PromptTripwire v0.1.12

Judge-facing Decision Inbox clarity for macOS arm64. This release keeps the
v0.1.11 measured Codex compatibility, explicit human approval, immutable
contract, and disposable-worktree execution boundaries unchanged.

What changed

• Classifies each review question as observed probe divergence, deterministic
  policy, both, or unknown provenance using validated persisted structure rather
  than reparsing model prose.
• Shows valid planning-probe counts, material alternative counts, and per-option
  support counts in the primary review view while keeping raw probe identifiers
  in the evidence disclosure.
• Projects the immutable contract into three direct groups: what Codex may
  change, what must pass, and what remains blocked.
• Adds English, Japanese, mobile Japanese, and contract-preview screenshots plus
  a 49-second deterministic UI preview. The preview is explicitly not a live
  Codex inspect, execution, or report recording.
• Strengthens submission metadata checks so the recorded v0.1.2 evidence capture
  and current judge distribution cannot be silently conflated.

Safety boundaries unchanged

• No model, Plugin, installer, or UI action selects a decision or approves a
  contract on the human's behalf.
• Canonical plans, decisions, contracts, hashes, snapshots, policy results, and
  mutation payloads are unchanged by the new presentation fields.
• Network access, remote writes, deploy, release, secret access, destructive
  operations, and permission expansion remain denied by default.
• The Plugin remains an explicit-only thin CLI adapter with no hook, MCP server,
  hosted backend, or additional credential path.
• OPENAI_API_KEY is not required; the existing authenticated Codex CLI session
  is reused.

Install

shasum -a 256 -c SHA256SUMS.txt
tar -xzf prompt-tripwire-v0.1.12-macos-arm64.tar.gz
cd prompt-tripwire-v0.1.12-macos-arm64
./install.sh --with-codex-plugin
codex plugin list --json

Uninstall only PromptTripwire-owned runtime and Plugin state with:

~/.local/lib/prompt-tripwire/0.1.12/uninstall.sh --with-codex-plugin

Evidence boundary

The canonical 2:52.862 submission video remains the disclosed v0.1.2 capture
because it contains the retained live inspect and separate human-approved safe
execution evidence. The v0.1.12 Issue #43 media is a deterministic fixture-based
UI preview and is not presented as new live execution evidence.

PromptTripwire v0.1.11

PromptTripwire v0.1.11

Final Build Week judge distribution for macOS arm64. This release does not add
npm publication, public Plugin Directory submission, deployment, YouTube
upload, or Devpost submission.

What changed

• Removed numeric Codex version gates from the runtime, Plugin adapter,
  installer, uninstaller, package checks, and active documentation.
• Added one shared machine-readable normal App Server compatibility profile for
  every request, notification, response, required field, type, nullability, and
  known enum consumed by PromptTripwire.
• Added a pre-repository compatibility gate that resolves and digests one Codex
  executable, generates its normal schema in private temporary storage, performs
  the normal handshake, and runs a bounded tool-free, read-only,
  network-disabled nonce canary through that same process.
• Bound executable realpath/digest, reported version, profile version,
  normalized schema fingerprint, canary fingerprint, and compatibility
  fingerprint into the repository snapshot and therefore the immutable
  contract hash.
• Re-measure compatibility immediately before approval and run. Failure or any
  exact attestation drift makes the run stale, and run reuses the verified
  process before creating its disposable worktree.
• Allow safe additive optional schema, unused methods, and schema-only unknown
  enum variants. Unknown requests or variants actually observed at runtime are
  denied and interrupt the turn.
• Keep the Plugin as a thin CLI adapter. Installation checks Codex command
  presence, output shape, and login rather than a version number. Uninstall
  requires no Codex version and does not guess-edit global configuration when
  the command is unavailable.
• Declare policy.allow_implicit_invocation: false in the bundled Skill
  metadata and package that metadata as a required installer safety file. The
  canonical invocation is $prompt-tripwire:preflight; matching prose alone
  does not activate the Skill.
• Align the Plugin manifest's interface.defaultPrompt with the current Codex
  array form while retaining the Skill-only adapter with no hook or MCP server.
• Redact secret-like task and decision source text before the Japanese
  translation turn and sanitize the complete browser review DTO before display.
  Canonical persistence, decision and contract identity, and mutation payloads
  remain unchanged.

Safety boundaries unchanged

• Human decisions and contract approval are never automated.
• Runtime experimentalApi, MCP, hooks, hosted services, new credentials,
  network access, remote writes, deploy, release, secret access, destructive
  operations, and permission expansion remain denied.
• Planning and comparison remain read-only and target writes remain contained
  in disposable worktrees with deviation interruption and sanitized reports.
• OPENAI_API_KEY is not required; PromptTripwire reuses the existing local
  Codex login.

Compatibility policy

The code has no per-version allowlist or behavior branch. Historical 0.144.4
Build Week evidence and the current 0.144.6 development smoke are documented
known-good versions only. Other versions pass or fail based on measured normal
schema, handshake, and canary behavior.

The canary is intentionally bounded. Semantic drift that preserves the schema
and lies outside the observed nonce/tool/network behavior remains a residual
risk and is not claimed as verified.

An isolated archive install on 2026-07-20 JST enabled the Plugin using the
existing Codex login with API-key variables unset. A new Codex task explicitly
injected the Skill; after one fail-closed nested request, the single documented
direct-adapter retry reached needs_review, showed Japanese reference content,
selected nothing, approved nothing, and left the safe fixture unchanged. The
isolated Plugin, marketplace, runtime, and copied authentication directory were
then removed.

Install

shasum -a 256 -c SHA256SUMS.txt
tar -xzf prompt-tripwire-v0.1.11-macos-arm64.tar.gz
cd prompt-tripwire-v0.1.11-macos-arm64
./install.sh --with-codex-plugin
codex plugin list --json

Uninstall only PromptTripwire-owned runtime and Plugin state with:

~/.local/lib/prompt-tripwire/0.1.11/uninstall.sh --with-codex-plugin

PromptTripwire v0.1.10

PromptTripwire v0.1.10

v0.1.10 makes the Japanese Decision Inbox understandable at the point of human
choice without changing what is approved. It preserves the v0.1.9 CLI,
Controller, Plugin, deterministic policy, contract, containment, execution, and
report boundaries.

Japanese reference presentation

• A fresh ephemeral, tool-free, read-only, network-denied App Server turn uses
  the existing logged-in Codex CLI to create Japanese reference text for the
  task and final decision questions, reasons, option labels, descriptions, and
  effects.
• The Japanese UI labels translated text as a reference and provides expandable
  access to the unchanged authoritative task and full decision text.
• English presentation continues to show authoritative source text.
• Translation needs no OPENAI_API_KEY, hosted backend, MCP server, automatic
  hook, or new credential path.

Authority and failure boundaries

• Reference text is stored separately in review_presentations; it is never an
  input to deterministic policy, decision identity, mutation fingerprints,
  contract creation or hashing, execution, or reports.
• Output must retain exact decision and option IDs and the original decision,
  option, and effect counts. Secret-like, invalid, or unbound output is rejected.
• Translation uses the same deny-all structured-turn tool boundary as the
  comparator. Any tool, permission, file-change, or diff request fails the turn.
• A translation failure does not approve or resolve anything. The UI displays a
  warning and the escaped authoritative source remains available.
• The aggregate API omits translation model/session metadata and internal
  failure detail.

Verification

The source suite covers structured-output binding, prompt-injection treatment,
tool/late-request denial, secret-like output rejection, persistence and fallback,
contract/content-hash identity, loopback API separation, browser language
switching, Japanese task/decision rendering, authoritative source disclosure,
and the existing keyboard approval flow.

Run:

npm run check
npm run package:macos-arm64
npm run verify:release

The supported environment remains macOS arm64, Node.js 24.15+, npm 11+, Git,
and an authenticated Codex CLI 0.144.4. The runtime and Plugin still require no
separate OpenAI API key.

PromptTripwire v0.1.9

PromptTripwire v0.1.9

Planning-probe command-notation patch for the macOS arm64 distribution.
v0.1.9 keeps the CLI, Controller, explicit Codex Plugin, deterministic policy,
contract, worktree containment, App Server isolation, report architecture, and
human approval boundary unchanged.

Release URL:
https://github.com/shuto-S/prompt-tripwire/releases/tag/v0.1.9. Verify the
archive only with the SHA256SUMS.txt published on that same Release; checksums
from earlier versions do not apply.

Fixed

• Tell every planning probe to invoke allowlisted inspection programs by bare
  name, such as ls or cat, instead of model-authored executable paths.
• Prohibit absolute/relative executable paths and explicit shells in probe
  instructions while retaining the pinned App Server's independently validated
  exact zsh envelope.
• Add regression coverage that /bin/ls remains an unknown containment
  violation rather than being normalized into a safe action.
• Preserve v0.1.8 and every earlier tag/asset as immutable historical evidence.

Unchanged safety boundaries

• PromptTripwire still trusts neither raw commands nor App Server structured
  actions alone. Both must match, and every path remains canonically contained.
• Unknown actions, including model-authored executable paths, remain
  fail-closed. This patch changes generation guidance, not the runtime gate.
• Neither the installer, Plugin, model, policy, nor language switch selects a
  Decision Inbox option or approves a contract.
• No separate OPENAI_API_KEY, credential path, hosted backend, MCP server,
  automatic hook, or non-Codex adapter is added.
• Network, remote writes, deploy, release, secret access, destructive actions,
  stale contracts, and out-of-scope files remain fail-closed.

Install

From the unpacked archive:

./install.sh --with-codex-plugin

No OPENAI_API_KEY is required. The runtime reuses the existing logged-in
Codex CLI 0.144.4 session. Runtime-only installation remains ./install.sh.

Targeted uninstall:

~/.local/lib/prompt-tripwire/0.1.9/uninstall.sh --with-codex-plugin

Verification

Source and tagged release preparation must pass:

npm run check
npm run package:macos-arm64
npm run verify:release

After publication, download the public artifact anonymously, verify its
checksum and provenance, confirm the packaged quickstart is self-consistent,
install it into an isolated prefix and Codex home, and exercise the explicit
Plugin flow without API-key environment variables. The source fixture must
remain unchanged and the Decision Inbox must wait for the human.

PromptTripwire v0.1.8

PromptTripwire v0.1.8

Planning-command output guidance patch for the macOS arm64 distribution.
v0.1.8 keeps the CLI, Controller, explicit Codex Plugin, deterministic policy,
contract, worktree containment, App Server isolation, report architecture, and
human approval boundary unchanged.

Release URL:
https://github.com/shuto-S/prompt-tripwire/releases/tag/v0.1.8. Verify the
archive only with the SHA256SUMS.txt published on that same Release; checksums
from earlier versions do not apply.

Fixed

• Require plan commands output to contain literal shell-free argv strings
  such as npm test, both in probe developer instructions and the
  structured-output field description.
• Tell probes that the explicit PromptTripwire invocation is already being
  fulfilled by inspection and is not an implementation command.
• Direct explanatory check prose to verificationSteps instead of commands.
• Add integration coverage proving all three probes receive identical guidance
  and the generated JSON Schema carries the same field contract.
• Preserve v0.1.7 and all earlier tags/assets as immutable historical evidence.

Unchanged safety boundaries

• PromptTripwire does not extract an executable command from prose. Any model
  output that still violates the field contract remains unknown and blocks.
• Neither the installer, Plugin, model, policy, nor language switch selects a
  Decision Inbox option or approves a contract.
• No separate OPENAI_API_KEY, credential path, hosted backend, MCP server,
  automatic hook, or non-Codex adapter is added.
• Network, remote writes, deploy, release, secret access, destructive actions,
  stale contracts, and out-of-scope files remain fail-closed.
• Planning remains read-only against the source checkout; approved execution
  remains in a fresh disposable worktree and Codex thread.

Install

From the unpacked archive:

./install.sh --with-codex-plugin

No OPENAI_API_KEY is required. The runtime reuses the existing logged-in
Codex CLI 0.144.4 session. Runtime-only installation remains ./install.sh.

Targeted uninstall:

~/.local/lib/prompt-tripwire/0.1.8/uninstall.sh --with-codex-plugin

Verification

Source and tagged release preparation must pass:

npm run check
npm run package:macos-arm64
npm run verify:release

After publication, download the public artifact anonymously, verify its
checksum and provenance, confirm the packaged quickstart is self-consistent,
install it into an isolated prefix and Codex home, and exercise the explicit
Plugin flow without API-key environment variables. The source fixture must
remain unchanged and the Decision Inbox must wait for the human.

PromptTripwire v0.1.7

PromptTripwire v0.1.7

Negated-list policy precision patch for the macOS arm64 distribution. v0.1.7
keeps the CLI, Controller, explicit Codex Plugin, contract, worktree
containment, App Server isolation, report architecture, and human approval
boundary unchanged.

Release URL:
https://github.com/shuto-S/prompt-tripwire/releases/tag/v0.1.7. Verify the
archive only with the SHA256SUMS.txt published on that same Release; checksums
from earlier versions do not apply.

Fixed

• Treat an explicit coordinated prohibition such as Do not A, B, C, or D as
  one negated list instead of promoting the middle comma-separated actions into
  dependency, network, or publication blockers.
• Preserve fail-closed detection for a comma splice without a terminal
  coordinator, and for a later positive action introduced by but, then, a
  new subject/modal, or a new sentence.
• Add the exact safe-fixture instruction that exposed the false dependency,
  network, and publication questions as a deterministic policy regression
  test.
• Preserve v0.1.6 and all earlier tags/assets as immutable historical evidence.

Unchanged safety boundaries

• Original task text remains first-class deterministic evidence. Only clearly
  negated coordinated operations are suppressed; ambiguous or positively
  requested high-impact actions remain blocking.
• Neither the installer, Plugin, model, policy, nor language switch selects a
  Decision Inbox option or approves a contract.
• No separate OPENAI_API_KEY, credential path, hosted backend, MCP server,
  automatic hook, or non-Codex adapter is added.
• Network, remote writes, deploy, release, secret access, destructive actions,
  stale contracts, and out-of-scope files remain fail-closed.
• Planning remains read-only against the source checkout; approved execution
  remains in a fresh disposable worktree and Codex thread.

Install

From the unpacked archive:

./install.sh --with-codex-plugin

No OPENAI_API_KEY is required. The runtime reuses the existing logged-in
Codex CLI 0.144.4 session. Runtime-only installation remains ./install.sh.

Targeted uninstall:

~/.local/lib/prompt-tripwire/0.1.7/uninstall.sh --with-codex-plugin

Verification

Source and tagged release preparation must pass:

npm run check
npm run package:macos-arm64
npm run verify:release

After publication, download the public artifact anonymously, verify its
checksum and provenance, confirm the packaged quickstart is self-consistent,
install it into an isolated prefix and Codex home, and exercise the explicit
Plugin flow without API-key environment variables. The source fixture must
remain unchanged and the Decision Inbox must wait for the human.

PromptTripwire v0.1.6

PromptTripwire v0.1.6

Judge-documentation correction for the macOS arm64 distribution. v0.1.6 keeps
the v0.1.5 runtime behavior, Japanese/English Decision Inbox presentation, CLI,
Controller, explicit Codex Plugin, policy, contract, worktree containment, App
Server isolation, and report architecture unchanged.

Release URL:
https://github.com/shuto-S/prompt-tripwire/releases/tag/v0.1.6. Verify the
archive only with the SHA256SUMS.txt published on that same Release; checksums
from earlier versions do not apply.

Fixed

• Make the README and Judge Guide packaged inside the current archive point to
  the v0.1.6 archive name, release URL, install root, uninstall command, and Git
  marketplace tag.
• Preserve v0.1.5 as immutable historical evidence instead of replacing its tag
  or uploaded assets. Its runtime and Plugin passed release verification, but
  its packaged quickstart still named v0.1.4 and should not be the judge-facing
  distribution.
• Keep the Devpost and demo confirmation copy aligned with the current release
  while retaining the explicit v0.1.2-footage disclosure.

Unchanged safety boundaries

• Localization changes fixed presentation only. Task, model output, evidence,
  decision identifiers, contracts, mutation data, reports, and persisted run
  state remain source-language and unchanged.
• Neither the installer, Plugin, language switch, nor model selects a Decision
  Inbox option or approves a contract.
• No separate OPENAI_API_KEY, credential path, hosted backend, MCP server,
  automatic hook, or non-Codex adapter is added.
• Network, remote writes, deploy, release, secret access, destructive actions,
  stale contracts, and out-of-scope files remain fail-closed.
• Planning remains read-only against the source checkout; approved execution
  remains in a fresh disposable worktree and Codex thread.

Install

From the unpacked archive:

./install.sh --with-codex-plugin

No OPENAI_API_KEY is required. The runtime reuses the existing logged-in
Codex CLI 0.144.4 session. Runtime-only installation remains ./install.sh.

Targeted uninstall:

~/.local/lib/prompt-tripwire/0.1.6/uninstall.sh --with-codex-plugin

Verification

Source and tagged release preparation must pass:

npm run check
npm run package:macos-arm64
npm run verify:release

After publication, download the public artifact anonymously, verify its
checksum and provenance, confirm the packaged quickstart is self-consistent,
install it into an isolated prefix and Codex home, and exercise the explicit
Plugin flow without API-key environment variables. The source fixture must
remain unchanged and the Decision Inbox must wait for the human.

PromptTripwire v0.1.5

PromptTripwire v0.1.5

Japanese Decision Inbox presentation for macOS arm64. v0.1.5 preserves the
v0.1.4 CLI, Controller, explicit Codex Plugin, policy, contract, worktree
containment, App Server isolation, and report architecture.

Release URL:
https://github.com/shuto-S/prompt-tripwire/releases/tag/v0.1.5. Verify the
archive only with the SHA256SUMS.txt published on that same Release; checksums
from earlier versions do not apply.

Added

• Select Japanese UI chrome automatically when the browser prefers Japanese.
• Add a visible 日本語 / English switch to the Decision Inbox and retain the
  presentation choice for the same loopback origin.
• Translate fixed navigation, status, action, category, trigger, and known
  PromptTripwire template labels into Japanese.
• Cover locale selection, switching, persistence, translated review states,
  contract preview, deviation states, and recorded replay with automated tests.

Data and approval boundaries

Localization changes presentation only. PromptTripwire does not translate or
rewrite the task, model output, repository evidence, decision identifiers,
contract content, mutation payloads, report data, or persisted run state. The
same source-language values remain bound to the repository snapshot and
content-addressed contract.

The language switch cannot choose a decision, approve a contract, start
execution, or change policy. Human Decision Inbox selections and explicit
contract approval remain separate steps. High-impact operations, stale or
unapproved contracts, out-of-scope files, secrets, network access, remote
writes, deploy, release, and destructive operations remain fail-closed.

Unchanged compatibility and security controls

• No separate OPENAI_API_KEY, credential path, hosted backend, MCP server,
  automatic hook, or non-Codex adapter is added.
• The Plugin remains an explicitly invoked, Skill-centered adapter over the
  existing CLI and Controller.
• Every PromptTripwire-owned child App Server still disables installed Plugin
  contributions without rewriting the task and retains the deterministic
  re-entry sentinel.
• Planning remains read-only against the source checkout. Approved execution
  remains in a fresh disposable worktree and Codex thread.
• The Decision Inbox remains loopback-only and protected by its per-run
  capability and authenticated mutation protocol.

The public v0.1.4 and earlier tags and assets remain immutable historical
evidence. The prepared 2:52.862 demo remains a v0.1.2 capture; its public copy
must disclose that v0.1.5 is the current localized distribution to install.

Install

From the unpacked archive:

./install.sh --with-codex-plugin

No OPENAI_API_KEY is required. The runtime reuses the existing logged-in
Codex CLI 0.144.4 session. Runtime-only installation remains ./install.sh.

Targeted uninstall:

~/.local/lib/prompt-tripwire/0.1.5/uninstall.sh --with-codex-plugin

Verification

Source and tagged release preparation must pass:

npm run check
npm run package:macos-arm64
npm run verify:release

After publication, download the public artifact anonymously, verify its
checksum and provenance, install it into an isolated prefix and Codex home, and
exercise the explicit Plugin flow without API-key environment variables. The
source fixture must remain unchanged, the Decision Inbox must wait for the
human, and the Japanese/English switch must not alter contract-bound data.

PromptTripwire v0.1.4

PromptTripwire v0.1.4

Plugin-child isolation and pinned App Server search-compatibility patch for
macOS arm64. v0.1.4 preserves the v0.1.3 CLI, Controller, explicit Codex
Plugin, policy, contract, worktree containment, Decision Inbox, and report
architecture.

Release URL:
https://github.com/shuto-S/prompt-tripwire/releases/tag/v0.1.4. Verify the
archive only with the SHA256SUMS.txt published on that same Release; earlier
release checksums do not apply.

Fixed

• Start every PromptTripwire-owned Codex App Server 0.144.4 process with the
  stable plugins feature disabled, so an exact task that names
  prompt-tripwire:preflight does not re-contribute the installed Plugin or
  bundled Skill to its child model context.
• Keep the exact task bytes and snapshot hash unchanged. The existing
  PROMPT_TRIPWIRE_PLUGIN_REENTRY process and child-shell sentinel remains a
  separate deterministic rejection layer.
• Preserve an explicitly configured CODEX_HOME for the App Server process so
  its existing login matches the adapter's login check, while
  shell_environment_policy.inherit=none keeps it and every unrelated caller
  variable out of App Server child commands.
• Accept the pinned App Server's basename-only search.path metadata only when
  it uniquely identifies an explicit rg operand. One or more search targets
  are allowed only after every operand independently passes canonical
  repository-containment and protected-content checks.

This switch disables Plugin contributions, not every standalone system, user,
or repository Skill. An out-of-repository action from any remaining Skill is
still rejected by the normal probe containment boundary. Unknown feature,
command, path, or protected-content states remain fail-closed.

Why this patch exists

The public v0.1.3 archive and unified installer verified correctly. A subsequent
API-key-free invocation from the installed preflight Skill preserved the
right task, but its child App Server rediscovered the same installed Plugin and
attempted to read the Skill outside the disposable repository. PromptTripwire
correctly stopped the run before a Decision Inbox or implementation, but the
explicit Plugin flow could not complete.

A pinned Codex 0.144.4 A/B canary confirmed that --disable plugins removes the
PromptTripwire Plugin contribution while preserving the exact request as task
text. The same canary exposed App Server's lossy basename and multi-file
structured search representation; v0.1.4 validates every actual operand rather
than trusting that metadata.

The published v0.1.2 and v0.1.3 tags and assets remain immutable historical
evidence and are not replaced by this release. The prepared 2:52.862 demo
remains a v0.1.2 capture; its public copy must disclose that v0.1.4 is the
current compatibility and safety patch to install.

Unchanged boundaries

• No separate OPENAI_API_KEY, new credential path, hosted backend, MCP server,
  automatic hook, or non-Codex adapter is added.
• The Plugin remains an explicit, Skill-centered adapter over the existing CLI
  and Controller.
• The installer, Plugin, and model never approve a contract or choose a Decision
  Inbox option for the human.
• Network, remote writes, deploy, release, secret access, permission expansion,
  destructive operations, stale contracts, and unapproved deviations remain
  fail-closed.
• The original checkout is never the planning or execution worktree.

Install

From the unpacked archive:

./install.sh --with-codex-plugin

No OPENAI_API_KEY is required. The runtime reuses the existing logged-in
Codex CLI 0.144.4 session. Runtime-only installation remains ./install.sh.

Targeted uninstall:

~/.local/lib/prompt-tripwire/0.1.4/uninstall.sh --with-codex-plugin

Verification

Source and tagged release preparation must pass:

npm run check
npm run package:macos-arm64
npm run verify:release

After publication, download the public artifact anonymously, verify its
checksum and provenance, install it into an isolated prefix and Codex home, and
exercise the explicit Plugin flow without API-key environment variables. The
source fixture must remain unchanged, the Decision Inbox must wait for the
human, and approved execution must stay in the existing disposable worktree
before report and targeted uninstall checks.

PromptTripwire v0.1.3

PromptTripwire v0.1.3

Compatibility and probe-boundary patch release for macOS arm64. v0.1.3 keeps
the v0.1.2 CLI, Controller, Codex Plugin, policy, contract, worktree containment,
Decision Inbox, and report architecture unchanged.

Release URL:
https://github.com/shuto-S/prompt-tripwire/releases/tag/v0.1.3. Verify the
archive only with the SHA256SUMS.txt published on that same Release; earlier
release checksums do not apply.

Fixed

• Accept the two exact Codex App Server 0.144.4 macOS launcher shapes observed
  for structured static reads: /bin/zsh -c <command> and
  /bin/zsh -lc <command>.
• Re-tokenize the single inner command and require it to match the structured
  read, listFiles, or search action before the existing command grammar,
  canonical path, protected-content, sandbox, and network checks run.
• Isolate ZDOTDIR in a controller-owned, empty, mode-0700 disposable
  directory so user zsh startup files cannot alter a validated static read.
• Reject missing or null actual commands on probe approval requests and inspect
  failed command/file items instead of treating them as necessarily unexecuted.
• Deny direct planning-probe content reads of .git and its descendants while
  preserving names-only listFiles behavior.

All other shell paths, shell flags, additional arguments, command mismatches,
compound syntax, redirection, substitutions, executable search hooks, writes,
network access, protected paths, and repository escape remain fail-closed.
Root-owned global zsh startup files remain part of the supported macOS host
trust boundary.

Why this patch exists

The clean v0.1.2 release artifact installed correctly, but an API-key-free live
Plugin invocation exposed an App Server representation mismatch: the structured
action was listFiles with command ls, while the completed command item was
reported through a zsh launcher envelope. v0.1.2 compared the outer and inner
tokens directly and blocked every planning probe. v0.1.3 normalizes only the
pinned, observed envelopes and adds regression plus real App Server checks.

The published v0.1.2 tag and assets remain immutable historical evidence and
are not replaced by this release.

The prepared 2:52.862 demo remains the v0.1.2 capture. It accurately shows the
human-decision and contract-bound execution flow, but it predates this narrowly
scoped App Server launcher compatibility and shell-startup hardening patch. The
YouTube description and Devpost entry must disclose that distinction.

Unchanged boundaries

• No separate OPENAI_API_KEY, new credential path, hosted backend, MCP server,
  automatic hook, or non-Codex adapter is added.
• The Plugin remains an explicit, Skill-centered adapter over the existing CLI
  and Controller.
• The installer, Plugin, and model never approve a contract or choose a Decision
  Inbox option for the human.
• Network, remote writes, deploy, release, secret access, permission expansion,
  destructive operations, stale contracts, and unapproved deviations remain
  fail-closed.
• PROMPT_TRIPWIRE_PLUGIN_REENTRY remains the deterministic child-thread
  recursion guard.

Install

From the unpacked archive:

./install.sh --with-codex-plugin

No OPENAI_API_KEY is required. The runtime reuses the existing logged-in
Codex CLI 0.144.4 session. Runtime-only installation remains ./install.sh.

Targeted uninstall:

~/.local/lib/prompt-tripwire/0.1.3/uninstall.sh --with-codex-plugin

Verification

Source and tagged release preparation must pass:

npm run check
npm run package:macos-arm64
npm run verify:release

After publication, the public artifact must additionally be downloaded
anonymously, checksum verified, installed into an isolated prefix with the
Plugin enabled, exercised without API-key environment variables through
inspect, human approval, contained execution, report, and targeted uninstall,
and confirmed not to change the source checkout.