DefinitelySecureStudio · andrewperis · Sep 11, 2026 · Sep 11, 2026 · chatgpt-codex-connector · Sep 11, 2026
@@ -1,5 +1,16 @@
 # Changelog
 
+## 1.0.0 — stable adoption candidate, artifact publication pending
+
+- Adopt all five published immutable Codex contracts with complete verified
+  schema/bundle manifests and exact source commit.
+- Regenerate every validator from published assets; expose released runtime
+  references and permit stable prompt lifecycle.
+- Align package, renderer and structured processor versions at 1.0.0.
+  Render/processing identities change because they include runtime provenance;
+  prompt messages, outputs, policy and algorithms are unchanged.
+- Strengthen readiness checks and negative tests for all five dependency pins.
+
 ## Unreleased — Prompt SDK v1 release preparation
 
 - Final API inventory, quick start, adapter guide, compatibility/deprecation

@@ -1,5 +1,20 @@
 # Constitution conformance record
 
+## Issue #72 stable adoption — 2026-09-11
+
+Owner: @andrewperis; Constitution v1.0.0 at
+`a9cc8a503aa30e17820edc62ac95f7cbe10e0564`.
+Five Codex contracts are now published with immutable releases at approved
+commit `62e78b606986988518b9dc502c25ae1cd189684a`. GitHub immutability and tag
+targets were checked; all 15 published assets match verified build bytes.
+The dependency lock records release URLs, timestamps, complete asset tuples.
+This candidate adopts those releases, regenerates validators, enables stable
+prompt lifecycle and aligns SDK/runtime versions. Golden updates reflect only
+version/contract metadata and resulting canonical identities.
+Owner merge, CI and final Platform artifact publication remain outstanding;
+dependency readiness does not itself approve the implementation release.
+No new dependencies, visibility changes, provider calls or exceptions.
+
 ## Issue #72 release preparation — 2026-09-11
 
 Owner: @andrewperis. Constitution v1.0.0 at

@@ -1,9 +1,11 @@
 # Prompt SDK v1 release guide
 
-This is the v1 release candidate documentation, not a claim of publication.
-Package/runtime version stays 0.1.0 and contract pins remain visibly provisional
-until Codex immutable artifacts and owner release approval are verified.
-Studio #72 and Epic #4 must remain open until the actual releases exist.
+The five Codex v1.0.0 contracts are published immutably at commit
+`62e78b606986988518b9dc502c25ae1cd189684a`; their verified manifests are in
+[contract-lock.json](../release/contract-lock.json). This adoption candidate
+updates package/renderer/processor to 1.0.0 and permits stable prompt lifecycle.
+The Platform artifact itself remains pending owner merge and publication:
+Studio #72 and Epic #4 stay open until that final release is verified.
 
 ## Quick start
 

@@ -1,6 +1,6 @@
 {
   "name": "@definitely-secure-studio/platform",
-  "version": "0.1.0",
+  "version": "1.0.0",
   "private": true,
   "type": "module",
   "exports": {

@@ -4,10 +4,10 @@
 compatibility review; the test suite detects accidental export additions/removals.
 
 Run `node scripts/check-sdk-release.mjs` for a machine-readable readiness
-report (exit 1 while blocked). Its current expected result is not ready.
+report (exit 1 while blocked). The adopted references now pass this offline check.
 It never creates tags, uploads files, changes version/status or grants approval.
 
-The later owner-reviewed adoption change adds `contract-lock.json`:
+This owner-reviewed adoption candidate adds `contract-lock.json`:
 `{ "contracts": [ ...five downloaded Codex manifests... ] }`.
 Each manifest retains the builder's repository, contract, version, tag, commit,
 schema_id and assets with URI, media type, byte size and SHA-256. Add
@@ -16,7 +16,14 @@ only after independently verifying GitHub immutable status, exact tag target,
 and downloaded asset bytes. Retain links to that evidence in the release review.
 
 This is an offline consistency check of reviewed evidence, not online proof.
-The owner must verify evidence before adopting it. The script checks the four
-public runtime metadata pins; the fifth provenance generator pin and every
-compiled validator must additionally be checked against downloaded schema bytes
-as specified in the [release guide](../docs/prompt-sdk-v1.md).
+The owner must verify evidence before adopting it. The script checks all five
+runtime metadata pins. Tests also check compiled validator commit/digest headers;
+all five validators were regenerated from the downloaded published schema assets.
+All tags resolve to `62e78b606986988518b9dc502c25ae1cd189684a`, GitHub reported
+`immutable: true`, and all 15 downloaded published assets matched local build
+bytes. The lock includes per-release URLs and verification times.
+
+Platform publication is still separate from dependency readiness. After owner
+merge and successful CI, build/inspect the package/source artifacts, record
+sizes/digests and the exact Platform commit, and publish the reviewed immutable
+`prompt-sdk/v1.0.0` release. See the [release guide](../docs/prompt-sdk-v1.md).
@@ -0,0 +1,154 @@
+{
+  "contracts": [
+    {
+      "repository": "DefinitelySecureStudio/codex",
+      "contract": "context-package",
+      "version": "1.0.0",
+      "tag": "contract/context-package/v1.0.0",
+      "commit": "62e78b606986988518b9dc502c25ae1cd189684a",
+      "constitution_commit": "a9cc8a503aa30e17820edc62ac95f7cbe10e0564",
+      "schema_id": "urn:definitely-secure:contract:context-package:1.0.0:context-package",
+      "assets": [
+        {
+          "filename": "context-package-v1.0.0.schema.json",
+          "artifact_uri": "https://github.com/DefinitelySecureStudio/codex/releases/download/contract%2Fcontext-package%2Fv1.0.0/context-package-v1.0.0.schema.json",
+          "media_type": "application/schema+json",
+          "byte_size": 8390,
+          "sha256": "sha256:d81e88780511c31099b2dd925f31aff26d6ba75e1173e953b98a37298764b617"
+        },
+        {
+          "filename": "context-package-v1.0.0.bundle.json",
+          "artifact_uri": "https://github.com/DefinitelySecureStudio/codex/releases/download/contract%2Fcontext-package%2Fv1.0.0/context-package-v1.0.0.bundle.json",
+          "media_type": "application/json",
+          "byte_size": 459899,
+          "sha256": "sha256:cb56c6c048e9af95e59c7053c9ce5cef2fecd74e864d828c3cc2482bd5f00c93"
+        }
+      ],
+      "publication": {
+        "immutable": true,
+        "verified_at": "2026-09-11T14:56:35.243Z",
+        "release_url": "https://github.com/DefinitelySecureStudio/codex/releases/tag/contract/context-package/v1.0.0"
+      }
+    },
+    {
+      "repository": "DefinitelySecureStudio/codex",
+      "contract": "execution-provenance",
+      "version": "1.0.0",
+      "tag": "contract/execution-provenance/v1.0.0",
+      "commit": "62e78b606986988518b9dc502c25ae1cd189684a",
+      "constitution_commit": "a9cc8a503aa30e17820edc62ac95f7cbe10e0564",
+      "schema_id": "urn:definitely-secure:contract:execution-provenance:1.0.0:record",
+      "assets": [
+        {
+          "filename": "execution-provenance-v1.0.0.schema.json",
+          "artifact_uri": "https://github.com/DefinitelySecureStudio/codex/releases/download/contract%2Fexecution-provenance%2Fv1.0.0/execution-provenance-v1.0.0.schema.json",
+          "media_type": "application/schema+json",
+          "byte_size": 13143,
+          "sha256": "sha256:d1f897fdd40c8a513f2f3dc9c44728ec124e53a57977a1b11b04e00953020118"
+        },
+        {
+          "filename": "execution-provenance-v1.0.0.bundle.json",
+          "artifact_uri": "https://github.com/DefinitelySecureStudio/codex/releases/download/contract%2Fexecution-provenance%2Fv1.0.0/execution-provenance-v1.0.0.bundle.json",
+          "media_type": "application/json",
+          "byte_size": 459904,
+          "sha256": "sha256:2bef0c6c87844ec94835b2b3ae2b8d4a16a531c54953b86e306a6307fab5abf2"
+        }
+      ],
+      "publication": {
+        "immutable": true,
+        "verified_at": "2026-09-11T14:56:35.252Z",
+        "release_url": "https://github.com/DefinitelySecureStudio/codex/releases/tag/contract/execution-provenance/v1.0.0"
+      }
+    },
+    {
+      "repository": "DefinitelySecureStudio/codex",
+      "contract": "prompt-definition",
+      "version": "1.0.0",
+      "tag": "contract/prompt-definition/v1.0.0",
+      "commit": "62e78b606986988518b9dc502c25ae1cd189684a",
+      "constitution_commit": "a9cc8a503aa30e17820edc62ac95f7cbe10e0564",
+      "schema_id": "urn:definitely-secure:contract:prompt-definition:1.0.0:prompt-definition",
+      "assets": [
+        {
+          "filename": "prompt-definition-v1.0.0.schema.json",
+          "artifact_uri": "https://github.com/DefinitelySecureStudio/codex/releases/download/contract%2Fprompt-definition%2Fv1.0.0/prompt-definition-v1.0.0.schema.json",
+          "media_type": "application/schema+json",
+          "byte_size": 18384,
+          "sha256": "sha256:6ac345956582d25c2db9c81b85cab9c73b2cbcfc79b8aac7a43d847c07173cb9"
+        },
+        {
+          "filename": "prompt-definition-v1.0.0.bundle.json",
+          "artifact_uri": "https://github.com/DefinitelySecureStudio/codex/releases/download/contract%2Fprompt-definition%2Fv1.0.0/prompt-definition-v1.0.0.bundle.json",
+          "media_type": "application/json",
+          "byte_size": 459901,
+          "sha256": "sha256:cd6577df588d50a8575910c398ce619dd84a6425ae199b480d94e68466b52800"
+        }
+      ],
+      "publication": {
+        "immutable": true,
+        "verified_at": "2026-09-11T14:56:35.253Z",
+        "release_url": "https://github.com/DefinitelySecureStudio/codex/releases/tag/contract/prompt-definition/v1.0.0"
+      }
+    },
+    {
+      "repository": "DefinitelySecureStudio/codex",
+      "contract": "provider-execution",
+      "version": "1.0.0",
+      "tag": "contract/provider-execution/v1.0.0",
+      "commit": "62e78b606986988518b9dc502c25ae1cd189684a",
+      "constitution_commit": "a9cc8a503aa30e17820edc62ac95f7cbe10e0564",
+      "schema_id": "urn:definitely-secure:contract:provider-execution:1.0.0:provider-execution",
+      "assets": [
+        {
+          "filename": "provider-execution-v1.0.0.schema.json",
+          "artifact_uri": "https://github.com/DefinitelySecureStudio/codex/releases/download/contract%2Fprovider-execution%2Fv1.0.0/provider-execution-v1.0.0.schema.json",
+          "media_type": "application/schema+json",
+          "byte_size": 25285,
+          "sha256": "sha256:4366665b89d7633974c4be15cac74f754e722b41031f708ca2f825ead892cb8b"
+        },
+        {
+          "filename": "provider-execution-v1.0.0.bundle.json",
+          "artifact_uri": "https://github.com/DefinitelySecureStudio/codex/releases/download/contract%2Fprovider-execution%2Fv1.0.0/provider-execution-v1.0.0.bundle.json",
+          "media_type": "application/json",
+          "byte_size": 459902,
+          "sha256": "sha256:765902129220eec8440be3f7e9b3f6dc6c9ad162642200637bd3fcaae48ac9c9"
+        }
+      ],
+      "publication": {
+        "immutable": true,
+        "verified_at": "2026-09-11T14:56:35.254Z",
+        "release_url": "https://github.com/DefinitelySecureStudio/codex/releases/tag/contract/provider-execution/v1.0.0"
+      }
+    },
+    {
+      "repository": "DefinitelySecureStudio/codex",
+      "contract": "structured-output",
+      "version": "1.0.0",
+      "tag": "contract/structured-output/v1.0.0",
+      "commit": "62e78b606986988518b9dc502c25ae1cd189684a",
+      "constitution_commit": "a9cc8a503aa30e17820edc62ac95f7cbe10e0564",
+      "schema_id": "urn:definitely-secure:contract:structured-output:1.0.0:processing",
+      "assets": [
+        {
+          "filename": "structured-output-v1.0.0.schema.json",
+          "artifact_uri": "https://github.com/DefinitelySecureStudio/codex/releases/download/contract%2Fstructured-output%2Fv1.0.0/structured-output-v1.0.0.schema.json",
+          "media_type": "application/schema+json",
+          "byte_size": 8427,
+          "sha256": "sha256:6ea2c5d4804b92bbca386d2b64063d72980ca1d294d23338be6adc057caaeeb2"
+        },
+        {
+          "filename": "structured-output-v1.0.0.bundle.json",
+          "artifact_uri": "https://github.com/DefinitelySecureStudio/codex/releases/download/contract%2Fstructured-output%2Fv1.0.0/structured-output-v1.0.0.bundle.json",
+          "media_type": "application/json",
+          "byte_size": 459901,
+          "sha256": "sha256:e0d91fc5c5b01d33bd665165306c1d0de6cc9cc9598e94831e9748cc450e562c"
+        }
+      ],
+      "publication": {
+        "immutable": true,
+        "verified_at": "2026-09-11T14:56:35.255Z",
+        "release_url": "https://github.com/DefinitelySecureStudio/codex/releases/tag/contract/structured-output/v1.0.0"
+      }
+    }
+  ]
+}
@@ -1,39 +1,41 @@
 import { readFile } from 'node:fs/promises';
 import { pathToFileURL } from 'node:url';
-import { CONTRACT, EXECUTION_CONTRACT, CONTEXT_PACKAGE_CONTRACT, STRUCTURED_OUTPUT_CONTRACT } from '../src/prompt-sdk/index.js';
-export async function releaseReadiness() {
-  const pkg = JSON.parse(await readFile(new URL('../package.json', import.meta.url)));
+import { RELEASE_CONTRACTS } from '../src/prompt-sdk/release-contracts.js';
+const names = ['prompt-definition', 'provider-execution', 'context-package', 'structured-output', 'execution-provenance'];
+export function checkReleaseInputs({ pkg, lock, pins = RELEASE_CONTRACTS }) {
   const blockers = [];
-  if (pkg.version !== '1.0.0') blockers.push('SDK package is not version 1.0.0.');
-  for (const [name, pin] of Object.entries({ 'prompt-definition': CONTRACT, 'provider-execution': EXECUTION_CONTRACT, 'context-package': CONTEXT_PACKAGE_CONTRACT, 'structured-output': STRUCTURED_OUTPUT_CONTRACT })) {
-    if (pin.status !== 'released') blockers.push(name + ' remains provisional.');
-  }
-  let lock;
-  try { lock = JSON.parse(await readFile(new URL('../release/contract-lock.json', import.meta.url))); }
-  catch { blockers.push('A reviewed immutable contract lock is missing or unreadable.'); }
-  const names = ['prompt-definition', 'provider-execution', 'context-package', 'structured-output', 'execution-provenance'];
-  if (lock) {
-    if (!Array.isArray(lock.contracts) || lock.contracts.length !== names.length) blockers.push('Contract lock must contain exactly five contracts.');
-    for (const name of names) {
-      const entries = Array.isArray(lock.contracts) ? lock.contracts.filter(entry => entry?.contract === name) : [];
-      const entry = entries[0];
-      const schema = Array.isArray(entry?.assets) ? entry.assets.find(asset => asset?.media_type === 'application/schema+json') : undefined;
-      if (entries.length !== 1 || entry.repository !== 'DefinitelySecureStudio/codex' || entry.version !== '1.0.0' ||
-          entry.tag !== 'contract/' + name + '/v1.0.0' || !/^[0-9a-f]{40}$/.test(entry.commit ?? '') ||
-          entry.publication?.immutable !== true || !Number.isFinite(Date.parse(entry.publication?.verified_at)) ||
-          !schema || !Number.isSafeInteger(schema.byte_size) || schema.byte_size < 1 ||
-          !/^sha256:[0-9a-f]{64}$/.test(schema.sha256 ?? '') ||
-          !schema.artifact_uri?.startsWith('https://github.com/DefinitelySecureStudio/codex/releases/download/' + encodeURIComponent(entry.tag) + '/')) {
-        blockers.push(name + ' lacks a complete verified immutable reference.');
-      }
-      const pin = { 'prompt-definition': CONTRACT, 'provider-execution': EXECUTION_CONTRACT, 'context-package': CONTEXT_PACKAGE_CONTRACT, 'structured-output': STRUCTURED_OUTPUT_CONTRACT }[name];
-      if (pin && (pin.commit !== entry?.commit || pin.schema_sha256 !== schema?.sha256 || pin.schema_byte_size !== schema?.byte_size)) blockers.push(name + ' runtime pin differs from the dependency lock.');
+  if (pkg?.version !== '1.0.0') blockers.push('SDK package is not version 1.0.0.');
+  if (!Array.isArray(lock?.contracts) || lock.contracts.length !== names.length) blockers.push('Immutable contract lock must contain exactly five contracts.');
+  for (const name of names) {
+    const matches = Array.isArray(lock?.contracts) ? lock.contracts.filter(entry => entry?.contract === name) : [];
+    const entry = matches[0], pin = pins?.[name];
+    const assets = Array.isArray(entry?.assets) ? entry.assets.filter(asset => asset?.media_type === 'application/schema+json') : [];
+    const schema = assets[0];
+    const tag = 'contract/' + name + '/v1.0.0';
+    const prefix = 'https://github.com/DefinitelySecureStudio/codex/releases/download/' + encodeURIComponent(tag) + '/';
+    if (matches.length !== 1 || entry?.repository !== 'DefinitelySecureStudio/codex' || entry?.version !== '1.0.0' ||
+        entry?.tag !== tag || !/^[0-9a-f]{40}$/.test(entry?.commit ?? '') ||
+        entry?.publication?.immutable !== true || typeof entry?.publication?.verified_at !== 'string' ||
+        !Number.isFinite(Date.parse(entry.publication.verified_at)) ||
+        entry.publication.release_url !== 'https://github.com/DefinitelySecureStudio/codex/releases/tag/' + tag ||
+        assets.length !== 1 || !Number.isSafeInteger(schema?.byte_size) || schema.byte_size < 1 ||
+        !/^sha256:[0-9a-f]{64}$/.test(schema?.sha256 ?? '') ||
+        typeof schema?.artifact_uri !== 'string' || schema.artifact_uri !== prefix + name + '-v1.0.0.schema.json') {
+      blockers.push(name + ' lacks a complete verified immutable reference.');
     }
+    if (pin?.status !== 'released') blockers.push(name + ' remains provisional.');
+    if (!pin || pin.commit !== entry?.commit || pin.schema_sha256 !== schema?.sha256 || pin.schema_byte_size !== schema?.byte_size ||
+        pin.artifact_uri !== schema?.artifact_uri || pin.media_type !== schema?.media_type || pin.tag !== tag || pin.version !== '1.0.0' ||
+        pin.repository !== 'DefinitelySecureStudio/codex' || pin.contract !== name) blockers.push(name + ' runtime pin differs from the dependency lock.');
   }
-  // Offline readiness checks the reviewed evidence; it is not a substitute for
-  // independently verifying GitHub publication and downloaded asset bytes.
   return { ready: blockers.length === 0, blockers };
 }
+export async function releaseReadiness() {
+  const pkg = JSON.parse(await readFile(new URL('../package.json', import.meta.url)));
+  let lock;
+  try { lock = JSON.parse(await readFile(new URL('../release/contract-lock.json', import.meta.url))); } catch { /* fail closed */ }
+  return checkReleaseInputs({ pkg, lock });
+}
 if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
   const report = await releaseReadiness();
   console.log(JSON.stringify(report, null, 2));

@@ -4,7 +4,7 @@ import Ajv2020 from "ajv/dist/2020.js";
 import addFormats from "ajv-formats";
 import standaloneCode from "ajv/dist/standalone/index.js";
 
-const CONTRACT_COMMIT = "cb76a9343312d0245b388381e318aa58463303cb";
+const CONTRACT_COMMIT = "62e78b606986988518b9dc502c25ae1cd189684a";
 const SCHEMA_SHA256 = "d81e88780511c31099b2dd925f31aff26d6ba75e1173e953b98a37298764b617";
 const sourcePath = process.argv[2];
 const outputPath = process.argv[3] ?? new URL("../src/prompt-sdk/generated/context-package-v1-schema.js", import.meta.url);

@@ -4,7 +4,7 @@ import Ajv2020 from "ajv/dist/2020.js";
 import addFormats from "ajv-formats";
 import standaloneCode from "ajv/dist/standalone/index.js";
 
-const CONTRACT_COMMIT = "dfd31a693674dc03dec4784dcdd1345f647cff1e";
+const CONTRACT_COMMIT = "62e78b606986988518b9dc502c25ae1cd189684a";
 const SCHEMA_SHA256 = "4366665b89d7633974c4be15cac74f754e722b41031f708ca2f825ead892cb8b";
 const sourcePath = process.argv[2];
 const outputPath = process.argv[3] ?? new URL("../src/prompt-sdk/generated/provider-execution-v1-schema.js", import.meta.url);