Release 0.3.7 with native hooks in public uploads - #15

• X
• Mastodon
• Reddit
• LinkedIn

• Includes native lifecycle hooks and executable permissions in deterministic public upload
 archives.
• Adds archive validation for manifest parity, contents, permissions, and reproducible bytes.
• Releases 0.3.7 and aligns documentation with current OpenAI compatibility guidance.

graph TD
  M["Plugin Manifest"] --> B["ZIP Builder"] --> Z[("Public ZIP")] --> U["Upload Validator"]
  C["Skills And Assets"] --> B
  H["Native Hooks"] --> B
  H --> L["Lifecycle Validator"]
  V["Wrapper Validation"] --> L
  V --> U

Loading

The following are alternative approaches to this PR:

1. Build from the repository manifest directly

• ➕ Eliminates duplicate manifest maintenance.
• ➕ Makes metadata parity automatic instead of validator-enforced.
• ➖ Removes an explicit public-upload profile boundary.
• ➖ Makes future public-only manifest differences harder to introduce safely.

Recommendation: Keep the profile-based builder for this release because it preserves an explicit public distribution boundary, while the new parity check prevents accidental drift. If the two manifests are intended to remain permanently identical, consolidating them later would reduce maintenance without changing archive behavior.

Bug fix (1) +7 / -2

build-codex-skills-only.pyPackage executable lifecycle hooks in public archives +7/-2

Package executable lifecycle hooks in public archives

• Adds the Codex hook definition and script to the public ZIP. Records Unix archive metadata and derives executable or regular-file permissions from each source file while retaining deterministic timestamps and ordering.

packaging/build-codex-skills-only.py

Tests (2) +77 / -2

validate-plugin.shExtend wrapper validation to public archives +4/-2

Extend wrapper validation to public archives

• Updates the expected wrapper version to 0.3.7 and invokes the new upload validator after lifecycle validation.

scripts/validate-plugin.sh

validate-upload.pyValidate deterministic public upload contents +73/-0

Validate deterministic public upload contents

• Adds end-to-end checks for manifest parity, reproducible ZIP bytes, a single package root, required content, and excluded repository-only components. It also verifies hook byte parity and executable script permissions.

scripts/validate-upload.py

Documentation (3) +28 / -21

README.mdDocument lifecycle hooks in public uploads +7/-6

Document lifecycle hooks in public uploads

• Explains that public-directory archives now include native Codex lifecycle hooks and preserve executable scripts. Clarifies host, CLI, trust, and ordinary Chat compatibility boundaries.

README.md

SUBMISSION.mdRefresh the submission dossier for release 0.3.7 +19/-13

Refresh the submission dossier for release 0.3.7

• Updates release notes and distribution guidance to describe native hooks in both Git and public packages. Adds current OpenAI contract links, runtime boundaries, and deterministic package validation expectations.

SUBMISSION.md

SKILL.mdCorrect lifecycle guidance for current Codex packages +2/-2

Correct lifecycle guidance for current Codex packages

• Replaces the obsolete claim that skills-only packages lack automatic hooks with guidance that current Git and public Codex packages include them.

skills/tree-ring-memory/SKILL.md

Other (2) +5 / -4

plugin.jsonBump the repository plugin to version 0.3.7 +1/-1

Bump the repository plugin to version 0.3.7

• Updates the canonical plugin manifest version for the lifecycle-hook public upload release.

.codex-plugin/plugin.json

plugin.jsonDeclare hooks in the versioned public manifest +4/-3

Declare hooks in the versioned public manifest

• Bumps the public profile to 0.3.7, points repository metadata at the Codex plugin repository, and declares the packaged native hook configuration.

packaging/codex-skills-only/.codex-plugin/plugin.json

Description

build() now includes native lifecycle hooks that require Tree Ring Memory CLI 0.15.6 or newer,
while the live Homebrew formula still installs 0.15.3. When a Homebrew user installs this public
upload without a project-local binary, codex-hook.sh resolves the outdated executable from PATH,
reaching unsupported automatic recall and checkpoint behavior.

Code

packaging/build-codex-skills-only.py[R40-42]

+        for name in ("codex-hooks.json", "codex-hook.sh"):
+            path = PLUGIN / "hooks" / name
+            write_file(archive, path, path.relative_to(PLUGIN))

Evidence

The PR adds the lifecycle hook files to every public archive, and the wrapper falls back to the
executable on PATH. Tree Ring Memory documents CLI 0.15.6 as the lifecycle-hook minimum, but the
live Homebrew formula downloads and verifies CLI 0.15.3.

packaging/build-codex-skills-only.py[40-42]
hooks/codex-hook.sh[21-26]
External repo: TerminallyLazy/Tree_Ring_Memory, plugins/tree-ring-memory/README.md [8-15]
External repo: TerminallyLazy/homebrew-tree-ring, Formula/tree-ring.rb [4-18]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The public upload now activates lifecycle hooks requiring CLI 0.15.6+, but the live Homebrew installation path supplies CLI 0.15.3. Prevent the hook from invoking an unsupported Homebrew runtime and coordinate a formula update to at least 0.15.6, preferably the pinned 0.15.7 release.

## Issue Context
The hook prefers a project-local executable but otherwise resolves `tree-ring` from `PATH`, where Homebrew installs version 0.15.3. Add an explicit compatibility check or graceful fallback until the Homebrew formula is updated.

## Fix Focus Areas
- hooks/codex-hook.sh[21-26]
- packaging/build-codex-skills-only.py[40-42]
- /cross_repos/homebrew-tree-ring/Formula/tree-ring.rb[4-18]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

Description

The manifest version is bumped to 0.3.7, while the release introduction in README.md still
identifies the plugin as 0.3.6. Anyone using the README to verify the installed or submitted
release receives metadata that conflicts with both packaged manifests and the submission dossier.

Code

.codex-plugin/plugin.json[3]

+  "version": "0.3.7",

Evidence

Both manifests now declare version 0.3.7 and SUBMISSION.md describes the 0.3.7 release, but
README.md line 9 remains at 0.3.6; the validator only checks the manifest version and does not
enforce README consistency.

.codex-plugin/plugin.json[1-4]
packaging/codex-skills-only/.codex-plugin/plugin.json[1-4]
SUBMISSION.md[78-83]
README.md[9-12]
scripts/validate-plugin.sh[30-34]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The release manifests and submission dossier declare version `0.3.7`, but the README still presents the plugin as version `0.3.6`.

## Issue Context
This release updates both packaged manifests to `0.3.7`; user-facing release documentation should identify the same version. Add validation if practical so future release bumps cannot leave this copy stale.

## Fix Focus Areas
- README.md[9-12]
- scripts/validate-plugin.sh[69-70]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

💡 Did you know, you can tweak Display preferences with a live preview to see your comment before it ships

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗