Add fixed-argv reviewed delivery

.agents/skills/sdlc/SKILL.md

@@ -36,6 +36,7 @@ Use this skill for implementation, bug-fix, refactor, testing, release, publish,
    Incremental checkpoint: use affected proof, exact-diff author review, and at most one risk-based reviewer before committing a coherent green slice. During the ten-delivery pilot, the completion boundary sends the whole base-to-candidate diff through the bounded Sol High plus Fable High joint gate; outside the pilot, use Fable only when cross-model policy requires it. A finding produces one bounded corrective delta with targeted proof. A third same-plan correction means stop; human approval may authorize a replan with newly scoped work, not silently extend the exhausted plan. Record ten-delivery pilot outcomes in `benchmarks/review-cadence.csv` before making this cadence permanent.
    Severity ladder: P0 stops the line; P1 blocks completion; P2 is a bounded fix now or a follow-up issue; P3 never blocks and is recorded only when worthwhile.
    When two reviewers are required, run `node .codex/hooks/dual-review.cjs --base <ref> --consent-subscription-quota`. Sol High and Fable High assess the same frozen candidate independently. Clean agreement stops immediately; a verdict split receives one verbatim cross-feed round of findings and then produces one conservative joint receipt. Do not add another reconciliation exchange. Allow at most two corrective rounds; if P0/P1 remains, decompose, abandon, or escalate rather than waiving it or continuing an unbounded loop.
+   After that joint receipt is certified, integrate it through `node .codex/hooks/dual-review.cjs deliver github --message <text> --branch <name> --base <name> --title <text> --body <text>`. Do not reconstruct the reviewed delivery with separate raw commit, push, PR, or merge commands. The fixed-argv delivery path honors configured Git hooks, commits the certified tree, pushes its immutable SHA, verifies the authoritative PR head/base, and requires at least one completed GitHub check before atomically advancing the unchanged base to that exact commit. Use `--allow-no-checks` only when the repository intentionally has no GitHub checks. A changed base, failing hook, failing check, or protected branch fails closed before integration. Use `deliver direct` only for an explicit non-GitHub integration path; it verifies the exact remote ref but does not claim GitHub CI semantics.
    For every corrective finding, check its provenance against the base. If the blocker is candidate-born and outside the allowlist, remove that accretion instead of repairing it.
    For a commit or push from a linked worktree, use a standalone `git -C <absolute-worktree> commit ...` or `git -C <absolute-worktree> push ...`; never rely only on the execution tool's `workdir`, because some Codex surfaces omit it from PreToolUse payloads.
    If the work is in a product repo, keep that session focused on the product repo. File a direct GitHub issue for proven reusable wizard findings and only switch to live wizard work if the product repo is actually blocked.

.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-sdlc-wizard",
-  "version": "0.7.37",
+  "version": "0.7.38",
   "description": "Install and maintain Codex SDLC enforcement in local repositories.",
   "author": {
     "name": "BaseInfinity",

PROVE-IT.md

@@ -74,6 +74,28 @@ Clean agreement stops immediately. A verdict split receives exactly one
 verbatim structured cross-feed round; the gate then emits one joint receipt and
 stops. It never permits a third reviewer exchange.
 
+After the joint receipt is certified, use the fixed-argv delivery boundary
+instead of separate raw commit, push, PR, and merge commands:
+
+```bash
+node .codex/hooks/dual-review.cjs deliver github \
+  --message "feat: describe the certified change" \
+  --branch feature-branch \
+  --base main \
+  --title "Describe the certified change" \
+  --body "Closes #123"
+```
+
+It commits the certified staged tree while honoring configured Git hooks,
+pushes that immutable commit, verifies the authoritative PR head/base and at
+least one completed check, then atomically advances the unchanged base to the
+certified commit. An empty check rollup fails closed unless the caller
+explicitly chooses `--allow-no-checks` for a repository with no GitHub checks.
+A changed base, failing hook, failing check, or protected branch fails closed
+before integration. For an
+explicit non-GitHub path, `deliver direct` pushes and verifies the exact remote
+ref but does not claim GitHub CI semantics.
+
 For this repository, run and stamp the complete maintainer suite once with:
 
 ```bash

README.md

@@ -53,8 +53,8 @@ After either path changes skills, hooks, hook config, or helper scripts, restart
 Useful follow-ups after install:
 
 ```bash
-npx codex-sdlc-wizard@0.7.37 check
-npx codex-sdlc-wizard@0.7.37 update
+npx codex-sdlc-wizard@0.7.38 check
+npx codex-sdlc-wizard@0.7.38 update
 ```
 
 If you want pinned release examples instead of `@latest`, see [Releases](#releases).
@@ -285,10 +285,10 @@ How to choose:
 
 ```bash
 # recommended interactive bootstrap path
-npx codex-sdlc-wizard@0.7.37 --model-profile maximum
+npx codex-sdlc-wizard@0.7.38 --model-profile maximum
 
 # experimental efficiency trial when you explicitly choose it
-npx codex-sdlc-wizard@0.7.37 --model-profile mixed
+npx codex-sdlc-wizard@0.7.38 --model-profile mixed
 
 # floating latest release with the same bootstrap recommendation
 npx codex-sdlc-wizard@latest --model-profile maximum
@@ -389,6 +389,19 @@ node .codex/hooks/dual-review.cjs --base main --consent-subscription-quota
 
 Sol High and Fable High review the same frozen candidate independently. Clean agreement stops after those two reviews. A verdict split gets exactly one verbatim cross-feed round, then the wrapper writes one conservative candidate-bound joint receipt; it never starts an unbounded reviewer dialogue.
 
+Once the joint receipt is certified, deliver that exact candidate through the fixed-argv boundary rather than rebuilding the sequence with separate shell commands:
+
+```bash
+node .codex/hooks/dual-review.cjs deliver github \
+  --message "feat: describe the certified change" \
+  --branch feature-branch \
+  --base main \
+  --title "Describe the certified change" \
+  --body "Closes #123"
+```
+
+The command commits the certified staged tree while honoring configured Git hooks, pushes its immutable SHA, creates or reuses the explicitly targeted PR, verifies the authoritative head/base and at least one completed check, then atomically advances the unchanged base to that exact commit. An empty check rollup waits and fails closed by default; use `--allow-no-checks` only when the repository intentionally has no GitHub checks. A changed base, failing hook, failing check, or protected branch blocks integration. `deliver direct` is available only for an explicitly intended non-GitHub path; it verifies the exact remote ref but does not claim GitHub CI semantics. This is immediate exact-SHA integration after verification, not GitHub auto-merge.
+
 ### Incremental checkpoints and the completion boundary
 
 For each coherent green slice, run affected proof, author-review the exact incremental diff, and use at most one risk-based reviewer before committing. During the ten-delivery pilot, the completion boundary is deliberately broader: freeze the candidate, run the broad proof once, and send the whole base-to-candidate diff through the bounded Sol High plus Fable High joint gate above. Outside the pilot, use Fable only when cross-model policy requires it. Fix a blocker as one bounded corrective delta with targeted proof. A third same-plan correction means stop; human approval may authorize a replan with newly scoped work, not silently extend the exhausted plan.
@@ -448,11 +461,14 @@ This keeps dogfooding useful without turning every implementation session into w
 
 ## Releases
 
-`0.7.37` adds Desktop-safe linked-worktree delivery guidance: commit and push
-commands expose their absolute worktree target through `git -C`, so PreToolUse
-hooks can bind proof correctly even when a Codex surface omits the tool
-`workdir`. It includes the bounded-review, proof-aware review, Fable transport,
-bounded reconciliation, and Windows proof/npm improvements from `0.7.36`.
+`0.7.38` adds one fixed-argv delivery boundary for a certified candidate. It
+commits the exact reviewed tree while honoring configured Git hooks, pushes
+immutable object IDs, verifies the authoritative GitHub PR identity and at
+least one completed check by default, and
+atomically integrates only when the reviewed base is unchanged. This removes
+the fragile multi-command handoff that could read the wrong worktree or publish
+something other than the reviewed candidate. It includes the Desktop-safe
+linked-worktree guidance and bounded-review improvements from `0.7.37`.
 
 Versioned releases for this adapter live at:
 
@@ -462,7 +478,7 @@ If you are consuming this repo in a real project, prefer a tagged release over `
 
 ```bash
 # npm / npx pinned to the current release
-npx codex-sdlc-wizard@0.7.37
+npx codex-sdlc-wizard@0.7.38
 
 # npm / npx floating on the newest published release
 npx codex-sdlc-wizard@latest
@@ -472,7 +488,7 @@ npx codex-sdlc-wizard@latest
 # so $codex-sdlc-wizard is available inside Codex
 
 # git-based install
-git clone --branch v0.7.37 --depth 1 https://github.com/BaseInfinity/codex-sdlc-wizard.git /tmp/codex-sdlc-wizard
+git clone --branch v0.7.38 --depth 1 https://github.com/BaseInfinity/codex-sdlc-wizard.git /tmp/codex-sdlc-wizard
 ```
 
 ### Maintainer Release Flow

ROADMAP.md

@@ -11,9 +11,9 @@
 
 ## Current State
 
-- Current release candidate: `v0.7.37`, adding explicit linked-worktree Git targeting to the already-merged bounded-review, proof-aware review, Fable transport, bounded reconciliation, and Windows proof/npm improvements.
-- Current GitHub release after this candidate is published: [`v0.7.37`](https://github.com/BaseInfinity/codex-sdlc-wizard/releases/tag/v0.7.37).
-- Current npm release after this candidate is published: [`codex-sdlc-wizard@0.7.37`](https://www.npmjs.com/package/codex-sdlc-wizard/v/0.7.37).
+- Current release candidate: `v0.7.38`, binding certified review evidence to one fixed-argv commit, push, PR-check, and exact integration boundary.
+- Current GitHub release after this candidate is published: [`v0.7.38`](https://github.com/BaseInfinity/codex-sdlc-wizard/releases/tag/v0.7.38).
+- Current npm release after this candidate is published: [`codex-sdlc-wizard@0.7.38`](https://www.npmjs.com/package/codex-sdlc-wizard/v/0.7.38).
 - Next release milestone: [`1.0.0 — Bounded autonomous delivery`](https://github.com/BaseInfinity/codex-sdlc-wizard/milestone/2).
 - The ten-delivery cadence pilot is installed on `main`; its measurement issue remains open until the recorded evidence supports a permanent policy.
 - Real Windows Codex Desktop and CLI acceptance is the last hardware-dependent gate. Mac/Linux implementation and proof continue before that handoff.

SDLC-LOOP.md

@@ -28,6 +28,7 @@ Codex does not have a native `/sdlc` command. This file is the honest replacemen
    Use a prompt-only review when supplying custom proof-aware instructions. A custom prompt must not be combined with `--uncommitted`, `--base`, or `--commit`; those predefined target flags are for reviews without a custom prompt. Include the exact base identity, frozen candidate tree identity, proof command, and result and say `Do not rerun tests`. Targeted verification is allowed only for a concrete suspected defect; never rerun the broad suite. Missing or stale proof is a blocker to report, not permission to launch another broad suite.
    Reviewer role: inspect the frozen diff and return prioritized code-review findings only; do not edit, implement, run tests, re-plan, or perform follow-up work. The builder owns every correction through the normal SDLC loop.
    When two reviewers are required, run `node .codex/hooks/dual-review.cjs --base <ref> --consent-subscription-quota`. Sol High and Fable High assess the same frozen candidate independently. Clean agreement stops immediately; a verdict split gets one verbatim cross-feed of findings before one conservative joint receipt. Consent acknowledges Claude subscription-quota use. Do not add another reconciliation exchange. Allow at most two corrective rounds. If P0/P1 remains, decompose, abandon, or escalate; never waive it or continue an unbounded review loop.
+   After certification, integrate with `node .codex/hooks/dual-review.cjs deliver github --message <text> --branch <name> --base <name> --title <text> --body <text>`. This fixed-argv path honors configured Git hooks, commits and publishes only the certified candidate, requires at least one completed GitHub check by default, then atomically advances the unchanged base to that exact commit. Use `--allow-no-checks` only when the repository intentionally has no GitHub checks. Do not replace it with separate raw commit/push/merge commands. Use `deliver direct` only when a non-GitHub path is explicitly intended.
    Check every corrective finding against the base. If the blocker is candidate-born and outside the allowlist, remove that accretion instead of repairing it.
    For a commit or push from a linked worktree, use a standalone `git -C <absolute-worktree> commit ...` or `git -C <absolute-worktree> push ...`; never rely only on the execution tool's `workdir`, because some Codex surfaces omit it from PreToolUse payloads.
 9. Escalate honestly

package.json

@@ -1,6 +1,6 @@
 {
   "name": "codex-sdlc-wizard",
-  "version": "0.7.37",
+  "version": "0.7.38",
   "description": "Codex SDLC plugin, adaptive setup wizard, and maintenance CLI",
   "license": "MIT",
   "funding": {

skill-sources/sdlc/SKILL.template.md

@@ -101,6 +101,8 @@ Use native Codex review for a second pass when the slice warrants it:
 
 When repo policy requires both reviewers, run `node .codex/hooks/dual-review.cjs --base <ref> --consent-subscription-quota`. Sol High and Fable High independently review the same frozen candidate. Clean agreement stops immediately; a verdict split receives one verbatim cross-feed round of findings and then produces one conservative joint receipt. Consent is explicit because this uses Claude subscription quota. Do not add another reconciliation exchange.
 
+After that joint receipt is certified, integrate it through `node .codex/hooks/dual-review.cjs deliver github --message <text> --branch <name> --base <name> --title <text> --body <text>`. Do not reconstruct the reviewed delivery with separate raw commit, push, PR, or merge commands. The fixed-argv delivery path honors configured Git hooks, commits the certified tree, pushes its immutable SHA, verifies the authoritative PR head/base, and requires at least one completed GitHub check before atomically advancing the unchanged base to that exact commit. Use `--allow-no-checks` only when the repository intentionally has no GitHub checks. A changed base, failing hook, failing check, or protected branch fails closed before integration. Use `deliver direct` only for an explicit non-GitHub integration path; it verifies the exact remote ref but does not claim GitHub CI semantics.
+
 Run one broad proof run total on the frozen candidate through `node .codex/hooks/git-guard.cjs prove --reviewed`; do not run the suite directly and then rerun it through the guard. Use a prompt-only review when supplying custom proof-aware instructions. A custom prompt must not be combined with `--uncommitted`, `--base`, or `--commit`; those predefined target flags are for reviews without a custom prompt. Include the exact base identity, frozen candidate tree identity, proof command, and result and say `Do not rerun tests`. Targeted verification is allowed only for a concrete suspected defect; never rerun the broad suite. Missing or stale proof is a blocker to report, not permission to launch another broad suite.
 
 Reviewer role: inspect the frozen diff and return prioritized code-review findings only; do not edit, implement, run tests, re-plan, or perform follow-up work. The builder owns every correction through the normal SDLC loop.
@@ -126,6 +128,7 @@ Never use auto-merge in this repo.
 `NEVER AUTO-MERGE`
 
 Read CI logs, handle valid review feedback, and merge explicitly only after the proof matches the diff.
+The reviewed-delivery command performs that exact atomic integration immediately after its candidate and checks are verified; it does not enable GitHub auto-merge.
 
 ### 6. Final summary
 

templates/AGENTS.baseline.md

@@ -18,6 +18,7 @@ Read `TESTING.md` and `ARCHITECTURE.md` when present and relevant. If `GOALS.md`
    Use a prompt-only review when supplying custom proof-aware instructions. A custom prompt must not be combined with `--uncommitted`, `--base`, or `--commit`; those predefined target flags are for reviews without a custom prompt. Include the exact base identity, frozen candidate tree identity, proof command, and result and say `Do not rerun tests`. Targeted verification is allowed only for a concrete suspected defect; never rerun the broad suite. Stale proof is a blocker to report, not permission to launch another broad suite.
    Reviewer role: inspect the frozen diff and return prioritized code-review findings only; do not edit, implement, run tests, re-plan, or perform follow-up work. The builder owns every correction through the normal SDLC loop.
    When both reviewers are required, run `node .codex/hooks/dual-review.cjs --base <ref> --consent-subscription-quota`. Sol High and Fable High review the same frozen candidate independently; clean agreement stops immediately, while a split gets one verbatim cross-feed round before one conservative joint receipt. Consent acknowledges Claude subscription-quota use.
+   After certification, integrate with `node .codex/hooks/dual-review.cjs deliver github --message <text> --branch <name> --base <name> --title <text> --body <text>`. It honors configured Git hooks, commits and publishes only the certified candidate, and requires at least one completed PR check before atomically advancing an unchanged base to that exact commit. Use `--allow-no-checks` only when the repository intentionally has no GitHub checks. Use `deliver direct` only for an explicit non-GitHub integration path.
    If a blocker is candidate-born and outside the allowlist, remove that accretion instead of repairing it.
 
 ## Model Policy

templates/AGENTS.md.tmpl

@@ -44,6 +44,7 @@ Use skills for the visible workflow contract, let hooks enforce silently, and ke
    - Use a prompt-only review when supplying custom proof-aware instructions. A custom prompt must not be combined with `--uncommitted`, `--base`, or `--commit`; those predefined target flags are for reviews without a custom prompt. Include the exact base identity, frozen candidate tree identity, proof command, and result and say `Do not rerun tests`. Targeted verification is allowed only for a concrete suspected defect; never rerun the broad suite. Stale proof is a blocker to report, not permission to launch another broad suite.
    - Reviewer role: inspect the frozen diff and return prioritized code-review findings only; do not edit, implement, run tests, re-plan, or perform follow-up work. The builder owns every correction through the normal SDLC loop.
    - When both reviewers are required, run `node .codex/hooks/dual-review.cjs --base <ref> --consent-subscription-quota`. Sol High and Fable High review the same frozen candidate independently; clean agreement stops immediately, while a split gets one verbatim cross-feed round before one conservative joint receipt. Consent acknowledges Claude subscription-quota use.
+   - After certification, integrate with `node .codex/hooks/dual-review.cjs deliver github --message <text> --branch <name> --base <name> --title <text> --body <text>`. It honors configured Git hooks, commits and publishes only the certified candidate, and requires at least one completed PR check before atomically advancing an unchanged base to that exact commit. Use `--allow-no-checks` only when the repository intentionally has no GitHub checks. Use `deliver direct` only for an explicit non-GitHub integration path.
    - If a blocker is candidate-born and outside the allowlist, remove that accretion instead of repairing it.
 
 ## Commands