CtxWise v0.4.0 — one command before the task

CtxWise v0.4.0 — one command before the task

CtxWise now gives a useful answer before asking a new user to understand the
whole audit model or spend quota on a benchmark:

npx @framy2/ctxwise snapshot

The command runs locally, calls no model or API, reads no session transcript,
and changes no configuration. It reports:

• the estimated known startup-token surface;
• the largest guidance and skill-discovery contributors;
• counts for guidance, skills, plugins, and MCP servers;
• configuration and MCP surfaces that remain unknown rather than being counted
  as zero;
• bounded next actions for warnings such as a large skill catalog or duplicate
  skill metadata.

This release also updates Vitest to 4.1.11 and tightens the public product
positioning around observability, safety, and reproducibility.

The existing benchmark remains available as supporting evidence, not the first
thing a new user is asked to run.

CtxWise v0.3.2

CtxWise v0.3.2 — runtime version synchronization

This patch fixes a release-metadata bug found by installing v0.3.1 in a real
Codex environment.

What changed

• ctxwise --version now reads the published package version.
• Codex app-server client metadata and newly generated capability lockfiles use
  the same single source of truth.
• End-to-end and integration tests fail if runtime and package versions drift
  again.

v0.3.1 functionality was unaffected, but its CLI displayed the stale value
0.3.0. v0.3.2 corrects the display and generated metadata rather than hiding
the discrepancy.

Evidence

• RED: the new tests observed 0.3.0 while npm contained 0.3.1.
• GREEN: CLI and lockfile tests match package.json after centralization.
• Full release gate: formatting, types, coverage, build, plugin validation,
  package inspection, runtime dependency audit, CI matrix, and CodeQL.

CtxWise v0.3.1

CtxWise v0.3.1 — rebrand completion

This patch release completes the visible CtxWise rename and keeps the release
path reproducible.

What changed

• The README demo, MP4, square social cut, GIF, and poster are rebuilt from the
  CtxWise sources. Scenes stay still; motion is limited to short diagonal
  transitions and opening/closing fades.
• CTXWISE_CODEX_BIN is now the preferred custom Codex executable override.
  Existing setups using CTXRAY_CODEX_BIN continue to work as a fallback.
• smol-toml and tsx receive their green Dependabot patch updates.
• Current public documentation and copyright metadata use the CtxWise identity.

Evidence

• Local-first behavior is unchanged: no telemetry, auth proxy, prompt upload,
  or background plugin hooks.
• Reproduction: npm run benchmark:quick after cloning v0.3.1.
• Release gate: formatting, type checking, coverage, build, plugin validation,
  npm package inspection, and runtime dependency audit.

CtxWise v0.3.0

CtxWise v0.3.0 — rename from CtxRay

CtxRay is now CtxWise. The product is the same local-first Codex audit,
profile, drift, and receipt CLI. The name change avoids the unrelated PyPI
project also called ctxray.

Install

npm install --global @framy2/ctxwise
ctxwise doctor

ctxray remains a one-release compatibility command. Existing ctxray
lockfiles still parse. New lockfiles write generator.name: "ctxwise".

What to use now

• Package: @framy2/ctxwise
• Repository: https://github.com/FramY2/ctxwise
• Reproduction: npm run benchmark:quick after cloning v0.3.0

This is a naming and identity release, not a new benchmark claim.

CtxRay v0.2.4 - make independent testing smaller

CtxRay v0.2.4 — make independent testing smaller

The full CtxRay benchmark is deliberately conservative: ten fixed tasks, two
modes, and twenty Codex turns. Version 0.2.4 adds a smaller activation path for
people who want to verify one baseline/optimized pair before committing to the
matrix.

This release began as the project's first external code contribution,
PR #7 by @blut-agent. Maintainer
follow-ups preserve that commit while adding regression coverage and
fail-closed evidence boundaries.

What changed

• npm run benchmark:quick runs a stable two-turn smoke test with no arguments.
• --task <id> selects any one task from benchmarks/tasks.json.
• Unknown and unsafe task IDs fail before a Codex process starts.
• A filtered run refuses a ledger that already contains unrelated tasks.
• Terminal, Markdown, JSON, and share-report denominators use the selected
  scope rather than the full matrix.
• Partial filtered-run continuation commands preserve --task.
• The full twenty-turn flow remains available and unchanged.

The command states its maximum Codex-turn cost before execution, creates a
fresh local community-* ledger, and never uploads generated artifacts.
Maintainer benchmarks remain maintainer evidence; this release does not claim
an independent reproduction has occurred.

Verification

• 17 test files and 80 passing tests.
• 92.05% statement, 83.10% branch, 91.92% function, and 94.76% line coverage.
• CI passes on Node.js 20, 22, and 24.
• Plugin validation and npm pack --dry-run pass.
• npm audit --omit=dev reports zero vulnerabilities.
• GitHub code-scanning, Dependabot, and secret-scanning report no open alerts.

See the RED/GREEN record.

CtxRay v0.2.3 - make the reproduction real

CtxRay v0.2.3 — make the reproduction real

The original community preflight had an activation trap: because the bundled
v1 ledger was already complete, a tester could run the documented command and
perform no fresh Codex turns. The result looked successful without being an
independent reproduction.

Version 0.2.3 fixes the path:

• npm run benchmark:reproduce creates a unique community-* ledger;
• the preflight clearly states that it may consume two Codex turns;
• the terminal prints the command to resume all 20 turns without repeats;
• bundled maintainer IDs cannot receive new calls;
• unsafe or ambiguous identifiers and limits fail before Codex starts;
• share.md labels exact, estimated, and withheld evidence honestly;
• SHA256SUMS.txt hashes the exact local artifacts.

The tool never uploads benchmark files or certifies who ran them. Maintainers
must still verify whether a submitted result is independent.

Quality gate: 17 test files, 69 passing tests, 91.91% statement coverage,
82.74% branch coverage, 91.55% function coverage, and 94.71% line coverage.
See the RED/GREEN record.

CtxRay v0.2.2 - match active Codex guidance

CtxRay v0.2.2 — match active Codex guidance

CtxRay v0.2.2 is a compatibility and audit-correctness patch release.

Highlights

• Detects the project root from Codex-compatible root markers instead of
  silently treating a nested working directory as the root.
• Inventories project guidance from the root down to the active working
  directory with AGENTS.override.md precedence and configured fallback names.
• Applies project_doc_max_bytes to the aggregate active guidance chain,
  including deterministic truncation of the last contributing file.
• Makes redacted capability locks track active nested guidance while excluding
  unrelated sibling instructions.
• Falls back from an empty global AGENTS.override.md to the normal
  AGENTS.md, matching Codex behavior.

The bug was reported with a minimal reproduction in
Issue #6. The fix was developed
with preserved RED/GREEN checkpoints and 60 passing automated tests.

Install

npm install --global @framy2/ctxray@0.2.2

Run ctxray audit from the directory where Codex will work. CtxRay detects a
configured project root automatically; --project remains available for an
explicit root. The lockfile schema, local-first boundary, and no-telemetry
behavior are unchanged.

CtxRay v0.2.1 - prove the proof

CtxRay v0.2.1 — prove the proof

CtxRay v0.2.1 is a benchmark-integrity and security patch release.

Highlights

• Publishes a second 20-turn Luna/Terra/Sol maintainer benchmark ledger with
  raw JSONL, checksums, and a conservative nine-pair headline.
• Preserves an erratum for a stale npm package-name validator instead of
  rewriting the raw result, then adds a regression test against current package
  metadata.
• Fixes prototype-like prompt roles in X-Ray aggregation after enabling GitHub
  CodeQL's extended local-and-remote analysis.
• Documents which CLI inputs belong to the trusted local operator boundary.

Install

npm install --global @framy2/ctxray@0.2.1

This patch does not change the command surface or weaken CtxRay's local-first,
no-telemetry behavior.

CtxRay v0.2.0 - Lock the signal

CtxRay v0.2.0 — lock the signal

CtxRay can now detect when the Codex capability surface changes after a new
skill, plugin, instruction, profile, or upgrade.

Highlights

• ctxray drift compares a redacted baseline with another lockfile or the live
  local setup.
• ctxray drift --fail-on-drift returns exit status 2, so CI can stop an
  unreviewed context change before it affects a task.
• Lockfiles are schema-validated and duplicate paths are rejected.
• The refined 20-second, 60 fps demo keeps every scene stationary and confines
  motion to brand-aligned diagonal transitions. It tells the complete audit →
  profile → drift → evidence story without a model call or hosted service.
• New reusable logo, README hero, social preview, and square launch video.

Try it

npm install --global @framy2/ctxray@0.2.0
ctxray lock
ctxray drift --fail-on-drift

CtxRay remains local-first, has no telemetry, requires no API key, and never
reads prompt history by default.

The published benchmark remains an initial bounded microbenchmark. Its method,
raw results, validators, and limitations are unchanged and public under
benchmarks/results/2026-08-09-v1/.

v0.1.0 — reproducible context evidence

CtxRay v0.1.0 is the first public, reproducible release.

Highlights:

• Local-first Codex context audit, map, prompt X-Ray, profile compiler, lockfile,
  quota/usage receipts, and explicit model-routing profiles.
• Quality-gated Luna/Terra/Sol evidence: 20/20 validator-passing turns, with a
  73.3% reduction in estimated model-visible prompt size and 29.1% lower exact
  aggregate turn tokens in the bounded paired matrix.
• Public npm package: https://www.npmjs.com/package/@framy2/ctxray
• Reproduction report: https://github.com/FramY2/ctxray/blob/v0.1.0/benchmarks/results/2026-08-09-v1/report.md
• 48-second demo: https://github.com/FramY2/ctxray/blob/v0.1.0/benchmarks/demo/ctxray-demo.gif

The benchmark report documents the character-based prompt estimate, exact
turn.completed usage, quality gate, served-model caveat, and all reproduction
inputs. This is evidence for the bounded workload, not a universal savings
claim.