docs(memory): sync Codex browser boundary facts

Signed-off-by: Danil Silantyev <danilsilantyevwork@gmail.com>

Author: rldyourmnd

.serena/memories/BROWSER-01-WORKFLOW.md

@@ -1,7 +1,7 @@
 <!-- Memory Metadata
 Last updated: 2026-07-10
 Last verified: 2026-07-10
-Last commit: 693a00640832d3af8355066c0fd2fda4e84ad78e chore(release): codex adapter 1.8.6
+Last commit: 4bd04d1837100ecc64530665cdd0fd8c3118697b feat(browser): enforce managed CloakBrowser skill boundary
 Scope: browser-visible validation and debugging workflows
 Area: BROWSER
 -->
@@ -25,26 +25,30 @@ browser-visible validation and debugging workflows
 
 ## Last verified
 - date: 2026-07-10
-- commit: `693a00640832d3af8355066c0fd2fda4e84ad78e`
-- checked by: Codex app-managed browser fail-closed hardening
+- commit: `4bd04d1837100ecc64530665cdd0fd8c3118697b`
+- checked by: Codex 1.8.8 browser skill-boundary implementation
 
 ## Facts
-- Browser memories route UI and runtime validation through Webwright, Playwright CLI, and Chrome DevTools MCP when relevant.
+- Every browser-capable `rldyour-browser` skill runs exact
+  `$HOME/.local/bin/cloakbrowser-cdp-health` before every browser action and
+  stops as `NOT_PROVEN` when the preflight is missing or nonzero.
 - CloakBrowser is the required browser engine; `CLOAKBROWSER_VERSION=0.4.10` is the adapter policy pin, while installation remains owned by `rldyour-new-mac-or-ubuntu`.
 - Chrome DevTools MCP must use `/bin/sh -c` with the exact bootstrap-managed `~/.local/bin/chrome-devtools-mcp` wrapper invocation. Stock-Chromium fallback is forbidden.
-- Webwright, Playwright CLI, and Chrome DevTools MCP must use their
-  bootstrap-owned wrappers under `$HOME/.local/bin`; every provider is backed
-  by CloakBrowser and missing runtime health fails closed as `NOT_PROVEN`.
-- Stock Chromium, the Codex in-app browser, raw browser processes, direct
-  provider-package launchers, and alternate browser engines are not fallbacks.
+- Browser actions may use only exact `$HOME/.local/bin/playwright-cli` without
+  `run-code`/`--filename`, or Chrome DevTools MCP through its exact managed
+  wrapper transport. The `webwright-task` name is compatibility-only and never
+  starts a Webwright or Python runtime.
+- Webwright runtime, stock/raw/in-app Browser, browser/computer-use helpers,
+  Playwright MCP/raw Playwright, direct packages, alternate CDP/config or
+  executable paths, and all fallbacks are forbidden.
 - System install explicitly disables `browser@openai-bundled`; app-managed
   `node_repl` and `computer-use` MCP metadata is preserved only with
   `enabled = false`. Doctor rejects an active or reinjected surface and directs
   the operator to rerun the installer and restart Codex.
 - CloakBrowser `v0.4.10` changes wrapper behavior only (iframe humanization and JavaScript CLI entry-point fixes); the managed browser-binary pins do not change.
 
 ## Evidence
-- `commit:693a00640832d3af8355066c0fd2fda4e84ad78e`
+- `commit:4bd04d1837100ecc64530665cdd0fd8c3118697b`
 - `path:README.md`
 - `path:plugins/rldyour-browser`
 - `path:plugins/rldyour-mcps/README.md`
@@ -92,8 +96,8 @@ Update after verified changes to the referenced source-of-truth files.
 ## Validation Commands
 
 - Run `python3 scripts/validate_browser_provider_policy.py --strict` to verify
-  the exact managed transport, CloakBrowser policy pin, ownership, and
-  fail-closed stock-browser rule.
+  every browser skill's preflight, exact provider transports, forbidden
+  surfaces, CloakBrowser policy pin, and fail-closed behavior.
 - Run `bash scripts/validate_fast.sh` to exercise the browser policy in the
   repository's default CI gate.
 - Run the rldyour control-plane Serena memory validators in strict mode: `validate_serena_memory_schema` (`--strict-mode strict-all`) and `validate_serena_memory_semantics` (`--strict-current-facts --strict-metadata-dates --strict-evidence-commits`).

.serena/memories/RELEASE-01-VALIDATION.md

@@ -1,7 +1,7 @@
 <!-- Memory Metadata
 Last updated: 2026-07-10
 Last verified: 2026-07-10
-Last commit: 693a00640832d3af8355066c0fd2fda4e84ad78e chore(release): codex adapter 1.8.6
+Last commit: 4bd04d1837100ecc64530665cdd0fd8c3118697b feat(browser): enforce managed CloakBrowser skill boundary
 Scope: release readiness, versioning, and artifact hygiene
 Area: RELEASE
 -->
@@ -18,22 +18,28 @@ release readiness, versioning, and artifact hygiene
 
 ## Last verified
 - date: 2026-07-10
-- commit: `693a00640832d3af8355066c0fd2fda4e84ad78e`
-- checked by: Codex adapter 1.8.7 security release preparation
+- commit: `4bd04d1837100ecc64530665cdd0fd8c3118697b`
+- checked by: Codex adapter 1.8.8 browser skill-boundary release preparation
 
 ## Facts
-- Current rldyour-codex adapter VERSION is `1.8.7`; the release workflow publishes the matching numeric GitHub Release tag at the released commit. Root `config/repositories.json` and the superproject gitlink own the current adapter HEAD.
-- Release `1.8.7` closes app-managed raw/in-app/computer-use browser bypasses
-  without changing Codex CLI `0.144.1`, CloakBrowser `0.4.10`, approved MCP
-  pins/transports, curated GitHub/Gmail plugins, or reusable CI `0.5.1`.
+- Current rldyour-codex adapter VERSION is `1.8.8`; the release workflow publishes the matching numeric GitHub Release tag at the released commit. Root `config/repositories.json` and the superproject gitlink own the current adapter HEAD.
+- Release `1.8.8` makes the exact CloakBrowser health preflight and two-provider
+  managed execution boundary mandatory in every browser skill while preserving
+  Codex CLI `0.144.1`, CloakBrowser `0.4.10`, the 1.8.7 app-managed surface
+  disabling, approved MCP pins/transports, curated GitHub/Gmail plugins, and
+  reusable CI `0.5.1`.
+- Non-strict static runtime materialization is portable to macOS Bash 3.2 and
+  covered by the 150-test fast gate; strict installed-runtime proof remains a
+  separate target-machine check.
 - Release automation consumes only a pre-existing signed numeric tag created
   after stable-green branch CI. Tag-push and manual retry paths verify exact
   remote tag peel/ancestry from `origin/main`; workflow dispatch cannot create
   or push tags.
 - Release memories record numeric versioning, tags, CI gates, and clean artifact hygiene without copying current control-plane pins.
 
 ## Evidence
-- `commit:693a00640832d3af8355066c0fd2fda4e84ad78e`
+- `commit:13e997a1f839a753404ac161f69a749276dee18b`
+- `commit:4bd04d1837100ecc64530665cdd0fd8c3118697b`
 - `path:VERSION`
 - `path:CHANGELOG.md`
 - `path:.github/workflows/release.yml`