docs(audit): which platform combinations a receipt measures (#730, slice 1) - #891

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Claude finished @cdeust's task in 1m 42s —— View job

Review of PR #891 (review 1 of 3)

• Read the diff (origin/main...HEAD, 2 files, docs only)
• Ran the five reviewers: code quality, performance, test coverage, documentation accuracy, security
• Checked the reviewers' findings against the receipts in docs/verification/
• Posted the review: docs(audit): which platform combinations a receipt measures (#730, slice 1) #891 (comment)

Result: no Blockers. No CI gate reads either changed file, and the diff contains no secrets. I posted three one-line Notes about statements in the matrix that say less was measured than the receipts record. They are on the N2 startup context, the "only receipt tied to a published artifact" claim, and the N4 count of 28 hooks.

Verdict: approve

Review 1 of 3: PR #891, docs-only (33153628)

Blockers: none. This PR changes only docs/audits/platform-support-matrix-2026-11-05.md and CHANGELOG.md, and no gate reads either file:

• check_craftsmanship.py only reads Python files.
• check_doc_claims.py has a fixed SCANNED_FILES list, and neither file is on it.
• test_docs_index_links.py only follows the links in docs/README.md.

The diff has no secrets and makes no support claim. Every path it cites exists, and the table column counts are consistent. The wrong statements below all claim less was measured than was, so none of them creates a support claim without a receipt.

Notes, no action before merge

• Line 30, N2 "without startup context" is wrong: claude-codex-handoff-2026-09-22/README.md:48-70 records native startup context on both hosts and 12 trusted Cortex hook entries (hook package 4.23.3). Line 79 should also cite N2.
• Line 34, "N1 is the only receipt tied to a published artifact version" is wrong: codex-native-4.23.2.md:53-62 has a native run on the published 4.23.2 wheel.
• Line 32, N4 "28 hook definitions trusted": per codex-hooks-20261002.md:48-49,60, the 28 span four plugins and 11 of them are Cortex hooks.

The five reviewers (code quality, performance, test coverage, documentation accuracy, security) ran to completion. Not verified offline: the N1 release asset and its digest, and the logs of run 42058911839.

Verdict: approve

Les trois remarques de la revue 1 sont exactes ; elles sont corrigées dans ae46d63 (fixup! du commit 4fa01aa, absorbé au squash) :

• N2 : startup context natif sur les deux hôtes et 12 entrées de hook Cortex de confiance dans Codex (package de hooks 4.23.3), d'après claude-codex-handoff-2026-09-22/README.md § Native hook verification ; N2 est aussi cité dans la ligne « Hook trust state ».
• N1 et N3 ont exécuté un artefact publié (le suivi de N3 sur la roue 4.23.2 publiée, 659 fichiers identiques à c8827be) ; aucun reçu n'enregistre le digest de l'artefact en lui-même.
• N4 : les 28 définitions de confiance couvrent quatre plugins, dont 11 hooks Cortex.

Generated by Claude Code

Claude finished @cdeust's task in 1m 22s —— View job

Review 2 of 3: PR #891

• Checked review 1's Blockers: it had none
• Read the one commit pushed after 33153628: ae46d63, a fixup that changes 6 lines and deletes 5 in the matrix document
• Ran the five reviewers (code quality, performance, test coverage, documentation accuracy, security) and checked their findings against the receipts
• Posted the review: docs(audit): which platform combinations a receipt measures (#730, slice 1) #891 (comment)

Result: no Blockers. The fixup fixes all three Notes from review 1. No CI gate or test reads the changed file, and it contains no secrets.

I posted three new one-line Notes:

• The run on the published 4.23.2 wheel did not pass file-cue priming.
• In N2, the Claude hooks were version 4.23.2; only the Codex hooks were 4.23.3.
• N2 does record a digest, for the Codex hook file.

Verdict: approve

Review 2 of 3: PR #891, commit ae46d63 (the only commit after 33153628)

Earlier Blockers: review 1 had none. Commit ae46d63 fixes all three of its Notes: the N2 startup context, the claim that only N1 ran a published artifact, and the N4 hook count.

Blockers: none. The commit edits only docs/audits/platform-support-matrix-2026-11-05.md, and no test, script or workflow reads that file. All four table rows still have 7 cells. The new text has no secrets or private paths and makes no support claim.

Notes, no action before merge

• Lines 31 and 34-35: the run on the published 4.23.2 wheel did not pass file-cue priming (memory stayed at 0.3, issue Shell-read priming misses explicitly attached project aliases #629; codex-native-4.23.2.md:56-58). Only briefing delivery and SessionEnd passed there.
• Line 30: only the Codex hooks were 4.23.3. The Claude startup check ran hook package 4.23.2 (claude-codex-handoff-2026-09-22/hooks.json:10,82).
• Lines 35-36: N2 does record a digest. The installed Codex hook file matched the released artifact, sha256 a25ce6d2… (claude-codex-handoff-2026-09-22/README.md:58-60).

Verdict: approve

Les trois remarques de la revue 2 sont exactes et corrigées dans 15a68e5 (fixup!) :

• N2 : package de hooks 4.23.3 côté Codex, 4.23.2 côté Claude (hooks.json).
• Run sur la roue 4.23.2 publiée : briefing et SessionEnd passent, le priming par fichier non (mémoire restée à 0.3, Shell-read priming misses explicitly attached project aliases #629) ; la ligne N3 garde le priming mesuré sur la roue épinglée.
• N2 enregistre un digest (fichier de hooks Codex installé, sha256 a25ce6d2…) ; le texte dit maintenant qu'aucun reçu ne lie chaque check au digest de l'artefact.

Generated by Claude Code

Claude finished @cdeust's task in 1m 58s —— View job

Review 3 of 3: PR #891

• Checked review 2's Blockers: it had none
• Read the one commit pushed after ae46d63: 15a68e5, a fixup to the N2 row and the paragraph below the table
• Ran the five reviewers (code quality, performance, test coverage, documentation accuracy, security) and checked their findings against the N2 receipt
• Posted the review: docs(audit): which platform combinations a receipt measures (#730, slice 1) #891 (comment)

Result: no Blockers. The fixup fixes all three Notes from review 2. The whole PR is accepted (CHANGELOG.md and the matrix document), and no file or commit has an open Blocker.

I posted three one-line Notes:

• The N2 digest covers only the Codex hook file.
• The receipt says "released repository artifact", and the document drops "repository".
• N1's sha256 is the hash of the receipt itself, not of the plugins that ran.

Verdict: approve

Review 3 of 3: PR #891, commit 15a68e5 (the only commit after ae46d63)

Earlier Blockers: reviews 1 and 2 had none. Commit 15a68e5 fixes all three of review 2's Notes:

• File-cue priming did not pass on the published 4.23.2 wheel (0.3, Shell-read priming misses explicitly attached project aliases #629).
• The Claude hook package in N2 was 4.23.2.
• N2 records the sha256 of the Codex hook file, a25ce6d2…, which matches claude-codex-handoff-2026-09-22/README.md:58-60 exactly.

Blockers: none. The commit edits only docs/audits/platform-support-matrix-2026-11-05.md. No script, test or workflow reads that file or docs/audits/, and no workflow has a path filter that it would trigger. The N2 row still has 7 cells. The edit adds no secrets or private paths and makes no support claim.

Notes, no action before merge

• Line 36, "Only N2 records a digest of what ran": the digest covers only the Codex hook file (hook package 4.23.3). The transfer and exclusion checks ran on MCP 4.23.2 and have no digest (README.md:68-70).
• Line 37: the receipt says "released repository artifact" (README.md:58). Without "repository", the sentence reads as if it were a published release asset like N1's.
• Line 36 against line 29: N1's sha256 identifies the receipt JSON, not the plugins that ran. Saying so would stop "only N2" from reading as a contradiction of row N1.

Accepted: the whole PR (CHANGELOG.md and docs/audits/platform-support-matrix-2026-11-05.md, commits 4fa01aa, ae46d63, 15a68e5). No file or commit has an open Blocker. The five reviewers (code quality, performance, test coverage, documentation accuracy, security) ran to completion. Not verified offline: the N1 release asset and its digest.

Verdict: approve

Revue 3 : les trois remarques (portée du digest de N2 limitée au fichier de hooks Codex, « released repository artifact », le sha256 de N1 identifie le reçu JSON et non les plugins) sont justes mais marquées sans action avant fusion ; elles ne changent aucune cellule de la matrice. Je ne relance pas un cycle de CI et de revue pour elles : elles seront intégrées dans la tranche 2 de #730 (schéma de reçu lié au digest), qui réécrit ce paragraphe.

Generated by Claude Code