Outsider Stage 0.5 v1.3.99 — Open-Source Beta

Outsider 1.3.99

Status: open-source beta release.

1.3.99 is the open-source beta identity for the direct Codex Stage 0.5 work
that followed 1.3.98. It does not replace or mutate the tagged 1.3.98 source
or artifacts.

Direct Codex control

• Handles the eleven lifecycle event names in the current Codex hook contract
  explicitly. Passive lifecycle events cannot fall through the PreToolUse
  policy path, and an unknown event fails closed instead of inheriting an
  action default.
• Records a source-bound, signed receipt for the canonical controller decision
  before projecting it into the current Codex native envelope. In particular,
  an allowed PreToolUse returns no unsupported permissionDecision: allow,
  while a denial remains an exact native denial.
• Keeps the frozen contract active after a red terminal verification. An
  unchanged Stop cannot become falsely green; a bounded replacement controller
  generation must observe an authorized repair action and its result before
  another terminal attempt.
• Binds final approval review to the exact persisted correction text,
  correction authority, factual audit, emission, and observation events.
  Worker final-report text may satisfy an operator-required report shape, but
  it is never accepted as proof that the implementation or tests are correct.
• Distinguishes a real apply_patch edit from Codex Desktop's generic custom
  exec transport wrapper, preventing wrapper traffic from inventing file
  changes.
• Allows the universal plugin's boundary-notice hook to coexist with one exact
  attached controller hook without treating the notice as controller
  authority.

Live result and exact boundary

In isolated project-local Codex task
6c28e828-0f23-4340-a87a-424c88dfbdd4, the exact 1.3.99 source runtime closed
the consequential control chain. One read-only child Agent was bound to its
delegated task and independently cleared. An acceptance-red first Stop was
denied; a fact-audited bounded correction was emitted and observed; only the
permitted source file changed; repository acceptance turned green; and the
repaired Stop continued. The run finalized as SAFE_DELIVERY with
proofComplete=true, deliveryComplete=true, and
interventionComplete=true.

The schema-specific verifier replayed the sealed 63-event chain successfully.
Its event-chain commitment is
sha256:77eb3315c5072db8ab32d61e602601c21a8472f70ceea2adbaa730c75e737740
and its manifest hash is
sha256:3f77f1cafb71be6e488839b355d86980045aaab0b484e1eec5153e730dba58e0.
This binds the tested runtime source and behavior; release archives are
separately rebuilt and certified from the frozen publication tree.

The tested host exposed ten project hook definitions and did not expose
SessionEnd. That documented event is advisory—its output cannot steer Codex
or keep a task open—so it was not counted as a passed hook. Outsider reports
the omission as a host capability gap, and this release does not claim that
all eleven documented lifecycle events, hosted tools, specialized paths, or
write_stdin on an existing exec session are controlled. The live task proves
the exact fixture and consequential hook path, not universal model correctness
or operating-system containment.

ChatGPT remains a skill/plugin surface: live ChatGPT Desktop installation and
new-chat evaluation are not established, and ordinary ChatGPT conversations
do not gain a universal lifecycle interceptor. Existing Claude Code/Desktop
Code and Cowork paths are retained; this Codex result is not presented as a new
Claude host certification.

Public release boundary

The public package contains the Stage 0.5 runtime modules required by the
installed controller, bilingual install documentation, the Claude plugin, and
the ChatGPT/Codex repo-marketplace plugin. The reviewed public staging profile
continues to exclude non-Stage-0.5 local research, internal planning assets,
tests, raw runs, private evidence, and private data.

Required release assets are:

• outsider-guard-1.3.99.tgz
• outsider-guard-1.3.99-claude.plugin.zip
• release-certificate-public-1.3.99.json
• SHA256SUMS

The tag, archives, public certificate, and checksums are rebuilt and bound from
the same frozen 1.3.99 publication tree by the release workflow.

Outsider Stage 0.5 v1.3.98

Outsider 1.3.98

1.3.98 is a new open-source beta identity for the reviewed Stage 0.5 public
runtime. It does not reuse the tagged 1.3.97 identity or artifacts.

Install surfaces

• Adds a validated repository marketplace and universal plugin package for
  ChatGPT and Codex.
• Adds complete English and Simplified Chinese README files with reciprocal
  language links.
• Includes the exact Apache-2.0 LICENSE in both the Claude archive and the
  ChatGPT/Codex universal plugin package.
• Verifies a clean Codex 0.144.5 local marketplace add, plugin discovery,
  installation, and enabled 1.3.98 identity inside an isolated CODEX_HOME;
  this proves packaging/installability, not runtime control.
• Keeps surface capabilities explicit: ChatGPT receives the Outsider skill but
  no universal lifecycle interception; Codex requires the companion runtime,
  exact /hooks trust, and a real conformance receipt before any controlled
  claim.
• Keeps Claude Code/Desktop Code and Cowork install paths separate; Cowork
  still requires the matching plugin archive and local helper handshake.

Safety and privacy

• External semantic supervision remains disabled unless the operator supplies
  both a supervisor command and independent external-disclosure consent.
• Supervisor evidence is recursively minimized; sensitive-path evidence
  units, binary/non-plain values, common credential blocks, authorization
  values, and URL queries are excluded or redacted.
• Repository-writable legacy run/contract files cannot grant command authority.
• Host settings and helper files use private, no-symlink, stable-identity,
  no-clobber publication paths.

Release boundary

The root workspace remains private and intentionally unpackable. The release
builder stages only the reviewed Stage 0.5 dependency closure, exact-compares
the packed npm member set, and validates every Claude plugin archive member by
path, byte count, and SHA-256. Stage 1–4, Reality Stewardship, governed model,
actuarial, outreach, acquisition, raw source, and canonical research artifacts
remain local.

This release remains beta. Plugin visibility, successful installation, hook
configuration, hook trust, runtime observation, and controlled status are
separate evidence states.

Outsider 1.3.97 — Open-source beta

Outsider 1.3.97

1.3.97 is the first open-source GitHub beta prepared for publication under the
authenticated EZ-VAI/outsider repository. It supersedes the unpublished
1.3.96 build, whose package metadata pointed at the wrong GitHub owner.

Public-release contents

• Apache-2.0 source release with CI, security, contribution, and privacy
  policies;
• native Claude Code and Desktop Cowork attached supervision packages;
• independently deployable Cloudflare Workers for the quarantine-only
  Experience gateway and real-run product demo;
• browser-verifiable evidence from a sealed, preregistered Claude Agent Team
  intervention run;
• privacy-projected public release certificate and reproducible checksums;
• DeepSeek Harness observation integration with no implied control authority.

Claim boundary

This release is an open-source beta and may be published only after its exact
archive passes the deterministic release build and certificate. It is not a
stable or production-ready release unless that exact certificate reports
stablePublicReleaseReady: true. Contributions remain disabled by default,
require explicit per-run consent, and enter quarantine rather than pricing,
guarantee, or settlement.

Validation target

• product tests: 469/469;
• deterministic command corpus: 125/125;
• clean npm archive install and clean-package test replay;
• hosted Cowork plugin archive validation;
• Cloudflare contribution gateway and product demo dry-runs;
• release decision: PRIVATE_BETA_READY;
• stable public release: false.

Public services

• product demo: https://outsider-stage05-demo.outsider-guard.workers.dev;
• opt-in contribution gateway:
  https://outsider-experience-gateway.outsider-guard.workers.dev;
• gateway key id:
  sha256:d4d51c3560764ed18f47b121721f4f4c9a3594d634e5dbcb00442300f39b6bad.

The contribution gateway is quarantine-only. It does not automatically train a
model or promote self-attested records into pricing, guarantees, or settlement.