Repository navigation
feat(wish): skills-everywhere-b — honest pinned install, delete every non-Orca integration - #2878
Merged
Merged
Conversation
wishes-lint imported the validator from plugins/genie/scripts/src, which wish skills-everywhere-b Group 4 deletes. Create scripts/validate-wish.ts and scripts/wish-template-text.d.ts as a maintained verbatim mirror -- the two files differ from the plugin originals only in the two relative import specifiers the depth change forces -- and re-point scripts/wishes-lint.ts at the local copy. The mirror is biome-ignored exactly as plugins/genie/scripts already is, so the byte parity between the two copies stays a fact rather than a formatting negotiation.
…omic-fs Wish skills-everywhere-b deletes agent-sync.ts (Group 5) and codex-activation-persistence.ts (Group 3). Both lend primitives to modules that survive the wish, so the primitives move first, verbatim, into the leaf module that already owns the crash-safety contract. From agent-sync.ts: the whole physical-tree digest cluster -- computeDirDigest/computeFileDigest plus the private traversal helpers, and the MANIFEST_NAME / PHYSICAL_TREE_IDENTITY_VERSION constants the digest grammar is defined in terms of. agent-sync.ts imports the four it still uses internally (computeExactDirDigest, computeLegacyRegularTreeDigest, physicalEntryKind, PhysicalTreeEntry) and re-exports the four public ones, so doctor, uninstall, runtime-integrations and the retirement module keep their current imports. Its two remaining private hashFile calls now say computeFileDigest. From codex-activation-persistence.ts: readBoundedRegularFile, fsyncParentDir, atomicWriteFileSync and unlinkWithParentFsync with their private helpers. The old module keeps renameNonOverwriting (Codex-only) and re-exports the four, so install-version-marker.ts and update-capabilities.ts -- both survivors -- need no change this wave. The BoundedFileRead / AtomicWriteOptions types are not re-exported: no module outside that file ever imported them, and a re-export with no importer is a knip failure. Both stay exported from atomic-fs. Tests: the computeDirDigest describe block moves to atomic-fs.test.ts and the four durable-write primitives gain coverage there (they had none). The GENIE_HOME permission scan's exemption is re-keyed from a drifting <path>:<line> to a content anchor, with a new test asserting every exemption still matches exactly one real call site -- a stale line key failed OPEN, this one fails closed; and its atomicWriteFileSync pin follows the call to atomic-fs.ts.
…every home skills@1.5.23 ignores the `@<ref>` suffix and always serves the repository default branch, so `add <repo>@v<version>` was never a pin. The channel now points the CLI at $GENIE_HOME/skills — the signed tarball's own bytes — and records `source: 'local:<abs root>'` beside the release tag. The same install now records what the CLI ACTUALLY wrote: a bounded $HOME discovery scan (depth/entry/wall-clock caps, symlinks never followed) unioned with the known-home floor replaces the four-row table that reported 4 where the CLI had written 57, and the operator line prints that real N. A pre-install collision snapshot backs up every foreign same-named skill directory --copy is about to overwrite, records it in an optional `collisions[]`, and reports it. `source` and `collisions` are optional so every 5.260830.x record on disk still parses and still drives `genie uninstall`.
…private legacy-integration-retirement.ts was agent-sync.ts's only surviving non-test importer, pulling nine symbols. computeFileDigest went to atomic-fs.ts with the digest cluster; the other eight -- MANIFEST_NAME excepted -- are now copied verbatim into the retirement module as module-private, with their transitive leaf helpers (the manifest parsers, the physical-identity reader, the workflow ownership read, the Hermes profile resolver). Decision 6: this module is deleted two stable releases after the wish ships, so a new shared home would outlive its only user. MANIFEST_NAME and PHYSICAL_TREE_IDENTITY_VERSION are imported from atomic-fs rather than copied: they travelled there with computeDirDigest, which outlives this module, and a second definition of the manifest name would silently diverge on what counts as a managed directory. The Hermes managed-skills marker becomes this module's own constant. Its drift guard pinned the literal inside hermes-skills-config.ts, which Group 5 deletes; a guard that fails on the deletion rather than on drift is not a contract. The mcp half of that test stays -- hermes-mcp-config.ts survives. No cycle: atomic-fs <- lifecycle-lease <- agent-sync, and retirement imports neither upward.
…ne safety
Five hardening items the Wish A G2/G3 reviews carried into this wish:
writeJsonDocument now stages, fsyncs, renames and fsyncs the directory. It
rewrites the user's known_marketplaces.json and settings.json in place, so a
truncating writeFileSync that died mid-flight destroyed exactly what this
module's backup-first story promises never to lose. Every failure path unlinks
the staging file; the target's mode survives the republish. The cost is that an
unwritable parent directory now fails the write instead of truncating in place,
and that failure is reported per-surface with the original bytes intact.
Two surfaces join the roster, taking LEGACY_INTEGRATION_SURFACES to seventeen:
codex-role-agent-inventory (the .genie-role-agents.json sidecar plus every
.genie-role-agents.{txn,conflict,prepare,committed-cleanup}-* directory a
crashed transaction left, none of which the genie-*.toml classifier ever saw)
and claude-marketplace-cache (~/.claude/plugins/marketplaces/automagik, which
inspectRuntimeIntegrationEvidence kept reading as installed evidence long after
retirement). Each has managed-clean / managed-modified / unmanaged / absent
coverage, and a new end-to-end test proves one run flips the evidence probe to
{codex:false, claude:false} while a second prints nothing to retire and
allocates no backup root.
planCodexPluginRegistrationRemoval now tracks TOML multi-line strings. A
"""...""" or '''...''' body containing a line that reads like a table header
used to either start a drop inside an unrelated operator's value or end the
genie table's drop early; three of the four new tests fail on the prior code.
A sidecar-less directory in the hidden .curated lane is now reported by path as
kept with a reason instead of being skipped silently. The same rule is
deliberately NOT applied under ~/.claude/skills, where the skills.sh channel's
own plain copies live and an advisory per skill would bury the report.
The scan's cap counted every directory entry, so on an ordinary developer $HOME it exhausted 50,000 long before the walk finished: a real host measures 112,885 entries under the same depth and prune rules. The scan reported `capped`, `agentDirs` fell back to the four-row known-home table, and the honest-N defect this group exists to fix survived in production. The cap now counts only the directories the walk considers (files, symlinks and pruned trees are free) and the ceiling is a runaway-walk backstop at 200,000 with the 10 s wall clock as the binding bound. Measured on this host after the change: status ok, 221 homes, 353 ms. A delivered $GENIE_HOME also holds a second, byte-identical skills tree at plugins/genie/skills, freshly stamped by tarball extraction — exactly what the selection rule keeps — so it could be recorded as an agent home and land in the uninstall manifest. The scan now prunes $GENIE_HOME whole, which on this host also removes plugins/hermes-genie/skills and an update staging payload a mirror-only prune would have missed. Collision backups taken before a FAILED install were also unreported: the snapshot runs pre-spawn, but the ok:false outcome carried no warnings, so an operator whose install then failed had no path to the bytes in state-backups. Warnings now ride both outcome variants and the convergence helper prints them after the failure line. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GKqeXSyZMD8YmQtk4vtXFZ
…nvergence The update-convergence retirement test pins the exact sorted surface list one pass retires. Its fixture's `~/.codex/agents` carries the `.genie-role-agents.json` sidecar, which the new surface now classifies and removes, so the list grows by one entry. CI caught it: this file is not in the group's local validation set, and the full suite OOMs the dev host.
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Team Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Wish skills-everywhere-b, Group 3. Removes authenticated Codex delivery, activation, generations, fallback lanes, repair/rollback and role profiles; leaves `doctor` with only the checks whose dependencies survive; decouples `genie uninstall` from the Codex lifecycle lease and runs plugin-era retirement before the home is removed. Rehomed first, so no surviving consumer loses a primitive: - src/lib/release-payload-proof.ts parseReleaseVersion + scanPhysicalTree - src/lib/delivery-evidence-verify.ts the offline evidence verifier - src/lib/delivery-evidence-verify.test-support.ts its deterministic pack - route-layer classifier -> src/lib/codex-project-mcp.ts (MCP surface) `genie update --publish-local-delivery` survives with its production verification reassigned: it materializes the request, extracts and proves the candidate, and runs the real embedded-trust-root verifier, then reports `delivery-verified` (exit 0). The release-update-path-smoke assertion moves with it. Manifests are delisted from the five toolchain lists in this same commit, and the codex-smoke CI job leaves with the scripts it invoked.
Deliverable 8 stopped staging `.agents/plugins/marketplace.json` in build-binary.sh but left two consumers declaring it, one of them release-breaking. `INSTALL_PAYLOAD_MEMBERS` is an exact allowlist: verifyPayloadLayout compares the staged member count AND every sorted name, so a seven-member tarball against the eight-member list aborted install.sh's promoter with "staged install does not match the exact installer member allowlist". `bun test scripts/install-swap.test.ts` reproduced it (3 fail; 12 pass on the base commit). Drop the entry and re-point the payload fixtures, including install-promotion.test.ts's per-member interruption scenarios, which used `.agents` as the first member. update.ts's AUXILIARY_DELIVERY_TREE_NAMES and syncAuxiliaryContent mirrored a tree that is no longer delivered, and the docblock still claimed parity with install.ts's AUX_LAYOUT_DIRS, which lost `.agents` in the same group. Proof: the freshly built linux-x64-glibc tarball's top-level set is exactly `.claude-plugin LICENSE VERSION genie plugins skills templates`. install.test.ts's negative assertion that an extracted `.agents/` is not a managed layout dir is deliberately left as-is.
…minal The job comment still described `codex-native-dogfood` as the other runner of the update-side delivery path and still promised an activation withheld "until explicit consent". Both left with the Codex activation store: the mode's terminal is now offline evidence verification, and the harness reference is stale on a head that no longer ships setup --codex.
…ents Completes the previous commit: `EXPECTED_MEMBER_KINDS` is keyed by `InstallPayloadMember`, so leaving `.agents` there is a typecheck error once the allowlist loses it (TS2353, caught by the pre-push gate). Carries the wish amendments in the same commit because this worktree may not rebase: amend the four G3 criteria the head legitimately contradicts (the publish-local-delivery terminal, the codex-module grep's two non-importer classes, the dropped integrationSummary key), transfer the two deferred deliverable halves to the groups that own them by name (D5's role-agent transaction engine to G5 D3, D7e's agent-sync import block to G5 D2), record the codex-native-dogfood release freeze that runs from G3 to G6, and add the installer payload-member rule the .agents delisting turned out to need.
# Conflicts: # src/lib/skills-installer.ts
…ayload Wish skills-everywhere-b, Group 4. One commit so `check` never observes a half-deleted plugin. Deleted: src/hooks/** (27 files: six handlers, the fail-closed envelope, `genie hook dispatch`, the Codex wire adapter, the quarantined trust loader), tests/hooks/, src/term-commands/hook/, the Claude marketplace plugin and the Kimi payload under plugins/genie (.claude-plugin, .kimi-plugin, agents, hooks, workflows, rules, scripts, the skills mirror, settings.json, genie.ts, index.ts and every reference except orca-orchestration.md), root .claude-plugin/marketplace.json, and the six lint scripts that existed only to lint them (council-workflow-lint, hook-bundle-parity, hook-budgets-lint, hook-content-binding, plugin-executables-check, sync-plugin-skills) with their tests and fixtures. `check` is now exactly eight steps and `check:fast` seven: the six `lint:*` gates and `hooks:bind` leave both compositions, ci.yml drops the five matching steps, and build-tarballs.yml drops their path filters. Payload contract: `.claude-plugin/` was staged only for the deleted marketplace manifest, so it leaves INSTALL_PAYLOAD_MEMBERS, AUX_LAYOUT_DIRS, syncAuxiliaryContent and the five toolchain version lists in the same commit — a tarball with a member the installer's exact allowlist does not name is rejected by install.sh's promoter, invisibly to `check`. fresh-install-smoke loses its whole plugin-layout half (it can no longer resolve a payload that does not ship) and derives its inventory from skills/*/SKILL.md; build-binary.sh stops passing --plugin-root. Orphans the deletions exposed, removed rather than left reachable: doctor's `omni hook timeout > pollBudget` check and its helpers, the 115s/125s PermissionRequest ladder constants in omni-config, the `hook` workspace exemption, and the council-stamp.cjs parity half of agent-sync.test.ts. plugins/genie/README.md is rewritten to Orca-only content with the release-docs content assertions re-pointed. AGENTS.md gets the minimum Decision-12 edit; README.md/CLAUDE.md get the command-inventory edit the live CLI registry test forces (16 -> 15 commands). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GKqeXSyZMD8YmQtk4vtXFZ
…anifests The .claude-plugin and .kimi-plugin manifests this test read left with their payloads; the surviving shipped manifests are orca-plugin.json and the compatibility plugin.json beside it. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GKqeXSyZMD8YmQtk4vtXFZ
The rehomed SHIPPED_SKILL_NAMES check only ran when no --skills-dir was passed, i.e. when the scanned tree WAS `skills/` — a comparison of the tree against itself that can never fail. The two runs that see a real payload (build-binary.sh staged + extracted) passed --skills-dir and so skipped it, leaving the deleted per-skill mirror loop's coverage with no replacement. Enforce the inventory on every run, with an explicit --allow-partial-inventory opt-out used only by the synthetic fixture trees in the tests, and add a case that drops one skill from a copy of the real tree and asserts the failure. Also re-point the plugin README drift guard at three contracts the Orca-only rewrite actually asserts (lint:orca-bundle byte-binding, the symlink-free 2000-file cap, and "Genie never registers the plugin with Orca"), so the rewritten README keeps a guard instead of losing one.
…ere-b Four ledger findings from the G4 execution review, none a code defect: - AC 1 (headline grep) amended the way G3's was: the residual hits are classified into two non-importer classes — negative guards / banned-token lint rules, and the surviving council-template stamper in agent-sync.ts, which G5 D2 deletes. - AC 7 scoped out `.genie/wishes/**`: the four remaining hits are a shipped wish's own validation evidence, invoked by no workflow, husky hook or package script. Each of the three scripts gets a retirement header; their bodies stay byte-unchanged so the shipped evidence is not falsified. - Decision 10 amended: the `omni hook-timeout` doctor check is G4's, not G3's, because its subject is the `hook dispatch` command this group deletes — it could only ever emit advice about a command that is gone. - D5 records the `.claude-plugin` payload-member removal as an installer payload contract change (INSTALL_PAYLOAD_MEMBERS, AUX_LAYOUT_DIRS, AUXILIARY_DELIVERY_TREE_NAMES, five toolchain lists) and hands the stale `$GENIE_HOME/.claude-plugin` host residue to Wish C, as with `.agents`. D2 and D4 also record what "re-pointed" has to mean for the plugin README assertions and for the shipped-skill inventory.
… manifests Removes plugins/hermes-genie/** (19 files) and plugins/pi-genie/** (7 files) with the toolchain lists that stamp them: scripts/version.ts (and its now subject-less YAML manifest machinery), scripts/release-guard.sh's version-child delta, and .github/workflows/version.yml, which drops from five version files to three (package.json, plugins/genie/orca-plugin.json, plugins/genie/package.json). Re-points version-format, version-ci-staging, release-guard and release-docs tests, and removes the two README paragraphs whose only content was a link into the deleted plugin tree. Wish: skills-everywhere-b, group 5 deliverable 1.
… live consumers Removes `src/lib/agent-sync.ts` (6,597) with its 4,913-line suite, `src/lib/hermes-skills-config.ts` (whose tier-3 root was the plugin skills mirror group 4 deleted), `scripts/generate-codex-fallback-allowlist.ts`, and the two fixtures that fed only those files. `src/lib/hermes-mcp-config.ts` and `src/lib/codex-config.ts` stay: the retirement module and the doctor OTel check are their named consumers. runtime-integrations.ts drops from 4,339 to 2,087 lines. The Codex role-agent transaction engine leaves by name — the CODEX_AGENT_* transaction prefixes, the inventory writer `publishRoleAgentTransaction` and BOTH its call sites (`installCodexAgents`, `removeCodexAgents`), `recoverCodexAgentTransactions`, `convergeCodexPlugin`, `convergeCodexPluginOnly`, `installCodexIntegration` — together with the Codex fallback classification/retirement API, `inspectManagedSkillTree` payload verification, `proveCodexPluginHealth`, `translateRetirementConflicts` and `CANONICAL_GENIE_SKILL_NAMES`. Role-agent removal is not lost: `legacy-integration-retirement.ts` already owns the `codex-role-agent` and `codex-role-agent-inventory` surfaces plus their transaction debris, and `genie uninstall` runs it. `inspectCodexAgentOwnership`, `removeCodexPluginRegistration`, `setCodexPluginEnabled` and `CODEX_AGENT_INVENTORY_NAME` survive as that module's imports. Every symbol with no surviving consumer is deleted or un-exported. `genie update` now runs skills-channel convergence, then the Claude plugin refresh, then plugin-era retirement, under one lifecycle lease and with no sync step and no `~/.genie/.last-agent-sync` throttle marker. `--sync-only` keeps its CLI surface and converges through the same manual convergence with no manifest fetch and no binary swap. `genie install` loses its sync seam. `genie uninstall` drops the whole managed-asset removal subsystem (the `agent-sync.js` import block, the flat-agent transaction machinery, the transaction-recovery lanes and the compatibility `performUninstall` seam). The durable batch journal is therefore v4: `agentAssets`, `codexRoleAgents` and `codexRoleInventoryStatus` leave the scope, and v3 joins v1/v2 in the read-only legacy lane that authenticates a journal before discarding and re-recording it. `ordered-lifecycle-leases.ts` keeps its shape with the lease renamed off the retired engine. Also removes the now-obsolete SCAN_EXEMPTIONS entry and every stale agent-sync prose site. The only remaining matches are the `genie-agent-sync` manifest `managedBy` wire contract retirement reads on legacy hosts and the published `genie-agent-sync-migration-v1` release-note marker. Wish: skills-everywhere-b, group 5 deliverables 2, 3, 4 and 6.
…d lane
The v3 -> v4 generation bump taught readUninstallBatchDecision to raise
LegacyUninstallBatchJournalError for a v3 record, but the guard in
discardLegacyUninstallBatchDecision was never extended past v1/v2. The
migration arm in executeUninstallBatch responded to that error by calling
discard, which threw from inside the catch clause, so the error escaped and
the whole uninstall aborted.
v3 is the generation every shipped and dev binary wrote, so any host whose
uninstall was interrupted before this branch could never uninstall again on
the new binary -- the exact fail-closed-forever regression the v3 legacy read
lane exists to prevent.
Adds writeLegacyV3Journal plus three tests that cover the lane the defect
shipped through: a clean migration re-recorded as v4, an interrupted-member
note, and a tampered v3 that still fails closed. Verified they fail on the
unfixed guard.
Also corrects five doc sites that pointed at symbols deleted in this group:
the two runtime-integrations {@link installCodexAgents} references, the
atomic-fs computeExactDirDigest mention, and the two uninstall comments that
still called the fresh generation v3.
… widening AC 1's literal "returns nothing" cannot hold: the token is also the vocabulary of two wire contracts and of the negative guard AC 3 requires. Amended to the three-named-class shape G3 and G4 already carry, with all 26 residuals classified and a fourth class still a regression. Deliverable 2 gains the record for two contract changes the group made that no wish decision covered: --sync-only becoming the ordinary manual convergence (and so performing a backup-first retirement it never performed before, with the two rejected alternatives stated), and the uninstall journal v3 -> v4 bump with its obligation to extend both the read and the discard guard.
`scripts/build.js` compiled hook executables and regenerated `plugins/genie/package.json`; both compile targets left with the hook runtime and the plugin manifest is now a reviewed, committed Orca-payload file. `scripts/sync.js` copied the plugin into `~/.claude/plugins/genie`, which no longer exists. Their `build:plugin`, `sync` and `build-and-sync` npm scripts and the `scripts/build.js` build-tarballs path filter go with them. `scripts/version.ts` gains a read-only `--check` mode. The bare command read no argv at all and always performed a real bump, so the three-file version set had no runnable verification; `--check` reports the targets and their bump-readiness and exits 0 without writing, and any other argv is rejected before any mutation. CLAUDE.md's version-file sentence follows the set down to three.
Closes the G3 release freeze. `codex-native-dogfood` and its
`codex-dogfood-completeness` roll-up exercised `genie setup --codex`, the
activation-pending update terminal and the doctor integrationSummary — all
deleted in G3 — so both jobs were guaranteed red on every head carrying G3.
They leave together with `tests/support/codex-dogfood-{harness,harness.test,entry-runner}.ts`,
`scripts/validate-live-dogfood-evidence.ts` and
`scripts/validate-dogfood-matrix-evidence.ts` (with their tests): 3,889 lines.
`publish.needs` drops exactly one edge, `codex-dogfood-completeness`, with its
matching if-guard; `admit`, `attest-delivery-evidence`,
`delivery-evidence-compatibility`, `skills-install-smoke`,
`release-update-path-smoke` and `stable-release-security-gate` all remain with
their guards byte-intact, and `release-update-path-smoke` keeps depending on
`genie update --publish-local-delivery`.
`scripts/candidate-dogfood-matrix.ts` is KEPT: `prepare-delivery-evidence`
derives the platform inventory and the update-path projection from it, and
`stable-release-security-gate` — itself a `publish.needs` edge — re-derives and
`cmp`s it. Only the `dogfood_matrix` job output, whose sole consumer was the
deleted matrix, goes with them; the JSON artifact it projected is still built,
uploaded and consumed.
`scripts/run-musl-dogfood.sh` and `.github/workflows/musl-adapter-smoke.yml` are
byte-unchanged against origin/dev.
Measures every wish-level criterion on the assembled head 3d56eed rather than inferring it from the group PRs. C4: 60,189 -> 38,308 non-test src/ lines (-21,881, -26 files), measured with the criterion's exact command in a detached worktree at 18b8534 and on the wish head; top-10 departed files, all 29 departures and the 12 largest survivor shrinks recorded. C5-lite, C7, C8, C9, C11, C-G, C-R4 and C-A each carry a pasted command and its output. C8 is met with one classified residual: the only diff against origin/dev in the Orca file set is a comment-only hunk in scripts/orca-bundle-parity.ts, zero executable bytes. C-R4 is a real fresh-host cycle in a throwaway fixture: install from the linux-x64-glibc candidate tarball records 57 agent dirs and 57 are measured by the dogfood evidence command; uninstall removes 1,425 recorded skill dirs (25 x 57), leaves zero genie skill dirs under HOME, removes the record, and leaves both planted foreign skills byte-identical. Records one HIGH finding found by that pass, with no src change: genie install --integrations claude|all aborts with a stack trace because G4 deleted the marketplace manifest that the surviving Claude runtime integration still registers. Three candidate dispositions are handed to the orchestrator. Full bun run check is substituted by check:fast plus the named CI Quality Gate run per the host OOM rule; the four-platform build matrix, the live candidate release run and the CI release-guard leg are recorded as post-merge acceptance.
The full bun run check that the host OOM rule prevents locally is proven by CI run 33455733167 (pull_request, PR #2878) on 3d56eed - the exact assembled head every measurement in this document was taken from - with both 'Quality Gate (typecheck + lint + test)' and 'Unit (build + typecheck + lint + dead-code + test)' success, and again by run 33456983012 dispatched on this branch head 6a011f6. ci.yml only triggers on pull requests into main or dev, so a group PR based on the wish branch gets no automatic run; the branch run was raised explicitly with gh workflow run. The full gate therefore leaves the post-merge acceptance list.
…etic Fix loop 1 for the Group 7 review (FIX-FIRST). All four findings were independently re-verified on this head before acting. MEDIUM — C-G was not "pasted in full" as Deliverable 2 requires, and the three class subtotals were back-fitted to the correct 105 total rather than counted (79/13/13 published; 86/9/10 actual). Paste the raw 105-line `git grep -n` output plus the `git grep -c` per-file table the classes sum from, correct the subtotals with per-class arithmetic, drop the phantom `build-delivery-evidence.ts:227` reference, and fix four wrong per-file counts. The conclusion is unchanged: three classes, no fourth. LOW — C4's line-accounting prose was wrong by 164 lines in two places (shrink 6,961/12 files, growth "the residual 2,000"). Replace it with a five-term per-file table: departed 17,685 / shrunk 6,797 (13) / grown 1,836 (7) / arrived 765, reconciling to 38,308 exactly. Add the shrink listing's missing 13th row. The headline delta was always exact. LOW — two pasted outputs went stale once this evidence file became tracked (`git ls-files` 3 to 4, `wishes-lint` 84 to 85). Both re-run on the current head with a note naming the cause. HIGH (Finding H1) — no code change. The review confirmed it is not a Group 7 defect and does not block this docs-only PR; it does block the wish merging to dev. H1 now carries the reviewer's line-by-line confirmation table and an explicit block/no-block status.
…ime-integrations G4 deleted the root .claude-plugin/marketplace.json and delisted the payload member, but the Claude runtime integration that registers it survived G5. On any host with the claude CLI, `genie install` printed a spurious failure line and an explicit `--integrations claude` (or `all`) aborted with an unhandled stack trace and exit 1, which install.sh treats as a fatal, incomplete installation. Found by the Group 7 fresh-host pass as finding H1. Executes the ratified disposition A: the install-side Claude subsystem is deleted rather than guarded, because G5 deliverable 3's exhaustive keep-list already excludes every one of its symbols. Deleted from src/lib/runtime-integrations.ts (2,088 -> 1,364 lines): installRuntimeIntegrations, InstallIntegrationsOptions, IntegrationResult, convergeClaudePlugin, installClaudeIntegration, convergeClaudePayloadIdentity, addClaudeMarketplace, verifyClaudePhysicalPayload, ClaudePayloadVerifier, readClaudeMarketplaceSource, fingerprintPhysicalPluginTree, hashPhysicalFileIncrementally, parseClaudePluginState and its validators, the whole RefreshIntent state machine, runChecked, IntegrationCommandError, and the bundle-root resolver with its GENIE_BUNDLE_ROOT probe. RuntimeName and RuntimeExecutableResolver stop being exported. src/genie-commands/update-integrations.ts is deleted whole (refreshUpdatePlugins was its only export and convergeClaudePlugin its only subject), taking narrowUpdatePluginRefreshSelection, ManualUpdateConvergenceResult.integrations and the failed-integration exit arm out of update.ts. install.ts loses the integration-results block: an explicit runtime selection now reports the retirement on one green line and cannot fail. Kept, each with a named consumer: inspectRuntimeIntegrationEvidence, removeRuntimeIntegrations, inspectCodexAgentOwnership, setCodexPluginEnabled, removeCodexPluginRegistration, CODEX_AGENT_INVENTORY_NAME, the consent read/write, CommandRunner/CommandResult/runBoundedIntegrationCommand, resolveRuntimeExecutable and IntegrationSelection. `genie update --sync-only` keeps the ratified contract in substance: it is still identical to a plain `genie update`'s convergence on the same head. The Claude refresh leg is now a structural no-op, so the ledger wording needs a one-line amendment; that is proposed in the PR, not applied here. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GKqeXSyZMD8YmQtk4vtXFZ
…d genie hook command
namastex888
marked this pull request as ready for review
September 1, 2026 02:26
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: af17e62ce2
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Comment on lines
118
to
122
| for required in \ | ||
| "LICENSE" \ | ||
| ".agents/plugins/marketplace.json" \ | ||
| ".claude-plugin/marketplace.json" \ | ||
| "plugins/genie/.codex-plugin/plugin.json" \ | ||
| "plugins/genie/.kimi-plugin/plugin.json" \ | ||
| "plugins/genie/orca-plugin.json" \ | ||
| "plugins/genie/orca-entrypoint.min.js" \ | ||
| "plugins/genie/.claude-plugin/plugin.json" \ | ||
| "plugins/genie/hooks/hooks.json" \ | ||
| "plugins/genie/hooks/codex-hooks.json"; do | ||
| "plugins/genie/orca-entrypoint.min.js"; do | ||
| [[ -f "${STAGE}/${required}" ]] || { echo "error: release payload missing ${required}" >&2; exit 1; } |
There was a problem hiding this comment.
This required-file list now accepts a tarball containing only the Orca manifest and entrypoint, while the same change removes the staging of both marketplaces and deletes the Claude/Codex manifests. Consequently every newly built release omits payload members that the repository release contract explicitly requires, so the build can pass despite producing a contract-invalid archive.
AGENTS.md reference: AGENTS.md:L54-L56
Useful? React with 👍 / 👎.
Comment on lines
+1000
to
+1004
| const preScan = scanSkillsHomes({ | ||
| home: context.home, | ||
| sourceRoot: context.skillsRoot, | ||
| genieHome: context.genieHome, | ||
| }); |
There was a problem hiding this comment.
When this pre-install scan returns capped or failed, preScan.dirs is empty, but the status is ignored and installation continues using only the four known homes. On a large, slow, or unexpectedly unreadable home, a dynamically discovered agent home can therefore contain a foreign same-named skill that the subsequent --all --copy invocation overwrites without a backup or even an incomplete-scan warning; do not launch the overwriting install until collision coverage is established.
AGENTS.md reference: AGENTS.md:L30-L30
Useful? React with 👍 / 👎.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Executes the approved wish
.genie/wishes/skills-everywhere-b/WISH.md(plan SHIP round 3): honest, genuinely pinned skills install, then the staged deletion of every non-Orca integration (Codex plugin subsystem, hooks, Claude/Kimi/Hermes/pi, agent-sync, toolchain plugin coupling). Target: >= 20,000 non-test src/ lines removed against baseline 60,189.Waves land sequentially onto this branch via per-group PRs with review evidence (reviewer != engineer, <=2 fix loops):
Draft until G7 + the independent final-gate pass are green. Review ledger lives under
## Review Resultsin the wish.🤖 Generated with Claude Code
https://claude.ai/code/session_01GKqeXSyZMD8YmQtk4vtXFZ