Skip to content

Releases: builtbyhuy/codex-plugin-check

Release list

Codex Plugin Check v0.1.1

Codex Plugin Check v0.1.1 Latest
Latest

Choose a tag to compare

View all tags
@builtbyhuy builtbyhuy released this 10 Aug 15:19
Immutable release. Only release title and notes can be modified.
v0.1.1
562567d
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What changed

  • Add GitHub Marketplace branding metadata.
  • Keep the released-binary and public-fixture evidence gates unchanged.

Verification

  • Node test suite: 158 passed, 0 failed, 1 expected strict-Docker skip locally.
  • GitHub Actions on Node 24 passed on the release commit.
Assets 3
Loading

Codex Plugin Check v0.1.0

Codex Plugin Check v0.1.0

Choose a tag to compare

View all tags
@builtbyhuy builtbyhuy released this 10 Aug 13:22
v0.1.0
181daab

Codex Plugin Check v0.1.0

This is the first experimental release of the evidence-first GitHub Action and
CLI for checking how an exact released Codex binary discovers one local plugin
checkout.

Included

  • Codex-owned install, plugin declaration, skill registry, and hook registry
    evidence in one deterministic JSON receipt;
  • strict Linux/Docker isolation with network, personal host state, and checkout
    writes denied during the probe;
  • diagnostic env mode for Linux, macOS, and Windows;
  • stable receipt states and process exit codes;
  • a synthetic released-Codex falsifier and an immutable public-plugin fixture
    matrix.

Verified evidence

The strict matrix tested ten pinned public plugin repositories against Codex
0.147.0 and 0.146.1: 10/10 fixtures and 20/20 cells passed. The
source run
used code commit 3285a65bab2ba805665c6be4e4349874fc7be417 on Ubuntu 24.04
and Node 24.19.0.

The attached codex-plugin-check-public-fixture-evidence-v0.1.0.zip contains
exactly 20 sanitized receipts and one summary. Its SHA-256 is:

3bcec67f5e1c3833bc5de684b1be6a7aa46859dd326cb9a776eeaf9b774b06f7

The summary inside the archive has SHA-256
7db42975282375feb5294d5d2be0c3964bfda127b5de4a6c02745185449492cc.

Important limits

  • A PASS proves only the bounded Codex discovery evidence described by the
    receipt; it is not a security or runtime-behavior certification.
  • Strict certification currently requires Linux with Docker. env mode never
    claims network or host-state enforcement.
  • MCP servers and apps remain DECLARED_ONLY; the checker does not start them
    or enter authentication flows.
  • Third-party fixture checks do not contain universal per-fixture execution
    tracing. Their non-execution claim is limited to the checker request path and
    the separate synthetic sentinel evidence.
  • This release has no independent-use, adoption, endorsement, or production-
    readiness claim. The Codex for Open Source application remains on hold.

See the README,
receipt schema,
public fixture ledger,
and security policy
for the complete contract.

Loading