repo-harness 0.16.2 → 0.17.0

package/README.es.md

@@ -8,7 +8,7 @@
 
 [![npm version](https://img.shields.io/npm/v/repo-harness.svg)](https://www.npmjs.com/package/repo-harness)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
-[![Runtime: Bun](https://img.shields.io/badge/runtime-Bun%20%E2%89%A5%201.1.35-black.svg)](https://bun.sh)
+[![Runtime: Bun](https://img.shields.io/badge/runtime-Bun%20%E2%89%A5%201.4.0-black.svg)](https://bun.sh)
 
 [English](README.md) | [简体中文](README.zh-CN.md) | [日本語](README.ja.md) | [Français](README.fr.md) | [Español](README.es.md)
 
@@ -43,7 +43,7 @@ de agente tasks-first que mantiene alineados a Claude y Codex.
 ### 1. Instalar el CLI
 
 Prerrequisitos: un Git working tree, `bash` y `bun`; `jq` es opcional. No se
-necesita Node.js — el instalador usa Bun >= 1.1.35 como runtime, instalando o
+necesita Node.js — el instalador usa Bun >= 1.4.0 como runtime, instalando o
 actualizando Bun primero si hace falta.
 
 ```bash
@@ -54,7 +54,7 @@ curl -fsSL https://raw.githubusercontent.com/Ancienttwo/repo-harness/main/instal
 irm https://raw.githubusercontent.com/Ancienttwo/repo-harness/main/install.ps1 | iex
 ```
 
-Si ya tienes Bun >= 1.1.35 en el PATH, omite el instalador de shell. Las
+Si ya tienes Bun >= 1.4.0 en el PATH, omite el instalador de shell. Las
 instalaciones de Bun gestionadas por un gestor de paquetes fallan de forma
 cerrada (fail closed) con el comando de actualización correspondiente
 (`brew upgrade bun`), en lugar de sobrescribir archivos que pertenecen a ese
@@ -467,8 +467,8 @@ repositorio adopte la misma política.
 
 ## Versión actual
 
-- Paquete npm: `repo-harness@0.16.2`
-- Sello de workflow generado: `repo-harness@0.16.2+template@0.16.2`
+- Paquete npm: `repo-harness@0.17.0`
+- Sello de workflow generado: `repo-harness@0.17.0+template@0.17.0`
 - Repositorio de GitHub: `Ancienttwo/repo-harness`
 - Notas de versión e historial: [`docs/CHANGELOG.md`](docs/CHANGELOG.md)
 

package/README.fr.md

@@ -8,7 +8,7 @@
 
 [![npm version](https://img.shields.io/npm/v/repo-harness.svg)](https://www.npmjs.com/package/repo-harness)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
-[![Runtime: Bun](https://img.shields.io/badge/runtime-Bun%20%E2%89%A5%201.1.35-black.svg)](https://bun.sh)
+[![Runtime: Bun](https://img.shields.io/badge/runtime-Bun%20%E2%89%A5%201.4.0-black.svg)](https://bun.sh)
 
 [English](README.md) | [简体中文](README.zh-CN.md) | [日本語](README.ja.md) | [Français](README.fr.md) | [Español](README.es.md)
 
@@ -43,7 +43,7 @@ d'agent tasks-first qui maintient Claude et Codex alignés.
 ### 1. Installer le CLI
 
 Prérequis : un working tree Git, `bash` et `bun` ; `jq` est optionnel. Node.js
-n'est pas nécessaire — l'installateur utilise Bun >= 1.1.35 comme runtime, en
+n'est pas nécessaire — l'installateur utilise Bun >= 1.4.0 comme runtime, en
 l'installant ou en le mettant à niveau d'abord si besoin.
 
 ```bash
@@ -54,7 +54,7 @@ curl -fsSL https://raw.githubusercontent.com/Ancienttwo/repo-harness/main/instal
 irm https://raw.githubusercontent.com/Ancienttwo/repo-harness/main/install.ps1 | iex
 ```
 
-Si Bun >= 1.1.35 est déjà sur le PATH, l'installateur shell peut être ignoré.
+Si Bun >= 1.4.0 est déjà sur le PATH, l'installateur shell peut être ignoré.
 Les installations de Bun gérées par un package manager échouent en mode
 fail-closed avec la commande de mise à niveau correspondante (`brew upgrade
 bun`), plutôt que d'écraser les fichiers appartenant au manager.
@@ -462,8 +462,8 @@ adopte la même policy.
 
 ## Release actuelle
 
-- Package npm : `repo-harness@0.16.2`
-- Generated workflow stamp : `repo-harness@0.16.2+template@0.16.2`
+- Package npm : `repo-harness@0.17.0`
+- Generated workflow stamp : `repo-harness@0.17.0+template@0.17.0`
 - Dépôt GitHub : `Ancienttwo/repo-harness`
 - Notes et historique de release : [`docs/CHANGELOG.md`](docs/CHANGELOG.md)
 

package/README.ja.md

@@ -8,7 +8,7 @@
 
 [![npm version](https://img.shields.io/npm/v/repo-harness.svg)](https://www.npmjs.com/package/repo-harness)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
-[![Runtime: Bun](https://img.shields.io/badge/runtime-Bun%20%E2%89%A5%201.1.35-black.svg)](https://bun.sh)
+[![Runtime: Bun](https://img.shields.io/badge/runtime-Bun%20%E2%89%A5%201.4.0-black.svg)](https://bun.sh)
 
 [English](README.md) | [简体中文](README.zh-CN.md) | [日本語](README.ja.md) | [Français](README.fr.md) | [Español](README.es.md)
 
@@ -42,7 +42,7 @@
 ### 1. CLI をインストールする
 
 前提条件は Git working tree、`bash`、`bun` です。`jq` は任意です。Node.js は
-不要です — installer は runtime として Bun >= 1.1.35 を使用し、必要であれば
+不要です — installer は runtime として Bun >= 1.4.0 を使用し、必要であれば
 先に Bun のインストールまたはアップグレードを行います。
 
 ```bash
@@ -53,7 +53,7 @@ curl -fsSL https://raw.githubusercontent.com/Ancienttwo/repo-harness/main/instal
 irm https://raw.githubusercontent.com/Ancienttwo/repo-harness/main/install.ps1 | iex
 ```
 
-Bun >= 1.1.35 がすでに PATH 上にある場合は、shell installer をスキップできます。
+Bun >= 1.4.0 がすでに PATH 上にある場合は、shell installer をスキップできます。
 Package manager が所有する Bun のインストールでは、manager が管理するファイルを
 上書きする代わりに、対応する upgrade コマンド(`brew upgrade bun`)を伴って
 fail closed します。
@@ -470,8 +470,8 @@ commit script や hooks に組み込まないでください。
 
 ## 現在の Release
 
-- npm package：`repo-harness@0.16.2`
-- Generated workflow stamp：`repo-harness@0.16.2+template@0.16.2`
+- npm package：`repo-harness@0.17.0`
+- Generated workflow stamp：`repo-harness@0.17.0+template@0.17.0`
 - GitHub repository：`Ancienttwo/repo-harness`
 - Release notes and history：[`docs/CHANGELOG.md`](docs/CHANGELOG.md)
 

package/README.md

@@ -8,7 +8,7 @@
 
 [![npm version](https://img.shields.io/npm/v/repo-harness.svg)](https://www.npmjs.com/package/repo-harness)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
-[![Runtime: Bun](https://img.shields.io/badge/runtime-Bun%20%E2%89%A5%201.1.35-black.svg)](https://bun.sh)
+[![Runtime: Bun](https://img.shields.io/badge/runtime-Bun%20%E2%89%A5%201.4.0-black.svg)](https://bun.sh)
 
 [English](README.md) | [简体中文](README.zh-CN.md) | [日本語](README.ja.md) | [Français](README.fr.md) | [Español](README.es.md)
 
@@ -44,7 +44,7 @@ with a tasks-first agent contract that keeps Claude and Codex aligned.
 Prerequisites: a Git working tree and `bun`; macOS/Linux also require `bash`,
 while Windows requires Git for Windows (including its Bash and `usr/bin`
 tools). `jq` is optional. No Node.js required — the installer uses Bun >=
-1.1.35 as the runtime, installing or upgrading Bun first when needed.
+1.4.0 as the runtime, installing or upgrading Bun first when needed.
 
 ```bash
 # macOS / Linux
@@ -54,7 +54,7 @@ curl -fsSL https://raw.githubusercontent.com/Ancienttwo/repo-harness/main/instal
 irm https://raw.githubusercontent.com/Ancienttwo/repo-harness/main/install.ps1 | iex
 ```
 
-With Bun >= 1.1.35 already on PATH, skip the shell installer. Package-manager-owned
+With Bun >= 1.4.0 already on PATH, skip the shell installer. Package-manager-owned
 Bun installs fail closed with the matching upgrade command (`brew upgrade bun`)
 instead of overwriting manager-owned files.
 
@@ -450,8 +450,8 @@ repo-harness commit scripts or hooks unless that repo adopts the same policy.
 
 ## Current Release
 
-- npm package: `repo-harness@0.16.2`
-- Generated workflow stamp: `repo-harness@0.16.2+template@0.16.2`
+- npm package: `repo-harness@0.17.0`
+- Generated workflow stamp: `repo-harness@0.17.0+template@0.17.0`
 - GitHub repository: `Ancienttwo/repo-harness`
 - Release notes and history: [`docs/CHANGELOG.md`](docs/CHANGELOG.md)
 

package/README.zh-CN.md

@@ -8,7 +8,7 @@
 
 [![npm version](https://img.shields.io/npm/v/repo-harness.svg)](https://www.npmjs.com/package/repo-harness)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
-[![Runtime: Bun](https://img.shields.io/badge/runtime-Bun%20%E2%89%A5%201.1.35-black.svg)](https://bun.sh)
+[![Runtime: Bun](https://img.shields.io/badge/runtime-Bun%20%E2%89%A5%201.4.0-black.svg)](https://bun.sh)
 
 [English](README.md) | [简体中文](README.zh-CN.md) | [日本語](README.ja.md) | [Français](README.fr.md) | [Español](README.es.md)
 
@@ -43,7 +43,7 @@ checks 和 review evidence 写回项目文件，让下一个 agent 会话从文
 
 前置条件：一个 Git working tree 和 `bun`；macOS/Linux 还需要 `bash`，
 Windows 则需要 Git for Windows（包括其 Bash 与 `usr/bin` 工具）。`jq`
-可选。不需要 Node.js——installer 使用 Bun >= 1.1.35 作为 runtime，需要时会
+可选。不需要 Node.js——installer 使用 Bun >= 1.4.0 作为 runtime，需要时会
 先安装或升级 Bun。
 
 ```bash
@@ -54,7 +54,7 @@ curl -fsSL https://raw.githubusercontent.com/Ancienttwo/repo-harness/main/instal
 irm https://raw.githubusercontent.com/Ancienttwo/repo-harness/main/install.ps1 | iex
 ```
 
-如果 Bun >= 1.1.35 已经在 PATH 上，可以跳过 shell installer。由包管理器
+如果 Bun >= 1.4.0 已经在 PATH 上，可以跳过 shell installer。由包管理器
 安装的 Bun 会 fail closed，并提示对应的升级命令（如 `brew upgrade bun`），
 而不是覆盖包管理器管理的文件。
 
@@ -457,8 +457,8 @@ policy。
 
 ## 当前 Release
 
-- npm package：`repo-harness@0.16.2`
-- Generated workflow stamp：`repo-harness@0.16.2+template@0.16.2`
+- npm package：`repo-harness@0.17.0`
+- Generated workflow stamp：`repo-harness@0.17.0+template@0.17.0`
 - GitHub repository：`Ancienttwo/repo-harness`
 - Release notes 和 history：[`docs/CHANGELOG.md`](docs/CHANGELOG.md)
 

package/agents/fleet/gatekeeper.md

@@ -10,7 +10,7 @@ You are the read-only acceptance and ship gate. Execution workers deliver work;
 
 - **Verdict first.** Your opening line is exactly one of `VERDICT: PASS`, `VERDICT: FAIL`, `VERDICT: BLOCKED`. PASS means every gate is clean and you state the recommended next action without performing it. FAIL means blocking findings and nothing touched. BLOCKED means a precondition prevents judgment, such as no verification command, auth failure, merge conflict, moved HEAD, or missing goal manifest.
 - **Worktree safety.** Start with `git status --short --branch -uall` and record `git rev-parse HEAD`. Modified, staged, and untracked files are user work. Never switch branch, stash, reset, clean, discard, stage, or commit them. If HEAD moves or unknown commits appear during review, stop and return BLOCKED.
-- **Acceptance gates.** Scope: every changed file traces to the stated goal. Verification: run the project's real commands and report their actual output. Hard stops include unknown identifiers, version skew, stale generated output, surprise dependencies, hardcoded secrets, and sleeps standing in for a completion signal.
+- **Acceptance gates.** Scope: every changed file traces to the stated goal. Verification: run the project's real commands and report their actual output. Hard stops include unknown identifiers, version skew, stale generated output, surprise dependencies, hardcoded secrets, sleeps standing in for a completion signal, near-duplicates of an existing canonical helper, special-case branches or one-off mode flags bolted into shared flows the goal does not cover, and pass-through wrappers or `any`/cast churn that obscure an existing contract without the goal requiring it.
 - **Decomposition is recommendation only.** Given a goal manifest, map changes to goals and propose file-granular commit or PR groups. A file entangling goals is a FAIL finding. Unmapped changes are user work and remain untouched. The orchestrator performs any approved split or ship action.
 - **Evidence before claim.** A test, CI result, or ship state counts only if checked in this turn. Before recommending merge, re-read PR and CI status; before recommending push, check local versus remote sync. Never recommend merge on red or stale evidence.
 - **FAIL returns findings, not fixes.** Each finding is `[CRITICAL|HIGH|MEDIUM] file:line — problem — concrete fix instruction — class(safe_auto|gated_auto|manual)`. You do not edit or patch through any tool.

package/assets/hooks/lib/workflow-state.sh

@@ -1857,7 +1857,7 @@ workflow_contract_allows_path() {
 }
 workflow_write_handoff() {
   local reason="${1:-session-stop}"
-  local source_plan parent_run_id bun_bin
+  local source_plan parent_run_id bun_bin helper_source recovery_view_cli
 
   # EPC-07: independent handoff/resume content assembly retired same-package
   # (Phase A/B: tasks/contracts/20260722-2246-epc-07-recovery-view-cutover.contract.md).
@@ -1871,7 +1871,21 @@ workflow_write_handoff() {
   # EPC-07's four named recovery views.
   workflow_ensure_harness_surface
   bun_bin="${REPO_HARNESS_BUN_BIN:-bun}"
-  "$bun_bin" "scripts/recovery-view-cli.ts" --reason "$reason" --quiet
+  helper_source="${REPO_HARNESS_HELPER_SOURCE_PATH:-}"
+  if [[ -n "$helper_source" ]]; then
+    if [[ ! -f "$helper_source" || "$(basename "$helper_source")" != "prepare-handoff.sh" ]]; then
+      echo "workflow_write_handoff: invalid REPO_HARNESS_HELPER_SOURCE_PATH for prepare-handoff" >&2
+      return 1
+    fi
+    recovery_view_cli="$(cd "$(dirname "$helper_source")" && pwd)/recovery-view-cli.ts"
+  else
+    recovery_view_cli="scripts/recovery-view-cli.ts"
+  fi
+  if [[ ! -f "$recovery_view_cli" ]]; then
+    echo "workflow_write_handoff: recovery materializer is missing: $recovery_view_cli" >&2
+    return 1
+  fi
+  "$bun_bin" "$recovery_view_cli" --reason "$reason" --quiet
 
   source_plan="$(get_todo_source_plan || true)"
   if [[ "$source_plan" == "(none)" ]]; then

package/assets/reference-configs/external-tooling.md

@@ -712,9 +712,9 @@ six source files before mutating any target; a missing, malformed, mismatched,
 or unmapped source makes the whole run fail closed and leaves installed files
 untouched.
 
-The installer requires Bun >= 1.1.35, matching repo-harness's package runtime
-contract and the first supported `Bun.TOML.parse` behavior for the generated
-multiline agent files.
+The installer requires Bun >= 1.4.0, matching repo-harness's package runtime
+contract and its verified subprocess environment-inheritance behavior.
+The CLI entry rejects older or unparseable Bun runtimes before command dispatch.
 The top-level Unix and Windows bootstrap installers upgrade an older detected
 Bun before installing repo-harness, rather than relying on package-engine
 metadata that older Bun releases do not enforce.

package/assets/skill-version.json

@@ -1,11 +1,11 @@
 {
-  "version": "0.16.2",
-  "templateVersion": "0.16.2",
+  "version": "0.17.0",
+  "templateVersion": "0.17.0",
   "skillName": "repo-harness",
   "contractId": "tasks-first-harness-v1",
   "compatibility": {
     "minClaudeCodeVersion": "1.0.0",
-    "minBunVersion": "1.0.0"
+    "minBunVersion": "1.4.0"
   },
   "breakingChanges": [
     {
@@ -263,6 +263,10 @@
     {
       "version": "0.16.2",
       "description": "Fixes MCP runtime issues from #204, binds MCP HTTP sessions to the startup profile with fail-closed config-flip handling, publishes the architecture queue lock owner record atomically via staged hard-link creation, requires and fail-closed-validates sandbox_mode in Codex custom-agent TOMLs with EXECUTION_BOUNDARY persona de-duplication, and adds artifact-hygiene rules (final-diff-only comments and PR text) to the global working rules and generated agent contracts"
+    },
+    {
+      "version": "0.17.0",
+      "description": "Adds the Git-backed Fleet control plane: immutable PublicationReceiptV1 identity and recovery, Lease protocol 2 reviewing/reopen/takeover lifecycle, fenced merge readiness and integration reconcile, deterministic cross-repo offers/acquire and FleetBoardSnapshotV1/watch, immutable provider feedback and task inbox delivery, GPT Pro advisory orchestration, Fleet MCP mirrors, and a Bun 1.4 runtime floor"
     }
   ],
   "generatedProjectStamp": {

package/assets/skills/repo-harness-chatgpt/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: repo-harness-chatgpt
-description: Canonical rule owner for repo-harness ChatGPT integration -- Oracle-first browser/GPT Pro consult and continuation, MCP Connector setup, MCP bridge planning handoff, and Connector invocation read-back evidence.
-when_to_use: "repo-harness-chatgpt, ChatGPT Web consult, GPT Pro consult, gptpro, browser GPT, ChatGPT MCP Connector, ChatGPT bridge, MCP read-back, GPT Pro delegate, delegate to ChatGPT, 外包给 GPT"
+description: Canonical rule owner for repo-harness ChatGPT integration -- Oracle-first browser/GPT Pro consult and continuation, advisory orchestration, MCP Connector setup, MCP bridge planning handoff, and Connector invocation read-back evidence.
+when_to_use: "repo-harness-chatgpt, ChatGPT Web consult, GPT Pro consult, GPT Pro orchestrate, gptpro, browser GPT, ChatGPT MCP Connector, ChatGPT bridge, MCP read-back, GPT Pro delegate, delegate to ChatGPT, 外包给 GPT"
 ---
 
 # repo-harness-chatgpt
@@ -15,6 +15,8 @@ mode protocol lives under `references/`.
 ## Mode Selection
 
 - First-time Oracle browser or MCP Connector configuration -> `references/setup.md`.
+- Explicit GPT Pro orchestration -> read the setup lane in
+  `references/setup.md`, then `references/orchestrate.md`.
 - Start a new local -> ChatGPT Web browser consult -> `references/consult.md`.
 - Continue, read, or clean up a saved browser session -> `references/continue.md`.
 - Verify or accept a ChatGPT MCP tool call as real evidence -> `references/read-back.md`.
@@ -27,5 +29,7 @@ mode protocol lives under `references/`.
 - Never request or handle ChatGPT passwords, 2FA codes, cookies, browser storage, or session tokens; login/captcha/SSO stop and hand back to the user.
 - Setup, consult, and bridge modes share these safety rules by reference; none shares secrets, auth state, or tokens with another mode.
 - Consult stays planning/review/critique only, never the code-edit executor; delegate is the sole approved path for code deliverables, and GPT Pro still never executes edits.
+- Orchestrate is explicit opt-in advisory planning/review; GPT Pro never owns
+  task, lease, writes, shell, or acceptance authority.
 - A missing or unreadable canonical reference fails the calling command closed; it never synthesizes replacement prose.
 - Do not enable remote CDP or an orchestrator dev runner unless the user explicitly asks and the boundary is documented.

package/assets/skills/repo-harness-chatgpt/references/orchestrate.md

@@ -0,0 +1,225 @@
+# Orchestrate Mode: GPT Pro Advisory Chief Planner and Reviewer
+
+Use this mode only after the user has explicitly enabled GPT Pro
+orchestration for the current repository and task and the orchestration lane
+in [`setup.md`](setup.md) has passed. It composes the existing ChatGPT Web
+browser consult, session read-back, and follow-up capabilities. It does not
+add a provider, runtime adapter, schema, fleet role, or second Skill.
+
+GPT Pro is an external chief planner/reviewer. Local Codex is the accountable
+coordinator and executor, including the Codex built-in browser (IAB) transport.
+Repository artifacts, the effective-state resolver, task contract, lease,
+allowed paths, real checks, and acceptance gate remain the only control-plane
+and execution authority.
+
+## Authority Boundary
+
+| Participant | May do | May not do |
+| --- | --- | --- |
+| GPT Pro Web | Read the exact context supplied to it, use the authorized GitHub Connector when visibly available, propose a plan, identify risks, and review the returned diff/evidence | Edit the local worktree, run local commands, create or change tasks, claim/release/steal a lease, widen `allowed_paths`, assert that local checks ran, or authorize commit/push/PR/merge/deploy |
+| Local Codex | Resolve state, select the remote revision, build and secret-scan the local bundle, dispatch work through the normal task/lease path, run checks, and decide acceptance | Treat GPT Pro prose or a tool-use claim as permission or as proof of a local fact |
+| GitHub Connector | Supply remote repository facts at an exact revision when its invocation is observable | Describe uncommitted local changes or replace the local repository source of truth |
+
+This is an advisory planning/review loop, not a managed `agent-fleet` role.
+Do not automatically spawn a local agent from GPT Pro's proposal. The
+`delegate.md` protocol remains the sole path for a GPT Pro-produced code
+deliverable; this mode receives advice and review only.
+
+## Readiness Gate
+
+Before opening a real conversation, verify the explicit setup checklist and
+all of the following:
+
+- the canonical Skill is projected from a durable checkout;
+- the selected browser session is signed in, visibly shows a Pro model, and
+  has no login, captcha, SSO, passkey, or workspace-picker interruption;
+- the user's GitHub Connector is selected and authorized in ChatGPT Web;
+- the target repository, ref, and exact remote commit SHA are recorded;
+- the local base commit, tracked delta, and untracked-file manifest are
+  captured separately from the remote facts;
+- the exact prompt and every local attachment pass the existing
+  `--dry-run --secret-scan` gate, and the saved prompt hash is unchanged.
+
+If any item is missing, stale, or only asserted by the model, fail closed and
+return to the setup guide. Do not switch providers, use an unbound browser
+profile,
+infer a remote fact from GitHub's default branch, or submit an unscanned
+attachment.
+
+## Evidence Binding Without a New Schema
+
+Keep these values as ordinary prompt and workflow evidence; do not invent a
+typed orchestration binding or receipt in this mode:
+
+```text
+remote.repository = <canonical owner/name>
+remote.ref        = <target branch/tag/ref>
+remote.sha        = <exact commit SHA>
+local.base        = <local base commit>
+local.delta       = <SHA-256 of the tracked-diff/untracked manifest bundle>
+git.version       = <exact stdout of `git --version`>
+conversation      = <same browser session/provider handle and URL>
+prompt            = <SHA-256 from the secret-scan receipt>
+```
+
+The untracked-file manifest identity is the SHA-256 of a canonical JSON array
+of `{path, sha256}` entries sorted by repo-relative path. Emit that manifest
+as compact UTF-8 JSON with no BOM and exactly one final LF; keep object keys in
+`path`, then `sha256`, order. The `local.delta` preimage is the exact tracked
+diff bytes followed immediately by the exact canonical manifest bytes, in that
+order: `sha256(trackedDiffBytes || manifestBytes)`. The framing adds no
+delimiter, separator, wrapper, or newline of its own; preserve each input's
+bytes exactly, including the tracked diff's own ending and the manifest's
+final LF. Reordering entries is therefore stable, while adding, removing, or
+changing an untracked file changes the identity; a tracked-diff hash alone is
+insufficient.
+
+Produce `trackedDiffBytes` from `local.base` with the following deterministic
+read-only command. Comparing a commit to the worktree includes both staged and
+unstaged changes to tracked files; untracked files are excluded here and enter
+through the manifest above. Record the exact `git --version` output alongside
+the resulting digest because Git versions can change patch rendering:
+
+```bash
+LC_ALL=C git --version
+LC_ALL=C git -c core.quotepath=false diff \
+  --binary --full-index --no-color --no-ext-diff --no-textconv \
+  --no-renames --no-indent-heuristic --diff-algorithm=myers \
+  --src-prefix=a/ --dst-prefix=b/ \
+  <local.base> --
+```
+
+Treat the command's raw stdout bytes as `trackedDiffBytes`; do not decode,
+normalize, add a delimiter, or reconstruct the diff before hashing. Pass the
+resulting tracked diff and manifest only through the existing exact
+`--dry-run --secret-scan` prompt/attachment gate.
+
+Remote GitHub facts and local worktree state are different inputs. A GitHub
+read cannot describe an uncommitted or untracked local file, and a local diff
+cannot prove that a remote SHA was read through MCP.
+
+For a branch code audit, GPT Pro must visibly invoke the GitHub Connector and
+read the pushed branch head at its exact commit SHA. A review against an
+unpublished worktree instead binds the exact remote base SHA plus the scanned
+local-delta bundle and must be labeled `local-bundle review`; it is not a
+GitHub branch audit. Never describe a branch name, model claim, or supplied
+diff alone as proof that the pushed commit was read.
+
+Classify GitHub Connector use from observable browser/tool evidence, not from
+GPT Pro's wording:
+
+- `verified`: the conversation/read-back exposes the GitHub MCP/Connector
+  invocation and the response binds the repository and exact SHA.
+- `bundle_only`: no invocation is observable, but the
+  exact remote facts were supplied in the scanned bundle. This is honest
+  context classification, not proof of GitHub MCP usage.
+- `unverified`: the invocation, repository, ref, or SHA is missing, stale, or
+  conflicts with the local record.
+
+An end-to-end GitHub-backed canary or any adoption that depends on a live
+Connector requires `verified`. `bundle_only` may be recorded for diagnosis but
+does not upgrade itself into `verified`; `unverified` blocks the round.
+
+## Protocol
+
+### 1. Prepare and send the plan turn
+
+1. Confirm the current task contract, active plan, effective state, lease, and
+   allowed paths locally. Preserve unrelated dirty worktree state.
+2. Resolve and record the exact remote repository/ref/SHA. Do not let GPT Pro
+   choose a moving branch or silently substitute another revision.
+3. Snapshot the local base, tracked diff, and untracked manifest. Render the
+   orchestration brief and attachments through the existing policy-checked
+   prompt path. Run a dry-run with `--secret-scan`, then use the exact saved
+   `prompt.md`; do not reconstruct it in the browser.
+4. Open a new conversation for this independent task. Visually record the
+   selected Pro model and wait until a conversation URL or equivalent handle
+   appears before waiting for generation. Use the existing browser consult
+   path; this mode does not create a new transport.
+5. Ask GPT Pro for an advisory plan with: proposed task slices, affected
+   paths, assumptions and evidence, risks, required local checks, and explicit
+   `blocked`/`unverified` items. Require it to distinguish GitHub Connector
+   observations from the supplied bundle.
+
+The local coordinator owns the session handle, prompt hash, remote SHA, and
+local-delta identity. GPT Pro cannot amend any of them through its response.
+
+### 2. Recheck and execute locally
+
+1. Read the saved answer only after the browser session reports a complete
+   generation and the answer is available through the managed session/read-back
+   surface. A changed message count or model self-report is not completion
+   evidence.
+2. Classify GitHub evidence as `verified`, `bundle_only`, or `unverified`.
+   Recheck the proposed paths and assumptions against the current local
+   contract and effective state. If the remote SHA or local delta changed,
+   discard the proposal and rebuild the bundle.
+3. Treat the proposal as advisory input. The local coordinator may dispatch
+   only work already authorized by the task contract and lease. It runs edits
+   and real checks locally; GPT Pro never claims those results for it.
+4. Stop closed on stale state, missing evidence, path widening, a proposed
+   commit/push/PR/deploy, or any instruction that crosses the authority table.
+
+### 3. Review the implemented result in the same conversation
+
+1. Capture the actual local diff, untracked manifest, command output, and
+   check results after implementation. Secret-scan the exact review prompt and
+   attachments again; the review bundle must identify the same remote SHA and
+   the new local-delta hash.
+2. Continue the original session with the existing follow-up command/path
+   (`browser-followup` / the Codex built-in browser's same conversation). Do
+   not open a new conversation to hide a failed continuation or silently
+   switch transports.
+3. Ask GPT Pro to review the exact result for scope, correctness risks, and
+   missing tests. Require it to mark every claim that cannot be verified from
+   the supplied diff or visible Connector evidence.
+4. Confirm the same conversation handle, visible completion state, and final
+   answer. A continuation failure, incomplete generation, or missing
+   termination/read-back evidence blocks the orchestration round.
+5. The local gatekeeper reruns the task's real checks and decides acceptance.
+   Record GPT Pro's response as review evidence only; it cannot approve the
+   task, release a lease, or override a failed gate.
+
+## Required Canary Evidence
+
+For a real Codex built-in-browser canary, retain ignored session/handoff
+evidence and promote only durable conclusions into the owning workflow review
+or notes. The evidence must make these values independently inspectable:
+
+- exact secret-scanned prompt hash and attachment outcome;
+- visible Pro model label and generation-complete state;
+- conversation URL/handle for the plan turn and same-conversation review;
+- canonical remote repository, ref, and exact SHA;
+- observable GitHub Connector invocation classification and supporting
+  read-back evidence (`verified`, `bundle_only`, or `unverified`);
+- local base commit and local-delta manifest identity;
+- actual local implementation diff and command/check output;
+- final local gatekeeper and acceptance outcome.
+
+Do not create a new JSON contract just to hold these fields. Existing session
+metadata, prompt receipts, ignored handoff artifacts, and tracked workflow
+review/notes are the evidence surfaces for this first canary.
+
+## Failure Handling
+
+Stop without inferred success when any of these occurs: setup is not explicitly
+enabled, Pro model visibility is absent, login or manual verification is
+needed, GitHub Connector selection is unavailable, the remote SHA is stale or
+unverifiable, local content changes after scanning, a secret scan fails, an
+attachment is blocked, generation is incomplete, the conversation handle is
+missing, or same-session continuation fails. Preserve the dry-run/session
+evidence and report the concrete stop reason.
+
+Never ask for passwords, 2FA codes, cookies, browser storage, session tokens,
+or GitHub credentials. Never retry through native/CDP or a different
+conversation to manufacture a passing canary. Never turn GPT Pro's plan or
+review into a task, lease, code edit, acceptance receipt, or publication
+authority.
+
+## Existing References
+
+- Setup and explicit enablement: [`setup.md`](setup.md)
+- New consult transport: [`consult.md`](consult.md)
+- Same-session follow-up and raw-evidence handling: [`continue.md`](continue.md)
+- Connector invocation read-back: [`read-back.md`](read-back.md)
+- Code-delivery delegation, if explicitly requested: [`delegate.md`](delegate.md)

package/assets/skills/repo-harness-chatgpt/references/setup.md

@@ -13,6 +13,72 @@ source.
 - ChatGPT Pro Web access is not OpenAI API quota or an API key substitute;
   never create API keys or billing projects from a ChatGPT Pro subscription.
 
+## Advisory Orchestration Enablement (Explicit Opt-In)
+
+Use this lane only after the user explicitly enables GPT Pro orchestration for
+the current repository and task. Enablement is task-scoped guidance, not a new
+install profile, managed fleet role, persistent schema, or grant of local
+write/lease/acceptance authority. Do not start an orchestration conversation
+until every prerequisite below is observable; a missing prerequisite returns
+to this guide and stops closed.
+
+1. Project the canonical Skill from a durable checkout, if it is not already
+   discoverable:
+
+   ```bash
+   repo-harness chatgpt install-skill --target both
+   ```
+
+   Use `--dry-run` first when inspecting an unfamiliar host. A projection from
+   a contract worktree is verification-only because worktree cleanup can leave
+   a dangling symlink; re-project from the durable checkout before use.
+2. Check the selected ChatGPT Web browser path (including the Codex built-in
+   browser/IAB when that is the transport) and the visible Pro model. For
+   Oracle, run:
+
+   ```bash
+   repo-harness chatgpt browser-doctor --repo <repo> --provider oracle --json
+   ```
+
+   The user must resolve sign-in, captcha, SSO, or model-plan prompts in the
+   browser. Never request credentials or switch silently to native/CDP.
+3. If the orchestration prompt needs the repo-harness ChatGPT Connector,
+   configure and verify that local server separately:
+
+   ```bash
+   repo-harness mcp setup chatgpt --repo <repo> --server-name <name>
+   repo-harness mcp doctor --repo <repo> --json
+   ```
+
+   `chatgpt.serverNameConfigured:true` and the expected server name are
+   required before starting a sidecar. This local Connector is not a substitute
+   for the user's separately authorized GitHub Connector in ChatGPT Web.
+4. In ChatGPT Web, select the user's authorized GitHub Connector for the new
+   conversation. Record the canonical repository, target ref, and exact remote
+   commit SHA that the task is allowed to use. A model claim that it used
+   GitHub MCP is not invocation evidence; the orchestration protocol classifies
+   observable use as `verified`, exact supplied context as `bundle_only`, and
+   everything else as `unverified`.
+5. Snapshot the local worktree separately from the remote facts. Include the
+   current base commit, tracked diff, and hashed untracked-file manifest only
+   through the existing policy-checked bundle path; this is the local delta
+   identity used by the review loop. Before any real submission,
+   run the exact prompt through the fail-closed secret gate:
+
+   ```bash
+   repo-harness chatgpt browser-consult \
+     --repo <repo> --provider oracle --dry-run --secret-scan \
+     --prompt "<orchestration brief>" --file <safe-context-file>
+   ```
+
+   Compare the saved `prompt.md` hash with the scan receipt; do not add an
+   unscanned attachment or paste a changed local delta into the browser.
+6. Only after the checklist passes, read `references/orchestrate.md` and start
+   the plan/review loop. If the remote SHA, local-delta hash, Connector
+   visibility, Pro model, attachment, generation completion, or conversation
+   handle cannot be verified, stop without transport fallback or inferred
+   success.
+
 ## Host Skill Projection
 
 The canonical package remains under