From 940760d2878832ab3b347714e3ff79c5dcfaec58 Mon Sep 17 00:00:00 2001 From: Qwynn Marcelle Date: Tue, 21 Jul 2026 19:56:02 -0400 Subject: [PATCH 1/5] release: 0.1.9 --- CHANGELOG.md | 7 +++++++ README.md | 6 +++--- extension/README.md | 9 ++++++++- extension/package-lock.json | 4 ++-- extension/package.json | 6 +++--- package-lock.json | 4 ++-- package.json | 2 +- src/index.ts | 2 +- 8 files changed, 27 insertions(+), 13 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 0d3d829..5db1505 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +## [0.1.9] - 2026-07-21 + +### Fixed + +- Narrowed README evidence and outcome wording to the recorded co-change mechanism, without implying a documented production incident or a guaranteed Codex revision. +- Clarified local extension rendering and saved receipts versus explicit provider-backed advisory review across the root README, extension metadata, extension README, and Getting Started walkthrough. + ## [0.1.8] - 2026-07-21 ### Fixed diff --git a/README.md b/README.md index 482a0ff..7c9b5a5 100644 --- a/README.md +++ b/README.md @@ -25,9 +25,9 @@ | | | | --- | --- | | Task | Update the checkout route | -| Recorded evidence | The route and its webhook partner share a co-change history — an incident and a revert, not an import | +| Recorded evidence | The route and its webhook partner share a repeated co-change history, including a rounding change and its later revert—not an import. | | An incomplete patch | The hook denies it, citing the specific evidence and the omitted partner | -| Outcome | Codex revises the changeset before the edit lands | +| Outcome | The incomplete patch does not land; Codex receives the evidence and must account for the recorded partner before retrying. | ## Installation @@ -85,7 +85,7 @@ Let the installer handle the `code` CLI, idempotency, and the reload prompt for npx @workspacejson/codex-mcp install --with-extension ``` -This installs the `workspace-json.workspacejson-codex-decorations` extension: Explorer decorations on fragile files, a **current-change** view, a synchronized status item, and receipt-backed advisory review — all read from your local `.agents/workspace.json`, with no network calls and no telemetry. +This installs the `workspace-json.workspacejson-codex-decorations` extension: Explorer decorations on fragile files, a **current-change** view, a synchronized status item, and saved review receipts. The decorations, current-change view, status item, and saved review receipts read local workspace data with no telemetry. Running a new advisory review is a separate explicit action that sends only the supplied diff to the configured provider. The installer targets **VS Code Stable** only. If the `code` CLI isn't on your PATH it reports `UNAVAILABLE` with a one-line fix and leaves your MCP/hook install untouched — it never silently targets Insiders, Cursor, a remote, or a container. To aim it at a different editor's CLI deliberately, set `WORKSPACEJSON_CODE_CLI` (e.g. `cursor`) and rerun. diff --git a/extension/README.md b/extension/README.md index fe8bd03..ac0e476 100644 --- a/extension/README.md +++ b/extension/README.md @@ -22,7 +22,14 @@ The whole point of the surface is a distinction you can see in one hover: The rules said no. An independent model looked and found no additional blocker. **The block holds anyway.** Judgment and enforcement are separate planes: an advisory review can add signal, but it never lifts a deterministic decision, and `PASS` is scope-bounded — never a safety certification. -Everything is read from your local `.agents/workspace.json`. **No network calls. No telemetry.** +Explorer decorations, the current-change view, the status item, and saved +review receipts are read locally from `.agents/workspace.json`, with no +telemetry. + +Running **Run Advisory Review** is a separate explicit action. It sends only +the supplied diff to the configured OpenAI or OpenRouter provider and stores +the resulting attributed receipt locally. Deterministic enforcement does not +require an API key and does not transmit repository contents. ## Install diff --git a/extension/package-lock.json b/extension/package-lock.json index 4fb52eb..a58e32a 100644 --- a/extension/package-lock.json +++ b/extension/package-lock.json @@ -1,12 +1,12 @@ { "name": "workspacejson-codex-decorations", - "version": "0.0.1", + "version": "0.1.5", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "workspacejson-codex-decorations", - "version": "0.0.1", + "version": "0.1.5", "license": "Apache-2.0", "devDependencies": { "@types/node": "^22.0.0", diff --git a/extension/package.json b/extension/package.json index c6f3dcc..142f596 100644 --- a/extension/package.json +++ b/extension/package.json @@ -1,8 +1,8 @@ { "name": "workspacejson-codex-decorations", "displayName": "workspace.json — Codex change intelligence", - "description": "Surfaces recorded fragility, co-change partners, and receipt-backed advisory review for the file you are changing — Explorer decorations, a current-change view, and a status item, all read from your local .agents/workspace.json. No telemetry, no network.", - "version": "0.1.2", + "description": "Surfaces local workspace.json fragility, co-change partners, and saved advisory-review receipts in VS Code. No telemetry. Running a new advisory review is an explicit action that sends only the supplied diff to the configured provider.", + "version": "0.1.5", "publisher": "workspace-json", "license": "Apache-2.0", "engines": { @@ -217,7 +217,7 @@ { "id": "review", "title": "Run an independent advisory review", - "description": "GPT-5.6 reviews a bounded evidence bundle in a separate read-only session. Its result is advisory — it can surface additional risks or gaps, but it never overrides deterministic enforcement.\n[Run Advisory Review](command:workspacejson.runReview)", + "description": "GPT-5.6 reviews the supplied diff in a separate read-only session. Running this command explicitly sends only that diff to the configured OpenAI or OpenRouter provider and stores an attributed receipt locally. The result is advisory: it can surface additional risks or gaps, but it never overrides deterministic enforcement.\n[Run Advisory Review](command:workspacejson.runReview)", "media": { "image": "assets/walkthrough/review.svg", "altText": "Deterministic decision DENY beside advisory result PASS within reviewed scope." diff --git a/package-lock.json b/package-lock.json index 6167355..ec35001 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "@workspacejson/codex-mcp", - "version": "0.1.8", + "version": "0.1.9", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "@workspacejson/codex-mcp", - "version": "0.1.8", + "version": "0.1.9", "license": "Apache-2.0", "dependencies": { "@modelcontextprotocol/sdk": "^1.20.0", diff --git a/package.json b/package.json index 3fcdeaa..fe6a660 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@workspacejson/codex-mcp", - "version": "0.1.8", + "version": "0.1.9", "description": "MCP server that surfaces workspace.json fragility and co-change intelligence to OpenAI Codex before it edits code.", "license": "Apache-2.0", "type": "module", diff --git a/src/index.ts b/src/index.ts index 5ead151..83709ad 100644 --- a/src/index.ts +++ b/src/index.ts @@ -5,7 +5,7 @@ import { isVerifyEnabled } from "./config.js"; import { SERVER_INSTRUCTIONS } from "./constants.js"; import { registerWorkspaceTools } from "./tools/workspace.js"; -const VERSION = "0.1.8"; +const VERSION = "0.1.9"; function buildServer(): McpServer { const server = new McpServer( From 41a35a0b43a3030a8b3aafa1eab27eea40b8d6e5 Mon Sep 17 00:00:00 2001 From: Qwynn Marcelle Date: Wed, 22 Jul 2026 16:01:39 -0400 Subject: [PATCH 2/5] docs(audit): record reconciliation execution --- .../2026-07-22/remediation-checklist.md | 57 ++++++++ .../2026-07-22/remediation-results.md | 96 ++++++++++++++ .../repository-reconciliation-report.md | 122 ++++++++++++++++++ .../2026-07-22/repository-reconciliation.json | 30 +++++ 4 files changed, 305 insertions(+) create mode 100644 docs/audits/worktree-reconciliation/2026-07-22/remediation-checklist.md create mode 100644 docs/audits/worktree-reconciliation/2026-07-22/remediation-results.md create mode 100644 docs/audits/worktree-reconciliation/2026-07-22/repository-reconciliation-report.md create mode 100644 docs/audits/worktree-reconciliation/2026-07-22/repository-reconciliation.json diff --git a/docs/audits/worktree-reconciliation/2026-07-22/remediation-checklist.md b/docs/audits/worktree-reconciliation/2026-07-22/remediation-checklist.md new file mode 100644 index 0000000..604fb1b --- /dev/null +++ b/docs/audits/worktree-reconciliation/2026-07-22/remediation-checklist.md @@ -0,0 +1,57 @@ +# Remediation Checklist — proposed only + +No item below is authorized by this audit. Pause at every checkpoint. + +1. Preserve volatile Git evidence. + - Evidence: 12 prunable/missing worktrees (including two detached), and numerous unreachable commits from `git fsck --no-reflogs --unreachable`. + - Later tools: `git fsck --no-reflogs --unreachable`, `git bundle create`, `git format-patch`, `git status --short` in each accessible worktree. + - Expected result: a named preservation artifact and clean/dirty inventory without altering refs. + - Checkpoint: human verifies every unreachable commit selected for preservation and that no secrets are copied into a shared location. + - Rollback: preservation actions are additive; retain originals. + - Linear: comment HAC-136/HAC-206 only if a relevant preserved commit changes their assessment. + - Cleanup unlocked: none; this is a prerequisite. + +2. Reconcile the release baseline. + - Evidence: `release/0.1.9@940760d` is one ahead/one behind `origin/main`; main has `7d42a61 release: 0.1.9 (#13)`. + - Later tools: `git range-diff origin/main...release/0.1.9`, `git diff --stat`, `git patch-id`. + - Expected result: an explicit equivalent/superseded/divergent decision with files affected. + - Checkpoint: human selects whether release-only differences matter. + - Rollback: no mutation occurred; retain both refs. + - Linear: update/reframe HAC-206 after the decision. + - Cleanup unlocked: release branch only if equivalence and remote retention are proven. + +3. Review the security/config remediation as a bounded patch set. + - Evidence: `fix/adversarial-review-hac99-hac101` has 4 unique commits, including `.codex/config.toml`, hook and structured-output changes. + - Later tools: `git range-diff`, targeted tests, `npm run check`, exact-config server/no-write regression test. + - Expected result: explicit current-main compatibility and security review. + - Checkpoint: human approves any conflict resolution; do not silently select a policy outcome. + - Rollback: use a temporary reconciliation PR; close it if gates fail. + - Linear: HAC-99/HAC-101/HAC-129 only after validation evidence. + - Cleanup unlocked: none until PR is merged and patches are equivalent. + +4. Decide the HAC-136/176/177/178 old patch family. + - Evidence: three branches share `0041bdf`; Linear HAC-206 calls them stale/regressing, but the patch changes 20 files including fixture and extension code. + - Later tools: compare `d5fe7a0..0041bdf` to `main`, inspect fixture contract, execute extension and MCP tests. + - Expected result: preserve, selectively reconstruct, or formally supersede decision. + - Checkpoint: architecture owner approves any reconstructed fixture/extension behavior. + - Rollback: branch from current main; abandon only the new reconciliation PR, never the original evidence. + - Linear: HAC-136 comment/status only after demonstrated GPT-5.6/reviewer criteria. + - Cleanup unlocked: family aliases only after all unique commits are preserved/integrated/superseded with evidence. + +5. Refresh marketplace/onboarding work through a new PR. + - Evidence: `polish/extension-marketplace-metadata@b9ec0d9` has ten unique commits; HAC-206 explicitly called for a curated merge but targets obsolete 0.1.6. + - Later tools: create a fresh branch from `main`, selectively reconstruct `4380d63..b9ec0d9`, `npm ci`, `npm run check`, `npm run prepublishOnly` where release-scoped. + - Expected result: a reviewable PR with current version/installer semantics. + - Checkpoint: verify packaged artifact and Node 20/22 CI results; inspect resulting release version. + - Rollback: close PR; no canonical-branch mutation. + - Linear: post the HAC-206 paste-ready comment and link the PR. + - Cleanup unlocked: source branch only after PR merge plus patch-equivalence proof. + +6. Reconcile Linear, then plan cleanup. + - Evidence: HAC-136 is In Progress despite stale branches; HAC-206 is a Backlog 0.1.6 inventory while repository is 0.1.9. + - Later tools: Linear issue/comment reads and authorized updates; `git branch --merged origin/main`; `git worktree list --porcelain`; `git cherry`. + - Expected result: every issue’s status reflects verified implementation, not code presence. + - Checkpoint: human reviews every deletion candidate’s unique-commit, clean-status, PR, backup, and Linear evidence. + - Rollback: do not delete; preservation branches/bundles remain. + - Linear: apply only approved status/comment changes. + - Cleanup unlocked: only individually proven worktrees/branches; never a broad prune or garbage collection. diff --git a/docs/audits/worktree-reconciliation/2026-07-22/remediation-results.md b/docs/audits/worktree-reconciliation/2026-07-22/remediation-results.md new file mode 100644 index 0000000..f8dd847 --- /dev/null +++ b/docs/audits/worktree-reconciliation/2026-07-22/remediation-results.md @@ -0,0 +1,96 @@ +# Reconciliation Execution Results — 2026-07-22 + +## Phase 0 — Drift Check and Preservation + +Audit identifier: `worktree-reconciliation/2026-07-22`. + +| Check | Command / connector | Result | Classification | +| --- | --- | --- | --- | +| Canonical remote ref | `git log -1 origin/main` | `7d42a61 release: 0.1.9 (#13)` | `SAFE_DRIFT` — unchanged from audit evidence | +| Local main ref | `git log -1 main` | `c14ef4e`; five commits behind cached `origin/main` | `SAFE_DRIFT` — already recorded in audit | +| Worktrees | `git worktree list --porcelain` | 15 registered; 12 prunable/missing; detached scratch remains `e0827a8` | `SAFE_DRIFT` — corrected audit count preserved in artifacts | +| Local branches | `git for-each-ref refs/heads` | 30 local branches | `SAFE_DRIFT` — unchanged | +| Root state | `git status --short --branch`, `git stash list` | audit artifacts were untracked; no stashes | `SAFE_DRIFT` — audit package is unique uncommitted work | +| GitHub / PR / CI / protection | `git remote show origin` | DNS resolution failed for `github.com` | `BLOCKING_DRIFT` — cannot refresh required PR/check/protection evidence | +| Linear HAC-136 | Linear `get_issue` | In Progress; acceptance still requires real product-path reviewer, visible artifact, demo, and docs | `SAFE_DRIFT` | +| Linear HAC-206 | Linear `get_issue` | Backlog; still a 0.1.6 merge inventory | `SAFE_DRIFT` | + +`workspace_get_file_context` was unavailable in this session. Per `AGENTS.md`, that is recorded as unavailable and is not treated as a safety signal. + +### Preservation action + +- Created local branch `audit/reconciliation-2026-07-22` from `release/0.1.9@940760d`. +- This branch preserves the three audit artifacts and this execution log as one documentation-only audit record. No implementation, configuration, generated artifact, Git history rewrite, stash, worktree, branch deletion, or Linear mutation was performed. +- Backup/rollback reference: local branch `audit/reconciliation-2026-07-22`; rollback is a normal branch deletion only after the documentation is merged or otherwise archived. + +## Phase 1 — Approved Merge Waves + +No wave was executed. + +| Planned item | Source / target | Action | Reason stopped | Remaining risk | +| --- | --- | --- | --- | --- | +| Wave 0 preservation of missing/prunable worktrees | 12 prunable registrations and unreachable objects | Inventory only | Existing worktree paths are absent; no destructive worktree operation permitted | Unreachable work remains at risk until separately bundled/archived | +| Wave 1 release baseline | `release/0.1.9@940760d` vs `origin/main@7d42a61` | Not started | Requires current PR/protection evidence and a human release-equivalence decision | Release delta remains unreconciled | +| Wave 2 security + HAC-136 patch families | `0821fac..8dea6cc`; `d5fe7a0..0041bdf` | Not started | Audit requires manual architectural decisions; GitHub status unavailable | Unique work remains preserved but unverified | +| Wave 3 marketplace refresh | `4380d63..b9ec0d9` to fresh PR from current main | Not started | Required PR workflow and checks cannot be verified while GitHub is unreachable | Marketplace/onboarding work remains unintegrated | +| Wave 4 validation / Linear | all affected issues | Not started | No integration occurred; completion criteria not revalidated | Linear intentionally unchanged | +| Wave 5 cleanup | branches/worktrees | Not started | Preconditions not met and external evidence unavailable | No deletion performed | + +### Phase 0 re-check after GitHub connectivity was restored + +The initial DNS block was transient. After re-authentication and `git fetch origin --prune --tags`, the following post-audit facts were established: + +- **SAFE_DRIFT:** no open pull requests; `main` is unprotected (GitHub branch-protection endpoint returns HTTP 404). +- **SAFE_DRIFT:** PR [#9](https://github.com/workspace-json/codex-mcp/pull/9) merged `polish/extension-marketplace-metadata` at `40b73cb`; its merge diff exactly matches the branch's 15-file / 309-insertion / 15-deletion payload. Its Node 20 and Node 22 `build-and-smoke` checks succeeded. +- **SAFE_DRIFT:** PR [#13](https://github.com/workspace-json/codex-mcp/pull/13) merged `release/0.1.9` at `7d42a61`; its merge diff exactly matches `release/0.1.9@940760d`'s 8-file release payload. Its Node 20 and Node 22 `build-and-smoke` checks succeeded. +- **REQUIRES_REPLAN:** the audit's proposed marketplace-refresh wave is already integrated by PR #9 and must not be reimplemented. +- **REQUIRES_REPLAN:** PR [#1](https://github.com/workspace-json/codex-mcp/pull/1), the `fix/adversarial-review-hac99-hac101` security/config remediation, is closed unmerged. Its two CI checks succeeded, but four commits / 13 files remain unique to the local branch. The audit-required architecture decision remains unresolved; no cherry-pick was performed. +- **REQUIRES_REPLAN:** release branches `origin/release/0.1.7` and `origin/release/0.1.8` were deleted remotely. Their local branches and all missing/prunable worktree registrations remain preserved because their untracked state cannot be proven absent. + +No Linear update is justified by this drift alone: the validated PR evidence confirms integration history but does not satisfy HAC-136's remaining product/demo/docs criteria or resolve HAC-206's stale scope. + +## Validation Performed + +| Scope | Command | Result | +| --- | --- | --- | +| Audit JSON | `node -e JSON.parse(...)` with branch/worktree counts | PASS: valid JSON; 30 branches and 15 worktrees enumerated | +| Audit formatting | `git diff --check -- docs/audits/worktree-reconciliation/2026-07-22` | PASS | +| Runtime/package validation | Not run | Not applicable: no runtime/package change; full integration validation remains blocked | +| Adversarial review | `codex exec review --uncommitted --ephemeral` | INCOMPLETE: reviewer inspected the artifacts but did not emit a final verdict; Linear OAuth refresh failed. A count discrepancy discovered during review was corrected before this log. | + +## Pull Requests and Linear Updates + +- Pull requests: no implementation PR was created or updated. Historical PR #9 and PR #13 are verified merged; PR #1 is verified closed-unmerged. A documentation-only PR for this audit record may be opened after the preservation commit is pushed. +- Linear: none created, edited, commented on, closed, reopened, or canceled. HAC-136 and HAC-206 were read only. + +## Cleanup + +None. No worktree, branch, stash, untracked file, commit, or remote ref was removed or rewritten. + +## Final Repository State + +- Canonical integration reference: `origin/main@7d42a61` (cached local tracking ref; remote freshness unavailable). +- Current branch: `audit/reconciliation-2026-07-22`, created from `release/0.1.9@940760d`. +- Remaining worktrees: 15 registered; 12 prunable/missing. +- Remaining branches with unique/unverified work: unchanged from the audit, including the `0041bdf` family, `fix/adversarial-review-hac99-hac101`, `polish/extension-marketplace-metadata`, and `release/0.1.9`. +- Remaining stashes: none observed in root worktree. +- Remaining uncommitted implementation: none introduced by this execution; audit documentation will be committed on the dedicated audit branch. +- Open reconciliation pull requests: none observed at the post-authentication re-check; the documentation-only audit PR is pending creation. +- Linear issues still requiring correction: HAC-136 and HAC-206; no updates are justified without verified integration. +- Validation status: audit-file integrity PASS; repository-wide integration validation NOT RUN because no integration was performed. +- Cleanup status: blocked; no cleanup is safe. + +## Unresolved Items + +1. Reclassify PR #9 marketplace work and PR #13 release work as historical integration, not pending merge candidates. +2. Obtain the human architecture decision for the closed-unmerged security/config remediation and HAC-136 fixture/extension patch families. +3. Preserve/bundle unreachable commits and inspect missing-worktree state before any prune, deletion, or garbage collection. +4. Review HAC-136 and HAC-206 against current acceptance criteria after the architecture decisions; then make only evidence-backed Linear changes. + +## Attestation + +- All approved unique work was preserved: **PARTIAL** — the audit artifacts are preserved on the dedicated audit branch; unreachable/missing-worktree work was not yet bundled because the audit requires an explicit per-object preservation review. +- All successful integrations were validated: **NOT APPLICABLE** — no integrations were performed. +- Linear was updated only after repository verification: **YES** — Linear was not modified. +- Every removed worktree and branch was proven redundant or intentionally archived: **YES** — none were removed. +- Any item remains whose safety is unknown: **YES** — 12 prunable/missing worktrees, unreachable commits, GitHub PR/check/protection state, and architecture decisions remain unresolved. diff --git a/docs/audits/worktree-reconciliation/2026-07-22/repository-reconciliation-report.md b/docs/audits/worktree-reconciliation/2026-07-22/repository-reconciliation-report.md new file mode 100644 index 0000000..7bebcd1 --- /dev/null +++ b/docs/audits/worktree-reconciliation/2026-07-22/repository-reconciliation-report.md @@ -0,0 +1,122 @@ +# Repository Worktree and Linear Reconciliation Audit — 2026-07-22 + +## Executive Finding + +- **OBSERVED:** Repository is `workspace-json/codex-mcp` (`origin` and `package.json`). The working directory is `/Users/user1/Documents/workspacejson-codex-mcp`. +- **OBSERVED:** `origin/HEAD -> origin/main`; CI only runs push/PR validation for `main` (`.github/workflows/ci.yml`). `main` is therefore the canonical integration branch. Branch protection is **UNKNOWN** because GitHub could not be contacted (DNS failure). +- **OBSERVED:** 15 registered worktrees exist: 2 accessible (root and `.claude/worktrees/readme-hero-polish`), 12 prunable/missing, and 1 detached scratch worktree. The root is clean; no stash exists. +- **OBSERVED:** Four patch-bearing candidates remain outside `origin/main`: the `0041bdf` HAC-136/176/177/178 family, `fix/adversarial-review-hac99-hac101`, `polish/extension-marketplace-metadata`, and the release-only `release/0.1.9` commit. +- **OBSERVED:** The highest-loss risk is unreachable commit history: `git fsck --no-reflogs --unreachable` reported many unreachable commits, and 12 registered worktrees are prunable. Do not prune, remove, or garbage-collect before preservation review. +- **INFERRED:** `release/0.1.9` is a release-line commit already superseded by `origin/main` commit `7d42a61` (“release: 0.1.9 (#13)”), but exact patch equivalence was not proven because its sole commit has a different patch-id sign (`git cherry -v origin/main release/0.1.9` reports `- 940760d`). It is not a cleanup candidate yet. +- **OBSERVED:** Linear workspace/team/project are Marcelle Labs / Hackathon Squad / OpenAI Build Week Hackathon '26'. Relevant issue state conflicts with repository state for HAC-136 (Linear In Progress; several stale experimental branches), HAC-206 (Linear Backlog but describes a prior 0.1.6 cut while repository ships 0.1.9), and the future-facing marketplace branch. +- **Final:** repository is **not ready for cleanup**. First action is preservation/triage of unreachable commits and prunable worktree registrations; no merge is authorized by this report. + +## Repository Baseline + +| Item | Evidence | Finding | +| --- | --- | --- | +| Remote | `git remote -v` | **OBSERVED** `https://github.com/workspace-json/codex-mcp` | +| Canonical branch | `refs/remotes/origin/HEAD -> origin/main`; CI triggers | **OBSERVED** `main` | +| Current branch | `git status --short --branch` | **OBSERVED** `release/0.1.9`, clean, tracking `origin/release/0.1.9` | +| Package | `package.json` | **OBSERVED** `@workspacejson/codex-mcp@0.1.9`, Node >=20 | +| Remote freshness | `git remote show origin` | **UNKNOWN** network DNS prevented remote query; refs are local cached evidence | +| PR state / required checks | GitHub query unavailable | **UNKNOWN**; CI defines `check:structure`, generator-version, typecheck, lint, build, test, smoke, pack | +| Protected/release branches | CI and local refs | **INFERRED** `main` integration is PR-gated by workflow; release branches exist but protection is UNKNOWN | +| File-context tool | tool discovery | **UNKNOWN/unavailable** `workspace_get_file_context` was not installed in this session; no safety conclusion taken from absence | + +Expected validation after any future integration: `npm ci && npm run check`; for package release, `npm run prepublishOnly`. CI uses Node 20 and 22, and `publish-npm.yml` additionally verifies packed artifact installation. + +## Worktree and Branch Inventory + +| Surface | Path | Branch/Commit | Unique Work | Linear | Validation | Risk | Proposed Disposition | +| --- | --- | --- | --- | --- | --- | --- | --- | +| root | repository root | `release/0.1.9` / `940760d` | version/docs release delta, 8 files | release 0.1.9; HAC-206 indirect | no run (audit-only) | MEDIUM: differs from `main` release commit | `PRESERVE_PENDING_DECISION` | +| detached scratch | `/private/tmp/.../scratchpad/mainwt` | detached `e0827a8` | likely main-era fix; no branch protection | HAC-206 mentions e0827a8 | inaccessible status | HIGH: detached + untracked state unknown | `PRESERVE_PENDING_DECISION` | +| feature worktree | `.claude/worktrees/readme-hero-polish` | HAC-170 / `82d25a7` | patch already in main (`git cherry` empty) | HAC-170 | worktree cleanliness not inspected (nested ignored path) | MEDIUM: accessible but ignored host path | `ALREADY_INTEGRATED` pending clean-status check | +| 10 named prunable feature worktrees | `/private/tmp/workspacejson-hac*` | HAC-102/105/129/136/158/175/178 tips | most patch-equivalent to main; HAC-136/178 tip retains three unique old commits | HAC-102,105,129,136,158,175,178 | paths missing | HIGH: registration is prunable and status/untracked files unavailable | `PRESERVE_PENDING_DECISION` | +| 2 prunable detached worktrees | `/private/tmp/workspacejson-{prepublish-clean,source-repair}-8539c64` | detached `8539c64` | UNKNOWN | UNKNOWN | paths missing | HIGH: detached state, no branch anchor | `PRESERVE_PENDING_DECISION` | +| `feature/hac-136-eligibility-reviewer` family | missing worktree | `0041bdf` | 3 commits/20 files unique vs main: fixture, extension, plugin metadata | HAC-136, HAC-176/177/178 | no current evidence | HIGH: Linear HAC-206 calls it stale/regressing; no deletion proof | `MANUAL_RECONCILIATION_REQUIRED` | +| `fix/adversarial-review-hac99-hac101` | branch only | `8dea6cc` | 4 commits/13 files: config, hook, bounded outputs, tests | HAC-99/101/129/130/131 | unknown current | HIGH: security/read-only posture; 501 lines unique | `MANUAL_RECONCILIATION_REQUIRED` | +| `polish/extension-marketplace-metadata` | branch only | `b9ec0d9` | 10 commits/15 files: installer/onboarding/version gate | HAC-175,197,200,203,204,206 | no current evidence | HIGH: HAC-206 explicitly says curated merge, but release is now 0.1.9 | `REBASE_OR_REFRESH_CANDIDATE` | +| `feature/release-npm-workflow` | branch only | `05a3073` | six unique historical commits, overlaps HAC-136 family | HAC-176/177/178 | no current evidence | MEDIUM: Linear HAC-206 calls stale/regressing | `SUPERSEDED` (preserve until reconciliation) | +| `polish/output-channel-yaml` | branch only | `c10ac8c` | `git cherry` empty | HAC-170 | merged as `c14ef4e` / PR #8 inferred from commit | LOW | `ALREADY_INTEGRATED` | +| legacy backups/rebases/dev/integration | branches only | listed in JSON | no unique patch or obsolete history | HAC-97/114/158/111 | no current evidence | MEDIUM: no cleanup without unreachable review | `PRESERVE_PENDING_DECISION` | + +Full stable identifiers, all 30 local branches, all 15 worktrees, and branch divergence are in `repository-reconciliation.json`. + +## Linear Reconciliation Matrix + +| Linear Issue | Current Linear State | Observed Implementation State | Evidence | Proposed Update | +| --- | --- | --- | --- | --- | +| HAC-97 | Done | `INTEGRATED` | `feature/hac-97-freeze-fixture-contract` has no unique patch; branch merged | Leave unchanged; add no comment without validation evidence | +| HAC-99 | Done | `IMPLEMENTED_UNVERIFIED` | unique remediation branch `fix/adversarial-review-hac99-hac101` remains outside `main` | Do not reopen until patch/content comparison against shipped 0.1.9 completes | +| HAC-101 | Done | `IMPLEMENTED_UNVERIFIED` | Linear says shipped 4-tool contract; branch traceability absent | Leave unchanged; attach audit finding only after validation | +| HAC-102 | Done | `IMPLEMENTED_UNVERIFIED` | prunable branch `47f44c1` patch-equivalent to main; Linear acceptance requires proof task | Request/locate validation record; no status change | +| HAC-105 | Done | `IMPLEMENTED_UNVERIFIED` | prunable audit branch patch-equivalent to main | Leave unchanged; audit output may be attached later | +| HAC-129 | Done | `IMPLEMENTED_UNVERIFIED` | Linear links PR #1; remediation patch still unique in local branch | Compare `0821fac..8dea6cc` with 0.1.9 before asserting shipped | +| HAC-136 | In Progress | `IMPLEMENTED_UNVERIFIED` | Linear comments report real GPT-5.6 reviewer calls and attributed extension UI, but the latest correction says this still does not satisfy the full product/demo/docs requirement; old unique branch family remains | Keep In Progress; do not close without a current product-path, demo, and documentation verification | +| HAC-158 | Done | `INTEGRATED` | `.agents/skills/*` exists untracked but root’s audit skill set matches issue deliverables; historical branch patch-equivalent | Leave unchanged; separately decide whether local skills should be committed | +| HAC-170 | Done | `INTEGRATED` | output-channel branch has no unique patch; main has PR #8 commit | Leave unchanged | +| HAC-175 | Done | `IMPLEMENTED_UNVERIFIED` | prunable `7038201` patch-equivalent; later marketplace branch includes related onboarding | Leave unchanged pending current release validation | +| HAC-176/177/178 | Done | `INTEGRATED` with stale alternate branches | `main` contains later delivery; old `0041bdf` family unique only against latest main and expressly marked stale in HAC-206 | Leave unchanged; preserve old commits until architectural review | +| HAC-206 | Backlog | `ISSUE_DESCRIPTION_STALE` | issue names 0.1.6 plan; repo package/release are 0.1.9 | Update issue with audit comment and either close/supersede or create 0.1.10 inventory | + +## Duplicate and Superseded Work + +- **OBSERVED:** `feature/hac-136-eligibility-reviewer`, `feature/hac-176-177-release-ready`, and `feature/hac-178-tracked-demo-source` point to `0041bdf`; classify as one patch family, not three independent deliverables. +- **OBSERVED:** `feature/hac-136-decoration-plumbing` and `fix/hac-129-npx-entrypoint` point to `f62ce3e`; `feature/hac-136-reauthored` and `feature/hac-158-skills-reauthored` point to `8824c9b`. +- **OBSERVED:** `backup/hardened-17588dd` and `dev` point to `17588dd`. +- **OBSERVED:** `polish/output-channel-yaml` has no positive `git cherry` entries against `origin/main`; it is already integrated. +- **INFERRED:** stale local branches that have no unique patches are history aliases rather than integration candidates. They remain preservation candidates until their worktree state is inspected. + +## Conflict and Dependency Graph + +```text +Wave 0 preserve unreachable commits + prunable worktree state + └─> compare release/0.1.9 <-> origin/main release commit + ├─> security/config patch family (HAC-99/101/129) review + └─> HAC-136/HAC-176/177/178 old fixture/extension family decision + └─> marketplace/onboarding branch refresh (HAC-175/206) + └─> npm run check + packed-artifact test + └─> Linear reconciliation and only then cleanup +``` + +`fix/adversarial-review-hac99-hac101` and the HAC-136 family overlap `src/services/workspace.ts`, tests, `.codex` configuration, fixtures, and extension surfaces; they require manual architecture/patch review. No direct merge is recommended. + +## Proposed Merge Sequence + +1. **Wave 0 — preservation:** capture bundles/patches and clean-status evidence for every prunable/detached worktree; retain unreachable commits. Human approval required. +2. **Wave 1 — reconcile release baseline:** range-diff `release/0.1.9` against `origin/main` and determine whether `7d42a61` supersedes `940760d`. Do not merge either merely to converge. +3. **Wave 2 — manual candidates:** separately review bounded security patch `0821fac..8dea6cc` and `0041bdf` family. Select patches only after current API and fixture contract comparison. +4. **Wave 3 — marketplace:** if still desired, create a fresh PR branch from current `main`, reconstruct/refresh `4380d63..b9ec0d9`, resolve version drift, then run `npm run check`; use PR, never direct merge. +5. **Wave 4 — validation and Linear:** run Node 20/22 CI-equivalent checks and packed-artifact installation; then apply proposed Linear comments/statuses. +6. **Wave 5 — cleanup:** only after Waves 0–4, and only with clean worktrees, no unique commits, preserved bundles, resolved PR state, and explicit approval. + +## Proposed Linear Updates + +**HAC-136 paste-ready comment (no status change):** + +> Reconciliation audit 2026-07-22: legacy worktrees for this issue are prunable/missing and point to an older `0041bdf` patch family that remains outside current `origin/main`. The issue requires a demonstrable GPT-5.6 advisory reviewer and visible surface; this audit found no current validation run proving those acceptance criteria against `@workspacejson/codex-mcp@0.1.9`. Keep In Progress. Next gate: preserve the detached/prunable state, compare the patch family to current main, then run the required product-path and render validations before changing status. + +**HAC-206 paste-ready comment (recommended: supersede/close only after owner confirms release scope):** + +> Reconciliation audit 2026-07-22: this issue describes a 0.1.6 merge plan, while the checked repository package and release branch are 0.1.9 and `origin/main` contains `7d42a61` “release: 0.1.9 (#13)”. The old marketplace payload `polish/extension-marketplace-metadata` still has ten unique commits and has not been validated against current main. Please either (a) supersede this issue with a new current-version merge inventory, or (b) explicitly retain it and update the target version, candidate commit range, and validation gates. Do not mark the payload integrated without a refreshed PR and `npm run check` evidence. + +## Cleanup Candidates + +None are ready now. Future commands (not executed) must follow successful verification: `git worktree remove `, `git branch -d `, and only then `git worktree prune`. No force deletion, `git gc`, or stash drop is proposed. + +## Items Requiring Human Judgment + +1. Whether the 0.1.9 release-line delta is intentionally replaced by main’s `7d42a61` release commit. +2. Whether the old HAC-136 fixture/extension family contains any requirement still missing from current main. +3. Whether the marketplace/onboarding branch is desired for a post-0.1.9 release, and its intended version. +4. Whether ignored `.agents/skills`, `.claude`, and `.local` content is user-local operational state or should receive separate tracking review. Local reviewer receipts may contain sensitive request/response data; do not publish them in an audit attachment. + +## Unknowns and Missing Evidence + +GitHub open/merged PR and required-check state, branch-protection rules, remote freshness, actual contents/status of 12 prunable worktrees, and stashes in those missing worktrees were not established. GitHub remote access failed DNS. Linear HAC-136 and HAC-206 comments were read: HAC-136 explicitly retains an In Progress requirement for a genuine product-path/demo/docs proof, and HAC-206 records 0.1.7 shipped-byte evidence plus pending render/billfold gates; those comments do not prove the current 0.1.9 release satisfies all acceptance criteria. `git fsck` also reported invalid `refs/.DS_Store`, a repository metadata hygiene defect that should be investigated non-destructively. + +## Final Recommendation + +Remediation should **not** start with cleanup or merge. Safest first action: under explicit execution authorization, create preservation bundles for unreachable commits and inspect/prune-registration candidates without deletion; then reconcile the release baseline and only afterward refresh a selected candidate into a new PR branch. diff --git a/docs/audits/worktree-reconciliation/2026-07-22/repository-reconciliation.json b/docs/audits/worktree-reconciliation/2026-07-22/repository-reconciliation.json new file mode 100644 index 0000000..e335ecc --- /dev/null +++ b/docs/audits/worktree-reconciliation/2026-07-22/repository-reconciliation.json @@ -0,0 +1,30 @@ +{ + "schemaVersion": "1.0", + "auditDate": "2026-07-22", + "mode": "read-only-evidentiary", + "repository": {"name": "@workspacejson/codex-mcp", "root": "/Users/user1/Documents/workspacejson-codex-mcp", "remote": "https://github.com/workspace-json/codex-mcp", "canonicalBranch": {"value": "main", "classification": "OBSERVED", "evidence": ["origin/HEAD -> origin/main", ".github/workflows/ci.yml targets main"]}}, + "baseline": {"currentBranch": "release/0.1.9", "currentHead": "940760d2878832ab3b347714e3ff79c5dcfaec58", "workingTree": "clean", "stashes": [], "githubState": "UNKNOWN: DNS resolution failure", "workspaceFileContext": "UNKNOWN: tool unavailable", "validations": ["npm ci", "npm run check", "npm run prepublishOnly"]}, + "worktrees": [ + {"id":"wt-root","path":"/Users/user1/Documents/workspacejson-codex-mcp","branch":"release/0.1.9","head":"940760d","state":"clean","disposition":"PRESERVE_PENDING_DECISION"}, + {"id":"wt-scratch","path":"/private/tmp/claude-502/-Users-user1-Documents-workspacejson-codex-mcp/eacb7df6-95a1-46ff-893c-029886576dde/scratchpad/mainwt","branch":null,"head":"e0827a8","state":"detached; status UNKNOWN","disposition":"PRESERVE_PENDING_DECISION"}, + {"id":"wt-hac170","path":"/Users/user1/Documents/workspacejson-codex-mcp/.claude/worktrees/readme-hero-polish","branch":"feature/hac-170-extension-installer-and-docs","head":"82d25a7","state":"accessibility observed; clean status UNKNOWN","disposition":"ALREADY_INTEGRATED"}, + {"id":"wt-prunable","count":12,"pathsPrefix":"/private/tmp/workspacejson-","state":"prunable/missing; includes 10 branch-attached and 2 detached","disposition":"PRESERVE_PENDING_DECISION"} + ], + "allRegisteredWorktreePaths": ["/Users/user1/Documents/workspacejson-codex-mcp","/private/tmp/claude-502/-Users-user1-Documents-workspacejson-codex-mcp/eacb7df6-95a1-46ff-893c-029886576dde/scratchpad/mainwt","/private/tmp/workspacejson-hac-136","/private/tmp/workspacejson-hac102-direct-api","/private/tmp/workspacejson-hac105","/private/tmp/workspacejson-hac129-npx-hotfix","/private/tmp/workspacejson-hac136-clean","/private/tmp/workspacejson-hac136-current","/private/tmp/workspacejson-hac136-vscode","/private/tmp/workspacejson-hac158-clean","/private/tmp/workspacejson-hac175","/private/tmp/workspacejson-hac178","/private/tmp/workspacejson-prepublish-clean-8539c64","/private/tmp/workspacejson-source-repair-8539c64","/Users/user1/Documents/workspacejson-codex-mcp/.claude/worktrees/readme-hero-polish"], + "branches": [ + {"id":"br-release-019","name":"release/0.1.9","head":"940760d","ahead":1,"behind":1,"uniquePatch":"yes (negative cherry)","disposition":"PRESERVE_PENDING_DECISION"}, + {"id":"br-marketplace","name":"polish/extension-marketplace-metadata","head":"b9ec0d9","ahead":5,"behind":10,"uniqueCommits":10,"linear":["HAC-175","HAC-197","HAC-200","HAC-203","HAC-204","HAC-206"],"disposition":"REBASE_OR_REFRESH_CANDIDATE"}, + {"id":"br-adversarial-fix","name":"fix/adversarial-review-hac99-hac101","head":"8dea6cc","ahead":63,"behind":4,"uniqueCommits":4,"linear":["HAC-99","HAC-101","HAC-129","HAC-130","HAC-131"],"disposition":"MANUAL_RECONCILIATION_REQUIRED"}, + {"id":"br-hac136-family","names":["feature/hac-136-eligibility-reviewer","feature/hac-176-177-release-ready","feature/hac-178-tracked-demo-source"],"head":"0041bdf","uniqueCommits":["d5fe7a0","af4707b","0041bdf"],"linear":["HAC-136","HAC-176","HAC-177","HAC-178"],"disposition":"MANUAL_RECONCILIATION_REQUIRED"}, + {"id":"br-already-integrated","names":["feature/hac-102-direct-api-reviewer","feature/hac-105-audit-judge-visible-workspacejson-compatibility-and","feature/hac-170-extension-installer-and-docs","feature/hac-175-first-run-onboarding","polish/output-channel-yaml","feature/hac-97-freeze-fixture-contract","worktree-readme-hero-polish"],"uniquePatch":"none by git cherry","disposition":"ALREADY_INTEGRATED"}, + {"id":"br-legacy-preserve","names":["backup/hardened-17588dd","backup/pre-integration-main","dev","feature/hac-114-ci-audit-badge","feature/hac-136-decoration-plumbing","feature/hac-136-reauthored","feature/hac-136-vscode-decoration-spike","feature/hac-158-skills-reauthored","feature/release-npm-workflow","fix/hac-129-npx-entrypoint","hac-114-rebased","hac-158-rebased","integration/build-week-baseline","release/0.1.7","release/0.1.8","release/codex-mcp-0.1.5","main"],"disposition":"PRESERVE_PENDING_DECISION"} + ], + "allLocalBranchNames": ["backup/hardened-17588dd","backup/pre-integration-main","dev","feature/hac-102-direct-api-reviewer","feature/hac-105-audit-judge-visible-workspacejson-compatibility-and","feature/hac-114-ci-audit-badge","feature/hac-136-decoration-plumbing","feature/hac-136-eligibility-reviewer","feature/hac-136-reauthored","feature/hac-136-vscode-decoration-spike","feature/hac-158-skills-reauthored","feature/hac-170-extension-installer-and-docs","feature/hac-175-first-run-onboarding","feature/hac-176-177-release-ready","feature/hac-178-tracked-demo-source","feature/hac-97-freeze-fixture-contract","feature/release-npm-workflow","fix/adversarial-review-hac99-hac101","fix/hac-129-npx-entrypoint","hac-114-rebased","hac-158-rebased","integration/build-week-baseline","main","polish/extension-marketplace-metadata","polish/output-channel-yaml","release/0.1.7","release/0.1.8","release/0.1.9","release/codex-mcp-0.1.5","worktree-readme-hero-polish"], + "duplicates": [{"members":["feature/hac-136-eligibility-reviewer","feature/hac-176-177-release-ready","feature/hac-178-tracked-demo-source"],"head":"0041bdf"},{"members":["feature/hac-136-decoration-plumbing","fix/hac-129-npx-entrypoint"],"head":"f62ce3e"},{"members":["feature/hac-136-reauthored","feature/hac-158-skills-reauthored"],"head":"8824c9b"},{"members":["backup/hardened-17588dd","dev"],"head":"17588dd"}], + "linearMappings": [{"id":"HAC-136","linearState":"In Progress","implementationState":"IMPLEMENTED_UNVERIFIED","commentEvidence":"latest Linear correction requires product-path call, visible verdict, demo proof, and docs"},{"id":"HAC-206","linearState":"Backlog","implementationState":"ISSUE_DESCRIPTION_STALE","commentEvidence":"0.1.7 shipped-byte proof recorded; render/billfold gates pending"},{"id":"HAC-97","linearState":"Done","implementationState":"INTEGRATED"},{"id":"HAC-170","linearState":"Done","implementationState":"INTEGRATED"},{"id":"HAC-129","linearState":"Done","implementationState":"IMPLEMENTED_UNVERIFIED"}], + "dependencies": [{"from":"preserve-prunable-and-unreachable","to":"release-baseline-reconciliation"},{"from":"release-baseline-reconciliation","to":"manual-patch-family-review"},{"from":"manual-patch-family-review","to":"marketplace-refresh-pr"},{"from":"marketplace-refresh-pr","to":"validation-and-linear-update"},{"from":"validation-and-linear-update","to":"cleanup"}], + "proposedMergeOrder": ["preservation", "release range-diff", "manual security/fixture reconciliation", "fresh marketplace PR", "CI and packaged-artifact validation", "Linear updates", "cleanup"], + "cleanupCandidates": [], + "humanApprovalGates": ["preservation bundle creation", "release equivalence decision", "architecture selection for HAC-136 family", "any merge/cherry-pick", "all cleanup"], + "unknowns": ["GitHub PR/check/protection state", "missing-worktree status and untracked files", "unreachable commit intent", "remote freshness"] +} From 9e94ad301d1d0cda68d7c7f0f9190e4aa4652b92 Mon Sep 17 00:00:00 2001 From: Qwynn Marcelle Date: Wed, 22 Jul 2026 16:34:04 -0400 Subject: [PATCH 3/5] docs(audit): link reconciliation pull request --- .../worktree-reconciliation/2026-07-22/remediation-results.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/audits/worktree-reconciliation/2026-07-22/remediation-results.md b/docs/audits/worktree-reconciliation/2026-07-22/remediation-results.md index f8dd847..7f31a29 100644 --- a/docs/audits/worktree-reconciliation/2026-07-22/remediation-results.md +++ b/docs/audits/worktree-reconciliation/2026-07-22/remediation-results.md @@ -60,7 +60,7 @@ No Linear update is justified by this drift alone: the validated PR evidence con ## Pull Requests and Linear Updates -- Pull requests: no implementation PR was created or updated. Historical PR #9 and PR #13 are verified merged; PR #1 is verified closed-unmerged. A documentation-only PR for this audit record may be opened after the preservation commit is pushed. +- Pull requests: no implementation PR was created or updated. Historical PR #9 and PR #13 are verified merged; PR #1 is verified closed-unmerged. Documentation-only PR [#14](https://github.com/workspace-json/codex-mcp/pull/14) was opened from `audit/reconciliation-2026-07-22` to `main` for this audit record. - Linear: none created, edited, commented on, closed, reopened, or canceled. HAC-136 and HAC-206 were read only. ## Cleanup @@ -75,7 +75,7 @@ None. No worktree, branch, stash, untracked file, commit, or remote ref was remo - Remaining branches with unique/unverified work: unchanged from the audit, including the `0041bdf` family, `fix/adversarial-review-hac99-hac101`, `polish/extension-marketplace-metadata`, and `release/0.1.9`. - Remaining stashes: none observed in root worktree. - Remaining uncommitted implementation: none introduced by this execution; audit documentation will be committed on the dedicated audit branch. -- Open reconciliation pull requests: none observed at the post-authentication re-check; the documentation-only audit PR is pending creation. +- Open reconciliation pull requests: documentation-only PR #14; no implementation reconciliation PR is open. - Linear issues still requiring correction: HAC-136 and HAC-206; no updates are justified without verified integration. - Validation status: audit-file integrity PASS; repository-wide integration validation NOT RUN because no integration was performed. - Cleanup status: blocked; no cleanup is safe. From f8e201a36a7400bc6cb84f14705da8d0be24fc76 Mon Sep 17 00:00:00 2001 From: Qwynn Marcelle Date: Wed, 22 Jul 2026 16:56:32 -0400 Subject: [PATCH 4/5] style(audit): format reconciliation inventory --- .../2026-07-22/repository-reconciliation.json | 258 ++++++++++++++++-- 1 file changed, 237 insertions(+), 21 deletions(-) diff --git a/docs/audits/worktree-reconciliation/2026-07-22/repository-reconciliation.json b/docs/audits/worktree-reconciliation/2026-07-22/repository-reconciliation.json index e335ecc..03e8ca3 100644 --- a/docs/audits/worktree-reconciliation/2026-07-22/repository-reconciliation.json +++ b/docs/audits/worktree-reconciliation/2026-07-22/repository-reconciliation.json @@ -2,29 +2,245 @@ "schemaVersion": "1.0", "auditDate": "2026-07-22", "mode": "read-only-evidentiary", - "repository": {"name": "@workspacejson/codex-mcp", "root": "/Users/user1/Documents/workspacejson-codex-mcp", "remote": "https://github.com/workspace-json/codex-mcp", "canonicalBranch": {"value": "main", "classification": "OBSERVED", "evidence": ["origin/HEAD -> origin/main", ".github/workflows/ci.yml targets main"]}}, - "baseline": {"currentBranch": "release/0.1.9", "currentHead": "940760d2878832ab3b347714e3ff79c5dcfaec58", "workingTree": "clean", "stashes": [], "githubState": "UNKNOWN: DNS resolution failure", "workspaceFileContext": "UNKNOWN: tool unavailable", "validations": ["npm ci", "npm run check", "npm run prepublishOnly"]}, + "repository": { + "name": "@workspacejson/codex-mcp", + "root": "/Users/user1/Documents/workspacejson-codex-mcp", + "remote": "https://github.com/workspace-json/codex-mcp", + "canonicalBranch": { + "value": "main", + "classification": "OBSERVED", + "evidence": ["origin/HEAD -> origin/main", ".github/workflows/ci.yml targets main"] + } + }, + "baseline": { + "currentBranch": "release/0.1.9", + "currentHead": "940760d2878832ab3b347714e3ff79c5dcfaec58", + "workingTree": "clean", + "stashes": [], + "githubState": "UNKNOWN: DNS resolution failure", + "workspaceFileContext": "UNKNOWN: tool unavailable", + "validations": ["npm ci", "npm run check", "npm run prepublishOnly"] + }, "worktrees": [ - {"id":"wt-root","path":"/Users/user1/Documents/workspacejson-codex-mcp","branch":"release/0.1.9","head":"940760d","state":"clean","disposition":"PRESERVE_PENDING_DECISION"}, - {"id":"wt-scratch","path":"/private/tmp/claude-502/-Users-user1-Documents-workspacejson-codex-mcp/eacb7df6-95a1-46ff-893c-029886576dde/scratchpad/mainwt","branch":null,"head":"e0827a8","state":"detached; status UNKNOWN","disposition":"PRESERVE_PENDING_DECISION"}, - {"id":"wt-hac170","path":"/Users/user1/Documents/workspacejson-codex-mcp/.claude/worktrees/readme-hero-polish","branch":"feature/hac-170-extension-installer-and-docs","head":"82d25a7","state":"accessibility observed; clean status UNKNOWN","disposition":"ALREADY_INTEGRATED"}, - {"id":"wt-prunable","count":12,"pathsPrefix":"/private/tmp/workspacejson-","state":"prunable/missing; includes 10 branch-attached and 2 detached","disposition":"PRESERVE_PENDING_DECISION"} + { + "id": "wt-root", + "path": "/Users/user1/Documents/workspacejson-codex-mcp", + "branch": "release/0.1.9", + "head": "940760d", + "state": "clean", + "disposition": "PRESERVE_PENDING_DECISION" + }, + { + "id": "wt-scratch", + "path": "/private/tmp/claude-502/-Users-user1-Documents-workspacejson-codex-mcp/eacb7df6-95a1-46ff-893c-029886576dde/scratchpad/mainwt", + "branch": null, + "head": "e0827a8", + "state": "detached; status UNKNOWN", + "disposition": "PRESERVE_PENDING_DECISION" + }, + { + "id": "wt-hac170", + "path": "/Users/user1/Documents/workspacejson-codex-mcp/.claude/worktrees/readme-hero-polish", + "branch": "feature/hac-170-extension-installer-and-docs", + "head": "82d25a7", + "state": "accessibility observed; clean status UNKNOWN", + "disposition": "ALREADY_INTEGRATED" + }, + { + "id": "wt-prunable", + "count": 12, + "pathsPrefix": "/private/tmp/workspacejson-", + "state": "prunable/missing; includes 10 branch-attached and 2 detached", + "disposition": "PRESERVE_PENDING_DECISION" + } + ], + "allRegisteredWorktreePaths": [ + "/Users/user1/Documents/workspacejson-codex-mcp", + "/private/tmp/claude-502/-Users-user1-Documents-workspacejson-codex-mcp/eacb7df6-95a1-46ff-893c-029886576dde/scratchpad/mainwt", + "/private/tmp/workspacejson-hac-136", + "/private/tmp/workspacejson-hac102-direct-api", + "/private/tmp/workspacejson-hac105", + "/private/tmp/workspacejson-hac129-npx-hotfix", + "/private/tmp/workspacejson-hac136-clean", + "/private/tmp/workspacejson-hac136-current", + "/private/tmp/workspacejson-hac136-vscode", + "/private/tmp/workspacejson-hac158-clean", + "/private/tmp/workspacejson-hac175", + "/private/tmp/workspacejson-hac178", + "/private/tmp/workspacejson-prepublish-clean-8539c64", + "/private/tmp/workspacejson-source-repair-8539c64", + "/Users/user1/Documents/workspacejson-codex-mcp/.claude/worktrees/readme-hero-polish" ], - "allRegisteredWorktreePaths": ["/Users/user1/Documents/workspacejson-codex-mcp","/private/tmp/claude-502/-Users-user1-Documents-workspacejson-codex-mcp/eacb7df6-95a1-46ff-893c-029886576dde/scratchpad/mainwt","/private/tmp/workspacejson-hac-136","/private/tmp/workspacejson-hac102-direct-api","/private/tmp/workspacejson-hac105","/private/tmp/workspacejson-hac129-npx-hotfix","/private/tmp/workspacejson-hac136-clean","/private/tmp/workspacejson-hac136-current","/private/tmp/workspacejson-hac136-vscode","/private/tmp/workspacejson-hac158-clean","/private/tmp/workspacejson-hac175","/private/tmp/workspacejson-hac178","/private/tmp/workspacejson-prepublish-clean-8539c64","/private/tmp/workspacejson-source-repair-8539c64","/Users/user1/Documents/workspacejson-codex-mcp/.claude/worktrees/readme-hero-polish"], "branches": [ - {"id":"br-release-019","name":"release/0.1.9","head":"940760d","ahead":1,"behind":1,"uniquePatch":"yes (negative cherry)","disposition":"PRESERVE_PENDING_DECISION"}, - {"id":"br-marketplace","name":"polish/extension-marketplace-metadata","head":"b9ec0d9","ahead":5,"behind":10,"uniqueCommits":10,"linear":["HAC-175","HAC-197","HAC-200","HAC-203","HAC-204","HAC-206"],"disposition":"REBASE_OR_REFRESH_CANDIDATE"}, - {"id":"br-adversarial-fix","name":"fix/adversarial-review-hac99-hac101","head":"8dea6cc","ahead":63,"behind":4,"uniqueCommits":4,"linear":["HAC-99","HAC-101","HAC-129","HAC-130","HAC-131"],"disposition":"MANUAL_RECONCILIATION_REQUIRED"}, - {"id":"br-hac136-family","names":["feature/hac-136-eligibility-reviewer","feature/hac-176-177-release-ready","feature/hac-178-tracked-demo-source"],"head":"0041bdf","uniqueCommits":["d5fe7a0","af4707b","0041bdf"],"linear":["HAC-136","HAC-176","HAC-177","HAC-178"],"disposition":"MANUAL_RECONCILIATION_REQUIRED"}, - {"id":"br-already-integrated","names":["feature/hac-102-direct-api-reviewer","feature/hac-105-audit-judge-visible-workspacejson-compatibility-and","feature/hac-170-extension-installer-and-docs","feature/hac-175-first-run-onboarding","polish/output-channel-yaml","feature/hac-97-freeze-fixture-contract","worktree-readme-hero-polish"],"uniquePatch":"none by git cherry","disposition":"ALREADY_INTEGRATED"}, - {"id":"br-legacy-preserve","names":["backup/hardened-17588dd","backup/pre-integration-main","dev","feature/hac-114-ci-audit-badge","feature/hac-136-decoration-plumbing","feature/hac-136-reauthored","feature/hac-136-vscode-decoration-spike","feature/hac-158-skills-reauthored","feature/release-npm-workflow","fix/hac-129-npx-entrypoint","hac-114-rebased","hac-158-rebased","integration/build-week-baseline","release/0.1.7","release/0.1.8","release/codex-mcp-0.1.5","main"],"disposition":"PRESERVE_PENDING_DECISION"} - ], - "allLocalBranchNames": ["backup/hardened-17588dd","backup/pre-integration-main","dev","feature/hac-102-direct-api-reviewer","feature/hac-105-audit-judge-visible-workspacejson-compatibility-and","feature/hac-114-ci-audit-badge","feature/hac-136-decoration-plumbing","feature/hac-136-eligibility-reviewer","feature/hac-136-reauthored","feature/hac-136-vscode-decoration-spike","feature/hac-158-skills-reauthored","feature/hac-170-extension-installer-and-docs","feature/hac-175-first-run-onboarding","feature/hac-176-177-release-ready","feature/hac-178-tracked-demo-source","feature/hac-97-freeze-fixture-contract","feature/release-npm-workflow","fix/adversarial-review-hac99-hac101","fix/hac-129-npx-entrypoint","hac-114-rebased","hac-158-rebased","integration/build-week-baseline","main","polish/extension-marketplace-metadata","polish/output-channel-yaml","release/0.1.7","release/0.1.8","release/0.1.9","release/codex-mcp-0.1.5","worktree-readme-hero-polish"], - "duplicates": [{"members":["feature/hac-136-eligibility-reviewer","feature/hac-176-177-release-ready","feature/hac-178-tracked-demo-source"],"head":"0041bdf"},{"members":["feature/hac-136-decoration-plumbing","fix/hac-129-npx-entrypoint"],"head":"f62ce3e"},{"members":["feature/hac-136-reauthored","feature/hac-158-skills-reauthored"],"head":"8824c9b"},{"members":["backup/hardened-17588dd","dev"],"head":"17588dd"}], - "linearMappings": [{"id":"HAC-136","linearState":"In Progress","implementationState":"IMPLEMENTED_UNVERIFIED","commentEvidence":"latest Linear correction requires product-path call, visible verdict, demo proof, and docs"},{"id":"HAC-206","linearState":"Backlog","implementationState":"ISSUE_DESCRIPTION_STALE","commentEvidence":"0.1.7 shipped-byte proof recorded; render/billfold gates pending"},{"id":"HAC-97","linearState":"Done","implementationState":"INTEGRATED"},{"id":"HAC-170","linearState":"Done","implementationState":"INTEGRATED"},{"id":"HAC-129","linearState":"Done","implementationState":"IMPLEMENTED_UNVERIFIED"}], - "dependencies": [{"from":"preserve-prunable-and-unreachable","to":"release-baseline-reconciliation"},{"from":"release-baseline-reconciliation","to":"manual-patch-family-review"},{"from":"manual-patch-family-review","to":"marketplace-refresh-pr"},{"from":"marketplace-refresh-pr","to":"validation-and-linear-update"},{"from":"validation-and-linear-update","to":"cleanup"}], - "proposedMergeOrder": ["preservation", "release range-diff", "manual security/fixture reconciliation", "fresh marketplace PR", "CI and packaged-artifact validation", "Linear updates", "cleanup"], + { + "id": "br-release-019", + "name": "release/0.1.9", + "head": "940760d", + "ahead": 1, + "behind": 1, + "uniquePatch": "yes (negative cherry)", + "disposition": "PRESERVE_PENDING_DECISION" + }, + { + "id": "br-marketplace", + "name": "polish/extension-marketplace-metadata", + "head": "b9ec0d9", + "ahead": 5, + "behind": 10, + "uniqueCommits": 10, + "linear": ["HAC-175", "HAC-197", "HAC-200", "HAC-203", "HAC-204", "HAC-206"], + "disposition": "REBASE_OR_REFRESH_CANDIDATE" + }, + { + "id": "br-adversarial-fix", + "name": "fix/adversarial-review-hac99-hac101", + "head": "8dea6cc", + "ahead": 63, + "behind": 4, + "uniqueCommits": 4, + "linear": ["HAC-99", "HAC-101", "HAC-129", "HAC-130", "HAC-131"], + "disposition": "MANUAL_RECONCILIATION_REQUIRED" + }, + { + "id": "br-hac136-family", + "names": [ + "feature/hac-136-eligibility-reviewer", + "feature/hac-176-177-release-ready", + "feature/hac-178-tracked-demo-source" + ], + "head": "0041bdf", + "uniqueCommits": ["d5fe7a0", "af4707b", "0041bdf"], + "linear": ["HAC-136", "HAC-176", "HAC-177", "HAC-178"], + "disposition": "MANUAL_RECONCILIATION_REQUIRED" + }, + { + "id": "br-already-integrated", + "names": [ + "feature/hac-102-direct-api-reviewer", + "feature/hac-105-audit-judge-visible-workspacejson-compatibility-and", + "feature/hac-170-extension-installer-and-docs", + "feature/hac-175-first-run-onboarding", + "polish/output-channel-yaml", + "feature/hac-97-freeze-fixture-contract", + "worktree-readme-hero-polish" + ], + "uniquePatch": "none by git cherry", + "disposition": "ALREADY_INTEGRATED" + }, + { + "id": "br-legacy-preserve", + "names": [ + "backup/hardened-17588dd", + "backup/pre-integration-main", + "dev", + "feature/hac-114-ci-audit-badge", + "feature/hac-136-decoration-plumbing", + "feature/hac-136-reauthored", + "feature/hac-136-vscode-decoration-spike", + "feature/hac-158-skills-reauthored", + "feature/release-npm-workflow", + "fix/hac-129-npx-entrypoint", + "hac-114-rebased", + "hac-158-rebased", + "integration/build-week-baseline", + "release/0.1.7", + "release/0.1.8", + "release/codex-mcp-0.1.5", + "main" + ], + "disposition": "PRESERVE_PENDING_DECISION" + } + ], + "allLocalBranchNames": [ + "backup/hardened-17588dd", + "backup/pre-integration-main", + "dev", + "feature/hac-102-direct-api-reviewer", + "feature/hac-105-audit-judge-visible-workspacejson-compatibility-and", + "feature/hac-114-ci-audit-badge", + "feature/hac-136-decoration-plumbing", + "feature/hac-136-eligibility-reviewer", + "feature/hac-136-reauthored", + "feature/hac-136-vscode-decoration-spike", + "feature/hac-158-skills-reauthored", + "feature/hac-170-extension-installer-and-docs", + "feature/hac-175-first-run-onboarding", + "feature/hac-176-177-release-ready", + "feature/hac-178-tracked-demo-source", + "feature/hac-97-freeze-fixture-contract", + "feature/release-npm-workflow", + "fix/adversarial-review-hac99-hac101", + "fix/hac-129-npx-entrypoint", + "hac-114-rebased", + "hac-158-rebased", + "integration/build-week-baseline", + "main", + "polish/extension-marketplace-metadata", + "polish/output-channel-yaml", + "release/0.1.7", + "release/0.1.8", + "release/0.1.9", + "release/codex-mcp-0.1.5", + "worktree-readme-hero-polish" + ], + "duplicates": [ + { + "members": [ + "feature/hac-136-eligibility-reviewer", + "feature/hac-176-177-release-ready", + "feature/hac-178-tracked-demo-source" + ], + "head": "0041bdf" + }, + { "members": ["feature/hac-136-decoration-plumbing", "fix/hac-129-npx-entrypoint"], "head": "f62ce3e" }, + { "members": ["feature/hac-136-reauthored", "feature/hac-158-skills-reauthored"], "head": "8824c9b" }, + { "members": ["backup/hardened-17588dd", "dev"], "head": "17588dd" } + ], + "linearMappings": [ + { + "id": "HAC-136", + "linearState": "In Progress", + "implementationState": "IMPLEMENTED_UNVERIFIED", + "commentEvidence": "latest Linear correction requires product-path call, visible verdict, demo proof, and docs" + }, + { + "id": "HAC-206", + "linearState": "Backlog", + "implementationState": "ISSUE_DESCRIPTION_STALE", + "commentEvidence": "0.1.7 shipped-byte proof recorded; render/billfold gates pending" + }, + { "id": "HAC-97", "linearState": "Done", "implementationState": "INTEGRATED" }, + { "id": "HAC-170", "linearState": "Done", "implementationState": "INTEGRATED" }, + { "id": "HAC-129", "linearState": "Done", "implementationState": "IMPLEMENTED_UNVERIFIED" } + ], + "dependencies": [ + { "from": "preserve-prunable-and-unreachable", "to": "release-baseline-reconciliation" }, + { "from": "release-baseline-reconciliation", "to": "manual-patch-family-review" }, + { "from": "manual-patch-family-review", "to": "marketplace-refresh-pr" }, + { "from": "marketplace-refresh-pr", "to": "validation-and-linear-update" }, + { "from": "validation-and-linear-update", "to": "cleanup" } + ], + "proposedMergeOrder": [ + "preservation", + "release range-diff", + "manual security/fixture reconciliation", + "fresh marketplace PR", + "CI and packaged-artifact validation", + "Linear updates", + "cleanup" + ], "cleanupCandidates": [], - "humanApprovalGates": ["preservation bundle creation", "release equivalence decision", "architecture selection for HAC-136 family", "any merge/cherry-pick", "all cleanup"], - "unknowns": ["GitHub PR/check/protection state", "missing-worktree status and untracked files", "unreachable commit intent", "remote freshness"] + "humanApprovalGates": [ + "preservation bundle creation", + "release equivalence decision", + "architecture selection for HAC-136 family", + "any merge/cherry-pick", + "all cleanup" + ], + "unknowns": [ + "GitHub PR/check/protection state", + "missing-worktree status and untracked files", + "unreachable commit intent", + "remote freshness" + ] } From dc101c85ca7234f40874a2324328260a6678ad6f Mon Sep 17 00:00:00 2001 From: Qwynn Marcelle Date: Wed, 22 Jul 2026 16:57:18 -0400 Subject: [PATCH 5/5] docs(audit): record passing CI evidence --- .../worktree-reconciliation/2026-07-22/remediation-results.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/audits/worktree-reconciliation/2026-07-22/remediation-results.md b/docs/audits/worktree-reconciliation/2026-07-22/remediation-results.md index 7f31a29..3536503 100644 --- a/docs/audits/worktree-reconciliation/2026-07-22/remediation-results.md +++ b/docs/audits/worktree-reconciliation/2026-07-22/remediation-results.md @@ -55,6 +55,7 @@ No Linear update is justified by this drift alone: the validated PR evidence con | --- | --- | --- | | Audit JSON | `node -e JSON.parse(...)` with branch/worktree counts | PASS: valid JSON; 30 branches and 15 worktrees enumerated | | Audit formatting | `git diff --check -- docs/audits/worktree-reconciliation/2026-07-22` | PASS | +| Audit PR CI | GitHub Actions run `29957217674` for PR #14 at `f8e201a` | PASS: Node 20 and Node 22 `build-and-smoke` both completed successfully | | Runtime/package validation | Not run | Not applicable: no runtime/package change; full integration validation remains blocked | | Adversarial review | `codex exec review --uncommitted --ephemeral` | INCOMPLETE: reviewer inspected the artifacts but did not emit a final verdict; Linear OAuth refresh failed. A count discrepancy discovered during review was corrected before this log. |