vigiles 10.0.0 → 12.0.0

package/.claude-plugin/plugin.json

@@ -39,6 +39,15 @@
             "command": "bash ${CLAUDE_PLUGIN_ROOT}/hooks/refs-nudge.sh"
           }
         ]
+      },
+      {
+        "matcher": "Edit|Write",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash ${CLAUDE_PLUGIN_ROOT}/hooks/eval-lock-nudge.sh"
+          }
+        ]
       }
     ],
     "SessionStart": [

package/README.md

@@ -6,13 +6,16 @@
   SPINE = CONCEPT 5 (proof/demo-led). Lead with REAL, screenshotable catches on
   plugins people actually ship, THEN explain the mechanism. The proofs are not
   illustrative — every block traces to a real dogfood run captured in
-  research/dogfood/. TWO COMMUNITY catches, anonymized (a skill-description collision
-  → wrong-skill-fires (claude-flow, Triggering F), an AskUserQuestion-never-available
-  tool) — both real GRADED defects that REPRODUCE on current main. NEVER replace a
-  real catch with a fabricated one. (Proof 1 was a missing-SKILL.md/Truthfulness
-  catch, swapped 2026-06-28: its source (superpowers) is clean on current main and NO
-  reproducible dead-file-ref exists in popular OSS — those are an adopt+strengthen
-  payoff, see research/oss-audit-render-findings.md.)
+  research/dogfood/. THREE COMMUNITY catches, anonymized (2026-06-29: Proof 1 is now a
+  lethal-trifecta exfil path → Safety 80, from madappgang's `tester` shown as
+  "my-plugin" — added to pay off the new Safety-ring hero; Proof 2 a skill-description
+  collision → wrong-skill-fires (claude-flow, Triggering F); Proof 3 an
+  AskUserQuestion-never-available tool) — all real GRADED/structural defects that
+  REPRODUCE on current main. NEVER replace a real catch with a fabricated one. (The
+  earlier Proof 1 was a missing-SKILL.md/Truthfulness catch, swapped 2026-06-28: its
+  source (superpowers) is clean on current main and NO reproducible dead-file-ref
+  exists in popular OSS — those are an adopt+strengthen payoff, see
+  research/oss-audit-render-findings.md.)
 
   WHY ONLY TWO (decided 2026-06-28): the earlier Proofs 3-4 leaned on
   pr-review-toolkit's "review agents inherit all tools" as an official-plugin
@@ -45,13 +48,32 @@
   6. NO INTERNAL VOCABULARY (moat / measurement-authority / flywheel) and NO
      research/ links — name the user benefit.
   7. ASSETS: the hero vigiles-audit.png is a REAL current report (a community
-     plugin rendered as "my-plugin" to anonymize) — A 92 with four rings and an
-     inline subagent-tool-contract fix; no dialect-drift banner (HTML report is
-     terminal-banner-free by design). Re-render via headless Chromium on the React
-     report if the UI changes. (vigiles-demo.gif was removed
+     plugin rendered as "my-plugin" to anonymize) — C 72 with five rings, the
+     SAFETY ring (80) flagging a subagent holding all three lethal-trifecta legs
+     (a prompt-injection exfil path) + an inline subagent-tool-contract fix; the
+     dramatic Safety catch is the whole point of leading with this report (chose
+     the "bite" over a clean A 92 on 2026-06-29). No dialect-drift banner (HTML
+     report is terminal-banner-free by design). Re-render via headless Chromium on
+     the React report if the UI changes (recipe: copy a trifecta-bearing plugin to
+     my-plugin/, `node dist/cli.js audit my-plugin --no-json --no-serve`,
+     headless_shell `--window-size=820,1180 --force-device-scale-factor=2
+     --screenshot` on vigiles-report.html, then `rm -rf my-plugin
+     vigiles-report.html`). (vigiles-demo.gif was removed
      from Proof 1 — it rendered as a frozen half-typed terminal and was redundant
      with the code block; if a lint demo returns, it belongs in the Lint section
      with a non-frozen asset.)
+
+  READABILITY (the 2026-06-29 pass — why this reads the way it does):
+  A. ONE bold per block, on the single phrase the eye should catch. Bold
+     everywhere = bold nowhere. Link CTAs may stay bold (they're navigation).
+  B. ONE idea per sentence. No em-dash clause-chains, no stacked parentheticals.
+     If a clause needs a paren, cut it or give it its own line.
+  C. PLAIN words in every LEAD; push jargon (rings, recall/precision,
+     interceptTools, selector, deterministic) into the linked docs. A skimmer who
+     lives in Claude Code still may not know the vocabulary.
+  D. SHOW via the proofs/code blocks; don't stack adjectives ("real, popular,
+     free, model-less") on top of what the block already proves.
+  E. SELL the outcome before the mechanism; the instruments come AFTER the proofs.
 -->
 
 <p align="center">
@@ -61,7 +83,7 @@
 <h1 align="center">vigiles</h1>
 
 <p align="center">
-  <strong>The tests your AI agent harness never had.</strong>
+  <strong>The tests your agent's skills and hooks never had.</strong>
 </p>
 
 <p align="center">
@@ -72,137 +94,149 @@
 
 ---
 
-**You installed a bunch of plugins and wrote a few skills — but do they actually work?**
-A skill that never fires, two skills the agent can't tell apart, a subagent wired to
-a tool that doesn't exist — your harness fails **silently**, and you find out mid-task.
+**You installed some plugins and wrote a few skills. Do they actually work?**
+
+Your skills, hooks, and instructions are your agent's **harness** — the half you wrote
+and own, and the half nothing checks. A skill that never fires. Two skills the agent
+confuses. A subagent wired to a tool that doesn't exist. It breaks silently, and you
+find out mid-task.
 
-**It's a library with no tests.** One command runs them — no key, no config, safe on
-any repo:
+It's a library with no tests. This runs them:
 
 ```bash
 npx vigiles audit
 ```
 
-Here's what it found on real, popular plugins. ↓
+No key, no config, safe on any repo. Here's what it caught on plugins people actually
+ship. ↓
 
-## The report
+## What it caught
 
 <p align="center">
-  <img src="vigiles-audit.png" width="760" alt="vigiles audit report: an overall A (92/100) score with four category rings — Truthfulness, Triggering, Structure, Tested — and an inline fix card for a subagent declaring a tool that doesn't exist" />
+  <img src="vigiles-audit.png" width="760" alt="vigiles audit report scoring my-plugin C (72/100): five categories scored A–F — Truthfulness, Triggering, Structure, Safety, Tested — with the Safety category flagging a subagent that holds all three lethal-trifecta legs (a prompt-injection exfil path), plus an inline fix card for a subagent declaring a tool that doesn't exist" />
 </p>
 
-Four deterministic rings, **each finding's fix inline**, and a shareable HTML report.
-Like Lighthouse, `audit` is a **local report you run on your machine** — safe on any
-repo (even one wired to prod), identical on every OS. **Not a CI step** (CI uses
-`lint`). **[Audit a harness →](docs/for-plugin-authors.md)**
+**Like Google's Lighthouse, but for your agent harness.** Five categories, each scored
+A–F — Truthfulness, Triggering, Structure, Safety, Tested — with every fix shown inline.
+
+It runs locally and only reads, so it's safe on any repo and the same on every OS.
+For CI gating, use `vigiles lint` instead. **[Audit a harness →](docs/for-plugin-authors.md)**
+
+## Proof 1 — your agent can read your secrets and ship them out
+
+```text
+◑ Safety   80  (80/100)
+    └ subagent "tester" holds all three lethal-trifecta legs:
+        reads private data (Bash, Read) · takes in untrusted web content (WebFetch)
+        · can send data out (Bash, WebFetch)
+```
+
+Give one subagent all three powers and it's a **prompt-injection exfil path**: a poisoned
+web page can tell it to read your `.env` and POST it anywhere — no exploit code, just the
+tools it was handed. vigiles flags it from the tool list alone, free, no model.
+**[How the Safety check works →](docs/for-plugin-authors.md)**
 
-## Proof 1 — two skills your agent can't tell apart
+## Proof 2 — two skills your agent can't tell apart
 
 ```text
-✗ Triggering   0
-    └ 45 near-identical skill descriptions — the selector can't tell them apart,
-      so the wrong one fires  (e.g. "agent-coder" ↔ "agent-tester", 83% alike)
+✗ Triggering   0  (0/100)
+    └ 45 pairs of near-identical skill descriptions — the agent can't tell them
+      apart, so the wrong one fires  (e.g. "agent-coder" ↔ "agent-tester", 83% alike)
 ```
 
-A real, popular plugin ships **45 skill pairs** described so similarly the model
-can't reliably pick between them — so it fires the **wrong** skill. Valid markdown;
-the selector chooses by description, and near-identical text collides.
+One popular plugin ships **45 pairs of skills** with near-identical descriptions. The
+agent picks which skill to run by reading those descriptions, so when two match it
+fires the wrong one. The markdown is perfectly valid.
 **[How triggering works →](docs/measuring-skills.md)**
 
-## Proof 2 — a tool your subagent silently can't call
+## Proof 3 — a tool your subagent silently can't call
 
 ```text
 ✗ tester — Tool "AskUserQuestion" is never available to a subagent.
     → remove or correct it — it's silently dropped from the contract.
 ```
 
-A real upstream subagent declares a tool the harness **silently drops**, so it loses
-a capability it thinks it has. vigiles flags it _and_ hands you the one-line fix —
-**free, no model.** That's the difference from a markdown linter: it checks your
-harness against **reality**, not style — every file path, script, code symbol, and
-linter rule across **7 catalogs** (ESLint, Ruff, Clippy + four more), each verified
-to **exist _and_ be enabled**. **[Full guide →](docs/verifying-instruction-files.md)**
+This subagent — a helper your main agent hands a task to — declares a tool that
+doesn't exist. The harness drops it silently, so the agent loses a capability it
+thinks it has. vigiles catches it and gives you the **one-line fix**.
 
-Two real catches, both **free and model-less** — and audit ranks a whole
-marketplace the same way. **[Audit a marketplace →](docs/for-plugin-authors.md)**
+That's the whole idea — it checks your harness against reality, not style. Every path,
+script, code symbol, and linter rule, verified to exist _and_ be enabled across 7
+catalogs (ESLint, Ruff, Clippy + four more).
+**[Full guide →](docs/verifying-instruction-files.md)**
 
-> **And it grades itself: 100/100, A, all four rings green** — and CI gates every
-> commit with `lint` + `test`. We eat what we cook.
+All three catches are free and need no model — and vigiles **prevents** other whole
+classes of bug by construction (a typed spec or compiled hook just won't compile).
+**[Everything it catches and prevents →](docs/what-vigiles-catches.md)** · point `audit`
+at a whole marketplace and it ranks every plugin the same way.
+**[Audit a marketplace →](docs/for-plugin-authors.md)**
 
-## How it does it — three instruments
+## How it works
 
-`Agent = Model + Harness`[^name]. The model gets the headlines; the **harness** is the
-half you own. `audit` is the dashboard — these fix and prove what it finds.
+The model isn't yours to fix. Your harness is. `audit` shows you the problems — here's
+what fixes and proves each one, almost all of it with no model and no key.
 
 ### 🔎 Lint — your CLAUDE.md stops lying
 
-Every path, script, symbol & linter rule resolved against reality (the catches
-above). **You don't write any of it** — `npx vigiles init` **adopts your existing
-CLAUDE.md _and every skill and subagent_ into verified specs**, non-destructively
-(untouched until you `compile`; `eject` reverses). After that, plain-English asks
-edit them for you. **[How →](docs/verifying-instruction-files.md)**
+Every path, script, symbol, and rule verified against reality — the catches above.
+You don't write the checks: `npx vigiles init` turns your CLAUDE.md, skills, and
+subagents into _specs_ (same content, plus a layer vigiles can verify). Non-destructive,
+edited by your agent in plain English, undone by `eject`.
+**[How →](docs/verifying-instruction-files.md)**
 
 ### 🧪 Test — does the harness actually do its job?
 
-A hook that blocks nothing, a skill that hijacks unrelated prompts, injected context
-that never reaches the model — all pass a naive "did it run?" check. Start at the
-cheapest tier: a hook, called directly. **No model, no key:**
-
-```typescript
-import { runHook } from "vigiles/testing";
-
-const r = runHook(guard, {
-  hook_event_name: "PreToolUse",
-  tool_name: "Bash",
-  tool_input: { command: "git commit --no-verify" },
-});
-assert(r.blocked); // a red ✗ means your guard silently lets it through
-```
-
-Hooks **block** · skills **trigger** (recall _and_ precision) · subagents **finish**
-in the outcome they promised (no LLM judge) · **safety holds** — `interceptTools`
-catches a push or paid-API call as an _attempt_, so the side effect never happens.
-Almost every tier runs with **no model and no key**, on every commit.
+A hook that blocks nothing, a skill that hijacks unrelated prompts, context that never
+reaches the model — each passes a naive "did it run?" check. vigiles tests the real
+thing: hooks **block**, skills **fire**, subagents **finish what they promised**, and a
+stray `git push` is caught before it happens. No model, no key, on every commit.
 **[How testing works →](docs/harness-testing.md)**
 
 ### 📊 Eval — does a skill help, or just cost more?
 
-_"65% fewer tokens." Says who?_ vigiles A/Bs the claim on real coding tasks and reports
-the **bill**, the **target it claims to move**, and the **blast radius** (did the code
-still work?).
-
-**The eval you can actually afford:** promptfoo / DeepEval hit a metered API and bill
-**per token, every run**. vigiles answers most questions with **no model at all**, and
-runs the rest on your own **Claude Pro/Max subscription — $0 extra.**
-**[Measure a skill →](docs/measuring-skills.md)**
+_"65% fewer tokens." Says who?_ vigiles[^name] A/Bs the claim on real coding tasks and reports
+the token bill, whether it hit its target, and whether the code still works. promptfoo
+and DeepEval bill **per token, every run**; vigiles runs on your own Claude Pro/Max
+subscription. Evals run locally — a committed lock then lets **CI catch stale results with no
+model call**. **[Measure a skill →](docs/measuring-skills.md)**
 
 ## Quick start
 
-**Paste into Claude Code or Codex:**
+**1. See what's broken** — read-only, no setup:
+
+```bash
+npx vigiles audit
+```
+
+**2. Set it up** when you like what you see. Paste into Claude Code or Codex:
 
 ```text
 Set up vigiles in this repo: run `npx vigiles init` and accept the defaults. If I
 already have a CLAUDE.md or AGENTS.md, adopt it into a spec and show me which
-references are stale. Then install the dep, compile, and write + run one harness
-test for a hook or skill of mine. Don't enforce a spec-per-file or add a real-model
-eval without asking me first.
+references are stale. Then compile and write + run one harness test for a hook or
+skill of mine. Don't run a real-model eval without asking me first.
 ```
 
-Or do it yourself:
+Or run it yourself:
 
 ```bash
-npx vigiles init   # lint + test: spec + harness test + CI + plugin
+npx vigiles init   # adopts your files (non-destructive — eject reverses), adds CI,
+                   # installs the Claude Code plugin globally
 ```
 
 Interactive in a terminal, non-interactive for agents/CI (or `--yes`).
 
-**You don't hand-write any of this — your agent does.** `init` installs
-model-invocable skills, so a plain-English ask does the work:
+**Adoption is smooth: one command, then your agent does the rest.** `init` installs
+the **skills and hooks**, so a plain-English ask does the work — no specs to
+hand-write, no hooks to wire:
 
-- _"test my skills"_ → scaffolds **and runs** a trigger/behaviour test (`test-harness`)
+- _"test my skills"_ → scaffolds **and runs** a trigger/behaviour test, then commits its result so CI can check it (`test-harness`)
 - _"harden my rules"_ → upgrades prose guidance into enforced linter rules (`strengthen`)
 - _"add a rule to my CLAUDE.md"_ → edits the source and recompiles (`edit-spec`)
 
+The **hooks** keep it honest in-loop — nudging the agent to mark a reference or
+refresh a stale eval — so there are no chores to remember.
+
 <details>
 <summary>What <code>init</code> sets up</summary>
 
@@ -227,6 +261,7 @@ JS **or** TS (`*.harness.{mjs,ts}`) — run with `npx vigiles test`.
 
 ## More
 
+- **[What vigiles catches and prevents →](docs/what-vigiles-catches.md)** — the full matrix of harness problems it handles, biggest first, marked prevent / catch / measure.
 - **[CLI →](docs/cli.md)** · **[GitHub Action →](docs/github-action.md)** · the full **[lint rules matrix →](docs/verifying-instruction-files.md#the-validation-rules--the-full-matrix)** lives with the linting guide.
 - **[Skills →](docs/skills.md)** — the skills `init` installs, and how the model-invocable ones trigger.
 - **[Ship plugins? The plugin-author guide →](docs/for-plugin-authors.md)** — scan a draft, make your skills fire, rank a whole marketplace — no key.

package/action.yml

@@ -7,7 +7,11 @@ branding:
 
 inputs:
   command:
-    description: "Which vigiles command to run: 'lint' (verify references + integrity + coverage) or 'compile' (specs → markdown)."
+    description: >
+      Which vigiles command to run: 'lint' (verify references + integrity +
+      coverage), 'compile' (specs → markdown), or 'eval-check' (verify committed
+      eval locks against current inputs — the staleness gate; runs NO model, so
+      it is the CI-safe half of evals you produce locally with `vigiles eval --update`).
     required: false
     default: "lint"
   paths:
@@ -65,7 +69,14 @@ runs:
         set -euo pipefail
 
         cmd="${VIGILES_COMMAND:-lint}"
-        args=("$cmd")
+        # 'eval-check' is the CI staleness gate — it maps to the real verb
+        # `eval --check` (verify committed locks vs current inputs, NO model).
+        # Real evals run locally on a subscription (`eval --update`), never in CI.
+        if [[ "$cmd" == "eval-check" ]]; then
+          args=("eval" "--check")
+        else
+          args=("$cmd")
+        fi
 
         # paths: split on commas and whitespace into positional args.
         paths="${VIGILES_PATHS:-}"

package/dist/adapter-conformance.js

@@ -67,6 +67,12 @@ function checkAdapterConformance(adapter) {
         need(adapter.hookProtocol !== undefined, "capabilities.shellHooks is true but hookProtocol is missing");
         if (adapter.hookProtocol) {
             need(Number.isInteger(adapter.hookProtocol.blockExitCode), "hookProtocol.blockExitCode is not an integer");
+            // A shell-hook harness must declare WHICH events can inject developer
+            // context (`additionalContext`). Encoding it makes "can this harness
+            // deliver an inject hook?" a tested contract — the gap that let Codex's
+            // inject support sit unverified in prose. Empty would mean the harness
+            // can't inject context from a hook at all; every harness we support can.
+            need(adapter.hookProtocol.injectableEvents.length > 0, "hookProtocol.injectableEvents is empty — a shell-hook harness must declare the events that honor additionalContext injection (or it can't deliver an inject/nudge hook)");
             portNames.push(["hookProtocol", adapter.hookProtocol.name]);
         }
     }

package/dist/adapter-registry.d.ts

@@ -83,4 +83,24 @@ export declare function resolveHarnessSelection(opts: {
     flag?: string;
     configHarness?: string | readonly string[];
 }): HarnessSelection;
+/**
+ * The FULL adapter set a compile-time INSTALL should fan out to. Unlike
+ * `resolveHarnessSelection` (which picks ONE dialect for a single-output compile,
+ * since you emit a markdown file in one harness's format), an install writes the
+ * SAME artifact into EVERY enabled harness's native config — so a repo targeting
+ * both harnesses gets a compiled hook in `.claude/settings.json` AND
+ * `.codex/config.toml`, not just the first. Precedence mirrors the single picker:
+ *
+ *   1. `--harness=` flag → just that one (an explicit override is singular).
+ *   2. config `harness` list → ALL of them (the multi-harness fan-out).
+ *   3. no config → auto-detect → the one detected.
+ *
+ * Returns ≥1 adapter, de-duplicated by name (a config that lists a harness twice,
+ * or an alias + its canonical, collapses to one install).
+ */
+export declare function resolveHarnessAdapters(opts: {
+    root: string;
+    flag?: string;
+    configHarness?: string | readonly string[];
+}): HarnessAdapter[];
 //# sourceMappingURL=adapter-registry.d.ts.map

package/dist/adapter-registry.js

@@ -9,6 +9,7 @@ exports.adapterForInstructionFile = adapterForInstructionFile;
 exports.resolveAdapter = resolveAdapter;
 exports.normalizeHarnessList = normalizeHarnessList;
 exports.resolveHarnessSelection = resolveHarnessSelection;
+exports.resolveHarnessAdapters = resolveHarnessAdapters;
 const adapter_js_1 = require("./adapters/claude-code/adapter.js");
 const adapter_js_2 = require("./adapters/codex/adapter.js");
 /** The default adapter when detection finds no harness markers. */
@@ -127,4 +128,30 @@ function resolveHarnessSelection(opts) {
     }
     return { kind: "ok", adapter: det.adapter };
 }
+/**
+ * The FULL adapter set a compile-time INSTALL should fan out to. Unlike
+ * `resolveHarnessSelection` (which picks ONE dialect for a single-output compile,
+ * since you emit a markdown file in one harness's format), an install writes the
+ * SAME artifact into EVERY enabled harness's native config — so a repo targeting
+ * both harnesses gets a compiled hook in `.claude/settings.json` AND
+ * `.codex/config.toml`, not just the first. Precedence mirrors the single picker:
+ *
+ *   1. `--harness=` flag → just that one (an explicit override is singular).
+ *   2. config `harness` list → ALL of them (the multi-harness fan-out).
+ *   3. no config → auto-detect → the one detected.
+ *
+ * Returns ≥1 adapter, de-duplicated by name (a config that lists a harness twice,
+ * or an alias + its canonical, collapses to one install).
+ */
+function resolveHarnessAdapters(opts) {
+    const { root, flag, configHarness } = opts;
+    if (flag !== undefined && flag !== "")
+        return [resolveAdapter(root, flag)];
+    const list = normalizeHarnessList(configHarness);
+    const adapters = list.length > 0
+        ? list.map((h) => resolveAdapter(root, h))
+        : [detectAdapterResult(root).adapter];
+    const seen = new Set();
+    return adapters.filter((a) => !seen.has(a.name) && seen.add(a.name));
+}
 //# sourceMappingURL=adapter-registry.js.map

package/dist/adapters/claude-code/dialect.js

@@ -79,6 +79,21 @@ exports.claudeCodeDialect = {
         "SessionStart",
         "SessionEnd",
     ],
+    // Events where a block decision is silently ignored ENTIRELY — no veto AND no
+    // model feedback (exit 2 there writes stderr only to the user). These are the
+    // ONLY events hook-block-ineffective flags as wrong-event. PostToolUse is NOT
+    // here: its exit 2 feeds stderr back to the model (a legitimate nudge/feedback
+    // channel), so flagging it would cry wolf (e.g. vigiles's own refs-nudge.sh).
+    noEffectHookEvents: [
+        "SessionStart",
+        "SessionEnd",
+        "Notification",
+        "PreCompact",
+    ],
+    // PreToolUse is the one event whose deny needs the structured
+    // `hookSpecificOutput.permissionDecision:"deny"`; the legacy top-level
+    // `decision` field is ignored there.
+    permissionDecisionHookEvents: ["PreToolUse"],
     // Claude Code natively reads CLAUDE.md only — it does NOT auto-load AGENTS.md
     // (anthropics/claude-code#34235 is open; AGENTS.md works solely via an
     // `@AGENTS.md` import inside CLAUDE.md or a symlink). AGENTS.md is the

package/dist/adapters/claude-code/hook-protocol.js

@@ -6,5 +6,9 @@ exports.claudeCodeHookProtocol = {
     blockExitCode: 2,
     denyDecisionValues: ["block", "deny"],
     eventEnvVars: [],
+    // Events that honor `hookSpecificOutput.additionalContext` (developer-context
+    // injection). Covers vigiles's shipped inject hooks: the SessionStart lint
+    // summary and the PostToolUse refs / eval-lock nudges.
+    injectableEvents: ["SessionStart", "UserPromptSubmit", "PostToolUse"],
 };
 //# sourceMappingURL=hook-protocol.js.map

package/dist/adapters/claude-code/runtime.js

@@ -22,6 +22,18 @@ exports.claudeCodeRuntime = {
             },
         };
     },
+    /**
+     * Claude Code keys on **major.minor**: a minor/major bump is where the system
+     * prompt + tool defs actually move (0.2 → 1.0 → 2.0 → 2.1, ~quarterly), while
+     * the daily patch stream rarely changes behavior — so keying patches would
+     * churn the cache for no signal. Falls back to the trimmed raw string when no
+     * semver is found. (If a specific patch is known to matter, clear the cache or
+     * bump `CACHE_FORMAT_VERSION`.)
+     */
+    versionKey(raw) {
+        const m = /(\d+)\.(\d+)\.\d+/.exec(raw);
+        return m ? `${m[1]}.${m[2]}` : raw.trim();
+    },
 };
 /**
  * Build the spawn env that points the agent CLI at the mock model: the caller's

package/dist/adapters/codex/eval.js

@@ -195,6 +195,9 @@ exports.codexEvalDriver = {
     runner: codexEvalAgentRunner,
     parse: parseCodexEvalRun,
     runError: codexRunError,
+    // The harness identity → folded into the trigger-rate lock hash, so a report
+    // recorded on Claude Code is STALE if the eval is switched to Codex (and v.v.).
+    harness: "codex",
 };
 /**
  * Spawn real `codex exec --json` for the eval tier (real model, the user's codex

package/dist/adapters/codex/hook-protocol.d.ts

@@ -1,9 +1,17 @@
 /**
- * codexHookProtocol — EXPERIMENTAL, internal-only. Codex's hook wire protocol.
+ * codexHookProtocol — Codex's hook wire protocol.
  * Finding: it is essentially IDENTICAL to Claude Code's (exit 2 / `decision:block`
  * / `permissionDecision:deny`) — the thin `HookProtocol` port was the right call.
  * The genuine deltas are the env vars a hook receives + the TOML config format
  * (the latter lives in PluginLayout.settingsFormat, not here).
+ *
+ * Context injection (`hookSpecificOutput.additionalContext`) is ALSO shared — same
+ * shape, confirmed against the official Codex hooks docs
+ * (developers.openai.com/codex/hooks): supported on SessionStart, UserPromptSubmit,
+ * PreToolUse, PostToolUse, SubagentStart. (Earlier docs called this "deferred" —
+ * it is not.) So vigiles's PostToolUse nudges + SessionStart summary deliver on
+ * Codex unchanged. Caveats: Stop/SubagentStop/PreCompact carry no context, and
+ * Codex marks a hook run failed if it emits an unsupported field for the event.
  */
 import type { HookProtocol } from "../../core/hook-protocol.js";
 export declare const codexHookProtocol: HookProtocol;

package/dist/adapters/codex/hook-protocol.js

@@ -8,6 +8,16 @@ exports.codexHookProtocol = {
     // Codex matchers are anchored regexes (`matcher = "^Bash$"`), unlike Claude
     // Code's exact tool name / `A|B` alternation.
     matcherStyle: "regex",
+    // Events that honor `hookSpecificOutput.additionalContext` on Codex, per the
+    // official hooks docs. Includes the events vigiles's shipped hooks use
+    // (PostToolUse, SessionStart), so those nudges reach the Codex agent too.
+    injectableEvents: [
+        "SessionStart",
+        "UserPromptSubmit",
+        "PreToolUse",
+        "PostToolUse",
+        "SubagentStart",
+    ],
     eventEnvVars: [
         "session_id",
         "cwd",

package/dist/adapters/codex/runtime.js

@@ -22,6 +22,16 @@ exports.codexRuntime = {
     wireMock(baseUrl) {
         return { args: codexMockArgs(baseUrl), env: codexMockEnv() };
     },
+    /**
+     * Codex opts OUT of version partitioning (`""`). It is perpetual `0.x` where
+     * the *minor* is the patch cadence (~2 bumps/week, 134 minors in 14 months), so
+     * keying `major.minor` like Claude Code would churn the cache/lock weekly. With
+     * no stable behavior boundary in the version string, Codex relies on the dated
+     * model id + `evalApiVersion` for staleness instead. See research/cache-invalidation.md.
+     */
+    versionKey(_raw) {
+        return "";
+    },
 };
 /**
  * The PROVEN `-c` flag array that points `codex exec` at a mock served at

package/dist/adapters/opencode/runtime.js

@@ -17,5 +17,9 @@ exports.opencodeRuntime = {
             },
         };
     },
+    /** Prototype: opts out of version partitioning (like Codex). */
+    versionKey(_raw) {
+        return "";
+    },
 };
 //# sourceMappingURL=runtime.js.map

package/dist/audit-report.d.ts

@@ -77,7 +77,7 @@ export interface Adoptable {
  */
 export interface AuditReport {
     readonly meta: AuditReportMeta;
-    /** The four deterministic category rings + the weighted overall + grade. */
+    /** The five deterministic category rings + the weighted overall + grade. */
     readonly score: AuditScore;
     /** The deterministic, ranked fixes (the inline recommendations). */
     readonly recommendations: readonly Recommendation[];