Skip to content

Commit 9a29d4e

Browse files
fix(codex): raise min_codex_version 0.122.0 → 0.140.0 (closes #26)
The developer_instructions agent-role schema and nested hooks.json schema emitted since v0.10.1 (#24) only exist on the Codex 0.14x generation, so 0.122.0 advertised compatibility with CLIs that reject or ignore both. Also repairs CHANGELOG section ordering (0.10.x had been inserted mid-file below 0.8.1, with a duplicated [Unreleased] heading). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
1 parent 459a9be commit 9a29d4e

6 files changed

Lines changed: 77 additions & 67 deletions

File tree

CHANGELOG.md

Lines changed: 67 additions & 62 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,54 @@ All notable changes to ADD are documented here. Format loosely follows [Keep a C
44

55
For commit-level detail see `git log`.
66

7+
## [Unreleased]
8+
9+
### Fixed
10+
11+
- **`min_codex_version` raised 0.122.0 → 0.140.0 (#26).** Since v0.10.1 the emitted agent-role TOMLs (`developer_instructions`) and nested hooks.json schema only exist on the Codex 0.14x generation, so the old floor advertised compatibility with CLIs that reject or silently ignore both. `runtimes/codex/adapter.yaml`, the `compile.py` fallback, and the capability matrix now state the honest floor.
12+
- **CHANGELOG ordering repaired** — the `[Unreleased]`/0.10.1/0.10.0 sections had been inserted mid-file (below 0.8.1) and `[Unreleased]` was duplicated; sections are now strictly newest-first with a single `[Unreleased]` head.
13+
14+
### Added
15+
16+
- **Codex smoke #24 regression guards**`run-smoke.sh` now asserts the installed hooks.json is the nested ≥0.14x schema (legacy flat form fails) and every installed agent TOML uses `developer_instructions` with no `prompt_skill`.
17+
18+
## [0.10.1] — 2026-07-18
19+
20+
**Codex ≥0.14x compatibility (#24)** — found by the v0.10.0 install smoke's first live run against the re-pinned CLI 0.144.5.
21+
22+
### Fixed
23+
24+
- **Sub-agent TOMLs were silently ignored on Codex ≥0.14x** — the `prompt_skill` field no longer exists in the agent-role schema. All 5 roles (explorer, implementer, reviewer, test-writer, verify) now use the required `developer_instructions` field, instructing the spawned agent to load its role's SKILL.md — behavior stays skill-sourced. Verified accepted by CLI 0.144.5.
25+
- **hooks.json was rejected on Codex ≥0.14x** — registration now uses the current schema (top-level `hooks` key, matcher groups, typed `command` entries) and `~/.codex/...` command paths (the old bare relative paths only resolved when the session started in `$HOME`). Verified accepted by CLI 0.144.5.
26+
- Migration hop 0.10.0→0.10.1 tells Codex users to re-run the installer to refresh `~/.codex/agents/` and `~/.codex/hooks.json`.
27+
28+
### Known limitations (carried)
29+
30+
- **Known gap (#23, found by the first live smoke run):** `/add:init --quick` still interviews, so headless one-shot sessions exit without writing config. Smokes work around it with inline answers; a true `--defaults` path targets v0.10.1.
31+
32+
## [0.10.0] — 2026-07-18
33+
34+
**"Install path confirmed" — GA release candidate** (spec: `specs/install-path-confirmation.md`; sequencing: smoke green → marketplace submission → v1.0.0 promotion tag on approval).
35+
36+
### Added
37+
38+
- **Real install smoke in CI (GA criterion #2).** `.github/workflows/install-smoke-claude.yml` — installs the checkout via the actual marketplace path (`claude plugin marketplace add` + `claude plugin install add@add-marketplace`), asserts skill discovery, and drives a headless `/add:init --quick` asserting `.add/config.json` (agent leg skips loudly without `ANTHROPIC_API_KEY`). `.github/workflows/install-smoke-codex.yml` + `tests/smoke/codex/` — Docker image with the Codex CLI pinned from `runtimes/codex/adapter.yaml` (single source of truth via build-arg), runs `scripts/install-codex.sh` for real, asserts 27/27 skills, hooks, shared assets, version parity, the F-002 path suite, and (with `OPENAI_API_KEY`) an agent-driven `/add-init`.
39+
- **`docs/capability-matrix.md` (GA criterion #3 / AC-027).** Per-runtime enforced vs agent-followed vs advisory truth table, appended to every release's notes by `release.sh`; `SECURITY.md` now points at it before the threat model.
40+
- **`scripts/release-evidence.sh` (GA criterion #4 / AC-025).** Assembles `reports/release-evidence/vX.Y.Z/` — version map, capability-matrix snapshot, command catalog, install-smoke run links, and a migration-graph reachability check; `--upload` attaches the bundle to the GitHub release.
41+
42+
### Changed
43+
44+
- **Codex CLI re-pinned 0.122.0 → 0.144.5** (`codex_cli_version`; `min_codex_version` stays 0.122.0). Install smoke verified green in Docker against the new pin (Q-001 re-baseline).
45+
- **`release.sh` is now release-blocking (GA criterion #1).** Refuses to tag unless HEAD is on origin/main with all CI check-runs green; `--no-verify-ci` is the loud emergency override.
46+
47+
### Fixed
48+
49+
- **`migrations.json`: v0.7.3 users were stranded** — no outgoing hop existed from 0.7.3 (same class as the v0.8.1→v0.9.3 chain break). Caught by the new reachability check; fixed with a 0.7.3→0.8.0 hop carrying the standard 0.8.0 steps.
50+
51+
### Known limitations
52+
53+
- **Telemetry emission confirmed absent (Q-MS-003/D6).** `.add/telemetry/` never populates — the spec exists, no hook writes it. Recorded as a finding; implementation deferred past v0.10.0 (does not gate the six GA criteria).
54+
755
## [0.9.11] — 2026-07-16
856

957
Closes the stale-rules gap reported by Tomasz Dmitruk ([@tdmitruk](https://github.com/tdmitruk)): `/add:init` used to copy 10 ADD rules into the consumer project's `.claude/rules/`, where they auto-loaded forever at the version they were copied — never updated by plugin upgrades, and (since v0.9.9) duplicating and eventually contradicting the fresh rules the SessionStart hook injects. Copies also bypassed maturity gating entirely.
@@ -117,68 +165,6 @@ CI/release hardening + truth-pass, opening the v1.0 credibility cycle. Turns a r
117165
- **`tests/release-tooling/test-release-verify.sh`** — behavioral regression guard for #18 (mocks git/gh/python3, asserts the script exits non-zero when no release page exists), registered in the guardrail matrix.
118166
- **`tests/security/fixtures/benign-multibyte.json`** — regression guard for the unicode-tag-block false-positive bug; asserts dense benign multibyte content does not fire (mutation-verified to go red against the old regex).
119167

120-
## [0.8.1] — 2026-04-23
121-
122-
Hotfix. Fixes three findings from the plugin-family release-hardening review before v0.9.0 ships. The M3 feature set (agents-md, cache-discipline, secrets-handling, telemetry-jsonl, prompt-injection-defense, test-deletion-guardrail, codex-native-skills) has already merged to main; this release makes that merge actually installable and makes the test-deletion guardrail actually enforce.
123-
124-
### Fixed
125-
126-
- **Claude marketplace validation (F-001).** `.claude-plugin/marketplace.json` had `description` at the root, which the marketplace schema rejects. Moved into the `metadata` object per the validator's guidance. `claude plugin validate .` and `claude plugin validate plugins/add` both now pass. Removed the stale `"13 commands, 12 skills, 15 rules"` count string — counts drift; manifests aren't the right place for them.
127-
- **Codex install path mismatch (F-002).** Generated Codex skills referenced `~/.codex/templates/`, `~/.codex/knowledge/`, `~/.codex/rules/`, `~/.codex/lib/`, `~/.codex/security/`, but `scripts/install-codex.sh` stages shared assets under the namespaced `~/.codex/add/` subdirectory. Every skill invocation on Codex would have failed to resolve its asset refs. Fixed by pointing the `${CLAUDE_PLUGIN_ROOT}` → Codex substitution at `~/.codex/add/` and adding a separate `${CLAUDE_PLUGIN_ROOT}/hooks``~/.codex/hooks` rule (hooks stay at the Codex-conventional root). `scripts/compile.py` now also ships `core/rules/` and `core/security/` into `dist/codex/`, and `scripts/install-codex.sh` stages `knowledge/`, `rules/`, `lib/`, `security/` under `$CODEX_HOME/add/` alongside the existing `templates/`. `filter-learnings.sh` is also now shipped into Codex's hooks dir as a cross-runtime utility.
128-
- **Test-deletion guardrail bypass (F-003).** `scripts/check-test-count.py` treated `--allow-test-rewrite` as a full bypass of the same-name-replacement approval check instead of as an acknowledgment flag that still required a recorded override. The documented intent (flag **AND** override record) matched the error message but not the code. Fix: the replacement check now runs unconditionally; `--allow-test-rewrite` is required to acknowledge intent, AND either a recorded override in `.add/cycles/cycle-{N}/overrides.json` or an `[ADD-TEST-DELETE: <reason>]` commit trailer is required to pass. Regression fixture `replacement-with-flag-no-override` added — proves the flag alone is insufficient.
129-
130-
### Added
131-
132-
- **`tests/codex-install/test-install-paths.sh`** — F-002 regression smoke. Installs the Codex adapter into a temp `CODEX_HOME`, collects every `~/.codex/...` reference from installed skill bodies, and asserts each one resolves (or is explicitly allowlisted). Runs in seconds; no Codex CLI needed.
133-
134-
### Known limitations (tracked for v0.8.2)
135-
136-
- `/add:version` reads `${CLAUDE_PLUGIN_ROOT}/.claude-plugin/plugin.json`, which has no Codex equivalent (the Codex version lives in `plugin.toml` or `VERSION`). Allowlisted in the new smoke test; cross-runtime fix deferred.
137-
- Hotfix does not address F-004+ from the plugin-family review — adapter contracts, host-neutral kernel, runtime overlays, command catalog generator. Those remain M4 / v0.10+ scope, not v0.9.0 blockers.
138-
139-
## [Unreleased]
140-
141-
## [Unreleased]
142-
143-
_(Nothing yet — tracking items go here between releases.)_
144-
145-
## [0.10.1] — 2026-07-18
146-
147-
**Codex ≥0.14x compatibility (#24)** — found by the v0.10.0 install smoke's first live run against the re-pinned CLI 0.144.5.
148-
149-
### Fixed
150-
151-
- **Sub-agent TOMLs were silently ignored on Codex ≥0.14x** — the `prompt_skill` field no longer exists in the agent-role schema. All 5 roles (explorer, implementer, reviewer, test-writer, verify) now use the required `developer_instructions` field, instructing the spawned agent to load its role's SKILL.md — behavior stays skill-sourced. Verified accepted by CLI 0.144.5.
152-
- **hooks.json was rejected on Codex ≥0.14x** — registration now uses the current schema (top-level `hooks` key, matcher groups, typed `command` entries) and `~/.codex/...` command paths (the old bare relative paths only resolved when the session started in `$HOME`). Verified accepted by CLI 0.144.5.
153-
- Migration hop 0.10.0→0.10.1 tells Codex users to re-run the installer to refresh `~/.codex/agents/` and `~/.codex/hooks.json`.
154-
155-
### Known limitations (carried)
156-
157-
- **Known gap (#23, found by the first live smoke run):** `/add:init --quick` still interviews, so headless one-shot sessions exit without writing config. Smokes work around it with inline answers; a true `--defaults` path targets v0.10.1.
158-
159-
## [0.10.0] — 2026-07-18
160-
161-
**"Install path confirmed" — GA release candidate** (spec: `specs/install-path-confirmation.md`; sequencing: smoke green → marketplace submission → v1.0.0 promotion tag on approval).
162-
163-
### Added
164-
165-
- **Real install smoke in CI (GA criterion #2).** `.github/workflows/install-smoke-claude.yml` — installs the checkout via the actual marketplace path (`claude plugin marketplace add` + `claude plugin install add@add-marketplace`), asserts skill discovery, and drives a headless `/add:init --quick` asserting `.add/config.json` (agent leg skips loudly without `ANTHROPIC_API_KEY`). `.github/workflows/install-smoke-codex.yml` + `tests/smoke/codex/` — Docker image with the Codex CLI pinned from `runtimes/codex/adapter.yaml` (single source of truth via build-arg), runs `scripts/install-codex.sh` for real, asserts 27/27 skills, hooks, shared assets, version parity, the F-002 path suite, and (with `OPENAI_API_KEY`) an agent-driven `/add-init`.
166-
- **`docs/capability-matrix.md` (GA criterion #3 / AC-027).** Per-runtime enforced vs agent-followed vs advisory truth table, appended to every release's notes by `release.sh`; `SECURITY.md` now points at it before the threat model.
167-
- **`scripts/release-evidence.sh` (GA criterion #4 / AC-025).** Assembles `reports/release-evidence/vX.Y.Z/` — version map, capability-matrix snapshot, command catalog, install-smoke run links, and a migration-graph reachability check; `--upload` attaches the bundle to the GitHub release.
168-
169-
### Changed
170-
171-
- **Codex CLI re-pinned 0.122.0 → 0.144.5** (`codex_cli_version`; `min_codex_version` stays 0.122.0). Install smoke verified green in Docker against the new pin (Q-001 re-baseline).
172-
- **`release.sh` is now release-blocking (GA criterion #1).** Refuses to tag unless HEAD is on origin/main with all CI check-runs green; `--no-verify-ci` is the loud emergency override.
173-
174-
### Fixed
175-
176-
- **`migrations.json`: v0.7.3 users were stranded** — no outgoing hop existed from 0.7.3 (same class as the v0.8.1→v0.9.3 chain break). Caught by the new reachability check; fixed with a 0.7.3→0.8.0 hop carrying the standard 0.8.0 steps.
177-
178-
### Known limitations
179-
180-
- **Telemetry emission confirmed absent (Q-MS-003/D6).** `.add/telemetry/` never populates — the spec exists, no hook writes it. Recorded as a finding; implementation deferred past v0.10.0 (does not gate the six GA criteria).
181-
182168
## [0.9.5] — 2026-04-22
183169

184170
**Hygiene + truth pass.** Doc-only release. Removes the smokescreen between what the docs claim and what's actually shipped, so the v1.0 credibility cycle (v0.9.6 → v1.0.0) starts from honest ground. No consumer config or plugin-runtime changes.
@@ -338,6 +324,25 @@ Seven feature specs planned together, built in parallel by worktree-isolated age
338324
- Cross-tool memory schema for `~/.claude/add/`
339325
- Governance maturity bands tied to autonomy ceilings
340326

327+
## [0.8.1] — 2026-04-23
328+
329+
Hotfix. Fixes three findings from the plugin-family release-hardening review before v0.9.0 ships. The M3 feature set (agents-md, cache-discipline, secrets-handling, telemetry-jsonl, prompt-injection-defense, test-deletion-guardrail, codex-native-skills) has already merged to main; this release makes that merge actually installable and makes the test-deletion guardrail actually enforce.
330+
331+
### Fixed
332+
333+
- **Claude marketplace validation (F-001).** `.claude-plugin/marketplace.json` had `description` at the root, which the marketplace schema rejects. Moved into the `metadata` object per the validator's guidance. `claude plugin validate .` and `claude plugin validate plugins/add` both now pass. Removed the stale `"13 commands, 12 skills, 15 rules"` count string — counts drift; manifests aren't the right place for them.
334+
- **Codex install path mismatch (F-002).** Generated Codex skills referenced `~/.codex/templates/`, `~/.codex/knowledge/`, `~/.codex/rules/`, `~/.codex/lib/`, `~/.codex/security/`, but `scripts/install-codex.sh` stages shared assets under the namespaced `~/.codex/add/` subdirectory. Every skill invocation on Codex would have failed to resolve its asset refs. Fixed by pointing the `${CLAUDE_PLUGIN_ROOT}` → Codex substitution at `~/.codex/add/` and adding a separate `${CLAUDE_PLUGIN_ROOT}/hooks``~/.codex/hooks` rule (hooks stay at the Codex-conventional root). `scripts/compile.py` now also ships `core/rules/` and `core/security/` into `dist/codex/`, and `scripts/install-codex.sh` stages `knowledge/`, `rules/`, `lib/`, `security/` under `$CODEX_HOME/add/` alongside the existing `templates/`. `filter-learnings.sh` is also now shipped into Codex's hooks dir as a cross-runtime utility.
335+
- **Test-deletion guardrail bypass (F-003).** `scripts/check-test-count.py` treated `--allow-test-rewrite` as a full bypass of the same-name-replacement approval check instead of as an acknowledgment flag that still required a recorded override. The documented intent (flag **AND** override record) matched the error message but not the code. Fix: the replacement check now runs unconditionally; `--allow-test-rewrite` is required to acknowledge intent, AND either a recorded override in `.add/cycles/cycle-{N}/overrides.json` or an `[ADD-TEST-DELETE: <reason>]` commit trailer is required to pass. Regression fixture `replacement-with-flag-no-override` added — proves the flag alone is insufficient.
336+
337+
### Added
338+
339+
- **`tests/codex-install/test-install-paths.sh`** — F-002 regression smoke. Installs the Codex adapter into a temp `CODEX_HOME`, collects every `~/.codex/...` reference from installed skill bodies, and asserts each one resolves (or is explicitly allowlisted). Runs in seconds; no Codex CLI needed.
340+
341+
### Known limitations (tracked for v0.8.2)
342+
343+
- `/add:version` reads `${CLAUDE_PLUGIN_ROOT}/.claude-plugin/plugin.json`, which has no Codex equivalent (the Codex version lives in `plugin.toml` or `VERSION`). Allowlisted in the new smoke test; cross-runtime fix deferred.
344+
- Hotfix does not address F-004+ from the plugin-family review — adapter contracts, host-neutral kernel, runtime overlays, command catalog generator. Those remain M4 / v0.10+ scope, not v0.9.0 blockers.
345+
341346
## [0.8.0] — 2026-04-22
342347

343348
Pre-filtered active learning views. Moves filtering work out of the LLM context window and into a `jq`-based hook, cutting autoload context cost by 62-82% as learnings accumulate. Community contribution from @tdmitruk via #7.

dist/codex/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ That script installs:
2323

2424
**Pinned versions:**
2525

26-
- `min_codex_version = "0.122.0"` — the oldest Codex CLI that
26+
- `min_codex_version = "0.140.0"` — the oldest Codex CLI that
2727
supports every feature ADD emits (native Skills, sub-agents, hooks, plugin
2828
marketplace).
2929
- `codex_cli_version = "0.144.5"` — the version ADD's CI

dist/codex/plugin.toml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
name = "add"
66
version = "0.10.1"
77
description = "Agent Driven Development (ADD) — spec-driven, test-first SDLC methodology for AI agent teams."
8-
min_codex_version = "0.122.0"
8+
min_codex_version = "0.140.0"
99

1010
skills = [
1111
".agents/skills/add-agents-md/SKILL.md",

docs/capability-matrix.md

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,9 @@ expected to obey; no mechanical backstop. **Advisory**: documentation/patterns o
2626
| GPG-signed releases | n/a (repo-level) | n/a (repo-level) | All tags signed; see `docs/release-signing.md` |
2727

2828
**Pinned Codex CLI (CI target):** see `codex_cli_version` in `runtimes/codex/adapter.yaml`
29-
(0.144.5 as of v0.10.0; minimum supported: 0.122.0).
29+
(0.144.5 as of v0.10.0; minimum supported: 0.140.0 — the `developer_instructions`
30+
agent-role schema and nested hooks.json schema ADD emits since v0.10.1 do not
31+
exist on older CLIs; see #26).
3032

3133
**Summary for release notes:** on Claude Code, ADD's quality gates are mechanically
3234
enforced by hooks; on Codex CLI they are agent-followed unless the user enables

runtimes/codex/adapter.yaml

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,12 @@ output_dir: dist/codex
1010
# ------------------------
1111
# min_codex_version: Lowest Codex CLI version that ships every feature ADD emits
1212
# (native Skills, sub-agents, hooks, plugin marketplace). Per spec AC-032.
13+
# Floor is 0.140.0 since v0.10.1 (#24/#26): the emitted agent-role schema
14+
# (developer_instructions) and nested hooks.json schema only exist on the
15+
# 0.14x generation — older CLIs reject or silently ignore both.
1316
# codex_cli_version: The version the CI plugin-validate job targets (AC-035).
1417
codex_cli_version: "0.144.5"
15-
min_codex_version: "0.122.0"
18+
min_codex_version: "0.140.0"
1619

1720
# Output mode: "native" = Codex Skills format (v0.9+). The legacy "prompts" mode
1821
# wrote to ~/.codex/prompts/ and is no longer emitted.

scripts/compile.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -744,7 +744,7 @@ def load_adapter_metadata() -> dict:
744744
Minimal parse — we only need two top-level scalar keys.
745745
"""
746746
adapter = RUNTIMES / "codex" / "adapter.yaml"
747-
meta = {"min_codex_version": "0.122.0", "codex_cli_version": "0.122.0"}
747+
meta = {"min_codex_version": "0.140.0", "codex_cli_version": "0.144.5"}
748748
if not adapter.exists():
749749
return meta
750750
for raw in adapter.read_text().splitlines():

0 commit comments

Comments
 (0)