#3635 Preserve review evidence and required test artifacts

User description

Summary

Result receipts could be reused for commands requiring report artifacts or interactive execution, and a missing Node runtime allowed the required push guard to be skipped. Restrict receipt reuse to eligible console runs, clarify the limits of committed review evidence, and refuse a push when the guard cannot run. Add the portable advisory Codex hook adapter and its synthetic checks, correct Windows Cloud fixtures and a lazy-render assertion, and align the shared operating guidance while retaining PsychSift's product-specific controls.

Areas touched: Knowledge and records, Delivery and assurance, Personal practice

Verification

• Checks run: the later three-file unit selection passed 160 tests with zero failures and eight platform skips; 14 adapter checks and the named documentation, rule and formatting checks passed.

Local evidence is composite: the earlier full verify:pr-local invocation failed in three test files (28 failed tests; 31,880 passed). After correcting those files, the later selected run passed 160 tests with eight existing platform skips and zero failures, with a real JSON report. The normal pre-push guard then found a TypeScript inference error in the two synthetic Cloud fixture helpers. After the two-line type correction, their fresh two-file run passed 158 tests with zero failures/eight skips and a real JSON report; normal source typecheck and scoped formatting also passed. The three previously unreached RAG/medication selectors passed separately. Fourteen synthetic adapter checks, documentation/organisation and rule-consistency checks passed. This is not a passing full-wrapper invocation on final HEAD.

The reviewed delivery adds the two-line fixture type correction on top of 9a0c6a518188c73304d54728ea762d09c95d1168, retaining the same 18 changed paths. Exact-main comparison against 62558e5c7cb6fa2cbc12944093d0d053240cb351 found no superseded repair or textual merge conflict. The pre-publication main snapshot advanced to b12f3d4b3f5deda6eaff00e460550f2ec1bdaf26 in one commit changing only five disjoint Supabase/SQL paths; the inspected workflow chain and 18 delivery paths did not change. Main's independent AGENTS and organisation-map entries must be preserved. Main has newer dependencies, so local branch evidence does not certify the eventual merge tree.

Risk and rollout

• Risk: agent tooling and governance behavior, including receipt eligibility, local fixture isolation and advisory hook routing. No clinical content, database, auth or retrieval behavior changes are included.
• Rollback: revert the affected commits through a separately reviewed change; do not weaken required guards to repair a failing gate.
• Provider or production effects: the explicitly authorized effect is one public draft PR and its inspected standard-runner CI. No ready-for-review/model trigger, database action, merge or deployment is part of this delivery.

This is a draft for review. Its hosted static checks remain pending until executed. Draft coverage/safety and automatic Claude review are deliberately deferred; native hook dispatch, clinical sign-off, merge and deployment are not certified by this change.

Summary by cubic

Vitest result receipts now reuse only for eligible console runs, and the pre-push guard blocks pushes when Node is missing. A portable Codex adapter adds advisory repository safeguards by routing supported events to the existing Claude hooks without running tool commands.

• The adapter handles edit aliases and apply_patch, warns about protected-file edits, detects gh pr create even with an inherited -R/--repo flag, command substitution, quoting, or a path prefix, and keeps push detection intact when git global options — including single-quoted, double-quoted, and attached -C values — precede push; its tests run in verify:cheap:internal after the stale-install parity check.
• Review-ledger guidance clarifies that matches cover committed HEAD and scope only; shared guidance also clarifies memory scope, spending approval, and formatting owned paths.
• Windows Cloud fixtures and a lazy-render test were corrected, and receipt tests now exercise the real memoisation rule.

CodeAnt-AI Description

Make test-result reuse safe, enforce push checks, and add Codex hooks

What Changed

• Test results are reused only for eligible console runs; runs that create reports or use interactive modes run again so required artifacts are not stale or missing.
• Push checks now recognize Git pushes with global options and block the push if Node is unavailable to run required guards.
• Codex sessions can use project-specific safety checks and guidance for pushes, edits, pull-request handoffs, startup, and context compaction.
• Working guidance now clarifies what review records prove, requires explicit publication targets, and sets boundaries for scoped memory use and billable runs.

Impact

✅ Fresh reports from artifact-producing test runs
✅ No push-guard bypass when Node is missing
✅ Codex users receive project-specific safety guidance

@codeant-ai ask: Your question here

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

@codeant-ai: Your feedback here

@codeant-ai: Do not flag unused imports.

@codeant-ai: review