chore(release): codex adapter 1.8.7

Signed-off-by: Danil Silantyev <danilsilantyevwork@gmail.com>

Author: rldyourmnd

.claude/CLAUDE.md

@@ -62,6 +62,9 @@ Do not treat OpenCode or Gemini command formats as native Codex runtime.
   `$HOME/.local/bin/playwright-cli`, and
   `$HOME/.local/bin/chrome-devtools-mcp` wrappers backed by CloakBrowser; no
   stock Chromium, in-app browser, or raw-browser fallback is allowed.
+- System install keeps `browser@openai-bundled`, `node_repl`, and
+  `computer-use` explicitly disabled; doctor rejects reinjected active copies
+  and requires reinstall plus Codex restart.
 - Security checks (CodeQL, secret scanning, dependency checks) are required checks in
   this adapter.
 
@@ -70,3 +73,6 @@ Do not treat OpenCode or Gemini command formats as native Codex runtime.
 - Keep `.serena/` durable context updated on `main` updates and avoid rewriting
   existing commit history.
 - Commit adapter changes in this repo first, then update super-repo submodule pointer.
+- Push a signed numeric release tag only after exact-SHA branch CI is stably
+  green; release workflow dispatch may verify an existing tag but never create
+  or push one.

.github/workflows/README.md

@@ -35,7 +35,7 @@ release `0.5.1` at commit
 
 | Workflow | Trigger | Purpose |
 | --- | --- | --- |
-| `release.yml` | numeric product tag or manual dispatch | Release validation, deterministic bundle, SBOM, attestations, GitHub Release. |
+| `release.yml` | numeric product tag or existing-tag manual dispatch | Verifies the exact remote tag and its ancestry from `origin/main`, then runs release validation, deterministic bundle, SBOM, attestations, and `gh release --verify-tag`; it never creates or pushes tags. |
 
 ## Cost Policy
 

.github/workflows/release.yml

@@ -7,7 +7,7 @@ on:
   workflow_dispatch:
     inputs:
       version:
-        description: Release version from VERSION (must match the file content).
+        description: Existing numeric release tag X.Y.Z; manual dispatch only verifies an existing tag.
         required: true
         type: string
 
@@ -38,25 +38,27 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Set up validation runtime
-        uses: ./.github/actions/setup-codex-runtime
-        with:
-          install-codex: "false"
-          install-dart: "false"
-
-      - name: Validate release version
+      - name: Resolve and verify existing release tag
         shell: bash
         env:
           RELEASE_INPUT_VERSION: ${{ inputs.version }}
           GITHUB_REF_NAME: ${{ github.ref_name }}
           GITHUB_EVENT_NAME: ${{ github.event_name }}
         run: |
           set -euo pipefail
-          if [ "$GITHUB_EVENT_NAME" = "push" ]; then
-            version="$GITHUB_REF_NAME"
-          else
-            version="$RELEASE_INPUT_VERSION"
-          fi
+          case "$GITHUB_EVENT_NAME" in
+            push)
+              version="$GITHUB_REF_NAME"
+              ;;
+            workflow_dispatch)
+              # manual dispatch only verifies an existing tag
+              version="$RELEASE_INPUT_VERSION"
+              ;;
+            *)
+              echo "unsupported release event '$GITHUB_EVENT_NAME'" >&2
+              exit 1
+              ;;
+          esac
           if [ -z "$version" ]; then
             echo "release version is empty; tag push or workflow_dispatch input required" >&2
             exit 1
@@ -65,16 +67,72 @@ jobs:
             echo "release version '$version' is not numeric SemVer X.Y.Z" >&2
             exit 1
           fi
-          file_version="$(tr -d '[:space:]' < VERSION)"
-          if [ "$version" != "$file_version" ]; then
-            echo "release version '$version' does not match VERSION '$file_version'" >&2
+
+          remote_tag_ref="refs/tags/${version}"
+          remote_tag_rows="$(git ls-remote --refs origin "$remote_tag_ref")"
+          remote_tag_count="$(printf '%s\n' "$remote_tag_rows" | awk -v ref="$remote_tag_ref" '$2 == ref { count += 1 } END { print count + 0 }')"
+          if [ "$remote_tag_count" -ne 1 ]; then
+            echo "release tag '$remote_tag_ref' must already exist exactly once on origin" >&2
             exit 1
           fi
-          if ! grep -q "^## \\[$version\\]" CHANGELOG.md; then
-            echo "CHANGELOG.md has no release entry for $version" >&2
+          remote_tag_oid="$(printf '%s\n' "$remote_tag_rows" | awk -v ref="$remote_tag_ref" '$2 == ref { print $1 }')"
+
+          git fetch --no-tags origin "+refs/heads/main:refs/remotes/origin/main"
+          git fetch --no-tags origin "+${remote_tag_ref}:${remote_tag_ref}"
+          local_tag_oid="$(git rev-parse "$remote_tag_ref")"
+          if [ "$local_tag_oid" != "$remote_tag_oid" ]; then
+            echo "local tag object '$local_tag_oid' does not match origin '$remote_tag_oid'" >&2
+            exit 1
+          fi
+          tag_commit="$(git rev-parse "${remote_tag_ref}^{commit}")"
+
+          if [ "$GITHUB_EVENT_NAME" = "push" ]; then
+            if [ "$GITHUB_SHA" != "$remote_tag_oid" ] && [ "$GITHUB_SHA" != "$tag_commit" ]; then
+              echo "push SHA '$GITHUB_SHA' matches neither tag object '$remote_tag_oid' nor peeled commit '$tag_commit'" >&2
+              exit 1
+            fi
+            if ! git merge-base --is-ancestor "$GITHUB_SHA" origin/main; then
+              echo "tag push SHA '$GITHUB_SHA' is not contained in origin/main" >&2
+              exit 1
+            fi
+          else
+            if ! git merge-base --is-ancestor "$tag_commit" origin/main; then
+              echo "existing tag '$version' is not contained in origin/main" >&2
+              exit 1
+            fi
+            git checkout --detach "$tag_commit"
+          fi
+
+          if [ "$(git rev-parse HEAD)" != "$tag_commit" ]; then
+            echo "checked out HEAD does not match peeled release tag commit '$tag_commit'" >&2
             exit 1
           fi
           echo "RELEASE_VERSION=$version" >> "$GITHUB_ENV"
+          echo "RELEASE_COMMIT=$tag_commit" >> "$GITHUB_ENV"
+
+      - name: Set up validation runtime
+        uses: ./.github/actions/setup-codex-runtime
+        with:
+          install-codex: "false"
+          install-dart: "false"
+
+      - name: Validate release version
+        shell: bash
+        run: |
+          set -euo pipefail
+          file_version="$(tr -d '[:space:]' < VERSION)"
+          if [ "$RELEASE_VERSION" != "$file_version" ]; then
+            echo "release version '$RELEASE_VERSION' does not match VERSION '$file_version'" >&2
+            exit 1
+          fi
+          if [ "$(git rev-parse HEAD)" != "$RELEASE_COMMIT" ]; then
+            echo "release checkout drifted from verified tag commit '$RELEASE_COMMIT'" >&2
+            exit 1
+          fi
+          if ! grep -q "^## \\[$RELEASE_VERSION\\]" CHANGELOG.md; then
+            echo "CHANGELOG.md has no release entry for $RELEASE_VERSION" >&2
+            exit 1
+          fi
 
       - name: Run release validation
         run: |
@@ -186,19 +244,6 @@ jobs:
           path: dist
           retention-days: 30
 
-      - name: Create release tag
-        shell: bash
-        run: |
-          set -euo pipefail
-          # On push:tags the tag already points at this commit, so we skip creation.
-          # On workflow_dispatch we create and push the tag to match the validated VERSION.
-          if git rev-parse -q --verify "refs/tags/${RELEASE_VERSION}" >/dev/null; then
-            echo "Tag ${RELEASE_VERSION} already exists"
-          else
-            git tag "${RELEASE_VERSION}"
-            git push origin "refs/tags/${RELEASE_VERSION}"
-          fi
-
       - name: Publish GitHub Release
         shell: bash
         env:
@@ -208,8 +253,7 @@ jobs:
           if gh release view "$RELEASE_VERSION" >/dev/null 2>&1; then
             gh release upload "$RELEASE_VERSION" dist/* --clobber
           else
-            gh release create "$RELEASE_VERSION" \
-              --verify-tag \
+            gh release create "$RELEASE_VERSION" --verify-tag \
               --title "$RELEASE_VERSION" \
               --notes-file dist/release-notes.md \
               dist/*

.serena/memories/BROWSER-01-WORKFLOW.md

@@ -1,7 +1,7 @@
 <!-- Memory Metadata
 Last updated: 2026-07-10
 Last verified: 2026-07-10
-Last commit: 8be83a228e75b152cd3b7612bf834906310219a4 chore(release): codex adapter 1.8.5
+Last commit: 693a00640832d3af8355066c0fd2fda4e84ad78e chore(release): codex adapter 1.8.6
 Scope: browser-visible validation and debugging workflows
 Area: BROWSER
 -->
@@ -19,11 +19,14 @@ browser-visible validation and debugging workflows
 - `path:config/mcp-runtime-versions.env`
 - `path:config/rldyour-contract.json`
 - `path:scripts/validate_browser_provider_policy.py`
+- `path:scripts/install_system_codex.sh`
+- `path:scripts/doctor_system_codex.sh`
+- `path:tests/fixtures/codex_app_managed_browser_config.toml`
 
 ## Last verified
 - date: 2026-07-10
-- commit: `8be83a228e75b152cd3b7612bf834906310219a4`
-- checked by: Codex managed browser documentation contract refresh
+- commit: `693a00640832d3af8355066c0fd2fda4e84ad78e`
+- checked by: Codex app-managed browser fail-closed hardening
 
 ## Facts
 - Browser memories route UI and runtime validation through Webwright, Playwright CLI, and Chrome DevTools MCP when relevant.
@@ -34,15 +37,22 @@ browser-visible validation and debugging workflows
   by CloakBrowser and missing runtime health fails closed as `NOT_PROVEN`.
 - Stock Chromium, the Codex in-app browser, raw browser processes, direct
   provider-package launchers, and alternate browser engines are not fallbacks.
+- System install explicitly disables `browser@openai-bundled`; app-managed
+  `node_repl` and `computer-use` MCP metadata is preserved only with
+  `enabled = false`. Doctor rejects an active or reinjected surface and directs
+  the operator to rerun the installer and restart Codex.
 - CloakBrowser `v0.4.10` changes wrapper behavior only (iframe humanization and JavaScript CLI entry-point fixes); the managed browser-binary pins do not change.
 
 ## Evidence
-- `commit:8be83a228e75b152cd3b7612bf834906310219a4`
+- `commit:693a00640832d3af8355066c0fd2fda4e84ad78e`
 - `path:README.md`
 - `path:plugins/rldyour-browser`
 - `path:plugins/rldyour-mcps/README.md`
 - `path:plugins/rldyour-mcps/.mcp.json`
 - `path:config/mcp-runtime-versions.env`
+- `path:scripts/install_system_codex.sh`
+- `path:scripts/doctor_system_codex.sh`
+- `path:tests/fixtures/codex_app_managed_browser_config.toml`
 - `https://github.com/CloakHQ/CloakBrowser/tree/v0.4.10`
 - `https://pypi.org/project/cloakbrowser/0.4.10/`
 

.serena/memories/CI-01-ACTIONS.md

@@ -1,7 +1,7 @@
 <!-- Memory Metadata
-Last updated: 2026-05-22
-Last verified: 2026-05-22
-Last commit: 698a800c48294a799de24f1f444044bb1bfbd6db chore(release): codex 1.6.1
+Last updated: 2026-07-10
+Last verified: 2026-07-10
+Last commit: 693a00640832d3af8355066c0fd2fda4e84ad78e chore(release): codex adapter 1.8.6
 Scope: GitHub Actions and local CI policy
 Area: CI
 -->
@@ -14,19 +14,27 @@ GitHub Actions and local CI policy
 ## Current source of truth
 - `path:.github/workflows`
 - `path:README.md`
+- `path:.github/workflows/release.yml`
+- `path:tests/unit/test_release_workflow_estate.py`
 
 ## Last verified
-- date: 2026-05-22
-- commit: `698a800c48294a799de24f1f444044bb1bfbd6db`
-- checked by: Codex ry-start memory taxonomy sync
+- date: 2026-07-10
+- commit: `693a00640832d3af8355066c0fd2fda4e84ad78e`
+- checked by: Codex release estate ancestry hardening
 
 ## Facts
 - CI memories record which checks prove repository integrity and which checks are intentionally lightweight.
+- Release tag-push jobs fetch `origin/main` and reject a release commit that is
+  not its ancestor. Manual dispatch resolves and peels an exact existing remote
+  numeric tag; no workflow path creates or pushes tags. GitHub Release creation
+  remains centralized behind `gh release --verify-tag`.
 
 ## Evidence
-- `commit:698a800c48294a799de24f1f444044bb1bfbd6db`
+- `commit:693a00640832d3af8355066c0fd2fda4e84ad78e`
 - `path:.github/workflows`
 - `path:README.md`
+- `path:.github/workflows/release.yml`
+- `path:tests/unit/test_release_workflow_estate.py`
 
 ## Known pitfalls
 - Treat this memory as derived context. Current code, configuration, runtime output, and GitHub state override stale memory text.

.serena/memories/CODEX-01-ADAPTER-SURFACE.md

@@ -1,7 +1,7 @@
 <!-- Memory Metadata
-Last updated: 2026-05-22
-Last verified: 2026-05-22
-Last commit: 698a800c48294a799de24f1f444044bb1bfbd6db chore(release): codex 1.6.1
+Last updated: 2026-07-10
+Last verified: 2026-07-10
+Last commit: 693a00640832d3af8355066c0fd2fda4e84ad78e chore(release): codex adapter 1.8.6
 Scope: Codex adapter implementation surface
 Area: CODEX
 -->
@@ -14,19 +14,27 @@ Codex adapter implementation surface
 ## Current source of truth
 - `path:config/rldyour-contract.json`
 - `path:.agents/plugins/marketplace.json`
+- `path:scripts/install_system_codex.sh`
+- `path:scripts/doctor_system_codex.sh`
 
 ## Last verified
-- date: 2026-05-22
-- commit: `698a800c48294a799de24f1f444044bb1bfbd6db`
-- checked by: Codex ry-start memory taxonomy sync
+- date: 2026-07-10
+- commit: `693a00640832d3af8355066c0fd2fda4e84ad78e`
+- checked by: Codex app-managed browser surface hardening
 
 ## Facts
 - Codex memories describe the Codex plugin marketplace, system install, hooks, MCP, apps, and managed agents.
+- Installer owns the explicit disabled state for `browser@openai-bundled` and
+  any present app-managed `node_repl` / `computer-use` MCP tables. Doctor is the
+  enforcement boundary for active or reinjected copies and requires reinstall
+  plus process restart before browser work resumes.
 
 ## Evidence
-- `commit:698a800c48294a799de24f1f444044bb1bfbd6db`
+- `commit:693a00640832d3af8355066c0fd2fda4e84ad78e`
 - `path:config/rldyour-contract.json`
 - `path:.agents/plugins/marketplace.json`
+- `path:scripts/install_system_codex.sh`
+- `path:scripts/doctor_system_codex.sh`
 
 ## Known pitfalls
 - Treat this memory as derived context. Current code, configuration, runtime output, and GitHub state override stale memory text.

.serena/memories/DOCS-01-INSTRUCTIONS.md

@@ -1,7 +1,7 @@
 <!-- Memory Metadata
-Last updated: 2026-05-22
-Last verified: 2026-05-22
-Last commit: 698a800c48294a799de24f1f444044bb1bfbd6db chore(release): codex 1.6.1
+Last updated: 2026-07-10
+Last verified: 2026-07-10
+Last commit: 693a00640832d3af8355066c0fd2fda4e84ad78e chore(release): codex adapter 1.8.6
 Scope: instruction docs and durable operator documentation
 Area: DOCS
 -->
@@ -16,21 +16,31 @@ instruction docs and durable operator documentation
 - `path:.claude/CLAUDE.md`
 - `path:README.md`
 - `path:system/AGENTS.md`
+- `path:CONTRIBUTING.md`
+- `path:docs/release-process.md`
 
 ## Last verified
-- date: 2026-05-22
-- commit: `698a800c48294a799de24f1f444044bb1bfbd6db`
-- checked by: Codex ry-start memory taxonomy sync
+- date: 2026-07-10
+- commit: `693a00640832d3af8355066c0fd2fda4e84ad78e`
+- checked by: Codex browser trust-boundary instruction sync
 
 ## Facts
 - Docs memories record which instruction and operator docs must change after durable behavior changes.
+- `AGENTS.md`, `.claude/CLAUDE.md`, README, browser skill docs, and MCP docs
+  consistently require the managed CloakBrowser wrappers and the explicit
+  disabled state for app-managed browser, Node REPL, and computer-use surfaces.
+- Release operator docs consistently require stable-green branch CI before a
+  manually created signed numeric tag and describe workflow dispatch as an
+  existing-tag-only verification/retry path.
 
 ## Evidence
-- `commit:698a800c48294a799de24f1f444044bb1bfbd6db`
+- `commit:693a00640832d3af8355066c0fd2fda4e84ad78e`
 - `path:AGENTS.md`
 - `path:.claude/CLAUDE.md`
 - `path:README.md`
 - `path:system/AGENTS.md`
+- `path:CONTRIBUTING.md`
+- `path:docs/release-process.md`
 
 ## Known pitfalls
 - Treat this memory as derived context. Current code, configuration, runtime output, and GitHub state override stale memory text.