codex-in-claude v0.15.0

A status-signal and diff-gather-hardening release. codex_status learns to report an
administrative spend block, codex_job_status/codex_job_list expose a finished job's
success/failure without a fetch, the diff-gather paths gain consistency and bounded-memory
guarantees across every review scope, and several capability-discovery contracts are corrected to
match what they advertise. Tracked Codex is bumped to 0.145. The agent-visible surface changed
(result fingerprint codex-in-claude/0.1/schema-49 → schema-56, and the persisted
RESULT_FORMAT 4 → 6), so pre-1.0 this is a minor release; clients that cache by fingerprint
re-fetch the contract. Every change is backward-compatible — no tool, field, or error code was
removed or retyped.

Added

• codex_status reports an administrative spend block (#359). codex 0.145 added
  spendControlReached to the app-server's rate-limit snapshot — a spend control the backend
  enforces, distinct from a quota window: no reset clears it. rate_limit now carries
  spend_control_reached (true | false | null) and rate_limit.status gains the value
  blocked, which outranks every window-derived verdict because its remedy is not waiting; it
  reports limiting_window: null and a note saying a reset will not clear it. The tri-state is
  load-bearing — null is not false, and a null never downgrades a healthy window reading to
  unknown (which would reintroduce the permanent-unknown failure #321 removed). The bundled
  collaborating-with-codex skill gains the matching rule: blocked is the one non-advisory
  rate-limit state — refuse the paid call rather than deferring it. Bumps the persisted
  result-format (RESULT_FORMAT 5 → 6) for the new status value; not breaking.

• result_ok on job status and list entries (#335). codex_job_status and each
  codex_job_list entry now carry result_ok — a finished job's producer-declared outcome
  (true = success, false = a stored error envelope, null = running, unclassifiable, or a
  record finalized before this field) — so a stored failure can be triaged without a per-job fetch.
  It reports the outcome recorded when the result was written and does not guarantee the payload
  is still readable across releases. codex_capabilities gains an
  async_lifecycle.result_ok_field entry for structural discovery. Backward-compatible output
  addition; not breaking.

Changed

• Diff-gather git reads are now counted in bounded memory (#331, #350, #351, #353). The
  untracked-file listing, the tracked-diff --numstat summary, and the untracked-count stderr read
  — all reached on the default codex_review_changes and free codex_dry_run paths — previously
  materialized whole git outputs unbounded in the workspace's changed-file count. They now stream
  through a single shared bounded runner, so a pathological workspace can neither exhaust server
  memory nor stall a review past its deadline, and a latent stderr deadlock is removed. The same
  work fixed a real corruption bug: a carriage return in a git-produced filename was rewritten by
  Python's universal-newline translation before the NUL-splitter saw it, silently omitting one file
  while still counting it as included — a quiet coverage-contract violation (#353). Reported counts
  and error vocabulary are unchanged, so no fingerprint change.

• Every egress caveat now discloses that user-global Codex skills auto-load (#358). Skills under
  $CODEX_HOME/skills/ (default ~/.codex/skills/) are discovered from outside the workspace
  and their bodies can reach OpenAI on any active call, despite --ignore-user-config — pre-existing
  behavior (verified against codex-cli 0.144.1 and 0.145.0), not new. The disclosure is
  corrected across the server instructions, all six tool descriptions and their capability entries,
  codex_capabilities' negative scope, README.md, SECURITY.md, COMPATIBILITY.md,
  cli_contract.py, and the collaborating-with-codex skill. A reword of covered descriptions, so
  it bumps the fingerprint; not breaking — the contract only ever promised ignore-config
  drops $CODEX_HOME/config.toml, never that all $CODEX_HOME content stays local.

• Tracked Codex version bumped to 0.145 (#361). SUPPORTED_VERSIONS now tracks (0, 145);
  the CLI contract, help snapshots, and KNOWN_MODEL_SLUGS fallback are verified against
  codex-cli 0.145.0, which required no code change — help text, sandbox values, drift/auth
  signatures, and reasoning-effort handling are all intact, and the app-server schema diff is
  additive-only for the surface this plugin consumes. Advisory only: an untracked version warns in
  codex_status but never blocks, and the CODEX_IN_CLAUDE_SUPPORTED_VERSIONS override still
  applies. No agent-visible surface change, so no fingerprint bump.

Fixed

• Diff gathers are now consistency-checked and atomic across every review scope (#336, #355). A
  gather runs its context summary and the transmitted diff as separate git invocations, so a
  concurrent edit or ref move between them could make the summary and the reviewed patch describe
  different content while coverage.status still reported "complete". working_tree reviews now
  bracket that window with a best-effort porcelain state token; on a mismatch they set a new
  tree_changed_during_gather value on coverage.omission_reasons, degrading coverage to partial
  and (via the #319 rules) a pass verdict to unknown. It is a consistency caveat, not a claim
  that specific content was omitted, and it does not trip on a content-only re-edit — so complete
  is documented as no longer proof the tree held still. branch and commit reviews now resolve
  their refs to immutable commit object IDs once, up front, so the summary and diff cannot split
  under a mid-gather commit/reset/checkout; an unborn HEAD fails closed, a concurrent HEAD move is
  disclosed via the same token, and a commit=<annotated-tag> review peels the tag to its commit.
  Widens CoverageOmissionReason and bumps the persisted result-format (RESULT_FORMAT 4 → 5,
  since an older closed-schema reader could reject the new enum value); not breaking.

• Capability-discovery contracts corrected to match what they advertise (#337, #370, #372, #373).
  Several codex_capabilities and error-envelope contracts were narrower or staler than their
  promise. fingerprint_covers said any change in a covered category bumps the fingerprint but
  silently excluded release-identity fields (serverInfo.version, the capabilities version); it
  now carries a description disclosing the carve-out in both directions, so a caching client can
  trust that an unchanged fingerprint means an unchanged contract. The codex_capabilities tool
  description advertised only two of the five include_schemas tokens (the parameter schema
  already listed all five), hiding the resource-blind route to parameter-contracts. And
  invalid_arguments omitted allowed_values for a rejected list[Literal] element — the one
  parameter shape the domain resolver did not read — on the very field whose repair hint says to use
  those values. The include_schemas token set is additionally drift-proofed against its runtime
  payload by an exact-equality test. Wording and coverage corrections that widen what is documented
  and weaken no guarantee — the fingerprint bump is for the fingerprint_covers and tool-
  description changes (the allowed_values fix is per-call envelope data, no discovered surface);
  not breaking.

• invalid_reasoning_effort gives the local pre-spend guard a provenance-specific repair (#332).
  The code is emitted from two paths: the Codex backend rejecting a sent effort (table repair
  correct_arguments + codex_models, correct there) and the local pre-spend guard refusing a
  hostile resolved value before any subprocess (zero spend). The guard previously inherited the
  backend repair, misdirecting an agent that branches on error.repair to a useless codex_models
  call. It now emits a provenance-specific repair with no tool: correct_config when the
  invalid value is the resolved CODEX_IN_CLAUDE_REASONING_EFFORT default, correct_arguments when
  it is an explicit per-call argument. Bumps the fingerprint for the corrected parameter contract;
  not breaking (correct_config is already a published RepairStep).