Fix lifecycle self improvement workflows

Author: ericpassmore

codex/codex-config.yaml

@@ -5,6 +5,11 @@ github_cli:
   owner_token_env:
     example-owner: GH_EXAMPLE_TOKEN
 
+git_commit:
+  allowed_env_sample_files:
+    - development.env
+    - develop.env
+
 notes:
   - "Update this manifest only when the repository's canonical commands change."
   - "Tasks must also copy the chosen commands into /tasks/<task-name>/spec.md under Verification Commands."
@@ -26,6 +31,8 @@ notes:
 
 
 
+
+
 # PREPARE-TAKEOFF BOOTSTRAP START
 bootstrap:
   codex_root: "/Users/eric/side-projects/prompts/codex"

codex/project-structure.md

@@ -39,6 +39,7 @@
 - Maintain canonical codex settings in `codex/codex-config.yaml`.
 - Keep this repository structure reference current in `codex/project-structure.md`.
 - Scaffold task artifacts via `./codex/scripts/task-scaffold.sh <task-name>`.
+- Task scaffolding materializes `tasks/<task-name>/complexity-signals.json` from `codex/tasks/_templates/complexity-signals.template.json`; Stage 3 can also remediate the missing file from the same template.
 
 ## Verification
 - Lint: `not-configured`

codex/prompts/acac.md

@@ -6,6 +6,8 @@ Strict trigger: the first non-empty line must be exactly `#ACAC` (case-sensitive
 
 Use the `acac` skill.
 
+After goals are approved, successful intermediate stage verdicts are continuation gates. Do not stop after `READY FOR PLANNING`, `READY FOR IMPLEMENTATION`, or `READY TO LAND` unless a stage emits `BLOCKED` or the user explicitly pauses the run.
+
 Inputs:
 
 - Request body after `#ACAC`: `{{USER_REQUEST_AFTER_ACAC}}`

codex/scripts/git-commit-preflight.sh

@@ -25,7 +25,7 @@ if ! upstream="$(git rev-parse --abbrev-ref --symbolic-full-name '@{u}' 2>/dev/n
   fi
 
   echo "Abort: branch '$branch' has no upstream and must be pushed first."
-  echo "Run the configured git push helper for this branch."
+  echo "Recovery: run ./codex/scripts/git-push-branch-safe.sh '$branch' after confirming this is the intended PR head branch, then rerun preflight."
   exit 1
 fi
 

codex/scripts/git-stage-safe.sh

@@ -13,4 +13,50 @@ if [[ "$#" -eq 0 ]]; then
   exit 2
 fi
 
+repo_root="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
+config_file="${repo_root}/codex/codex-config.yaml"
+
+is_env_like_file() {
+  case "$1" in
+    .env|.env.*|*.env|*.env.*)
+      return 0
+      ;;
+  esac
+  return 1
+}
+
+is_allowed_env_sample_file() {
+  local path="$1"
+
+  if [[ "$path" == "development.env" ]]; then
+    return 0
+  fi
+
+  if [[ -f "$config_file" ]] && awk '
+    /^[[:space:]]*allowed_env_sample_files:[[:space:]]*$/ {in_list=1; next}
+    in_list && /^[^[:space:]-]/ {exit}
+    in_list && /^[[:space:]]*-[[:space:]]*/ {
+      value=$0
+      sub(/^[[:space:]]*-[[:space:]]*/, "", value)
+      gsub(/^"|"$/, "", value)
+      gsub(/^'\''|'\''$/, "", value)
+      print value
+    }
+  ' "$config_file" | grep -Fx -- "$path" >/dev/null 2>&1; then
+    git ls-files --error-unmatch -- "$path" >/dev/null 2>&1
+    return
+  fi
+
+  return 1
+}
+
+for path in "$@"; do
+  base="${path##*/}"
+  if is_env_like_file "$base" && ! is_allowed_env_sample_file "$path"; then
+    echo "Abort: refusing to stage env-like file '${path}'."
+    echo "Allowed sample env files must be listed in codex/codex-config.yaml and already tracked, or be exactly development.env."
+    exit 1
+  fi
+done
+
 git add -- "$@"

codex/scripts/git-track-safe-untracked.sh

@@ -8,9 +8,95 @@ eligible=()
 skipped=()
 needs_permission=()
 auto_image_count=0
+TASK_NAME="${1:-${CODEX_TASK_NAME:-}}"
+
+usage() {
+  echo "Usage (canonical): ./.codex/scripts/git-track-safe-untracked.sh [task-name]"
+  echo "Usage (repo-local fallback): ./codex/scripts/git-track-safe-untracked.sh [task-name]"
+  echo "Usage (home fallback): ${HOME}/.codex/scripts/git-track-safe-untracked.sh [task-name]"
+}
+
+if [ "$#" -gt 1 ]; then
+  echo "Abort: too many arguments."
+  usage
+  exit 2
+fi
+
+if [ -n "$TASK_NAME" ] && ! [[ "$TASK_NAME" =~ ^[a-z0-9]+(-[a-z0-9]+)*$ ]]; then
+  echo "Abort: task-name must be kebab-case using lowercase letters, digits, and hyphens only."
+  exit 2
+fi
 
 is_exception_env_file() {
-  [ "$1" = "development.env" ]
+  local path="$1"
+  local repo_root
+  local config_file
+
+  [ "$path" = "development.env" ] && return 0
+
+  repo_root="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
+  config_file="${repo_root}/codex/codex-config.yaml"
+  [ -f "$config_file" ] || return 1
+
+  awk '
+    /^[[:space:]]*allowed_env_sample_files:[[:space:]]*$/ {in_list=1; next}
+    in_list && /^[^[:space:]-]/ {exit}
+    in_list && /^[[:space:]]*-[[:space:]]*/ {
+      value=$0
+      sub(/^[[:space:]]*-[[:space:]]*/, "", value)
+      gsub(/^"|"$/, "", value)
+      gsub(/^'\''|'\''$/, "", value)
+      print value
+    }
+  ' "$config_file" | grep -Fx -- "$path" >/dev/null 2>&1
+}
+
+infer_task_name_from_untracked() {
+  local inferred=""
+  local candidate=""
+
+  while IFS= read -r -d '' path; do
+    case "$path" in
+      tasks/*/*|goals/*/*)
+        candidate="${path#*/}"
+        candidate="${candidate%%/*}"
+        ;;
+      *)
+        continue
+        ;;
+    esac
+
+    if ! [[ "$candidate" =~ ^[a-z0-9]+(-[a-z0-9]+)*$ ]]; then
+      continue
+    fi
+
+    if [ -z "$inferred" ]; then
+      inferred="$candidate"
+    elif [ "$inferred" != "$candidate" ]; then
+      echo ""
+      return 0
+    fi
+  done < <(git ls-files -o --exclude-standard -z)
+
+  echo "$inferred"
+}
+
+if [ -z "$TASK_NAME" ]; then
+  TASK_NAME="$(infer_task_name_from_untracked)"
+fi
+
+is_task_owned_untracked_path() {
+  local path="$1"
+
+  [ -n "$TASK_NAME" ] || return 1
+
+  case "$path" in
+    "tasks/${TASK_NAME}/"*|"goals/${TASK_NAME}/"*)
+      return 0
+      ;;
+  esac
+
+  return 1
 }
 
 is_env_like_file() {
@@ -87,6 +173,11 @@ while IFS= read -r -d '' path; do
     continue
   fi
 
+  if ! is_task_owned_untracked_path "$path"; then
+    needs_permission+=("$path (untracked path outside task scope)")
+    continue
+  fi
+
   case "$lower_path" in
     *.mp4|*.mp3)
       skipped+=("$path (video/audio not allowed)")
@@ -144,7 +235,7 @@ fi
 
 if [ "${#needs_permission[@]}" -gt 0 ]; then
   echo
-  echo "Permission-required image files (not added): ${#needs_permission[@]}"
+  echo "Permission-required files (not added): ${#needs_permission[@]}"
   printf '%s\n' "${needs_permission[@]}"
-  echo "Action required: request explicit user approval before adding these files."
+  echo "Action required: request explicit user approval before adding these files, or stage intended paths explicitly with git-stage-safe.sh."
 fi

codex/scripts/prepare-phased-impl-scaffold.sh

@@ -132,9 +132,15 @@ else
 fi
 
 if [[ ! -f "${COMPLEXITY_SIGNALS_FILE}" ]]; then
-  echo "Abort: missing task complexity signals file ${COMPLEXITY_SIGNALS_FILE}."
-  echo "Remediation: create ${COMPLEXITY_SIGNALS_FILE} and re-run prepare-phased-impl-scaffold.sh."
-  exit 1
+  if CODEX_ROOT_FOR_SIGNALS="$(resolve_codex_root tasks/_templates/complexity-signals.template.json)"; then
+    signals_template="${CODEX_ROOT_FOR_SIGNALS}/tasks/_templates/complexity-signals.template.json"
+    cp "${signals_template}" "${COMPLEXITY_SIGNALS_FILE}"
+    echo "Materialized missing task complexity signals from template: ${COMPLEXITY_SIGNALS_FILE}"
+  else
+    echo "Abort: missing task complexity signals file ${COMPLEXITY_SIGNALS_FILE}."
+    echo "Remediation: create ${COMPLEXITY_SIGNALS_FILE} from codex/tasks/_templates/complexity-signals.template.json and re-run prepare-phased-impl-scaffold.sh."
+    exit 1
+  fi
 fi
 
 if [[ ! -f "${SELECTED_SIGNALS_FILE}" ]]; then

codex/scripts/prepare-takeoff-worktree.sh

@@ -101,4 +101,5 @@ echo "Uncommitted entries: ${STATUS_COUNT}"
 if [[ "${STATUS_COUNT}" -gt 0 ]]; then
   echo "Status summary:"
   printf '%s\n' "${STATUS_PORCELAIN}" | sed '/^$/d' | sed 's/^/  /'
+  echo "Dirty worktree decision required before downstream progression: record continue, isolate, or stop in the task spec."
 fi

codex/scripts/revalidate-code-review.sh

@@ -94,24 +94,30 @@ BASE_BRANCH="$(resolve_base_branch)"
 DIFF_MODE="base-branch"
 DIFF_COMMAND="git diff ${BASE_BRANCH}...HEAD"
 
-if DIFF_TEXT="$(git diff "${BASE_BRANCH}...HEAD" 2>/dev/null)"; then
-  :
+STAGED_DIFF_TEXT="$(git diff --cached 2>/dev/null || true)"
+UNSTAGED_DIFF_TEXT="$(git diff 2>/dev/null || true)"
+WORKTREE_DIFF_TEXT="${STAGED_DIFF_TEXT}${UNSTAGED_DIFF_TEXT}"
+
+if [[ -n "${WORKTREE_DIFF_TEXT}" ]]; then
+  DIFF_MODE="working-tree"
+  DIFF_COMMAND="git diff --cached && git diff"
+  DIFF_TEXT="${WORKTREE_DIFF_TEXT}"
+  CHANGED_FILES="$({
+    git diff --cached --name-only 2>/dev/null || true
+    git diff --name-only 2>/dev/null || true
+  } | sed '/^$/d' | sort -u)"
+  HUNKS="$({
+    git diff --cached -U0 2>/dev/null || true
+    git diff -U0 2>/dev/null || true
+  })"
 else
-  DIFF_TEXT=""
-fi
-
-if [[ -z "${DIFF_TEXT}" ]]; then
-  DIFF_MODE="fallback"
-  DIFF_COMMAND="git diff"
-  DIFF_TEXT="$(git diff 2>/dev/null || true)"
-fi
-
-if [[ "${DIFF_MODE}" == "base-branch" ]]; then
+  if DIFF_TEXT="$(git diff "${BASE_BRANCH}...HEAD" 2>/dev/null)"; then
+    :
+  else
+    DIFF_TEXT=""
+  fi
   CHANGED_FILES="$(git diff --name-only "${BASE_BRANCH}...HEAD" 2>/dev/null || true)"
   HUNKS="$(git diff -U0 "${BASE_BRANCH}...HEAD" 2>/dev/null || true)"
-else
-  CHANGED_FILES="$(git diff --name-only 2>/dev/null || true)"
-  HUNKS="$(git diff -U0 2>/dev/null || true)"
 fi
 
 CITATIONS="$(printf '%s\n' "${HUNKS}" | awk '

codex/scripts/task-scaffold.sh

@@ -58,6 +58,7 @@ fi
 SPEC_TPL="${TEMPLATES_DIR}/spec.template.md"
 PHASE_TPL="${TEMPLATES_DIR}/phase.template.md"
 FINAL_TPL="${TEMPLATES_DIR}/final-phase.template.md"
+COMPLEXITY_SIGNALS_TPL="${TEMPLATES_DIR}/complexity-signals.template.json"
 
 mkdir -p "${TASK_DIR}"
 
@@ -92,6 +93,13 @@ if [[ ! -f "${TASK_DIR}/final-phase.md" ]]; then
   created_files+=("${TASK_DIR}/final-phase.md")
 fi
 
+# complexity-signals.template.json -> complexity-signals.json
+# This is a neutral planning input template; scoring remains gated by Stage 3.
+if [[ -f "${COMPLEXITY_SIGNALS_TPL}" && ! -f "${TASK_DIR}/complexity-signals.json" ]]; then
+  cp "${COMPLEXITY_SIGNALS_TPL}" "${TASK_DIR}/complexity-signals.json"
+  created_files+=("${TASK_DIR}/complexity-signals.json")
+fi
+
 # Materialize any additional *.template.md files (beyond known ones)
 shopt -s nullglob
 for tpl in "${TEMPLATES_DIR}"/*.template.md; do