[codex] close out clusterfuzzlite, local gates, and proof routes

.clusterfuzzlite/Dockerfile

@@ -1,9 +1,9 @@
-FROM gcr.io/oss-fuzz-base/base-builder-python
+FROM gcr.io/oss-fuzz-base/base-builder-python@sha256:6bb326cd90cc82d526add050b67b92bf53f900d5f61aa9abd74cc2f04f622dc9
 
 WORKDIR $SRC/movi-organizer
 COPY . $SRC/movi-organizer
 COPY .clusterfuzzlite/build.sh $SRC/build.sh
+COPY .clusterfuzzlite/requirements.txt $SRC/movi-organizer/.clusterfuzzlite/requirements.txt
+ENV PYTHONPATH=$SRC/movi-organizer
 
-RUN python3 -m pip install --disable-pip-version-check --upgrade pip==26.0.1 \
-    && python3 -m pip install --disable-pip-version-check atheris \
-    && python3 -m pip install --disable-pip-version-check .
+RUN python3 -m pip install --disable-pip-version-check --require-hashes -r $SRC/movi-organizer/.clusterfuzzlite/requirements.txt

.clusterfuzzlite/build.sh

@@ -2,8 +2,6 @@
 set -euo pipefail
 
 cd "$SRC/movi-organizer"
-
-python3 -m pip install --disable-pip-version-check atheris
-python3 -m pip install --disable-pip-version-check .
+export PYTHONPATH="${PYTHONPATH:-$SRC/movi-organizer}"
 
 compile_python_fuzzer tests/fuzz/fuzz_safe_join.py

.clusterfuzzlite/requirements.txt

@@ -0,0 +1,2 @@
+atheris @ https://files.pythonhosted.org/packages/00/01/3a2a31c0016233599b12e8fa6c956ec6c1df78630d8cec9cfa78904d0013/atheris-2.3.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl \
+    --hash=sha256:e4e43d1ee4760916a84ff73c9c6cf9ac6eee80fc030479bbed43fe0b8e994981

.env.example

@@ -2,8 +2,9 @@
 # Movi environment template
 # SSOT facts: contracts/runtime/env_contract_registry.yaml
 # Policy / explain: docs/env_contract.md
-# Copy to .env and fill real values.
-# Sensitive values policy: only set via .env or shell environment variables.
+# For a durable runtime file, copy the keys you need into <workspace-root>/.movi/env/runtime.env.
+# The repository root .env file is local-only convenience and is not a supported runtime source.
+# Sensitive values policy: only set via <workspace-root>/.movi/env/runtime.env or shell environment variables.
 # =========================
 
 # [Minimal template - required]

.github/workflows/mutation-weekly.yml

@@ -1,16 +1,14 @@
-name: mutation-weekly
+name: mutation-manual
 
 on:
   workflow_dispatch:
-  schedule:
-    - cron: "0 3 * * 1"
 
 permissions:
   contents: read
   packages: read
 
 concurrency:
-  group: mutation-weekly-${{ github.ref }}
+  group: mutation-manual-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
@@ -102,7 +100,7 @@ jobs:
           MATRIX_TESTS: ${{ matrix.tests }}
         run: |
           set -euo pipefail
-          bash tooling/scripts/container_exec.sh --label mutation-weekly -- bash -lc '
+          bash tooling/scripts/container_exec.sh --label mutation-manual -- bash -lc '
             set -euo pipefail
             $HOME/.cache/movi-organizer/venv/default/bin/mutmut run \
               --paths-to-mutate "${MATRIX_MUTATE_PATH}" \
@@ -114,7 +112,7 @@ jobs:
           MATRIX_MODULE: ${{ matrix.module }}
         run: |
           set -euo pipefail
-          bash tooling/scripts/container_exec.sh --label mutation-weekly-report -- bash -lc '
+          bash tooling/scripts/container_exec.sh --label mutation-manual-report -- bash -lc '
             set -euo pipefail
             $HOME/.cache/movi-organizer/venv/default/bin/mutmut results | tee ".runtime-cache/logs/mutmut-results-${MATRIX_MODULE}.txt"
             $HOME/.cache/movi-organizer/venv/default/bin/python tooling/scripts/check_mutation_report.py \
@@ -130,7 +128,7 @@ jobs:
         if: always()
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
         with:
-          name: mutation-weekly-diagnostics-${{ matrix.module }}
+          name: mutation-manual-diagnostics-${{ matrix.module }}
           path: |
             .runtime-cache/logs/
             .runtime-cache/test/mutation/.mutmut-cache
@@ -218,7 +216,7 @@ jobs:
       - name: Run cargo-mutants
         if: steps.detect_rs.outputs.has_rs == 'true'
         env:
-          XDG_CACHE_HOME: ${{ runner.temp }}/organizer-mutation-weekly-xdg-cache
+          XDG_CACHE_HOME: ${{ runner.temp }}/organizer-mutation-manual-xdg-cache
         run: |
           set -euo pipefail
           cargo mutants --in-place

.github/workflows/upstream-governance-weekly.yml

@@ -1,16 +1,13 @@
-name: upstream-governance-weekly
+name: upstream-governance-manual
 
 on:
   workflow_dispatch:
-  merge_group:
-  schedule:
-    - cron: "30 5 * * 1"
 
 permissions:
   contents: read
 
 concurrency:
-  group: upstream-governance-weekly-${{ github.ref }}
+  group: upstream-governance-manual-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
@@ -60,6 +57,6 @@ jobs:
         if: always()
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
         with:
-          name: upstream-governance-weekly
+          name: upstream-governance-manual
           path: .runtime-cache/logs/
           if-no-files-found: warn

.pre-commit-config.yaml

@@ -4,7 +4,8 @@
 #
 # Layer responsibilities:
 #   Pre-Commit (<15s): formatting, syntax, security (staged files only), commit hygiene
-#   Pre-Push (<90s): incremental lint, incremental type check, commit governance
+#   Pre-Push standard (<30s): minimal local burn, changed-only secret scan, commit governance
+#   Pre-Push strict (<90s): local fast lane, incremental validation, mutation canary
 #   CI (full): all checks, multi-version matrix, full security scan
 #
 # Developers can bypass with --no-verify; CI provides full coverage as safety net.

README.md

@@ -2,15 +2,15 @@
 
 Movi is a review-first local file organizer and workbench for messy photos, screenshots, documents, and audio. It lets AI assist with the manifest first, then lets you inspect, label, and approve the plan before deterministic `apply` or `rollback` touches your files.
 
-[Safe First Look](#safe-first-look) · [10-Second Tour](#10-second-tour) · [Browser Surface](#browser-surface) · [Movi MCP v1](docs/mcp.md) · [Codex Integration](docs/codex_mcp.md) · [Claude Code Integration](docs/claude_code_mcp.md) · [Developer Guide](docs/developer_guide.md) · [Docs](docs/index.md) · [Releases](https://github.com/xiaojiou176-open/movi-organizer/releases) · [Discussions](https://github.com/xiaojiou176-open/movi-organizer/discussions) · [Security](SECURITY.md)
+[Safe First Look](#safe-first-look) · [10-Second Tour](#10-second-tour) · [Good Fit / Not A Fit](#good-fit--not-a-fit) · [Public Proof](docs/public_proof.md) · [Docs](docs/index.md) · [Browser Surface](#browser-surface) · [Releases](https://github.com/xiaojiou176-open/movi-organizer/releases) · [Discussions](https://github.com/xiaojiou176-open/movi-organizer/discussions) · [Security](SECURITY.md) · [Movi MCP v1](docs/mcp.md) · [Codex Integration](docs/codex_mcp.md) · [Claude Code Integration](docs/claude_code_mcp.md) · [Developer Guide](docs/developer_guide.md)
 
 ![Movi overview showing mixed files flowing into manifest review and organized output](docs/assets/storefront/hero-movi-overview.svg)
 
 Movi is a **review-first local AI file organizer**. It turns a chaotic intake folder into a review queue, then into a reviewed manifest, and only then into safer file moves you can dry-run, audit, and roll back. The current shipped surface stays intentionally narrow: `Movi Review`, `Movi Rules`, `Movi Inbox`, `Movi Copilot v1`, and `Movi MCP v1` all describe real current surfaces, but they still stay inside one safety story instead of pretending Movi is an autonomous organizer.
 
 Public maintenance posture: limited-maintenance open source.
 
-Current proof posture: reproducible smoke-tier evidence with upgrade packs for recorded manual baselines and human rubric review. It is not public-grade headline proof yet.
+Current proof posture: reproducible smoke-tier evidence with a live release trail, Pages front door, and repo-side safety gates. It is not public-grade headline proof yet, and the current proof routes are kept explicit in [Public Proof](docs/public_proof.md) instead of being buried in operator-only docs.
 
 ## Why Movi Exists
 
@@ -33,6 +33,17 @@ Think of it like moving house: AI makes the packing list, but the moving crew st
 - **Local-first runtime**: your folders, manifests, and reports stay under your chosen workspace root.
 - **Operator-grade guardrails**: quality gates, structured logs, and release runbooks exist for people who need deeper operational truth.
 
+## Public Proof At A Glance
+
+If you are asking, "is this a real product surface or just a careful README," the shortest honest answer is:
+
+- **Public source repo + GitHub Releases**: the release trail is public on [GitHub Releases](https://github.com/xiaojiou176-open/movi-organizer/releases).
+- **Live Pages front door**: the current public landing route is [xiaojiou176-open.github.io/movi-organizer](https://xiaojiou176-open.github.io/movi-organizer/).
+- **Review-first proof, not autonomy theater**: the repo ships a fixture-backed safe first look, dry-run apply, rollback boundaries, and a real MCP surface that still stays behind review-safe semantics.
+- **Honest boundary language**: Movi does not claim hosted SaaS, zero-review file mutation, or public benchmark-grade proof that the repo has not actually earned yet.
+
+If you want the full outsider-facing proof map, open [Public Proof](docs/public_proof.md). If you want the shortest hands-on route, stay on this page and run [Safe First Look](#safe-first-look).
+
 ## Product Surface Baseline
 
 - **Movi**: the main product brand.
@@ -155,7 +166,7 @@ If you want the public release storyline instead of the repo history, start with
 - **The manifest is the source of truth**: review happens before file mutation.
 - **`apply` and `rollback` stay deterministic**: AI helps plan, not execute arbitrary moves.
 - **Safety language is explicit**: `dry-run`, `allowed-root`, and manifest validation are first-class, not buried extras.
-- **Governance truth is documented**: deeper runtime, release, and platform boundaries are kept in operator docs instead of being silently implied.
+- **Proof routes are explicit**: live release, Pages, and deeper operator truth routes are linked directly instead of being hidden in internal-only notes.
 
 ## Brand And Landing Notes
 
@@ -221,25 +232,25 @@ Container-first default:
 
 If review-first cleanup is the workflow you keep wishing existed, star the repo so you can find Movi again when the next messy folder lands.
 
-## Operator And Governance References
+## Proof And Truth Routes
 
+- Public-facing proof map: [docs/public_proof.md](docs/public_proof.md)
 - Detailed operator route: [docs/usage.md](docs/usage.md)
 - Architecture and execution boundaries: [docs/architecture.md](docs/architecture.md)
 - Public release and platform boundary: [docs/open_source_runbook.md](docs/open_source_runbook.md)
 - Third-party notices: [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md)
 
-## Deeper Operator Truth Surfaces
-
 Delivery-complete truth for the current snapshot still depends on fresh gate evidence, not on static prose.
-Treat `bash tooling/gates/quality_gate.sh` as the delivery-complete receipt for the current snapshot.
-Treat repository docs as guidance, not as live platform state.
+Treat `bash tooling/gates/quality_gate.sh` as the delivery-complete receipt for the current snapshot, and treat repository docs as guidance rather than a live platform dashboard.
 
 ## Minimal Truth Routes
 
-- Overview and fastest first look: [README.md](README.md)
-- Detailed operator guide: [docs/usage.md](docs/usage.md)
-- Architecture and execution boundaries: [docs/architecture.md](docs/architecture.md)
-- Public release and platform boundary: [docs/open_source_runbook.md](docs/open_source_runbook.md)
+If you only want the shortest honest map of what is true right now, follow these four routes:
+
+- **Public proof map**: [docs/public_proof.md](docs/public_proof.md)
+- **Current release and platform boundary**: [docs/open_source_runbook.md](docs/open_source_runbook.md)
+- **Detailed operator route**: [docs/usage.md](docs/usage.md)
+- **System wiring and contracts**: [docs/architecture.md](docs/architecture.md)
 
 Public readiness gates:
 
@@ -287,7 +298,7 @@ Public readiness gates:
 - **Supplemental gates**: `webui-build-test` (frontend correctness), `functional-gate` (critical smoke), `test` (Python version parity)
 - **Dual failure-domain required jobs**: None
 - **Shared-pool-only required jobs**: None
-- **Side workflows**: `pre-commit` bootstraps directly on hosted runners, while `live-integration` and `mutation-weekly` reuse `reusable-build-runtime-image.yml`; runtime image build keeps provenance artifact wiring when the platform supports attestations.
+- **Side workflows**: `pre-commit` bootstraps directly on hosted runners, while `live-integration` and `mutation-manual` reuse `reusable-build-runtime-image.yml`; runtime image build keeps provenance artifact wiring when the platform supports attestations.
 - **Drift / evidence surfaces**: `nightly-drift-audit.yml`, `collect_ci_run_metrics.py`, `generate_ci_evidence_bundle.py`.
 - **Local auxiliary evidence**: `npm run ci:local` writes repo-local CI metrics, a repo-local evidence bundle, and governed upstream receipts under the repo-local runtime cache directory; these are local derived reports, not Branch Protection truth. Read `truth.truth_class`, `truth.remote_traceability`, and `truth.authoritative_terminal_receipt` before treating the bundle as anything stronger. Older pass receipts remain historical audit evidence only; current closeout wording must follow the latest canonical terminal receipt.
 - **Developer fallback**: use `bash tooling/gates/pre_push_gate.sh` (`standard/strict/full`) for fast local feedback before remote CI.

contracts/docs/docs_nav_registry.yaml

@@ -51,6 +51,10 @@ docs:
     layer: human-authored
     scope: strict
     command_smoke: false
+  - path: docs/public_proof.md
+    layer: human-authored
+    scope: strict
+    command_smoke: false
   - path: docs/brand_positioning.md
     layer: human-authored
     scope: strict

contracts/governance/root_allowlist.yaml

@@ -1,5 +1,6 @@
 version: 1
 canonical_tracked_entries:
+  - .clusterfuzzlite
   - .devcontainer
   - .env.example
   - .github
@@ -43,6 +44,7 @@ local_only_tracking:
     - .serena
 entry_purposes:
   .agents: repo-local execution plans and governance control boards
+  .clusterfuzzlite: ClusterFuzzLite build and run entrypoints
   .devcontainer: devcontainer and runtime image sources
   .env: local-only runtime secret file that must remain untracked
   .env.example: runtime env template

contracts/governance/root_change_control.yaml

@@ -6,6 +6,10 @@ entries:
     approval_rule: architecture-review
     tracked_policy: must-remain-untracked
     tracked_policy_reason: repo-local plans and conversations must never enter git tracked public surface
+  .clusterfuzzlite:
+    owner: repo
+    change_class: platform
+    approval_rule: architecture-review
   .env:
     owner: repo
     change_class: local-only