Code-X v1.22.8

A hardening patch: the one leg of the eval gate that had never been proven to fail on its OWN reason now is — with a test-only override that production refuses, loudly. 597 self-tests · 488 gate clauses each proven to bite · consistency strict-clean · installer 26/26.

What's new

• The kaizen leg of cx check evals now proves it bites in isolation (F-PROP-002). cx check evals runs four legs; the 4th audits the live protocol-improvement queue. That leg always pointed at the real live queue file — so its contract clause was "proven" by a shared bad fixture that actually failed a DIFFERENT leg first, meaning the kaizen leg itself had never been shown to turn the gate red on its own. Now a CX_KAIZEN_QUEUE test-only override (honored ONLY under CODE_X_TEST_MODE=1) lets a real bad kaizen queue fixture drive that leg alone: the gate goes red with the kaizen leg's own failure reason while the other three legs stay green.
• The override fails loud in production, never silently. Setting CX_KAIZEN_QUEUE without test mode is REFUSED: it raises a P1 finding AND the real live queue is still audited — a stale or malicious environment variable can never quietly redirect the audit away from real canon. A new gate clause (EVALS-KAIZEN-QUEUE-ENV-TEST-ONLY) pins that refusal path, mirroring the existing CX_PROFILES posture.
• The contract harness is no longer cwd-sensitive for env-carried fixture paths. Clause env values now support a {CHECKERS_DIR} token expanded to the absolute checkers directory — env values aren't cwd-resolved like args, so a relative fixture path in env would silently break depending on where the harness was launched from. Both test suites are verified green from BOTH the skill root and the checkers/ directory.
• EVAL-059 registered; 3 new unit tests cover the override gating (unset / honored under test mode / refused outside it).

Verify it yourself

git clone https://github.com/1984-alt/code-x.git && cd code-x/plugins/code-x/skills/code-x
python3 checkers/tests/run.py             # 597 tests, OK
python3 checkers/tests/run_contracts.py   # all 488 gate clauses bite
python3 checkers/cx --version             # cx — Code-X V1.22.8

Full details in CHANGELOG.md.

Code-X v1.22.7

A hardening patch: a protocol invariant that lived in prose convention is now a declared, checker-parsed fact — and 95 more gate clauses now prove they fail for the RIGHT reason. 594 self-tests · 487 gate clauses each proven to bite · consistency strict-clean · installer 26/26.

What's new

• The conflict-scan version floor is now a declared anchor, not a prose convention (PBF-PROP-023). When a protocol-improvement proposal is queued, the checker verifies its conflict scan wasn't run against stale history — using a "floor" commit it used to find by grabbing the FIRST backtick-quoted sha anywhere in the current version's history row. That's positional prose: an innocent citation reorder could silently move the floor, and a hex-looking non-commit produced misleading mass failures. Now the current version's row must declare exactly one structured base=`<40-hex sha>` token. Zero tokens, two tokens, or a sha that isn't a real commit each fail CLOSED with their own plain-English message — and both legacy fallbacks (first-sha scan and git-blame) are deleted, proven gone by 6 new adversarial tests (hijack, missing, duplicate, non-commit, legacy row shape, malformed token).
• 95 gate clauses now prove they fail for the right reason (PBF-PROP-021 remainder). A contract clause used to only prove "the gate rejects this bad fixture" — it could start failing for a completely different (wrong) reason and stay green. Every pre-existing clause that lacked a cause-specific expect_contains substring now carries one, each verified against the real failure output, closing the audit backlog.
• EVAL-057 and EVAL-058 registered; the shipped VERSION-HISTORY template documents the new base= token rule for fresh installs recording their own folds.

Verify it yourself

git clone https://github.com/1984-alt/code-x.git && cd code-x/plugins/code-x/skills/code-x
python3 checkers/tests/run.py             # 594 tests, OK
python3 checkers/tests/run_contracts.py   # all 487 gate clauses bite
python3 checkers/cx --version             # cx — Code-X V1.22.7

Full details in CHANGELOG.md.

Code-X v1.22.6

An audit fold: the checker audited itself, and every confirmed hole is now closed fixture-first. 588 self-tests · 487 gate clauses each proven to bite · consistency strict-clean · installer 26/26.

What's new

• 13 reachable false-PASS holes closed (PBF-PROP-021). A read-only audit hunted for inputs that SHOULD fail a fail-closed gate but returned exit 0 — and found 13 real ones. Each is closed fixture-first: the failing input is pinned as a permanent regression test before the fix lands. On top of that, 11 blocking clauses that had never been proven to bite got their own pinned bad fixtures.
• A packet can no longer author proof of its own freezing. The --legacy-migration waiver leg that accepted a self-authored registry hash (even a validly-shaped one) is removed entirely — only a --migration-ref resolving to a real protocol-ledger decision row waives the forge-parity marker requirement.
• Smarter PII tripwire on outbound reviews. The egress scrub check graduates from a blanket 12-plus-digit rule to structured detection: separator-normalized phone numbers (dashes, dots, parens, international prefixes) and context-gated 10-digit account numbers — with negative controls pinned so benign order ids, dates, and hashes stay quiet instead of turning the tripwire into noise.
• Gate-ROI ceremony slim with honest keeps and drops (PBF-PROP-022). Two zero-consumer ledger templates are cut (the cost log stays live — it's the working waste sensor); EVALS.md becomes a 1-line-per-eval index (no checker ever parsed its prose; enforcement lives in the contract clauses, untouched); and a new non-blocking advisory nudges new projects to make the risk-tier choice explicitly instead of silently riding the STRICT default.
• EVAL-056 registered; kaizen status/fence parsing hardened against case-drift and exotic-tag dodges.

Verify it yourself

git clone https://github.com/1984-alt/code-x.git && cd code-x/plugins/code-x/skills/code-x
python3 checkers/tests/run.py             # 588 tests, OK
python3 checkers/tests/run_contracts.py   # all 487 gate clauses bite
python3 checkers/cx --version             # cx — Code-X V1.22.6

Full details in CHANGELOG.md.

Code-X v1.22.5

A bundle of five protocol folds since v1.22.4. 566 self-tests · 456 gate clauses each proven to bite · consistency strict-clean · installer 26/26.

What's new

• Per-project risk tiers — LITE / STANDARD / STRICT. The #1 adoption blocker removed: a throwaway prototype no longer pays the same review ceremony as a real-money app. You pick a tier per project; the non-negotiable safety floor (coverage, frozen-plan hash, scope limits, dependency scanning, forced review of money/auth/secrets work) is identical at every tier, and an undeclared or invalid tier fails closed to STRICT.
• Given/When/Then acceptance examples, wired into runtime proof. Every behavioral requirement carries at least one concrete {given, when, then} example (or a typed exemption), and the runtime verification step must actually cite and resolve those examples — not just claim the feature was checked.
• /cx-accept forge-parity acceptance recompute. Acceptance receipts stop being trusted at face value: the commit reference and quality-card hash are independently recomputed against reality, so a hand-edited receipt can't pass. A new cx check accept stamper generates receipts correctly by construction.
• Mockup-first change rule. A card touching a user-visible screen must cite the current locked design AND compare its build against a real render — never a prose-only description of a visual change.
• Checker-crash-masks-finding fix. cx check state / cx check boot no longer crash on a malformed session-state file — they report a clean [P0] instead of masking it.

Verify it yourself

git clone https://github.com/1984-alt/code-x.git && cd code-x/plugins/code-x/skills/code-x
python3 checkers/tests/run.py             # 566 tests, OK
python3 checkers/tests/run_contracts.py   # all 456 gate clauses bite
python3 checkers/cx --version             # cx — Code-X V1.22.5

Full details in CHANGELOG.md.

v1.22.4

Full Changelog: v1.22.2...v1.22.4

v1.22.2

docs: AI-reader parity — FOR-AI-REVIEWERS.md + llms.txt + AGENTS.md +…

v1.22.1

Patch release — PBF-PROP-016.

• CI now runs the full eval gate. .github/workflows/tests.yml runs cx check evals as one step — unit tests + the contract-bite suite (every gate clause proves it rejects a bad fixture) + consistency --strict + the live kaizen-queue check. Previously CI ran unit tests only; green CI never proved the gates bite. Found by an external GPT-5.5 Pro review; fixed the same day.
• New README section: "Who Code-X is for." States plainly who this protocol serves (solo builders who can't read code and want evidence over speed) and who it does NOT serve (fast MVPs, prototypes, throwaway tools — use a capable AI builder directly for those). From an external Grok review.
• Backfilled version tags v1.12.1, v1.14.0, v1.17.0, v1.19.0 so every separately-published changelog version carries its tag. v1.11.0/v1.12.0 predate the public repository and v1.20.0 shipped bundled inside the v1.21.0 commit — noted in the changelog, deliberately untagged.
• Public checker version constant now reports V1.22.1 (was skewed at 1.22 vs the 1.22.1 packaging).

v1.22.0

Full Changelog: v1.21.0...v1.22.0

v1.21.0

See CHANGELOG.md [1.21.0] — graduation gate, Kaizen checker + fixtures, EVALS renumber, canon hygiene. 375 self-tests, 366 gate clauses.

v1.18.0 — the Master Blueprint (PROP-039)

Syncs the public release up to protocol v1.18 (PROP-039, the Master Blueprint). Cross-family reviewed twice and fixed-first before landing.