v1.5.3 — Standalone Codex & Native Hooks

⚡ Superkit v1.5.3 — standalone Codex, safe updates and native hooks

v1.5.3 delivers a standalone Codex installer, customization-preserving upgrades,
Astra-authored GPT role sources, compatible workflows and two bounded native hook
handlers. It also includes the completed Claude statusline/updater improvements
and optional GAN source work accumulated since v1.5.2.

The shared package contains both harnesses. --codex-only installs only Codex
assets; --codex continues to install Claude + Codex. Claude totals remain
56 agents, 16 commands, 42 shipped hooks, 22 skills and 19 rules. Codex installs
82 skills and 2 native hook handlers in one script. Optional GAN remains a
separate manual opt-in.

📦 Standalone installation and safe upgrades

• New noninteractive --codex-only bypasses Claude executable checks, plugins,
  .claude/CLAUDE.md writes, Claude documentation scaffolding and validation.
  It resolves the target Git root even when launched from a subdirectory.
• Skills remain stored under .codex/skills; relative .agents/skills links
  expose them through current Codex discovery. Existing discovery entries are
  preserved and reported, including conflicts.
• Codex updates use their own schema-1 manifest and recorded installed hashes.
  Stock pre-manifest v1.5.2 skills are recognized through a pinned, bundled
  SHA-256 baseline. No network lookup is needed for that recognition.
• Pristine replacements receive unique backups; edited skills and managed hook
  assets are preserved and reported. Existing AGENTS, config, rules, active hook
  definitions and unrelated files remain under the consumer's ownership.
• Corrupt manifests, unsafe managed-path links, invalid file types and incomplete
  packages fail explicitly. A lock prevents concurrent installers. Individual
  replacements are atomic; the whole installation is not a transaction.
• Combined --codex installation uses the same independent Codex update policy.
  The existing Claude installation path and consumer model defaults are retained.

🧠 GPT role sources and workflow compatibility

Astra-authored sources retain specialist depth while grounding decisions in the
actual project, task authority and available evidence:

• Planning and final gates: architect, plan-checker, evaluator, goal-verifier,
  critic and reality-checker use requirement-specific evidence, explicit unknowns,
  bounded correction and honest partial outcomes.
• Delivery and review: minimal-change, onboarding, endpoint scaffolding, cleanup,
  code review, silent-failure, documentation and comment analysis retain scoped
  edit/read authority and distinguish findings from missing coverage.
• Testing, diagnosis and API work: test/e2e generators, health checks, API sync,
  tree generation and debug observation separate test oracles, mocks, actual
  runtime observations and unavailable checks.
• Security, dependencies, infrastructure and data: audit roles distinguish
  inspected impact from scanner candidates, missing evidence and version age;
  backend/database/migration work follows real data flow, workload and rollout
  contracts. Audit aggregation preserves mandatory coverage gaps.
• Languages and delivery readiness: Go correctness/error/concurrency,
  modernization/performance/observability, TypeScript/Python/Rust and pre-deploy
  reviewers follow the configured toolchain and actual readiness criteria.
• UI and 3D: core UI/visual/design-system/audit reviewers, six frontend-ui aliases
  and four frontend-3d reviewers preserve distinct specialties. Source, rendered,
  interaction, GPU and measured performance evidence remain distinct.
• Bot/nudge, architecture/output and authoring guides preserve messaging/scheduling
  authority, stop/snooze preferences, observed project facts, authorized change
  scope, role-specific verdicts and truthful verification coverage.

All nine workflow skills now resolve actual installed tools and roles.
Test/lint runners avoid implicit installation or formatting authority; commit
helpers respect the staged scope and unrelated index; migration scaffolding is
separate from application, and rollback is never silently replaced with reset or
push. Benchmark comparisons preserve work and use isolated baselines. Four
support-source fixes remove missing companion/rule/tool assumptions. The native
manifest protects 65 sources from converter overwrites, including the newly
adapted workflows and support sources. The dev workflow retains 16 phases.

These are accepted source and compatibility changes. They do not establish
empirically measured model quality or live acceptance of every workflow. Shipped
consumer defaults remain Astra/high coordinator and Sol/medium fallback; prompt
authorship and current contributor routing are separate from those defaults.

🪝 Two native Codex handlers, with explicit trust

• PreToolUse / Bash rejects covered static destructive Git commands. It never
  grants permission. Dynamic syntax, aliases and arbitrary wrappers are outside
  its bounded recognition surface; it is not a complete shell security boundary.
• Stop checks tracked staged/unstaged whitespace in filter-free repositories
  and permits at most one continuation. It does not establish test/build success
  or untracked-file correctness.
• Conversion-filter safety: any configured filter.*.clean or
  filter.*.process, including unused drivers and global Git LFS, skips both
  diffs with UNVERIFIED. Only config keys are enumerated; conversion values
  are not captured, config is not changed and conversion programs are not run.
• The script and merge template are managed backup assets. Existing active
  hooks.json is preserved. New wiring is created only beside absent/exact-stock
  config with no managed-asset conflicts; other configurations receive a manual
  merge template.

The installer grants no project or hook trust. Review the script and definition,
trust the project when appropriate, and inspect each definition through /hooks.
Review script updates separately from definition-hash trust. Other config layers
can contribute hooks, so avoid duplicate registrations.

Actual codex-cli 0.162.0-alpha.17.2 in a disposable POSIX/macOS fixture observed
native PreToolUse blocking an attempted hard reset, then Stop progressing from
blocked → completed, followed by a completed native turn. Normal folder trust
and individual hook review were used. A first attempt remains recorded as partial;
a distinct successor captured completion. Sentinel bytes and installed hook
assets were preserved. This proves the two bounded handlers in that runtime; it
does not activate hooks in other projects. Windows/cloud remain unqualified.

📊 Claude statusline and updater improvements

The completed Claude work since v1.5.2 is included in this shared release:

• Parse current Claude Code context_window objects: prefer used_percentage,
  otherwise derive a ratio from usable token counts, and retain transcript
  fallback when the object contains no usable numbers. Legacy numeric payloads
  and the existing context-limit precedence remain supported.
• Remove the stale active-task readout. The continuity state file and its
  compaction/restore consumers remain intact.
• Trim the line to version, branch, model/effort/ULTRA, context and real 5-hour/
  weekly usage meters. Light-terminal support remains available.
• Sync statusline.cjs through the same pristine-update policy: create absent
  copies, update untouched ones, preserve and report customized copies.

Historical Claude Fable 5 hardening applies to the Claude layer. The GPT role
sources in this release were authored by Astra; there is no blanket Fable
attribution across both harnesses.

🎭 Optional GAN and research boundaries

The optional GPT GAN planner/generator/evaluator sources align scenario/rubric
handoffs, bounded implementation and independent evidence-based verdicts. Missing
mandatory rubric or runtime evidence remains explicit. Playwright and manual
opt-in are still required; inclusion is not live GAN/model acceptance.

Internal evaluation/oracle/collector and migration-inventory research code was
removed from the product workstream. Historical baselines and evidence remain
preserved. W00B, provider attestation, G01/G02 and universal behavioral
qualification are outside this release scope, not declared completed or passed.
Historical source/behavior counters are not product completion percentages.

🚀 Install or update

Node.js 18+ and Git are required. Clone the released version to a separate
location, then invoke it from the target project's Git directory:

git clone --branch v1.5.3 --depth 1 \
  https://github.com/RaNDoM6913/claude-code-superkit.git \
  /path/to/claude-code-superkit-1.5.3
cd /path/to/your-project
node /path/to/claude-code-superkit-1.5.3/bin/cli.js --codex-only

For an existing Codex installation, run the same command to update. Read the
conflict/backup summary: a preserving install can succeed while leaving edited
files for manual comparison. Existing config and active hook definitions do not
receive automatic upstream merges. Codex updates are explicit; no scheduler or
Claude SessionStart hook is installed for Codex.

For the combined Claude + Codex route, use:

node /path/to/claude-code-superkit-1.5.3/bin/cli.js --defaults --codex

For Claude alone, use the existing interactive installer without either Codex
selector. After Codex installation, inspect /skills (or $) for discovery and
/hooks for review/trust. Discovery is not proof of successful workflow execution.

A package archive can also be extracted to a separate directory and run from the
target project with node /path/to/extracted/package/bin/cli.js --codex-only.
The package archive includes both harnesses; the selector controls installation.
Release assets: claude-code-superkit-1.5.3.tgz (npm package format),
claude-code-superkit-1.5.3-source.zip (source archive) and SHA256SUMS.
GitHub's automatic source archives remain available separately.

npm publication verified: claude-code-superkit@1.5.3 is published and tagged latest. The downloaded registry tarball is byte-identical to the GitHub package asset; a fresh-cache registry install verified v1.5.3, 82 skills and no Claude installation.

npx claude-code-superkit@1.5.3 --codex-only

✅ Verification and evidence limits

The stable v1.5.3 release tree passed 133/133 product tests, 13/13 smoke
checks, 56/56 hook cases, 15 core-hook suites and three frontend UI hook
suites (13 animation, 9 banned-font and 12 color checks). Archive fresh/repeat
installs, stock v1.5.2 upgrade/customization preservation, schema-1 manifest
upgrades, native-source converter preservation, native policy decisions and all
82 skill discovery entries were checked. Native hook lifecycle proof is described
separately above. Documentation/version/metadata release edits do not expand those
behavioral claims.

Canonical evidence:

• Workflow, support and hook contract / code verification
• Native activation and reviewed artifact accounting
• Install, update, backup and trust guide
• Full changelog

The evidence records retain their original dates, candidate version 1.5.2 and
then-current authorization boundaries. The later native activation record
supersedes the earlier packet's pending native-firing status only for its bounded
fixture. Neither record is a production deployment or universal behavioral claim.