Codex ProofKit v0.3.0

v0.3.0 makes Codex ProofKit usable as a reusable GitHub Action while preserving its dependency-free, offline core.

Highlights

• Add a root composite Action for strict Git-tracked release audits.
• Write privacy-safe JSON and Markdown reports and a GitHub Job Summary.
• Add receipt --git-tracked to hash the complete public release surface.
• Expose proof-file paths without implicit uploads; maintainers choose whether to upload .codex-proof/.
• Add a structured, privacy-aware maintainer feedback issue form.
• Preserve the codex-proofkit-receipt-v1 schema and existing CLI exit behavior.

Quick start

steps:
  - uses: actions/checkout@v5
  - uses: benzzy1287/codex-proofkit@v0.3.0

Verification

• 15 standard-library unit tests passed.
• GitHub-hosted test and action-smoke jobs passed on the PR and merged main.
• Strict Git-tracked privacy audit passed with 0 errors and 0 warnings.
• CI generated and verified the v1 SHA-256 receipt and published only the 2 KB proof artifact.

Privacy

The CLI and composite Action contain no credentials, telemetry, subscription dependency, paid service, source upload, or implicit network call. Optional artifact upload is explicit and limited to generated proof files.

Full changelog: v0.2.0...v0.3.0

Codex ProofKit v0.2.0

Release audit gate

v0.2.0 makes public releases safer and easier to verify:

• audit --git-tracked selects the Git-index file set and ignores unrelated untracked notes.
• audit --strict turns privacy and configuration warnings into CI failures.
• New high-confidence checks cover OpenAI organization IDs, Slack tokens, Stripe live keys, JWTs, and non-example email addresses.
• Findings no longer echo matched emails, usernames, or secret values.
• CI now runs the strict Git-tracked audit.

Compatibility is preserved: the receipt schema remains codex-proofkit-receipt-v1, the normal audit mode keeps its prior warning behavior, and the project remains offline with no telemetry or paid service.

Verified

• 10 unit tests passed
• strict Git-tracked audit passed with 0 errors and 0 warnings
• plugin and skill validation passed
• delivery receipt verified 17 files with 0 failures

Full changes: https://github.com/benzzy1287/codex-proofkit/blob/main/CHANGELOG.md

Codex ProofKit v0.1.0

First public release of Codex ProofKit.

• Audit AGENTS.md, SKILL.md, and Codex plugin manifests.
• Detect likely credentials and hard-coded personal home paths.
• Bind artifacts to real evidence files with SHA-256 receipts.
• Verify drift with stable exit behavior.
• Run fully offline with the Python standard library.

CI: 6 unit tests plus a repository self-audit.