feat: complete setup authoring and refreshed harness artifacts

.github/workflows/publish-crates.yml

@@ -48,7 +48,7 @@ jobs:
 
       - name: Mint a short-lived crates.io token
         id: crates
-        uses: rust-lang/crates-io-auth-action@82864bf380abd3e242c564a5ba58dd29d6265b00
+        uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5
 
       - name: Publish codex-setup-system
         env:

CHANGELOG.md

@@ -15,6 +15,17 @@ cut and that this clone does not carry.
 
 ## [Unreleased]
 
+## [0.0.67] - 2026-09-07
+
+nddev-builder creates complete native tool collections: select and author
+components, compose exact setups across declared roots, document capabilities,
+and verify installation, native invocation and recovery. Provider maintenance
+checks are separate from ordinary setup authoring. The toolkit includes the
+consumer's exact digest-approval steps and preserves the active environment.
+Product artifacts are refreshed from verified vendor bytes, with previous
+pins retained for rollback. Release authentication uses the tagged upstream
+action release.
+
 ## [0.0.66] - 2026-09-07
 
 Reset is an optional protocol operation: it empties declared native

Cargo.toml

@@ -8,7 +8,7 @@ members = [
 ]
 
 [workspace.package]
-version = "0.0.66"
+version = "0.0.67"
 edition = "2024"
 rust-version = "1.89"
 license = "AGPL-3.0-or-later"
@@ -23,9 +23,9 @@ sha2 = "0.11"
 # `setup-core::archive`); an inflate loop is not, because its bugs are
 # memory-safety bugs and it is not improved by being hand-written here.
 miniz_oxide = "0.9"
-setup-core = { path = "crates/setup-core", version = "0.0.66" }
-provider-v3 = { path = "crates/provider-v3", version = "0.0.66" }
-harness-runtime = { path = "crates/harness-runtime", version = "0.0.66" }
+setup-core = { path = "crates/setup-core", version = "0.0.67" }
+provider-v3 = { path = "crates/provider-v3", version = "0.0.67" }
+harness-runtime = { path = "crates/harness-runtime", version = "0.0.67" }
 
 [workspace.lints.rust]
 unsafe_code = "forbid"

README.md

@@ -179,7 +179,7 @@ release is a convenience, not the authorised copy.
 
 ```bash
 docker run --rm -v "$HOME/.config:/config" \
-  ghcr.io/nddev-opennetwork/codex-setup-system:0.0.66 \
+  ghcr.io/nddev-opennetwork/codex-setup-system:0.0.67 \
   status --target /config/<dir> --json
 ```
 

crates/codex-setup-system/src/software.rs

@@ -20,116 +20,116 @@ use harness_runtime::{Artifact, Delivery, Previous, Shape, Software};
 pub(crate) const ARTIFACTS: &[Artifact] = &[
     Artifact {
         platform: "linux/arm64",
-        url: "https://registry.npmjs.org/@openai/codex/-/codex-0.153.2-linux-arm64.tgz",
-        bytes: 121_675_259,
-        sha256: "sha256:df2f8f764bf86aeae51d71cc37686dcbd2c24e4bce9a9d1e8f249141fd99fac3",
+        url: "https://registry.npmjs.org/@openai/codex/-/codex-0.153.4-linux-arm64.tgz",
+        bytes: 121_707_000,
+        sha256: "sha256:439c0dd0d6923f607b4e5cd1e3079c12f0b86f6e5007f07e377d6ad25e2d7bb9",
         shape: Shape::GzipTar,
         member: "package/vendor/aarch64-unknown-linux-musl/bin/codex",
     },
     Artifact {
         platform: "linux/x86_64",
-        url: "https://registry.npmjs.org/@openai/codex/-/codex-0.153.2-linux-x64.tgz",
-        bytes: 129_259_793,
-        sha256: "sha256:1fd52113294979c9936a110cab7cb9d5e9d1e28086f112fd6748a05826a9e5a0",
+        url: "https://registry.npmjs.org/@openai/codex/-/codex-0.153.4-linux-x64.tgz",
+        bytes: 129_272_137,
+        sha256: "sha256:54818cb9fce3360cc6e44cfc5a96952cd5c1243efb43cbe488e11dda84663e08",
         shape: Shape::GzipTar,
         member: "package/vendor/x86_64-unknown-linux-musl/bin/codex",
     },
     Artifact {
         platform: "macos/arm64",
-        url: "https://registry.npmjs.org/@openai/codex/-/codex-0.153.2-darwin-arm64.tgz",
-        bytes: 115_669_249,
-        sha256: "sha256:151ecdd90b96af823a2828146bff056c8a5f42d2ab4da63a198fe8a4ad84990b",
+        url: "https://registry.npmjs.org/@openai/codex/-/codex-0.153.4-darwin-arm64.tgz",
+        bytes: 115_672_312,
+        sha256: "sha256:535d301b49131abfda3264f959fb0defa40bbc306976d98ddbc15c424636c55c",
         shape: Shape::GzipTar,
         member: "package/vendor/aarch64-apple-darwin/bin/codex",
     },
     Artifact {
         platform: "macos/x86_64",
-        url: "https://registry.npmjs.org/@openai/codex/-/codex-0.153.2-darwin-x64.tgz",
-        bytes: 123_497_670,
-        sha256: "sha256:ec139bb87cdd25d8038069cef7ff2bdd2d119c7fcf0ac6e26dcc1020573cd112",
+        url: "https://registry.npmjs.org/@openai/codex/-/codex-0.153.4-darwin-x64.tgz",
+        bytes: 123_544_033,
+        sha256: "sha256:5e468958503c60e940b1b1af3fe2064c16fd141f1607111caf99f2c0a0e80725",
         shape: Shape::GzipTar,
         member: "package/vendor/x86_64-apple-darwin/bin/codex",
     },
     Artifact {
         platform: "windows/arm64",
-        url: "https://registry.npmjs.org/@openai/codex/-/codex-0.153.2-win32-arm64.tgz",
-        bytes: 132_143_077,
-        sha256: "sha256:71ba906090143a310354ae5c864d5c677e05842b373cadcf84ef2872f8ddcfa1",
+        url: "https://registry.npmjs.org/@openai/codex/-/codex-0.153.4-win32-arm64.tgz",
+        bytes: 132_173_674,
+        sha256: "sha256:6d0bf07e04810f0ed4ad2984f6c9f0547bb9e0e1bb1f8fe9ecce0de3376bbfef",
         shape: Shape::GzipTar,
         member: "package/vendor/aarch64-pc-windows-msvc/bin/codex.exe",
     },
     Artifact {
         platform: "windows/x86_64",
-        url: "https://registry.npmjs.org/@openai/codex/-/codex-0.153.2-win32-x64.tgz",
-        bytes: 141_510_231,
-        sha256: "sha256:e674587ea13f7051aeae697b1425ec028a236f54fa1dd1a15661ef7c063f2874",
+        url: "https://registry.npmjs.org/@openai/codex/-/codex-0.153.4-win32-x64.tgz",
+        bytes: 141_495_386,
+        sha256: "sha256:05f473573f38b3f4dc9484e6807a511a1bb0e128dfa50816dafc5f79e553cdca",
         shape: Shape::GzipTar,
         member: "package/vendor/x86_64-pc-windows-msvc/bin/codex.exe",
     },
 ];
 
-/// The artifacts 0.153.1 was published as, kept so
+/// The artifacts 0.153.2 was published as, kept so
 /// `software_update` has a version to move from and `rollback` a tree to
 /// return to. Measured from bytes when it was the current pin.
 pub(crate) const PREVIOUS_ARTIFACTS: &[Artifact] = &[
     Artifact {
         platform: "linux/arm64",
-        url: "https://registry.npmjs.org/@openai/codex/-/codex-0.153.1-linux-arm64.tgz",
-        bytes: 121_697_093,
-        sha256: "sha256:3e050251b40b334e74a27c52128b86f8468fa8242d5c8205b04f4b31f85690f7",
+        url: "https://registry.npmjs.org/@openai/codex/-/codex-0.153.2-linux-arm64.tgz",
+        bytes: 121_675_259,
+        sha256: "sha256:df2f8f764bf86aeae51d71cc37686dcbd2c24e4bce9a9d1e8f249141fd99fac3",
         shape: Shape::GzipTar,
         member: "package/vendor/aarch64-unknown-linux-musl/bin/codex",
     },
     Artifact {
         platform: "linux/x86_64",
-        url: "https://registry.npmjs.org/@openai/codex/-/codex-0.153.1-linux-x64.tgz",
-        bytes: 129_241_027,
-        sha256: "sha256:33b4ae16df4530361a651bc1540ae8de325ccc789622a812c94585bdf205f7f4",
+        url: "https://registry.npmjs.org/@openai/codex/-/codex-0.153.2-linux-x64.tgz",
+        bytes: 129_259_793,
+        sha256: "sha256:1fd52113294979c9936a110cab7cb9d5e9d1e28086f112fd6748a05826a9e5a0",
         shape: Shape::GzipTar,
         member: "package/vendor/x86_64-unknown-linux-musl/bin/codex",
     },
     Artifact {
         platform: "macos/arm64",
-        url: "https://registry.npmjs.org/@openai/codex/-/codex-0.153.1-darwin-arm64.tgz",
-        bytes: 115_673_114,
-        sha256: "sha256:33babfe9db041ff18100775bf34df673c1baf9a5d7b1d09fdcafefc58501aa87",
+        url: "https://registry.npmjs.org/@openai/codex/-/codex-0.153.2-darwin-arm64.tgz",
+        bytes: 115_669_249,
+        sha256: "sha256:151ecdd90b96af823a2828146bff056c8a5f42d2ab4da63a198fe8a4ad84990b",
         shape: Shape::GzipTar,
         member: "package/vendor/aarch64-apple-darwin/bin/codex",
     },
     Artifact {
         platform: "macos/x86_64",
-        url: "https://registry.npmjs.org/@openai/codex/-/codex-0.153.1-darwin-x64.tgz",
-        bytes: 123_566_510,
-        sha256: "sha256:bafcac30746296be53a183ff907b9ae59cef9f8e65fa511abcb7661bd247bf80",
+        url: "https://registry.npmjs.org/@openai/codex/-/codex-0.153.2-darwin-x64.tgz",
+        bytes: 123_497_670,
+        sha256: "sha256:ec139bb87cdd25d8038069cef7ff2bdd2d119c7fcf0ac6e26dcc1020573cd112",
         shape: Shape::GzipTar,
         member: "package/vendor/x86_64-apple-darwin/bin/codex",
     },
     Artifact {
         platform: "windows/arm64",
-        url: "https://registry.npmjs.org/@openai/codex/-/codex-0.153.1-win32-arm64.tgz",
-        bytes: 132_174_290,
-        sha256: "sha256:5ee2fab96e2ba898ea7e4c0c8f4222f4dfd08d0ea9b4c9b849323ebb1e90ef14",
+        url: "https://registry.npmjs.org/@openai/codex/-/codex-0.153.2-win32-arm64.tgz",
+        bytes: 132_143_077,
+        sha256: "sha256:71ba906090143a310354ae5c864d5c677e05842b373cadcf84ef2872f8ddcfa1",
         shape: Shape::GzipTar,
         member: "package/vendor/aarch64-pc-windows-msvc/bin/codex.exe",
     },
     Artifact {
         platform: "windows/x86_64",
-        url: "https://registry.npmjs.org/@openai/codex/-/codex-0.153.1-win32-x64.tgz",
-        bytes: 141_469_181,
-        sha256: "sha256:fa9e2ac23e905fdcba1fb4f396c57da65fac04c1a3ee4eebbbb85b5ad6b2dc10",
+        url: "https://registry.npmjs.org/@openai/codex/-/codex-0.153.2-win32-x64.tgz",
+        bytes: 141_510_231,
+        sha256: "sha256:e674587ea13f7051aeae697b1425ec028a236f54fa1dd1a15661ef7c063f2874",
         shape: Shape::GzipTar,
         member: "package/vendor/x86_64-pc-windows-msvc/bin/codex.exe",
     },
 ];
 
 /// Codex's program, and where its bytes come from.
 pub(crate) const SOFTWARE: Software = Software {
-    version: "0.153.2",
+    version: "0.153.4",
     command: "codex",
     delivery: Delivery::Artifacts(ARTIFACTS),
     unsupported: &[],
     previous: Some(Previous {
-        version: "0.153.1",
+        version: "0.153.2",
         artifacts: PREVIOUS_ARTIFACTS,
     }),
 };

install.ps1

@@ -7,7 +7,7 @@
 #   powershell -ExecutionPolicy Bypass -File install.ps1 -Version 0.1.0
 [CmdletBinding()]
 param(
-  [string]$Version = "0.0.66",
+  [string]$Version = "0.0.67",
   [string]$InstallDir = "$env:LOCALAPPDATA\Programs\codex-setup-system"
 )
 $ErrorActionPreference = "Stop"

install.sh

@@ -14,7 +14,7 @@ set -eu
 
 REPO="NDDev-OpenNetwork/codex-setup-system"
 BINARY="codex-setup-system"
-VERSION="${1:-0.0.66}"
+VERSION="${1:-0.0.67}"
 PREFIX="${CODEX_INSTALL_DIR:-$HOME/.local/bin}"
 
 case "$(uname -s)" in