Fix proof-aware native review flow

.agents/skills/sdlc/SKILL.md

@@ -28,7 +28,8 @@ Use this skill for implementation, bug-fix, refactor, testing, release, publish,
 10. Review is mandatory. The portable contract is review behavior, not a slash-command name.
    Use native Codex review when appropriate: `codex review --uncommitted` before commit, `codex review --base <branch>` for branch or PR-sized diffs, and `codex review --commit <sha>` for a specific commit.
    Use `codex -c 'model_reasoning_effort="high"' review --uncommitted` for an enforced Sol-high gate, especially from `mixed`; apply the same prefix to `--base` or `--commit` reviews.
-   Pass the fresh proof command and result in the custom review prompt and say `Do not rerun tests`; the reviewer inspects the diff and evidence. Missing or stale proof is a blocker to report, not permission to launch another broad suite.
+   Run one broad proof run total on the frozen candidate through the proof-stamping entrypoint. In this repo, use `node .codex/hooks/git-guard.cjs prove --reviewed --check "node scripts/run-proof-suite.cjs"`; do not run the suite directly and then rerun it through the guard.
+   Use a prompt-only review when supplying custom proof-aware instructions. A custom prompt must not be combined with `--uncommitted`, `--base`, or `--commit`; those predefined target flags are for reviews without a custom prompt. Include the exact base identity, frozen candidate tree identity, fresh proof command, and result, and say `Do not rerun tests`. Targeted verification is allowed only for a concrete suspected defect; never rerun the broad suite. Missing or stale proof is a blocker to report, not permission to launch another broad suite.
    Reviewer role: inspect the frozen diff and return prioritized code-review findings only; do not edit, implement, run tests, re-plan, or perform follow-up work. The builder owns every correction through the normal SDLC loop.
    `review_model` controls native Codex review model selection but does not set review reasoning independently. `auto_review` is for eligible approval prompts, not code-diff review. Do not require `/autoreview` unless the current Codex host exposes it as a verified feature.
    At each coherent green slice, author-review the exact incremental diff before committing. Once the cumulative candidate is stable, freeze it, run one fresh broad proof, and review the full base-to-candidate diff once. A relevant correction invalidates that completion proof; use narrow delta checks while fixing, then run a fresh final proof.

PROVE-IT.md

@@ -48,13 +48,22 @@ Do not commit until you can answer:
 - The proof is recent
 - The diff matches the proof
 
-After the checks and self-review are complete, stamp local proof for the git
-gate:
+After focused checks and self-review, run required broad verification through
+the proof-stamping command for the git gate:
 
 ```bash
 node .codex/hooks/git-guard.cjs prove --reviewed
 ```
 
+For this repository, run and stamp the complete maintainer suite once with:
+
+```bash
+node .codex/hooks/git-guard.cjs prove --reviewed --check "node scripts/run-proof-suite.cjs"
+```
+
+Do not run `node scripts/run-proof-suite.cjs` immediately before this command;
+the proof-stamping invocation already runs it.
+
 If setup has not detected proof commands yet, pass them explicitly:
 
 ```bash

README.md

@@ -208,7 +208,7 @@ Layer 1: LOCAL TRUTH
 | Capability | Codex-specific shape |
 |------------|----------------------|
 | **Proof-aware git gates** | `git commit` and `git push` stay blocked until a fresh reviewed SDLC proof stamp is tied to the current repo content |
-| **Codex-native review** | Uses `codex review --uncommitted`, `--base`, or `--commit`; mixed mode explicitly overrides review effort to keep its Sol review at `high` |
+| **Codex-native review** | Reuses one stamped broad proof in a prompt-only Sol-high code review; predefined `--uncommitted`, `--base`, and `--commit` targets remain available for reviews without a custom prompt |
 | **Adaptive setup/update** | Default `npx` setup bootstraps first, then hands off into Codex for unresolved questions; update repairs drift without blind overwrites |
 | **Honest skill model** | `$sdlc` is the public repo-scoped workflow; helper skills stay support tooling instead of pretending Codex has slash commands |
 | **Cross-platform hook shape** | Universal Node hook entrypoints avoid Bash/PowerShell hook-config churn across macOS, Linux, Windows, and `type: module` repos |
@@ -219,12 +219,18 @@ Layer 1: LOCAL TRUTH
 The git gate is proof-aware: `git commit` and `git push` are still hard manual
 checkpoints, but they can proceed when a fresh SDLC proof stamp exists.
 
-After running the required checks and self-review, stamp proof:
+After focused checks and self-review, run required broad verification through the proof-stamping command:
 
 ```bash
 node .codex/hooks/git-guard.cjs prove --reviewed
 ```
 
+For this repository's maintainer suite, use the single canonical command below. It runs all proof groups once and writes the receipt in that same invocation:
+
+```bash
+node .codex/hooks/git-guard.cjs prove --reviewed --check "node scripts/run-proof-suite.cjs"
+```
+
 If the repo has no detected commands in `.codex-sdlc/manifest.json`, provide the
 proof command explicitly:
 
@@ -352,12 +358,17 @@ codex review --base main
 
 # Review one already-created commit
 codex review --commit <sha>
+
+# Proof-aware custom review: prompt only; do not add a predefined target flag
+codex -c 'model_reasoning_effort="high"' review 'Review only this frozen diff. Base: <base-commit-or-tree>. Candidate: <candidate-tree>. Proof: <command> => <result>. Do not rerun tests. Return prioritized code-review findings only.'
 ```
 
 When `review_model = "gpt-5.6-sol"` is present, native Codex review uses Sol for the review pass. `review_model` does not set review reasoning independently: effort otherwise inherits the profile's global `model_reasoning_effort`. Mixed-mode agents must therefore use the explicit `high` override above (and the same prefix with `--base` or `--commit`) to provide the advertised Sol-high gate.
 
 Do not treat `/autoreview` as a required SDLC command. `auto_review` is a Codex approval-review setting for eligible tool approval prompts; it is not the code-diff review path. In yolo/full-bypass sessions, approval review usually does not apply because approvals are already bypassed.
 
+Run one broad proof run total on the frozen candidate through the proof-stamping entrypoint. Do not run the suite directly and then rerun it through the guard. When supplying custom proof-aware instructions, use a prompt-only review. A custom prompt must not be combined with `--uncommitted`, `--base`, or `--commit`; those predefined target flags are for reviews without a custom prompt. Include the exact base identity, frozen candidate tree identity, proof command, and result, and say `Do not rerun tests`. Targeted verification is allowed only for a concrete suspected defect; never rerun the broad suite.
+
 ## Repo-Scoped Skills
 
 `install.sh` and `setup.sh` scaffold repo-local Codex skills under `.agents/skills`.

RELEASE.md

@@ -22,12 +22,14 @@ If the branch cannot be cleanly rebased or merged onto `origin/main`, stop and f
 
 ## 2. Required Proof Suite
 
-Preferred path: run the bounded parallel proof runner and keep every check green before tagging:
+Preferred path: run the bounded parallel proof runner once through the proof-stamping entrypoint and keep every check green before tagging:
 
 ```bash
-node scripts/run-proof-suite.cjs
+node .codex/hooks/git-guard.cjs prove --reviewed --check "node scripts/run-proof-suite.cjs"
 ```
 
+Do not run `node scripts/run-proof-suite.cjs` immediately before the command above; the proof-stamping invocation already runs it.
+
 Use the serial fallback when debugging one failure at a time:
 
 ```bash

SDLC-LOOP.md

@@ -23,7 +23,8 @@ Codex does not have a native `/sdlc` command. This file is the honest replacemen
    Commit coherent green slices after focused proof. Freeze the cumulative completion candidate and run one fresh broad proof before final review; relevant changes invalidate it and require a fresh final proof.
 8. Review to a decision
    Review the full base-to-candidate diff once after it is stable. Severity ladder: P0 stops the line; P1 blocks completion; P2 is a bounded fix now or a follow-up issue; P3 never blocks and is recorded only when worthwhile.
-   Give reviewers the fresh proof command and result and say `Do not rerun tests`; missing or stale proof is a blocker to report, not permission to launch another broad suite.
+   Run one broad proof run total on the frozen candidate through `node .codex/hooks/git-guard.cjs prove --reviewed`; do not run the suite directly and then rerun it through the guard.
+   Use a prompt-only review when supplying custom proof-aware instructions. A custom prompt must not be combined with `--uncommitted`, `--base`, or `--commit`; those predefined target flags are for reviews without a custom prompt. Include the exact base identity, frozen candidate tree identity, proof command, and result and say `Do not rerun tests`. Targeted verification is allowed only for a concrete suspected defect; never rerun the broad suite. Missing or stale proof is a blocker to report, not permission to launch another broad suite.
    Reviewer role: inspect the frozen diff and return prioritized code-review findings only; do not edit, implement, run tests, re-plan, or perform follow-up work. The builder owns every correction through the normal SDLC loop.
    When two reviewers are required, they assess the same frozen candidate independently, exchange compact findings once, and return a joint ledger. Allow at most two corrective rounds. If P0/P1 remains, decompose, abandon, or escalate; never waive it or continue an unbounded review loop.
    Check every corrective finding against the base. If the blocker is candidate-born and outside the allowlist, remove that accretion instead of repairing it.

lib/codex-config.sh

@@ -2,7 +2,7 @@
 set -euo pipefail
 
 MINIMUM_GPT56_CODEX_VERSION="${MINIMUM_GPT56_CODEX_VERSION:-0.144.0}"
-MODEL_POLICY_SCHEMA_VERSION=2
+MODEL_POLICY_SCHEMA_VERSION=3
 
 require_gpt56_codex_version() {
     local version_output=""

lib/refresh-manifest-hashes.cjs

@@ -87,9 +87,6 @@ function synchronizeModelProfile(manifest, touchedFiles) {
     ...(manifest.model_profile || {}),
     selected_profile: selectedProfile,
   };
-  if (Number.isInteger(profile.schema_version)) {
-    next.policy_schema_version = profile.schema_version;
-  }
   const baselineReasoning = profile.profiles?.[selectedProfile]?.main_reasoning;
   if (typeof baselineReasoning !== "string" || baselineReasoning === "") {
     throw new Error(`${profilePath} does not define main_reasoning for ${selectedProfile}`);

setup.sh

@@ -1360,7 +1360,7 @@ const manifest = {
   },
   model_profile: {
     selected_profile: process.env.MODEL_PROFILE_SELECTED || "",
-    policy_schema_version: Number(process.env.MODEL_POLICY_SCHEMA_VERSION_SELECTED || "2"),
+    policy_schema_version: Number(process.env.MODEL_POLICY_SCHEMA_VERSION_SELECTED || "3"),
     baseline_reasoning: process.env.REASONING_BASELINE_SELECTED || "high",
     escalation_reasoning: process.env.REASONING_ESCALATION_SELECTED || "xhigh",
     repo_risk_signals: process.env.REASONING_RISK_SIGNALS_SELECTED || "none detected during setup"

skill-sources/sdlc/SKILL.template.md

@@ -99,7 +99,7 @@ Use native Codex review for a second pass when the slice warrants it:
 
 `review_model` controls native Codex review model selection but does not set review reasoning independently. Mixed mode must use the explicit `high` command override above; apply the same prefix to `--base` or `--commit` reviews. This is a CLI review path, not a slash-command contract.
 
-Pass the fresh proof command and result in the custom review prompt and say `Do not rerun tests`; the reviewer inspects the diff and evidence. Missing or stale proof is a blocker to report, not permission to launch another broad suite.
+Run one broad proof run total on the frozen candidate through `node .codex/hooks/git-guard.cjs prove --reviewed`; do not run the suite directly and then rerun it through the guard. Use a prompt-only review when supplying custom proof-aware instructions. A custom prompt must not be combined with `--uncommitted`, `--base`, or `--commit`; those predefined target flags are for reviews without a custom prompt. Include the exact base identity, frozen candidate tree identity, proof command, and result and say `Do not rerun tests`. Targeted verification is allowed only for a concrete suspected defect; never rerun the broad suite. Missing or stale proof is a blocker to report, not permission to launch another broad suite.
 
 Reviewer role: inspect the frozen diff and return prioritized code-review findings only; do not edit, implement, run tests, re-plan, or perform follow-up work. The builder owns every correction through the normal SDLC loop.
 

templates/AGENTS.baseline.md

@@ -13,7 +13,8 @@ Read `TESTING.md` and `ARCHITECTURE.md` when present and relevant. If `GOALS.md`
 5. Never claim completion without fresh proof.
 6. Author-review and commit coherent green slices. Freeze the cumulative candidate for one fresh broad proof and completion review.
 7. Severity ladder: P0 stops the line; P1 blocks completion; P2 is a bounded fix or follow-up issue; P3 never blocks. When two reviewers are required, they exchange compact findings once. Allow at most two corrective rounds; unresolved P0/P1 requires decomposition, abandonment, or escalation.
-   Give reviewers the fresh proof command and result and say `Do not rerun tests`; stale proof is a blocker to report, not permission to launch another broad suite.
+   Run one broad proof run total on the frozen candidate through `node .codex/hooks/git-guard.cjs prove --reviewed`; do not run the suite directly and then rerun it through the guard.
+   Use a prompt-only review when supplying custom proof-aware instructions. A custom prompt must not be combined with `--uncommitted`, `--base`, or `--commit`; those predefined target flags are for reviews without a custom prompt. Include the exact base identity, frozen candidate tree identity, proof command, and result and say `Do not rerun tests`. Targeted verification is allowed only for a concrete suspected defect; never rerun the broad suite. Stale proof is a blocker to report, not permission to launch another broad suite.
    Reviewer role: inspect the frozen diff and return prioritized code-review findings only; do not edit, implement, run tests, re-plan, or perform follow-up work. The builder owns every correction through the normal SDLC loop.
    If a blocker is candidate-born and outside the allowlist, remove that accretion instead of repairing it.
 

templates/AGENTS.md.tmpl

@@ -39,7 +39,8 @@ Use skills for the visible workflow contract, let hooks enforce silently, and ke
 4. **Verify incrementally:** run focused proof for each coherent green slice; run the full required proof on the frozen completion candidate
 5. **Active goals:** When `GOALS.md` exists, complete that active scope before claiming the run is done; do not confuse active goal completion with roadmap completion.
 6. **Review to a decision:** author-review each incremental diff, then review the stable cumulative candidate once. Severity ladder: P0 stops the line; P1 blocks completion; P2 is a bounded fix or follow-up issue; P3 never blocks. When two reviewers are required, they exchange compact findings once. Allow at most two corrective rounds; unresolved P0/P1 requires decomposition, abandonment, or escalation.
-   - Give reviewers the fresh proof command and result and say `Do not rerun tests`; stale proof is a blocker to report, not permission to launch another broad suite.
+   - Run one broad proof run total on the frozen candidate through `node .codex/hooks/git-guard.cjs prove --reviewed`; do not run the suite directly and then rerun it through the guard.
+   - Use a prompt-only review when supplying custom proof-aware instructions. A custom prompt must not be combined with `--uncommitted`, `--base`, or `--commit`; those predefined target flags are for reviews without a custom prompt. Include the exact base identity, frozen candidate tree identity, proof command, and result and say `Do not rerun tests`. Targeted verification is allowed only for a concrete suspected defect; never rerun the broad suite. Stale proof is a blocker to report, not permission to launch another broad suite.
    - Reviewer role: inspect the frozen diff and return prioritized code-review findings only; do not edit, implement, run tests, re-plan, or perform follow-up work. The builder owns every correction through the normal SDLC loop.
    - If a blocker is candidate-born and outside the allowlist, remove that accretion instead of repairing it.
 

tests/test-adapter.sh

@@ -4126,6 +4126,7 @@ const path = require("path");
 const root = process.env.ROOT;
 const agents = fs.readFileSync(path.join(root, "AGENTS.md"));
 fs.writeFileSync(path.join(root, ".codex-sdlc", "manifest.json"), `${JSON.stringify({
+  model_profile: { selected_profile: "mixed", policy_schema_version: 3 },
   managed_files: {
     "AGENTS.md": `sha256:${crypto.createHash("sha256").update(agents).digest("hex")}`,
     ".codex-sdlc/model-profile.json": "sha256:old",
@@ -4168,6 +4169,7 @@ NODE
 const manifest = require(process.env.MANIFEST_PATH);
 if (manifest.model_profile?.selected_profile !== "maximum") process.exit(1);
 if (manifest.model_profile?.baseline_reasoning !== "high") process.exit(1);
+if (manifest.model_profile?.policy_schema_version !== 3) process.exit(1);
 NODE
     rm -rf "$legacy_dir" "$partial_dir"
 
@@ -4989,6 +4991,8 @@ test_e2e_bypasses_hook_trust_only_for_ephemeral_automation() {
 test_docs_document_proof_stamp_gate() {
     if grep -q 'git-guard.cjs prove --reviewed' "$REPO_DIR/PROVE-IT.md" \
         && grep -q 'git-guard.cjs prove --reviewed' "$REPO_DIR/README.md" \
+        && grep -Fq 'node .codex/hooks/git-guard.cjs prove --reviewed --check "node scripts/run-proof-suite.cjs"' "$REPO_DIR/PROVE-IT.md" \
+        && grep -Fq 'node .codex/hooks/git-guard.cjs prove --reviewed --check "node scripts/run-proof-suite.cjs"' "$REPO_DIR/README.md" \
         && grep -q 'fresh SDLC proof' "$REPO_DIR/README.md" \
         && grep -qi 'same-repository linked worktree' "$REPO_DIR/README.md" \
         && grep -qi 'same-repository linked worktree' "$REPO_DIR/PROVE-IT.md" \