.join(", ")}`);
+  }
+
+  return errors;
+}
+
+function template() {
+  const { name, version } = packageMetadata();
+  const gitHead = currentGitHead();
+  const jobs = Object.fromEntries(canonicalPresetIds().map((preset) => [preset, {
+    preset,
+    provider: "chatgpt",
+    jobId: `replace-with-completed-${preset}-job-uuid`,
+    jobDir: `/tmp/oracle-replace-with-completed-${preset}-job-uuid`,
+    conversation: "replace-with-actual-conversation-id-or-chat-url",
+  }]));
+
+  console.log(JSON.stringify({
+    schemaVersion: 1,
+    packageName: name,
+    packageVersion: version,
+    gitHead,
+    provider: "chatgpt",
+    extensionUnderTest: "loaded-extension",
+    validatedAt: new Date().toISOString(),
+    jobs,
+  }, null, 2));
+}
+
+function main() {
+  const command = process.argv[2] || "check";
+  if (command === "--help" || command === "-h") {
+    usage();
+    return;
+  }
+  if (command === "template") {
+    template();
+    return;
+  }
+  if (command !== "check") {
+    usage();
+    fail(`Unknown command: ${command}`);
+    return;
+  }
+
+  const path = proofPath();
+  if (!existsSync(path)) {
+    fail(`Missing ChatGPT preset release proof: ${path}\n\nRun live loaded-extension oracle jobs for every canonical ChatGPT preset, then save proof JSON.\nCreate a non-valid starting template with:\n  mkdir -p .artifacts/chatgpt-preset-proof\n  node scripts/oracle-chatgpt-preset-proof.mjs template > ${DEFAULT_PROOF_PATH}\n\nThis gate is intentional: releases are blocked until every preset has fresh live proof backed by actual oracle job state.`);
+    return;
+  }
+
+  let proof;
+  try {
+    proof = readJson(path);
+  } catch (error) {
+    fail(`Could not read proof JSON at ${path}: ${error.message}`);
+    return;
+  }
+
+  const errors = validateProof(proof, path);
+  if (errors.length > 0) {
+    fail(`ChatGPT preset release proof rejected: ${path}\n- ${errors.join("\n- ")}`);
+  }
+}
+
+main();

package/scripts/platform-smoke/invariants.mjs

@@ -92,7 +92,7 @@ function testCanonicalWorkflowConfig() {
   assert.deepEqual(config.workflows?.release?.commands, ["npm run release:check"], "release workflow should use the full local-plus-platform release gate");
   assert.equal(config.requiredCrabbox?.minVersion, "0.26.0", "Crabbox baseline should match the documented provider contract");
   assert.equal(pkg.scripts["smoke:platform:all"], "npm run smoke:platform:doctor && node scripts/platform-smoke.mjs run --target macos,ubuntu,windows-native", "full platform smoke should remain doctor-first and cover all required targets");
-  assert.match(pkg.scripts["release:check"], /npm run verify:oracle && npm run smoke:platform:all/, "release check should combine local verification and full platform smoke");
+  assert.match(pkg.scripts["release:check"], /npm run verify:oracle && npm run release:proof:chatgpt-presets && npm run smoke:platform:all/, "release check should combine local verification, ChatGPT preset proof, and full platform smoke");
   const runnerSource = readFileSync(new URL("./crabbox-runner.mjs", import.meta.url), "utf8");
   assert.match(runnerSource, /PLATFORM_SMOKE_CRABBOX/, "runner should honor reusable Crabbox binary override");
   assert.match(runnerSource, /PLATFORM_SMOKE_MAC_WORK_ROOT/, "runner should honor reusable macOS work-root override");