From 9366754bd004d4d4f981673685739ee1c04ff0cd Mon Sep 17 00:00:00 2001 From: Qwynn Marcelle Date: Wed, 12 Aug 2026 20:37:48 -0400 Subject: [PATCH 1/5] ci(meta-337): make a missing parity receipt fail instead of skipping to green MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `parity-receipt-reproduction` gated both of its substantive steps on `steps.check-receipt.outputs.has_receipt == 'true'`. On a branch with no committed receipt the two steps skipped, the job concluded `success`, and the log said "skipping reproduction check" — a green result that had reproduced nothing. That is tolerable while the job is advisory. It is not tolerable once the check is required, which META-337 intends: at that point the cheapest way to satisfy a failing parity gate is to delete the receipt, and the gate would reward it. "Missing is not green" has to hold for the gate itself, not only for the product code it inspects. Absence of the receipt is now a hard failure, and the two reproduction steps run unconditionally. The failure output names the invariant, the authority, the evidence that discharges it, and what must not be weakened to recover green, so an implementation agent can act on it without a human relay. This changes CI only. No product code, no packaging, and no adapter behavior is touched. Refs META-337. --- .github/workflows/ci.yml | 45 ++++++++++++++++++++++++++++++++-------- 1 file changed, 36 insertions(+), 9 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 44b3446..5954390 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -77,24 +77,51 @@ jobs: - name: Install dependencies run: npm ci - - name: Check for committed parity receipt - id: check-receipt + # The receipt must be present, not merely checked for. + # + # This step previously set `has_receipt=false` and let the two steps below + # skip, so a branch with no committed receipt produced a **green** job that + # had reproduced nothing. That is survivable while the job is advisory, but + # it becomes a merge-authorizing false green the moment the check is + # required: the cheapest way to satisfy a failing parity gate would be to + # delete the receipt. Absence is now a failure. + - name: Require a committed parity receipt run: | - if [ -f docs/migration/parity-receipt.json ]; then - echo "has_receipt=true" >> $GITHUB_OUTPUT - else - echo "has_receipt=false" >> $GITHUB_OUTPUT - echo "No committed parity receipt found — skipping reproduction check." + set -euo pipefail + if [ ! -f docs/migration/parity-receipt.json ]; then + echo "::error file=docs/migration/parity-receipt.json::Missing committed parity receipt" + { + echo "## parity-receipt-reproduction failed" + echo + echo "**Invariant.** The committed parity receipt at" + echo "\`docs/migration/parity-receipt.json\` is reproducible from the source" + echo "it names." + echo + echo "**Why it matters.** This job exists to prove the committed receipt is" + echo "not a stale artifact. With no receipt there is nothing to reproduce, and" + echo "a green result would assert a reproduction that never ran. Missing is" + echo "not green." + echo + echo "**Authority.** Repository CI, reported by \`github-actions\` as" + echo "\`parity-receipt-reproduction\`." + echo + echo "**Evidence required.** Either restore the committed receipt, or — if the" + echo "migration it records is genuinely retired — remove this job in the same" + echo "change that removes the receipt, so the deletion is a reviewable" + echo "decision rather than a silent loss of coverage." + echo + echo "**Do not weaken.** Do not restore the previous skip-if-absent behavior" + echo "to recover green." + } >> "$GITHUB_STEP_SUMMARY" + exit 1 fi - name: Reproduce parity receipt - if: steps.check-receipt.outputs.has_receipt == 'true' run: | TARGET_SHA=$(node -p "require('./docs/migration/parity-receipt.json').refs.targetSha") node scripts/migration/verify-clone-parity.mjs --target-ref "$TARGET_SHA" --out .parity-ci - name: Compare CI receipt against committed reference - if: steps.check-receipt.outputs.has_receipt == 'true' run: | node scripts/migration/verify-receipt.mjs \ docs/migration/parity-receipt.json \ From 4b77a337575174d5ea165726a4bd9e63cf954548 Mon Sep 17 00:00:00 2001 From: Qwynn Marcelle Date: Wed, 12 Aug 2026 20:38:41 -0400 Subject: [PATCH 2/5] =?UTF-8?q?PROOF=201/3=20(META-337=20=C2=A78):=20delet?= =?UTF-8?q?e=20the=20parity=20receipt?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit DO NOT MERGE. Bounded violation proving `parity-receipt-reproduction` now reports RED on a missing receipt. Before the fix in #15 this exact state concluded `success` by skipping. Reverted in PROOF 3/3. --- docs/migration/parity-receipt.json | 174 ----------------------------- 1 file changed, 174 deletions(-) delete mode 100644 docs/migration/parity-receipt.json diff --git a/docs/migration/parity-receipt.json b/docs/migration/parity-receipt.json deleted file mode 100644 index dff886e..0000000 --- a/docs/migration/parity-receipt.json +++ /dev/null @@ -1,174 +0,0 @@ -{ - "$comment": "META-241 Phase 1 machine parity receipt. Generated by scripts/migration/verify-clone-parity.mjs — do not hand-edit.", - "generatedAt": "2026-07-28T10:26:30.864Z", - "startedAt": "2026-07-28T10:26:03.076Z", - "refs": { - "sourceSha": "7e3f0fead990a470abc3f2647e0aeec59aafdcfc", - "targetSha": "4ea6711684bc6157468d24c7ce8a7b3227014bd6" - }, - "manifest": "docs/migration/source-manifest.json", - "toolchain": { - "node": "v22.19.0", - "npm": "10.9.8", - "vsce": "2.15.0", - "platform": "darwin/arm64" - }, - "summary": { - "total": 10, - "passed": 10, - "failed": 0, - "unsupported": 0 - }, - "verdict": "PARITY", - "intentionalDifferences": [], - "checks": [ - { - "id": "git.tree-equality", - "description": "Frozen source tree vs target tree; every diff must be narrowly declared in the manifest", - "status": "pass", - "evidence": { - "sourceSha": "7e3f0fead990a470abc3f2647e0aeec59aafdcfc", - "targetSha": "4ea6711684bc6157468d24c7ce8a7b3227014bd6", - "differingPaths": 0, - "filesCompared": 124 - }, - "violations": [], - "commands": [ - "git ls-tree -r ", - "git ls-tree -r HEAD" - ] - }, - { - "id": "pkg.pack-inventory", - "description": "npm pack --json inventory; per-file content hashes of the extracted tarballs", - "status": "pass", - "evidence": { - "sourceFiles": 28, - "targetFiles": 28, - "sourceIntegrity": "sha512-lyYVn5uYvGg52RqJCTJXj498p+3mjhL+JUB6jeyyM3r8oYXKzTVloX899OURoyqC7gFLDasY4nxn2324JYbyBA==", - "targetIntegrity": "sha512-em2qS+NYXtW4TT5NQh2PPIPD5zvATRr1fsN/mPBMd2ygW5N/E8979WaIu0NMrkPhxRzwm5XRRi2yZkW9iRZ8jw==", - "sourceSha256": "b170eaf1c3d23d059fd074178128f764f5b180e13db7942e4277cb98af7b917a", - "targetSha256": "a46a2c08265002bbb89431712653419c321eab30680a6c1666455d772ed3d23b" - }, - "violations": [], - "commands": [ - "npm pack --json (both checkouts)" - ] - }, - { - "id": "pkg.identity", - "description": "Packed manifest name/version/exports/bin/files/engines", - "status": "pass", - "evidence": { - "name": "@workspacejson/codex-mcp", - "version": "0.1.9" - }, - "violations": [], - "commands": [] - }, - { - "id": "pkg.bins", - "description": "Both bin entrypoints present, executable, and with identical dispatch behavior", - "status": "pass", - "evidence": { - "bins": [ - "codex-mcp", - "workspacejson-codex-mcp" - ] - }, - "violations": [], - "commands": [ - "node scripts/install.mjs __no_such_command__ (both checkouts)" - ] - }, - { - "id": "mcp.smoke", - "description": "MCP smoke suite against identical fixtures on both sides", - "status": "pass", - "evidence": { - "sourcePass": 41, - "sourceFail": 0, - "targetPass": 41, - "targetFail": 0 - }, - "violations": [], - "commands": [ - "node scripts/smoke.mjs (both checkouts)" - ] - }, - { - "id": "hooks.behavior", - "description": "Hook allow/deny decisions and missing/malformed failure modes on identical inputs", - "status": "pass", - "evidence": { - "cases": 5 - }, - "violations": [], - "commands": [ - "node hooks/pre-edit-check.mjs --paths ... (both checkouts, 5 cases)" - ] - }, - { - "id": "installer.assets", - "description": "Installer output and installed assets (.codex/config.toml + vendored runtime) in disposable dirs, install then uninstall", - "status": "pass", - "evidence": { - "sourceRuntimeFiles": 20, - "targetRuntimeFiles": 20, - "installExit": { - "source": 0, - "target": 0 - } - }, - "violations": [], - "commands": [ - "node scripts/install.mjs install --with-hook && uninstall (disposable dirs, both sides)" - ] - }, - { - "id": "plugin.surfaces", - "description": ".mcp.json, .codex-plugin/**, hooks/**, .agents/** presence and content", - "status": "pass", - "evidence": { - "surfaces": [ - ".mcp.json", - ".codex-plugin", - "hooks", - ".agents" - ] - }, - "violations": [], - "commands": [] - }, - { - "id": "extension.vsix", - "description": "Extension build + VSIX publisher/ID/version/commands/activationEvents/asset inventory (extracted content only; ZIP metadata never compared)", - "status": "pass", - "evidence": { - "sourceVsix": "../../../../../var/folders/sy/frt_v9rn73lbqr1l92qfjxhw0000gp/T/clone-parity-cnTKer/source/vsix/workspacejson-codex-decorations-0.1.5.vsix", - "targetVsix": "../../../../../var/folders/sy/frt_v9rn73lbqr1l92qfjxhw0000gp/T/clone-parity-cnTKer/target/vsix/workspacejson-codex-decorations-0.1.5.vsix", - "sourceVsixSha256": "5afc7af0809bf89c0ecec0a887770e83a51dd9dfb295e99cd8c4f4992d4e3f70", - "targetVsixSha256": "6e38484a25f152f595f6aa7363f862fc8f9ec5001e486a4e3c574af6df8174ae", - "sourceAssets": 30, - "targetAssets": 30 - }, - "violations": [], - "commands": [ - "npm run build:extension (both checkouts)", - "unzip + content-hash inventory (both VSIXes)" - ] - }, - { - "id": "generator.resolution", - "description": "Version-pinned generator invocation resolves identically to the frozen baseline on both sides", - "status": "pass", - "evidence": { - "resolution": "agents-audit version check passed (6 reference(s), pinned to 0.4.3)." - }, - "violations": [], - "commands": [ - "node scripts/check-generator-version.mjs (both checkouts)" - ] - } - ] -} From 4600e183cf010489653d9f24c0a459e7b1d8e2dc Mon Sep 17 00:00:00 2001 From: Qwynn Marcelle Date: Wed, 12 Aug 2026 20:40:08 -0400 Subject: [PATCH 3/5] =?UTF-8?q?PROOF=202/3=20(META-337=20=C2=A78):=20resto?= =?UTF-8?q?re=20the=20receipt,=20drop=20.mcp.json=20from=20files[]?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit DO NOT MERGE. Restores the parity receipt (expect `parity-receipt-reproduction` back to GREEN) and removes `.mcp.json` from the published `files` array, which is a real packaging-truth regression the consumption harness owns (expect `standard-candidate-consumption` RED). Reverted in PROOF 3/3. --- docs/migration/parity-receipt.json | 174 +++++++++++++++++++++++++++++ package.json | 10 +- 2 files changed, 183 insertions(+), 1 deletion(-) create mode 100644 docs/migration/parity-receipt.json diff --git a/docs/migration/parity-receipt.json b/docs/migration/parity-receipt.json new file mode 100644 index 0000000..dff886e --- /dev/null +++ b/docs/migration/parity-receipt.json @@ -0,0 +1,174 @@ +{ + "$comment": "META-241 Phase 1 machine parity receipt. Generated by scripts/migration/verify-clone-parity.mjs — do not hand-edit.", + "generatedAt": "2026-07-28T10:26:30.864Z", + "startedAt": "2026-07-28T10:26:03.076Z", + "refs": { + "sourceSha": "7e3f0fead990a470abc3f2647e0aeec59aafdcfc", + "targetSha": "4ea6711684bc6157468d24c7ce8a7b3227014bd6" + }, + "manifest": "docs/migration/source-manifest.json", + "toolchain": { + "node": "v22.19.0", + "npm": "10.9.8", + "vsce": "2.15.0", + "platform": "darwin/arm64" + }, + "summary": { + "total": 10, + "passed": 10, + "failed": 0, + "unsupported": 0 + }, + "verdict": "PARITY", + "intentionalDifferences": [], + "checks": [ + { + "id": "git.tree-equality", + "description": "Frozen source tree vs target tree; every diff must be narrowly declared in the manifest", + "status": "pass", + "evidence": { + "sourceSha": "7e3f0fead990a470abc3f2647e0aeec59aafdcfc", + "targetSha": "4ea6711684bc6157468d24c7ce8a7b3227014bd6", + "differingPaths": 0, + "filesCompared": 124 + }, + "violations": [], + "commands": [ + "git ls-tree -r ", + "git ls-tree -r HEAD" + ] + }, + { + "id": "pkg.pack-inventory", + "description": "npm pack --json inventory; per-file content hashes of the extracted tarballs", + "status": "pass", + "evidence": { + "sourceFiles": 28, + "targetFiles": 28, + "sourceIntegrity": "sha512-lyYVn5uYvGg52RqJCTJXj498p+3mjhL+JUB6jeyyM3r8oYXKzTVloX899OURoyqC7gFLDasY4nxn2324JYbyBA==", + "targetIntegrity": "sha512-em2qS+NYXtW4TT5NQh2PPIPD5zvATRr1fsN/mPBMd2ygW5N/E8979WaIu0NMrkPhxRzwm5XRRi2yZkW9iRZ8jw==", + "sourceSha256": "b170eaf1c3d23d059fd074178128f764f5b180e13db7942e4277cb98af7b917a", + "targetSha256": "a46a2c08265002bbb89431712653419c321eab30680a6c1666455d772ed3d23b" + }, + "violations": [], + "commands": [ + "npm pack --json (both checkouts)" + ] + }, + { + "id": "pkg.identity", + "description": "Packed manifest name/version/exports/bin/files/engines", + "status": "pass", + "evidence": { + "name": "@workspacejson/codex-mcp", + "version": "0.1.9" + }, + "violations": [], + "commands": [] + }, + { + "id": "pkg.bins", + "description": "Both bin entrypoints present, executable, and with identical dispatch behavior", + "status": "pass", + "evidence": { + "bins": [ + "codex-mcp", + "workspacejson-codex-mcp" + ] + }, + "violations": [], + "commands": [ + "node scripts/install.mjs __no_such_command__ (both checkouts)" + ] + }, + { + "id": "mcp.smoke", + "description": "MCP smoke suite against identical fixtures on both sides", + "status": "pass", + "evidence": { + "sourcePass": 41, + "sourceFail": 0, + "targetPass": 41, + "targetFail": 0 + }, + "violations": [], + "commands": [ + "node scripts/smoke.mjs (both checkouts)" + ] + }, + { + "id": "hooks.behavior", + "description": "Hook allow/deny decisions and missing/malformed failure modes on identical inputs", + "status": "pass", + "evidence": { + "cases": 5 + }, + "violations": [], + "commands": [ + "node hooks/pre-edit-check.mjs --paths ... (both checkouts, 5 cases)" + ] + }, + { + "id": "installer.assets", + "description": "Installer output and installed assets (.codex/config.toml + vendored runtime) in disposable dirs, install then uninstall", + "status": "pass", + "evidence": { + "sourceRuntimeFiles": 20, + "targetRuntimeFiles": 20, + "installExit": { + "source": 0, + "target": 0 + } + }, + "violations": [], + "commands": [ + "node scripts/install.mjs install --with-hook && uninstall (disposable dirs, both sides)" + ] + }, + { + "id": "plugin.surfaces", + "description": ".mcp.json, .codex-plugin/**, hooks/**, .agents/** presence and content", + "status": "pass", + "evidence": { + "surfaces": [ + ".mcp.json", + ".codex-plugin", + "hooks", + ".agents" + ] + }, + "violations": [], + "commands": [] + }, + { + "id": "extension.vsix", + "description": "Extension build + VSIX publisher/ID/version/commands/activationEvents/asset inventory (extracted content only; ZIP metadata never compared)", + "status": "pass", + "evidence": { + "sourceVsix": "../../../../../var/folders/sy/frt_v9rn73lbqr1l92qfjxhw0000gp/T/clone-parity-cnTKer/source/vsix/workspacejson-codex-decorations-0.1.5.vsix", + "targetVsix": "../../../../../var/folders/sy/frt_v9rn73lbqr1l92qfjxhw0000gp/T/clone-parity-cnTKer/target/vsix/workspacejson-codex-decorations-0.1.5.vsix", + "sourceVsixSha256": "5afc7af0809bf89c0ecec0a887770e83a51dd9dfb295e99cd8c4f4992d4e3f70", + "targetVsixSha256": "6e38484a25f152f595f6aa7363f862fc8f9ec5001e486a4e3c574af6df8174ae", + "sourceAssets": 30, + "targetAssets": 30 + }, + "violations": [], + "commands": [ + "npm run build:extension (both checkouts)", + "unzip + content-hash inventory (both VSIXes)" + ] + }, + { + "id": "generator.resolution", + "description": "Version-pinned generator invocation resolves identically to the frozen baseline on both sides", + "status": "pass", + "evidence": { + "resolution": "agents-audit version check passed (6 reference(s), pinned to 0.4.3)." + }, + "violations": [], + "commands": [ + "node scripts/check-generator-version.mjs (both checkouts)" + ] + } + ] +} diff --git a/package.json b/package.json index 3fad28b..21a1654 100644 --- a/package.json +++ b/package.json @@ -34,7 +34,15 @@ "import": "./dist/index.js" } }, - "files": ["dist", "hooks", "scripts/install.mjs", ".codex-plugin", ".mcp.json", "vsix", "README.md", "LICENSE"], + "files": [ + "dist", + "hooks", + "scripts/install.mjs", + ".codex-plugin", + "vsix", + "README.md", + "LICENSE" + ], "scripts": { "build": "tsc", "build:extension": "rm -rf extension/node_modules extension/*.vsix vsix/*.vsix && npm --prefix extension ci && npm --prefix extension run package && mkdir -p vsix && cp extension/workspacejson-codex-decorations-*.vsix vsix/", From 65404e73297149d69291c9107e0c33ae601700c7 Mon Sep 17 00:00:00 2001 From: Qwynn Marcelle Date: Wed, 12 Aug 2026 20:41:51 -0400 Subject: [PATCH 4/5] =?UTF-8?q?PROOF=203/4=20(META-337=20=C2=A78):=20isola?= =?UTF-8?q?te=20the=20consumption=20defect?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit DO NOT MERGE. Restores `.mcp.json` and instead drops `scripts/install.mjs` from `files[]`. PROOF 2/4 showed `.mcp.json` is asserted by BOTH `build-and-smoke` (which greps the pack log for it) and `standard-candidate-consumption` — so that defect could not attribute a RED to the consumption gate alone. `scripts/install.mjs` is asserted only by the consumption harness, so this commit isolates it: expect `standard-candidate-consumption` RED with `build-and-smoke` GREEN. --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index 21a1654..2b93120 100644 --- a/package.json +++ b/package.json @@ -37,8 +37,8 @@ "files": [ "dist", "hooks", - "scripts/install.mjs", ".codex-plugin", + ".mcp.json", "vsix", "README.md", "LICENSE" From eff8bc58e5c2222888d2e8f49fb92ca6667d0f6b Mon Sep 17 00:00:00 2001 From: Qwynn Marcelle Date: Wed, 12 Aug 2026 20:44:14 -0400 Subject: [PATCH 5/5] =?UTF-8?q?PROOF=204/4=20(META-337=20=C2=A78):=20resto?= =?UTF-8?q?re=20everything?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit DO NOT MERGE. Tree is now identical to the #15 fix branch. Expect all four CI checks GREEN, closing both bidirectional proofs. Correction to PROOF 3/4: rewriting package.json with a JSON.stringify round trip reformatted the `files` array and tripped biome, so `build-and-smoke` went red for a formatting reason rather than the injected one. That commit is not admissible as a proof and is not cited as one. The two gates are proven by PROOF 1/4 and 2/4, whose reds were verified against the failing step. --- package.json | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) diff --git a/package.json b/package.json index 2b93120..3fad28b 100644 --- a/package.json +++ b/package.json @@ -34,15 +34,7 @@ "import": "./dist/index.js" } }, - "files": [ - "dist", - "hooks", - ".codex-plugin", - ".mcp.json", - "vsix", - "README.md", - "LICENSE" - ], + "files": ["dist", "hooks", "scripts/install.mjs", ".codex-plugin", ".mcp.json", "vsix", "README.md", "LICENSE"], "scripts": { "build": "tsc", "build:extension": "rm -rf extension/node_modules extension/*.vsix vsix/*.vsix && npm --prefix extension ci && npm --prefix extension run package && mkdir -p vsix && cp extension/workspacejson-codex-decorations-*.vsix vsix/",