Bump Codex package to 0.4.5

Author: Cipher-85

.agents/skills/bug-report/SKILL.md

@@ -100,7 +100,47 @@ Produce a verification verdict:
 - **STILL PRESENT** — bug reproduces as described; fix did not resolve the issue
 - **CANNOT VERIFY** — automated checks inconclusive; manual playtest required
 
-Ask: "May I update `production/qa/bugs/[BUG-ID].md` to set Status: Verified Fixed / Still Present / Cannot Verify?"
+If the verdict is **VERIFIED FIXED**, treat verification, closure, stale triage
+metadata cleanup, and session-state routing as one deterministic bug lifecycle
+operation when the facts are unambiguous.
+
+Before writing, present the verification evidence and ask once for the full
+changeset:
+
+> "May I update these files to mark [BUG-ID] Verified Fixed, add verification
+> evidence, close the bug, refresh stale triage metadata when safe, and update
+> the derived checkpoint in `production/session-state/active.md`?
+> Files: `production/qa/bugs/[BUG-ID].md`, [any affected
+> `production/qa/bug-triage-*.md` files], `production/session-state/active.md`."
+
+Do not stop after VERIFIED FIXED to offer `$bug-report close [BUG-ID]` as the
+next action when closure facts are deterministic. Do not ask a separate "May I
+write?" for `production/session-state/active.md` when the update is only a
+derived checkpoint for completed bug lifecycle work. Do not ask a separate "May
+I write?" for this file.
+
+Bundle only deterministic metadata cleanup:
+- Set top-level `**Status**: Verified Fixed`.
+- Add or update verification evidence with the command(s), grep checks, commit
+  or file evidence, and verifier.
+- Append the Closure Record from Phase 2D and set top-level `**Status**: Closed`
+  when the closure record can be completed from known facts.
+- Refresh affected `production/qa/bug-triage-*.md` reports only when the refresh
+  removes closed bugs, updates open/closed counts, clears a stale recommended
+  action, or records "0 open bugs" without assigning priorities or changing
+  sprint scope.
+- Update `production/session-state/active.md` only with derived checkpoint
+  routing: completed bug lifecycle work, files touched, owed verification, and
+  the next valid Session Worklist lane.
+
+Do not bundle and stop for user decision if triage would require assigning
+priorities, choosing sprint scope, marking bugs Won't Fix, changing severity, or
+resolving conflicting bug states.
+
+If the verdict is **STILL PRESENT** or **CANNOT VERIFY**, ask:
+
+> "May I update `production/qa/bugs/[BUG-ID].md` to set Status: Still Present /
+> Cannot Verify and add the verification evidence?"
 
 If STILL PRESENT: reopen the bug, set Status back to Open, and suggest re-running `$hotfix [BUG-ID]`.
 
@@ -125,9 +165,29 @@ Append a closure record to the bug file:
 
 Update the top-level `**Status**: Open` field to `**Status**: Closed`.
 
-Ask: "May I update `production/qa/bugs/[BUG-ID].md` to mark it Closed?"
+If the bug is already `Verified Fixed`, close the bug and refresh stale triage
+metadata under the same approval when the refresh is safe deterministic cleanup.
+Before writing, list the exact files and ask once:
 
-After closing, check `production/qa/bug-triage-*.md` — if the bug appears in an open triage report, note: "Bug [ID] is referenced in the triage report. Run `$bug-triage` to refresh the open bug count."
+> "May I update these files to close [BUG-ID], refresh stale triage metadata
+> when safe, and update the derived checkpoint in
+> `production/session-state/active.md`?
+> Files: `production/qa/bugs/[BUG-ID].md`, [any affected
+> `production/qa/bug-triage-*.md` files], `production/session-state/active.md`."
+
+Do not ask a separate "May I write?" for `production/session-state/active.md`
+when the update is only a derived checkpoint for completed bug lifecycle work.
+Do not ask a separate "May I write?" for this file.
+
+Safe stale triage metadata refresh includes removing the closed bug from open
+bug tables, updating open/closed counts, clearing stale "fix this bug" actions,
+and recording a zero-open-bugs refresh. It must not assign priorities, choose
+sprint scope, mark bugs Won't Fix, change severity, or resolve conflicting bug
+states.
+
+If stale triage metadata exists but is unsafe to refresh automatically, close
+the bug and mark triage cleanup as non-blocking owed follow-up instead of
+blocking closure.
 
 ---
 
@@ -156,8 +216,11 @@ After saving, suggest based on mode:
 - Never mark a bug closed without verification — a fix that doesn't verify is still Open
 
 **After verify returns VERIFIED FIXED:**
-- Run `$bug-report close [BUG-ID]` — write the closure record and update status
-- Run `$bug-triage` to refresh the open bug count and remove it from the active list
+- When closure facts are deterministic, complete verification, closure, stale
+  triage metadata cleanup, and derived session-state routing under the same
+  approved changeset.
+- If closure or triage refresh requires a manual decision, stop at the decision
+  point and make the blocked item explicit.
 
 ## Ported metadata
 

.agents/skills/bug-triage/SKILL.md

@@ -16,6 +16,9 @@ ensures no critical bug is lost between sprints.
 - Sprint start — assign open bugs to the new sprint or backlog
 - After `$team-qa` completes and new bugs have been filed
 - When the bug count crosses 10+ open items
+- As bundled metadata cleanup after `$bug-report verify [BUG-ID]` or
+  `$bug-report close [BUG-ID]` closes a bug and stale triage report fields can
+  be refreshed without new prioritization decisions
 
 ---
 
@@ -46,6 +49,13 @@ If no bug files found:
 
 Stop and report. Do not proceed if no bugs exist.
 
+If this run is a zero-open-bugs closure refresh started from an approved
+`$bug-report verify [BUG-ID]` or `$bug-report close [BUG-ID]` lifecycle, do not
+stop for a separate triage decision. Treat it as metadata cleanup: update the
+affected stale triage report so the open bug count, priority tables, and
+recommended action reflect that no bugs remain open. Mark any broader trend or
+sprint-priority work as non-blocking follow-up.
+
 ### Step 2b — Load sprint context
 
 Read the most recently modified file in `production/sprints/` to understand:
@@ -217,6 +227,19 @@ Present the report in conversation, then ask:
 
 Write only after approval.
 
+Exception for bundled bug lifecycle cleanup: when `$bug-report verify [BUG-ID]`
+or `$bug-report close [BUG-ID]` already obtained approval for the full
+changeset, do not ask a second triage write prompt for deterministic metadata
+cleanup. The approval must have listed the exact stale
+`production/qa/bug-triage-*.md` file(s) being updated.
+
+Bundled triage cleanup is allowed only when it removes closed bugs from open
+tables, updates counts, clears stale recommended actions, or records a
+zero-open-bugs closure refresh. It must be explicitly marked non-blocking if it
+cannot be completed safely. Do not bundle if the triage work would require
+assigning priorities, choosing sprint scope, marking bugs Won't Fix, changing
+severity, or resolving conflicting bug states.
+
 After writing:
 - If any S1 bugs are unassigned: "S1 bugs must be assigned before the sprint
   can be considered healthy. Run `$sprint-status` to see current capacity."

.codex/VERSION

@@ -1 +1 @@
-0.4.4
+0.4.5

.codex/lib/validate_runtime.py

@@ -255,6 +255,46 @@
     ),
 }
 
+BUG_LIFECYCLE_REQUIRED_PHRASES = {
+    ".agents/skills/bug-report/SKILL.md": (
+        "treat verification, closure, stale triage",
+        "one deterministic bug lifecycle operation",
+        "Do not stop after VERIFIED FIXED to offer `$bug-report close [BUG-ID]` as the",
+        "refresh stale triage metadata under the same approval",
+        "zero-open-bugs refresh",
+        "derived checkpoint",
+        'Do not ask a separate "May I write?" for `production/session-state/active.md`',
+        "Do not bundle and stop for user decision if triage would require assigning",
+    ),
+    ".agents/skills/bug-triage/SKILL.md": (
+        "zero-open-bugs closure refresh",
+        "Treat it as metadata cleanup",
+        "non-blocking follow-up",
+        "Exception for bundled bug lifecycle cleanup",
+        "deterministic metadata cleanup",
+        "It must be explicitly marked non-blocking if it cannot be completed safely",
+        "Do not bundle if the triage work would require assigning priorities",
+    ),
+}
+
+BUG_LIFECYCLE_FORBIDDEN_PHRASES = (
+    (
+        ".agents/skills/bug-report/SKILL.md",
+        'Bug [ID] is referenced in the triage report. Run `$bug-triage` to refresh the open bug count.',
+        "bug close still defers deterministic triage refresh to a separate prompt",
+    ),
+    (
+        ".agents/skills/bug-report/SKILL.md",
+        "Run `$bug-report close [BUG-ID]` — write the closure record and update status",
+        "verified-fixed still forces a separate close step",
+    ),
+    (
+        ".agents/skills/bug-report/SKILL.md",
+        "Run `$bug-triage` to refresh the open bug count and remove it from the active list",
+        "verified-fixed still forces a separate triage cleanup step",
+    ),
+)
+
 INTERNAL_READONLY_CLOSEOUT_PATTERNS = (
     (re.compile(r"\bself[- ]check\b", re.IGNORECASE), "Self-Check"),
     (re.compile(r"\bregistry (?:candidate )?scan\b", re.IGNORECASE), "registry scan"),
@@ -472,6 +512,33 @@ def validate_playtest_focus_contract(root: Path) -> list[str]:
     return errors
 
 
+def contains_phrase(text: str, phrase: str) -> bool:
+    normalized_text = re.sub(r"\s+", " ", text)
+    normalized_phrase = re.sub(r"\s+", " ", phrase)
+    return normalized_phrase in normalized_text
+
+
+def validate_bug_lifecycle_contract(root: Path) -> list[str]:
+    errors: list[str] = []
+    for rel, required_phrases in BUG_LIFECYCLE_REQUIRED_PHRASES.items():
+        path = root / rel
+        if not path.exists():
+            errors.append(f"{rel}: missing bug lifecycle contract surface")
+            continue
+        text = path.read_text(encoding="utf-8")
+        missing = [phrase for phrase in required_phrases if not contains_phrase(text, phrase)]
+        if missing:
+            errors.append(f"{rel}: missing bug lifecycle contract phrase(s): {', '.join(missing)}")
+
+    for rel, phrase, message in BUG_LIFECYCLE_FORBIDDEN_PHRASES:
+        path = root / rel
+        if not path.exists():
+            continue
+        if phrase in path.read_text(encoding="utf-8"):
+            errors.append(f"{rel}: {message}")
+    return errors
+
+
 def validate_active_state_checkpoint_text(rel: Path, text: str, exempt: bool = False) -> list[str]:
     if exempt or ACTIVE_STATE_PATH not in text:
         return []
@@ -525,6 +592,7 @@ def validate_skills(root: Path, require_present: bool = False) -> list[str]:
     unexpected = sorted(skill_names - REQUIRED_CORE_SKILLS - ALLOWED_PROJECT_LOCAL_SKILLS)
     if unexpected:
         errors.append(f".agents/skills: unexpected project-local skills: {', '.join(unexpected)}")
+    errors.extend(validate_bug_lifecycle_contract(root))
 
     for skill_file in skill_files:
         rel = skill_file.relative_to(root)

CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## v0.4.5 - 2026-07-09
+
+- Updated `$bug-report verify` so a VERIFIED FIXED result can complete
+  verification evidence, closure, safe stale triage cleanup, and derived
+  session-state routing under one approved changeset.
+- Updated `$bug-report close` so already verified bugs can close and refresh
+  stale triage metadata without handing the user a separate bookkeeping prompt.
+- Clarified `$bug-triage` zero-open-bugs closure refreshes as deterministic
+  metadata cleanup when they do not require priority, sprint-scope, severity, or
+  Won't Fix decisions.
+- Added runtime validation to keep the bug lifecycle contract from regressing
+  back into forced verify -> close -> triage handoffs.
+
 ## Unreleased
 
 - Nothing yet.