fix(v0.9.8): P0 correctness batch — Codex substitution + autoload parity + fail-open detector

- codex compiler: transform copied trees (rules/knowledge/templates/security/lib),
  /add: → /add- namespace rule, .template/.toml in substitution set,
  agent TOMLs substituted, handoff-detect.sh messages fixed at source
- shared rule_autoloads() predicate for both runtimes; explicit autoload: key
  required on every rule (design-system.md was Claude-only autoloaded)
- posttooluse-scan.sh: audit skipped:no-python3 instead of silently disabling
  the critical unicode-tag-block detector
- compile.py --check: snapshot + content-diff (catches pre-drifted trees)
- AGENTS.md: global.md read-before-work pointer; adapter.yaml truth-pass
  (advisory-only injection defense on Codex, real output_shape, no false strip claim)
- scan-secrets.sh: ~/.codex/add catalog fallback

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: MountainUnicorn

.add/agents-md.stale

@@ -1 +1 @@
-{"timestamp":"2026-06-14T19:41:44Z","changed":["core/rules/model-roles.md"]}
+{"timestamp":"2026-07-12T16:38:27Z","changed":["core/rules/design-system.md"]}

.add/config.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://github.com/MountainUnicorn/add/config.schema.json",
-  "version": "0.9.7",
+  "version": "0.9.8",
   "project": {
     "name": "ADD",
     "description": "Agent Driven Development \u2014 Claude Code plugin implementing an AI-native SDLC methodology",

CHANGELOG.md

@@ -4,6 +4,22 @@ All notable changes to ADD are documented here. Format loosely follows [Keep a C
 
 For commit-level detail see `git log`.
 
+## [0.9.8] — 2026-07-12
+
+P0 correctness patch from a full token-sensitivity audit (four parallel deep-dives across rules, skills, the Codex runtime, and the operational machinery). Fixes cross-runtime divergence and fail-open security behavior; opens the three-release path to v1.0 (v0.9.9 token architecture, v0.9.10 dedup + hygiene).
+
+### Fixed
+
+- **Codex substitution leaks.** The compiler applied `codex_substitute` only to skill bodies and references — `rules/`, `knowledge/`, `templates/`, `security/`, `lib/` docs and agent TOMLs shipped with raw `${CLAUDE_PLUGIN_ROOT}` paths and **286 `/add:` Claude-namespace command references** (Codex commands are `/add-<name>`). `copy_tree` now takes a transform; a `/add:` → `/add-` substitution rule was added; `.template`/`.toml` files joined the substitution set; `handoff-detect.sh` messages corrected at source. `scan-secrets.sh` additionally resolves its catalog at `~/.codex/add/security/` when env/script-relative resolution misses.
+- **Claude/Codex autoload divergence.** The Claude `@rules` list included a rule unless `autoload: false`; the Codex AGENTS.md invariants required `autoload: true` — `design-system.md` (no key) autoloaded on Claude but was missing from Codex invariants. Both runtimes now share one `rule_autoloads()` predicate, and **every rule must declare `autoload:` explicitly** (compile hard-fails otherwise).
+- **Critical injection detector failed open.** Hex-escape patterns (incl. the `critical` `unicode-tag-block` invisible-injection detector) silently no-op'd when `python3` was absent. The scanner now emits an `ADD-SEC … action=skipped-no-python3` warning and a `skipped:"no-python3"` audit event.
+- **`compile.py --check` could false-pass on a pre-drifted tree** (it compared before-vs-after `git status --porcelain` strings, identical either way). Now snapshots the output dirs and content-diffs after recompile — git-independent, works uncommitted.
+- **Codex sessions never saw `knowledge/global.md`.** `adapter.yaml` claimed AGENTS.md was built from it, but the compiler never read it. The slim manifest now carries the read-before-work pointer to Tier-1 global learnings + `.add/learnings-active.md`.
+
+### Changed
+
+- **`adapter.yaml` truth-pass.** The `limitations` section previously described an injection-scan hook writing audit events on Codex — no such hook ships. It now states plainly: injection defense on Codex is **advisory-only** (no scanner hook, no audit events; parity targeted at v1.0), `filter-learnings.sh` ships but is not auto-registered, and hook stderr is not surfaced. `output_shape` now documents all real emit targets (`rules/`, `knowledge/`, `lib/`, `security/`); the false `rules.strip` frontmatter claim replaced with `preserve: true` (the maturity-loader reads rule `maturity:` keys at runtime).
+
 ## [0.9.7] — 2026-06-18
 
 Methodology reframe + a security trust signal. Positions ADD as the policy layer over native orchestration, leads with the maturity-ladder moat, and dogfoods the injection defense.

README.md

@@ -13,7 +13,7 @@
   <br>
   <br>
   <a href="https://github.com/MountainUnicorn/add/blob/main/LICENSE"><img src="https://img.shields.io/badge/license-MIT-blue.svg" alt="License: MIT"></a>
-  <a href="#"><img src="https://img.shields.io/badge/version-0.9.7-brightgreen.svg" alt="Version"></a>
+  <a href="#"><img src="https://img.shields.io/badge/version-0.9.8-brightgreen.svg" alt="Version"></a>
   <a href="#"><img src="https://img.shields.io/badge/Claude_Code-plugin-blueviolet.svg" alt="Claude Code Plugin"></a>
 </p>
 

core/VERSION

@@ -1 +1 @@
-0.9.7
+0.9.8

core/lib/scan-secrets.sh

@@ -143,6 +143,12 @@ resolve_catalog() {
     (cd "$(dirname "$candidate")" && printf '%s/%s\n' "$(pwd)" "$(basename "$candidate")")
     return
   fi
+  # Codex runtime: the adapter installs the compiled tree at ~/.codex/add/
+  # and CLAUDE_PLUGIN_ROOT is never set there.
+  if [ -f "$HOME/.codex/add/security/secret-patterns.json" ]; then
+    echo "$HOME/.codex/add/security/secret-patterns.json"
+    return
+  fi
   echo ""
 }
 

core/rules/design-system.md

@@ -1,4 +1,5 @@
 ---
+autoload: true
 description: "Design system for visual artifacts — loads full reference on demand"
 maturity: ga
 globs: ["docs/infographic.svg", "reports/*.html"]

core/templates/migrations.json

@@ -1,6 +1,6 @@
 {
   "schema_version": "1.0.0",
-  "plugin_version": "0.9.7",
+  "plugin_version": "0.9.8",
   "migrations": [
     {
       "from": "0.1.0",
@@ -260,6 +260,12 @@
       "to": "0.9.7",
       "steps": [],
       "description": "v0.9.7 \u2014 methodology reframe. swarm-protocol.md + agent-coordination.md reframed as policy-over-native-Workflows (manual fallback retained; WIP semantics invariant); swarm-state machine-readable format contract pinned; README leads with the maturity ladder; skill self-scan CI gate added (scripts/self-scan-skills.py + skill-self-scan guardrail); runtimes/claude/workflows/ scaffold (inert). No consumer config changes."
+    },
+    {
+      "from": "0.9.7",
+      "to": "0.9.8",
+      "steps": [],
+      "description": "v0.9.8 \u2014 P0 correctness patch. Codex compiler now rewrites ${CLAUDE_PLUGIN_ROOT} paths and /add: command namespace in rules/knowledge/templates/security/lib and agent TOMLs (previously leaked Claude-isms verbatim); Claude and Codex runtimes share one autoload predicate (explicit autoload: key now required on every rule; design-system.md was autoloaded on Claude but missing from Codex invariants); Codex AGENTS.md points to knowledge/global.md (was silently dropped); posttooluse-scan.sh records a skipped:no-python3 audit event instead of silently disabling the critical unicode-tag-block detector; compile.py --check content-diffs against a snapshot (git-independent, catches pre-drifted trees); adapter.yaml limitations rewritten to state Codex injection defense is advisory-only. No consumer config changes."
     }
   ]
 }

dist/codex/.agents/skills/add-agents-md/SKILL.md

@@ -1,10 +1,10 @@
 ---
 name: add-agents-md
-description: "[ADD v0.9.7] Generate or sync a portable AGENTS.md from ADD project state — writes, checks drift, or merges with hand-curated content"
+description: "[ADD v0.9.8] Generate or sync a portable AGENTS.md from ADD project state — writes, checks drift, or merges with hand-curated content"
 argument-hint: "[--write|--check|--merge|--import] [--dry-run]"
 ---
 
-# ADD AGENTS.md Skill v0.9.7
+# ADD AGENTS.md Skill v0.9.8
 
 Generate a portable [`AGENTS.md`](https://agents.md) at project root from the project's `.add/` state. `AGENTS.md` is the cross-tool open standard for project-level agent instructions — any agent (Claude Code, Cursor, Codex CLI, Windsurf, Amp, Devin, Copilot) will read it on session start. Publishing one lets mixed-toolchain teams respect the same invariants without installing ADD.
 
@@ -13,11 +13,11 @@ This skill is the only way to regenerate AGENTS.md. A PostToolUse hook marks the
 ## Invocation
 
 ```
-/add:agents-md               # default: --write
-/add:agents-md --check       # drift detection, CI-friendly (exit 1 on drift)
-/add:agents-md --merge       # prepend ADD block to an existing hand-curated AGENTS.md
-/add:agents-md --import      # one-time absorption (same as --merge; explicit intent)
-/add:agents-md --dry-run     # preview without writing (combines with any mode)
+/add-agents-md               # default: --write
+/add-agents-md --check       # drift detection, CI-friendly (exit 1 on drift)
+/add-agents-md --merge       # prepend ADD block to an existing hand-curated AGENTS.md
+/add-agents-md --import      # one-time absorption (same as --merge; explicit intent)
+/add-agents-md --dry-run     # preview without writing (combines with any mode)
 ```
 
 ## Pre-Flight Checks
@@ -144,14 +144,14 @@ Marker contents:
 }
 ```
 
-The hook does **not** rewrite `AGENTS.md`. The next `/add:agents-md` invocation announces the stale state, lists the changed sources, then regenerates when the human runs `--write`.
+The hook does **not** rewrite `AGENTS.md`. The next `/add-agents-md` invocation announces the stale state, lists the changed sources, then regenerates when the human runs `--write`.
 
 ## Integration With Other Skills
 
-- **`/add:init`** — calls `/add:agents-md` at the end of the init flow to write the initial `AGENTS.md`.
-- **`/add:spec`** — after a new spec becomes the "spec under work", prompts: "Update AGENTS.md active-spec pointer? (Y/n)". On yes, runs `/add:agents-md --write`.
-- **`/add:verify`** — opt-in Gate 4.5: if `agentsMd.gateOnVerify: true` is set in `.add/config.json`, `/add:verify` runs `--check` and fails the gate on drift. Off by default.
-- **`/add:promote`** — maturity bumps recommend a regen (since the verbosity level changes) but do not auto-rewrite.
+- **`/add-init`** — calls `/add-agents-md` at the end of the init flow to write the initial `AGENTS.md`.
+- **`/add-spec`** — after a new spec becomes the "spec under work", prompts: "Update AGENTS.md active-spec pointer? (Y/n)". On yes, runs `/add-agents-md --write`.
+- **`/add-verify`** — opt-in Gate 4.5: if `agentsMd.gateOnVerify: true` is set in `.add/config.json`, `/add-verify` runs `--check` and fails the gate on drift. Off by default.
+- **`/add-promote`** — maturity bumps recommend a regen (since the verbosity level changes) but do not auto-rewrite.
 
 ## Configuration
 
@@ -206,7 +206,7 @@ AGENTS.md drift detected.
 @@ ... @@
  ...unified diff...
 
-Run /add:agents-md --write to regenerate.
+Run /add-agents-md --write to regenerate.
 Exit code: 1
 ```
 

dist/codex/.agents/skills/add-away/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: add-away
-description: "[ADD v0.9.7] Declare absence — get autonomous work plan for the duration"
+description: "[ADD v0.9.8] Declare absence — get autonomous work plan for the duration"
 argument-hint: "[duration, e.g. '4 hours', '30 minutes', 'end of day']"
 ---
 
@@ -26,14 +26,14 @@ argument-hint: "[duration, e.g. '4 hours', '30 minutes', 'end of day']"
 
 ---
 
-# ADD Away Command v0.9.7
+# ADD Away Command v0.9.8
 
 The human is stepping away. Establish what work can proceed autonomously and what must wait.
 
 ## Phase 1: Understand the Absence
 
 Parse the duration from $ARGUMENTS. If not provided, default to **2 hours**. Do not ask — just acknowledge the default:
-"No duration specified — I'll plan for a 2-hour session. Say `/add:away 4 hours` next time to adjust."
+"No duration specified — I'll plan for a 2-hour session. Say `/add-away 4 hours` next time to adjust."
 
 ## Phase 2: Assess Available Work