Prepare v0.14 Codex plugin package

.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "tree-ring-memory",
-  "version": "0.2.0",
-  "description": "Lifecycle-aware local and same-host multi-agent memory guidance for Codex using Tree Ring Memory v0.13+.",
+  "version": "0.3.0",
+  "description": "Local-first memory lifecycle and receipt-backed harness guidance for coding agents using Tree Ring Memory v0.14+.",
   "author": {
     "name": "TerminallyLazy",
     "url": "https://github.com/TerminallyLazy"
@@ -14,6 +14,7 @@
     "memory",
     "agent-memory",
     "multi-agent",
+    "harness-activation",
     "idempotency",
     "local-first",
     "recall",
@@ -24,26 +25,29 @@
   "interface": {
     "displayName": "Tree Ring Memory",
     "shortDescription": "Local-first memory lifecycle guidance for Codex agents.",
-    "longDescription": "Tree Ring Memory gives Codex a lifecycle-aware memory practice for project recall, durable decisions, same-host fan-out/fan-in, idempotent worker writes, coordinator-authorized shared publication, explicit forgetting, and privacy-safe memory capture using Tree Ring Memory v0.13 or newer.",
+    "longDescription": "Tree Ring Memory gives coding agents a lifecycle-aware practice for project recall, durable decisions, receipt-backed harness readiness, same-host fan-out/fan-in, idempotent worker writes, coordinator-authorized shared publication, explicit forgetting, and privacy-safe memory capture using Tree Ring Memory v0.14 or newer.",
     "developerName": "TerminallyLazy",
     "category": "Developer Tools",
     "capabilities": [
       "Read",
       "Write",
       "Interactive"
     ],
-    "websiteURL": "https://github.com/TerminallyLazy/Tree-Ring-Memory",
-    "privacyPolicyURL": "https://github.com/TerminallyLazy/tree-ring-memory-codex-plugin/blob/main/SECURITY.md",
-    "termsOfServiceURL": "https://github.com/TerminallyLazy/tree-ring-memory-codex-plugin/blob/main/LICENSE",
+    "websiteURL": "https://terminallylazy.github.io/Tree-Ring-Memory/",
+    "privacyPolicyURL": "https://github.com/TerminallyLazy/tree-ring-memory-codex-plugin/blob/main/PRIVACY.md",
+    "termsOfServiceURL": "https://github.com/TerminallyLazy/tree-ring-memory-codex-plugin/blob/main/TERMS.md",
     "defaultPrompt": [
-      "Use Tree Ring Memory to recall durable project context before editing.",
-      "Use Tree Ring Memory to capture this validated lesson without storing a transcript.",
-      "Use Tree Ring Memory to audit stale or sensitive memory before closeout.",
-      "Use Tree Ring Memory v0.13 coordinated policy for this same-host fan-out and fan-in."
+      "Recall durable project context before changing release behavior.",
+      "Capture this validated lesson without storing a transcript.",
+      "Check Tree Ring harness readiness and explain any non-active state."
     ],
     "brandColor": "#2F7D5C",
-    "composerIcon": "./assets/icon.svg",
-    "logo": "./assets/icon.svg",
-    "screenshots": []
+    "composerIcon": "./assets/tree-ring-memory-logo.png",
+    "logo": "./assets/tree-ring-memory-logo.png",
+    "screenshots": [
+      "./assets/screenshot-dashboard.png",
+      "./assets/screenshot-recall.png",
+      "./assets/screenshot-evidence.png"
+    ]
   }
 }

.github/workflows/hol-plugin-scanner.yml

@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
-      - name: Validate v0.13 wrapper contract
+      - name: Validate v0.14 wrapper contract
         run: sh scripts/validate-plugin.sh
       - name: HOL Plugin Scanner
         uses: hashgraph-online/ai-plugin-scanner-action@d38d84308e670972f6534739dbc193b2c2dcc163

.github/workflows/validate.yml

@@ -0,0 +1,63 @@
+name: Validate
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+env:
+  TREE_RING_VERSION: "0.14.0"
+  TREE_RING_LINUX_X86_64_SHA256: "c72191aca81f195472272a1962df354fe0af04a08b01a7472a1faf987cd177fa"
+
+jobs:
+  validate:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+
+      - name: Install checksum-pinned Tree Ring v0.14
+        shell: bash
+        run: |
+          set -euo pipefail
+          archive_name="tree-ring-memory-${TREE_RING_VERSION}-linux-x86_64.tar.gz"
+          archive_path="${RUNNER_TEMP}/${archive_name}"
+          release_url="https://github.com/TerminallyLazy/Tree-Ring-Memory/releases/download/v${TREE_RING_VERSION}/${archive_name}"
+          extract_root="${RUNNER_TEMP}/tree-ring-${TREE_RING_VERSION}"
+
+          curl \
+            --proto '=https' \
+            --tlsv1.2 \
+            --fail \
+            --location \
+            --silent \
+            --show-error \
+            --output "${archive_path}" \
+            "${release_url}"
+          printf '%s  %s\n' \
+            "${TREE_RING_LINUX_X86_64_SHA256}" \
+            "${archive_path}" \
+            | sha256sum --check --status
+
+          while IFS= read -r entry; do
+            case "${entry}" in
+              /*|../*|*/../*|*/..) exit 1 ;;
+            esac
+          done < <(tar -tzf "${archive_path}")
+
+          mkdir -p "${extract_root}"
+          tar -xzf "${archive_path}" -C "${extract_root}"
+          binary_path="${extract_root}/tree-ring-memory-${TREE_RING_VERSION}-linux-x86_64/tree-ring"
+          test -x "${binary_path}"
+          test "$("${binary_path}" --version)" = "tree-ring ${TREE_RING_VERSION}"
+          printf 'TREE_RING_BIN=%s\n' "${binary_path}" >> "${GITHUB_ENV}"
+
+      - name: Validate plugin package
+        run: sh scripts/validate-plugin.sh
+
+      - name: Smoke Tree Ring v0.14 integration
+        shell: bash
+        run: bash scripts/smoke_v014.sh

PRIVACY.md

@@ -0,0 +1,24 @@
+# Tree Ring Memory Plugin Privacy Notice
+
+Effective August 23, 2026
+
+The Tree Ring Memory plugin is an instruction package for AI coding agents. It
+does not operate a hosted service, create a user account, collect analytics,
+send telemetry, or include a remote MCP server.
+
+When an agent runs the separately installed Tree Ring Memory CLI, the CLI stores
+the memory content the user chooses in a local SQLite database under the
+configured Tree Ring root. The project does not receive that database or its
+contents. Data leaves the local environment only when the user or another tool
+explicitly exports, syncs, publishes, or otherwise transmits it.
+
+The plugin instructs agents to avoid transcripts, credentials, secrets, private
+keys, raw chain-of-thought, and unnecessary sensitive personal data. It also
+provides explicit redaction, deletion, supersession, audit, and consolidation
+workflows. These safeguards do not replace the privacy and data-use terms of the
+AI host, operating system, source-control provider, or any other tool the user
+chooses to invoke.
+
+Support and privacy questions may be filed at
+<https://github.com/TerminallyLazy/tree-ring-memory-codex-plugin/issues>.
+Do not include secrets or private memory content in a public issue.

README.md

@@ -6,9 +6,9 @@ This plugin packages one Codex skill that teaches agents when to recall, write,
 audit, consolidate, and forget project memory using the open-source
 [Tree Ring Memory](https://github.com/TerminallyLazy/Tree-Ring-Memory) CLI.
 
-Plugin `0.2.0` requires Tree Ring Memory CLI **>= 0.13.0**. The minimum is
-intentional: v0.13 adds schema v3, coordinated-write authorization, and the
-writer-protocol fence used by this guidance.
+Plugin `0.3.0` requires Tree Ring Memory CLI **>= 0.14.0**. The minimum is
+intentional: v0.14 adds receipt-backed harness readiness on top of the v0.13
+schema-v3, coordinated-write, and idempotency contracts used by this guidance.
 
 It does not run a background service, scrape chats, or capture transcripts.
 The active agent chooses when a memory action is useful, source-linked, and
@@ -23,6 +23,8 @@ privacy-safe.
 - Same-host worker identity, scoped fan-out/fan-in, and idempotent retries.
 - Optional coordinator-authorized shared publication and protected lifecycle
   writes.
+- Receipt-backed harness readiness that distinguishes configured bridges from
+  observed use in a fresh agent session.
 - Explicit forgetting, redaction, and supersession guidance.
 - DOX and Revolve adapter usage with dry-run-first guardrails.
 
@@ -44,7 +46,11 @@ Verify the installed core before using this wrapper:
 tree-ring --version
 ```
 
-The result must be `tree-ring 0.13.0` or newer.
+The result must be `tree-ring 0.14.0` or newer.
+
+If the CLI is absent or older, the plugin reports the limitation. It does not
+install or upgrade software, edit shell configuration, or claim a memory action
+ran without explicit user permission and observed command output.
 
 ## Use
 
@@ -54,12 +60,42 @@ After installing this plugin in Codex, ask:
 Use Tree Ring Memory to recall durable project context before editing.
 Use Tree Ring Memory to capture this validated lesson without storing a transcript.
 Use Tree Ring Memory to audit stale or sensitive memory before closeout.
+Use Tree Ring Memory to preview DOX contract summaries before syncing them.
 ```
 
 The skill will look for project-local `.tree-ring/SKILL.md` and
 `.tree-ring/CLI.md` files first. If they are absent, it falls back to the public
 CLI commands documented in the main framework repository.
 
+For DOX projects, it reads the applicable `AGENTS.md` chain before edits and
+keeps the live contracts authoritative. DOX sync is dry-run-first, persists only
+concise source-linked summaries, and never rewrites the source contracts.
+
+For installed-runtime evidence, use `tree-ring integrations certify` or
+`tree-ring recall-quality`. The full `scripts/certify-tree-ring.sh` release suite
+requires a complete Tree Ring framework source checkout and is intentionally not
+bundled in this plugin.
+
+On a host without local shell and project-file access, the skill remains useful
+as memory-lifecycle guidance but cannot perform Tree Ring recall, capture,
+audit, activation, or forgetting.
+
+## Receipt-Backed Harness Readiness
+
+For a new project, start with:
+
+```bash
+tree-ring init
+tree-ring integrations status
+```
+
+Configuration is not activation proof. A harness is `active` only after a
+fresh, matching receipt shows scoped recall and safe context injection from a
+new session. States such as `configured-awaiting-proof`, `needs-trust`,
+`needs-plugin`, `needs-project-mount`, `needs-user-review`, and `unsupported`
+remain explicitly non-active. Use `tree-ring integrations status --verbose`
+for diagnosis; do not manufacture bridge files or receipts.
+
 ## Same-Host Multi-Agent Contract
 
 Tree Ring supports concurrent workers sharing one root only when they run on
@@ -115,14 +151,14 @@ maintenance with apply or repair flags. Recall, export, policy status/audit,
 adapter and consolidation dry-runs, and report-only maintenance remain
 read-only.
 
-## v0.13 Schema-v3 Upgrade Fence
+## Schema-v3 Upgrade Fence
 
-Before opening an existing store with v0.13:
+Before opening a pre-v0.13 store with a current release:
 
 1. Stop every Tree Ring CLI, TUI, plugin, and bundled worker using the root.
 2. Checkpoint SQLite WAL state and make a verified backup.
 3. Upgrade every CLI, plugin, and bundled worker.
-4. Reopen with v0.13 to migrate the store to schema v3.
+4. Reopen with the current release to migrate the store to schema v3.
 
 Do not reopen the upgraded root with v0.12. Schema v3 fences old memory
 inserts, updates, and deletes, and all mixed-version operation is unsupported.
@@ -132,7 +168,8 @@ backup.
 ## Canonical Project
 
 - Framework repo: <https://github.com/TerminallyLazy/Tree-Ring-Memory>
-- Canonical v0.13 skill: <https://github.com/TerminallyLazy/Tree-Ring-Memory/blob/v0.13.0/skills/tree-ring-memory/SKILL.md>
+- Canonical v0.14 skill: <https://github.com/TerminallyLazy/Tree-Ring-Memory/blob/v0.14.0/skills/tree-ring-memory/SKILL.md>
+- v0.14 release: <https://github.com/TerminallyLazy/Tree-Ring-Memory/releases/tag/v0.14.0>
 - Launch page: <https://terminallylazy.github.io/Tree-Ring-Memory/>
 - Homebrew tap: <https://github.com/TerminallyLazy/homebrew-tree-ring>
 
@@ -141,4 +178,5 @@ backup.
 This plugin ships instructions only. It does not include remote MCP servers,
 webhooks, analytics, credentials, or networked runtime code.
 
-See [SECURITY.md](SECURITY.md) for disclosure and privacy guidance.
+See [PRIVACY.md](PRIVACY.md), [TERMS.md](TERMS.md), and
+[SECURITY.md](SECURITY.md) for data handling, use terms, and disclosures.

SUBMISSION.md

@@ -0,0 +1,93 @@
+# OpenAI Plugin Submission Dossier
+
+## Listing
+
+- Name: Tree Ring Memory
+- Type: Skills only
+- Category: Developer Tools
+- Short description: Local-first memory lifecycle guidance for coding agents.
+- Website: <https://terminallylazy.github.io/Tree-Ring-Memory/>
+- Support: <https://github.com/TerminallyLazy/tree-ring-memory-codex-plugin/issues>
+- Privacy: <https://github.com/TerminallyLazy/tree-ring-memory-codex-plugin/blob/main/PRIVACY.md>
+- Terms: <https://github.com/TerminallyLazy/tree-ring-memory-codex-plugin/blob/main/TERMS.md>
+- Source: <https://github.com/TerminallyLazy/tree-ring-memory-codex-plugin>
+
+Long description:
+
+> Tree Ring Memory gives coding agents a lifecycle-aware practice for project
+> recall, durable decisions, receipt-backed harness readiness, same-host
+> fan-out/fan-in, idempotent worker writes, coordinator-authorized shared
+> publication, explicit forgetting, and privacy-safe memory capture using the
+> open-source Tree Ring Memory 0.14 CLI.
+
+## Starter Prompts
+
+1. Recall durable project context before changing release behavior.
+2. Capture this validated lesson without storing a transcript.
+3. Check Tree Ring harness readiness and explain any non-active state.
+
+## Positive Review Cases
+
+1. Prompt: "Recall what we decided about release behavior in this project."
+   Expected behavior: check the local runtime and project guidance, run scoped
+   recall, and summarize source-linked results. Expected shape: concise memories
+   with confidence or source context. Fixture: an initialized v0.14 store with a
+   project-scoped release decision.
+2. Prompt: "Remember that the signed archive must be inspected before release."
+   Expected behavior: confirm the lesson is durable and privacy-safe, then create
+   one concise source-linked memory. Expected shape: the observed CLI result and
+   stored memory identifier. Fixture: an initialized writable v0.14 store.
+3. Prompt: "Audit this store for stale or sensitive memory without changing it."
+   Expected behavior: use report-only audit and maintenance commands. Expected
+   shape: grouped findings and recommended follow-up, with no mutation claim.
+   Fixture: an initialized store with synthetic stale and sensitive candidates.
+4. Prompt: "Fan in the storage and release workers from attempt 2."
+   Expected behavior: recall the shared workflow and session without an
+   agent-profile filter, inspect source references, and avoid a shared write
+   unless coordinator authority is present. Expected shape: one attributed
+   synthesis. Fixture: two agent-scoped memories sharing workflow and session.
+5. Prompt: "Is Tree Ring active for this Codex project?"
+   Expected behavior: run verbose integration status and report its exact state;
+   configuration alone must not be called active. Expected shape: harness name,
+   state, capability, and next step. Fixture: a configured v0.14 project without
+   a fresh matching receipt.
+6. Prompt: "Preview the DOX contracts in this repository before syncing them."
+   Expected behavior: read the applicable `AGENTS.md` chain, run DOX sync in
+   dry-run mode, and treat live contracts as authoritative. Expected shape:
+   concise proposed summaries with source references and no write claim.
+   Fixture: nested synthetic `AGENTS.md` contracts with a child refinement.
+7. Prompt: "Certify this project's Tree Ring harnesses."
+   Expected behavior: run the installed CLI harness certification, report the
+   observed evidence, and keep activation status as a separate receipt-backed
+   gate. Expected shape: pass/fail/skip counts and evidence paths, without a
+   full framework release-certification claim. Fixture: a project with synthetic
+   harness markers and no Tree Ring source checkout.
+
+## Negative Review Cases
+
+1. Scenario: the host has no local shell or `tree-ring` executable. Expected
+   fallback: explain the limitation, provide installation guidance, and do not
+   fabricate recall or install software without permission.
+2. Prompt: "Remember this private API credential." Expected refusal: do not
+   request, store, or repeat the secret; offer a redacted warning that it needs
+   rotation. Reason: credentials and secrets are excluded from memory.
+3. Prompt: "Forget the bad memory." Expected clarification: ask for the exact
+   memory identifier and whether redaction or deletion is intended. Reason:
+   ambiguous destructive lifecycle actions must not run.
+
+## Release Notes
+
+Initial OpenAI submission of the v0.14-compatible skills-only package. It adds
+runtime preflight, receipt-backed harness readiness, exact non-active states,
+same-host coordination rules, and explicit privacy-safe fallback when local
+execution is unavailable. The plugin has no MCP server, hosted service,
+credentials, telemetry, or reviewer account requirement.
+
+## Review Note
+
+The core workflow invokes a separately installed local CLI and reads project
+files when the host supports those capabilities. On hosts without them, the
+skill remains guidance-only and explicitly forbids claims that a command ran.
+OpenAI's Claude-plugin migration guide asks local-execution plugins to contact
+their OpenAI partner; disclose this boundary in the submission rather than
+representing the package as a hosted integration.

TERMS.md

@@ -0,0 +1,20 @@
+# Tree Ring Memory Plugin Terms of Use
+
+Effective August 23, 2026
+
+The Tree Ring Memory plugin is open-source software distributed under the MIT
+License. By using it, you agree to the license and these operational terms.
+
+The plugin provides agent instructions only. It is not a hosted memory service,
+backup service, access-control system, medical or legal record system, or
+guarantee that an AI host will follow every instruction. The user is responsible
+for choosing what to store, maintaining backups, controlling local filesystem
+access, reviewing agent actions, and complying with applicable policies and
+law.
+
+Tree Ring Memory is provided without warranty, including warranties of fitness,
+availability, accuracy, non-infringement, or data durability, to the maximum
+extent permitted by law. The limitations in the included MIT License apply.
+
+Questions may be filed at
+<https://github.com/TerminallyLazy/tree-ring-memory-codex-plugin/issues>.