feat(peer): add strict structured output and Brave evidence

.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "cc",
-  "version": "1.7.1",
+  "version": "1.7.2",
   "description": "Claude Code Plugin for Codex. Run reviews, tracked tasks, and independent Codex-Claude design or research workflows.",
   "author": {
     "name": "CBEPX",

CHANGELOG.md

@@ -2,6 +2,13 @@
 
 ## [Unreleased]
 
+## v1.7.2
+
+### Added
+
+- Require strict mode-specific schemas for peer design, research, and critique output.
+- Allow the exact audited Brave web-search and LLM-context IDs as frozen-manifest-bound Claude web evidence.
+
 ## v1.7.1
 
 ### Changed

README.md

@@ -48,7 +48,7 @@ It follows the shape of [openai/codex-plugin-cc](https://github.com/openai/codex
 Install the fork release from the CBEPX marketplace snapshot:
 
 ```bash
-codex plugin marketplace add CBEPX/cc-plugin-codex --ref v1.7.1
+codex plugin marketplace add CBEPX/cc-plugin-codex --ref v1.7.2
 codex plugin add cc@cbepx
 ```
 
@@ -61,8 +61,8 @@ The optional `npx` helper can install this fork release and enable the required
 ```bash
 CC_PLUGIN_CODEX_MARKETPLACE_NAME=cbepx \
 CC_PLUGIN_CODEX_MARKETPLACE_SOURCE=CBEPX/cc-plugin-codex \
-CC_PLUGIN_CODEX_MARKETPLACE_REF=v1.7.1 \
-npx -y https://github.com/CBEPX/cc-plugin-codex/releases/download/v1.7.1/cc-plugin-codex-1.7.1.tgz install
+CC_PLUGIN_CODEX_MARKETPLACE_REF=v1.7.2 \
+npx -y https://github.com/CBEPX/cc-plugin-codex/releases/download/v1.7.2/cc-plugin-codex-1.7.2.tgz install
 ```
 
 On Windows, prefer the marketplace path or the `npx` helper. The shell-script helper below is POSIX-only.
@@ -180,6 +180,10 @@ $cc:design --retry <workflow-id>
 
 New workflows default to Claude `fable` with `opus` fallback and inherited Codex model at `xhigh` effort. Use `--model`, `--fallback-model`, `--effort`, `--codex-model`, or `--codex-effort` to override them. Repeat `--user-mcp-tool <mcp__server__tool>` for explicitly trusted eligible tools; automatic selection is limited to the smallest relevant eligible set exposed to the active Codex turn. Eligibility records whether trust came from `readOnlyHint` or the audited registry, but does not independently enforce server behavior. Project MCP servers still require `--allow-project-mcp-servers`.
 
+The audited annotationless Brave allowlist contains exactly `mcp__brave-search__brave_web_search` and `mcp__brave-search__brave_llm_context`; other Brave IDs are not eligible through it. A Brave event counts as Claude web evidence only when that exact ID is also in the workflow's frozen selected-tool manifest. The manifest records the selected ID and trust basis, not the provider's behavior: an `@latest` Brave server can still change a tool behind the same ID. Pin a server version when that drift is unacceptable.
+
+Selected Brave MCP servers are external trusted processes/services, not an OS sandbox. Their query or context input can disclose the brief and research terms to the provider; do not send secrets or sensitive material through either tool. The workflow never persists raw MCP configuration or credentials, but that does not remove this upstream disclosure risk.
+
 The stored and rendered workflow shows independent branch states, requested/final models and fallback events, source/tool evidence counts, selected public tool IDs and reasons, checkpoint or final result, and the exact continue/retry command. Raw MCP configuration, environment variables, headers, and credentials are never persisted or rendered. Claude receives no Bash, write, or Agent capability, and only selected MCP servers enter its strict runtime config. Peer turns also require the platform filesystem sandbox, deny unsandboxed commands and reads of canonical Codex/Claude state, persist no Claude transcript, and expose only content-free phase/tool/model-fallback progress before reveal. Native Windows peer execution is unsupported and isolation failures stop with `PEER_ISOLATION_UNAVAILABLE`.
 
 Attempt leases are single-use secrets sent through stdin, while durable state keeps only their digests. A Claude-first memo remains process-local until Codex seals its independent memo. That wait has one absolute 30-minute deadline; retry keeps a committed waiter only while its current linked job is alive, rotates only unfinished reservations, and never rewrites completed payloads. A lost, terminal, or reaped worker becomes retryable, while unresolved process cancellation stays terminal as `cancel_failed`.
@@ -369,7 +373,7 @@ The review gate is an **optional** stop-time hook. When enabled, pressing Ctrl+C
 Install from the fork's marketplace snapshot:
 
 ```bash
-codex plugin marketplace add CBEPX/cc-plugin-codex --ref v1.7.1
+codex plugin marketplace add CBEPX/cc-plugin-codex --ref v1.7.2
 codex plugin add cc@cbepx
 ```
 
@@ -390,8 +394,8 @@ This fork does not install from the upstream Sendbird marketplace. Use the CBEPX
 ```bash
 CC_PLUGIN_CODEX_MARKETPLACE_NAME=cbepx \
 CC_PLUGIN_CODEX_MARKETPLACE_SOURCE=CBEPX/cc-plugin-codex \
-CC_PLUGIN_CODEX_MARKETPLACE_REF=v1.7.1 \
-npx -y https://github.com/CBEPX/cc-plugin-codex/releases/download/v1.7.1/cc-plugin-codex-1.7.1.tgz install
+CC_PLUGIN_CODEX_MARKETPLACE_REF=v1.7.2 \
+npx -y https://github.com/CBEPX/cc-plugin-codex/releases/download/v1.7.2/cc-plugin-codex-1.7.2.tgz install
 ```
 
 After install, run:
@@ -421,7 +425,7 @@ $cc:setup
 Re-run the fork marketplace install flow, pinned to the release you want:
 
 ```bash
-codex plugin marketplace add CBEPX/cc-plugin-codex --ref v1.7.1
+codex plugin marketplace add CBEPX/cc-plugin-codex --ref v1.7.2
 codex plugin add cc@cbepx
 ```
 

internal-skills/peer-runtime/runtime.md

@@ -26,7 +26,7 @@ In short: rerun preflight after installation or restart.
 ## New workflow
 
 1. Resolve routing with `session-routing-context --json`.
-2. Run `mcp-diagnose --json` with the user's exact MCP flags. This actively starts/probes every configured server in scope and can therefore have server-defined side effects. The active Codex controller chooses the smallest relevant subset of eligible exact IDs from their descriptions. Pass those choices as repeated internal `--auto-mcp-tool` values to `peer-create`; Node validates exact IDs and safety only. Eligibility trusts a server's `readOnlyHint` declaration or the audited registry, is not an OS sandbox, and always vetoes `destructiveHint`. With `--no-auto-tools`, choose none automatically. Exact user pins remain exact and still must be eligible.
+2. Run `mcp-diagnose --json` with the user's exact MCP flags. This actively starts/probes every configured server in scope and can therefore have server-defined side effects. The active Codex controller chooses the smallest relevant subset of eligible exact IDs from their descriptions. Pass those choices as repeated internal `--auto-mcp-tool` values to `peer-create`; Node validates exact IDs and safety only. Eligibility trusts a server's `readOnlyHint` declaration or the audited registry, is not an OS sandbox, and always vetoes `destructiveHint`. The annotationless audited registry includes exactly `mcp__brave-search__brave_web_search` and `mcp__brave-search__brave_llm_context`; no other Brave ID is eligible through it. With `--no-auto-tools`, choose none automatically. Exact user pins remain exact and still must be eligible.
 3. Keep a shell-hostile or multiline brief out of argv: normalize it once, write it to an OS temporary file outside the workspace, and use the internal `--brief-file`. Delete that temporary file after `peer-create` returns.
 4. Run `peer-create --mode <mode> --cwd <workspaceRoot> --owner-session-id <ownerSessionId> ... --json`. Preserve public model/MCP flags and controller-selected internal IDs.
 5. `peer-create` has already reserved the Codex memo, Claude memo, and checkpoint attempts atomically. Use its returned `spawnPlan` with built-in `spawn_agent`: spawn exactly two children. For both, pass `fork_turns: "none"` and the returned self-contained message. Do not add parent history.
@@ -47,7 +47,9 @@ Each worker receives only its own raw lease in its spawn message. A raw lease is
 
 The pure Claude forwarder must run exactly one companion command, in the foreground, and return stdout unchanged. It does no repository inspection or reasoning itself. Never use shell backgrounding (`nohup`, detached spawn, or an ampersand operator). Never invoke `codex exec`. If the shell yields a session, poll that same session until exit.
 
-`peer-claude-turn` gives Claude only Read, Glob, Grep, the selected `WebSearch, WebFetch` route, and exact selected MCP tools. The companion enforces `permission-mode=dontAsk`, a strict MCP config, no Bash, and no Agent. It also requires a fail-closed filesystem sandbox: native Windows is unsupported, unsandboxed commands are disabled, the canonical workspace is the only explicit read allowance, and canonical `CODEX_HOME` plus `~/.claude/projects` are denied by both the sandbox and Read permission rules. If the required filesystem sandbox is unavailable or the workspace overlaps protected state, fail closed with `PEER_ISOLATION_UNAVAILABLE` before research can proceed. Selected external MCP servers remain trusted declarations rather than an OS sandbox; the rendered manifest preserves the exact trust basis. Revalidation starts/probes only the servers represented in the frozen selection. It records requested/final/fallback model telemetry and actual public tool-event names.
+`peer-claude-turn` gives Claude only Read, Glob, Grep, the selected `WebSearch, WebFetch` route, and exact selected MCP tools. The companion enforces `permission-mode=dontAsk`, a strict MCP config, no Bash, and no Agent. It also requires a fail-closed filesystem sandbox: native Windows is unsupported, unsandboxed commands are disabled, the canonical workspace is the only explicit read allowance, and canonical `CODEX_HOME` plus `~/.claude/projects` are denied by both the sandbox and Read permission rules. If the required filesystem sandbox is unavailable or the workspace overlaps protected state, fail closed with `PEER_ISOLATION_UNAVAILABLE` before research can proceed. Selected external MCP servers remain trusted declarations rather than an OS sandbox; the rendered manifest preserves the exact trust basis. Revalidation starts/probes only the servers represented in the frozen selection. It records requested/final/fallback model telemetry and actual public tool-event names. A Brave event is web evidence only if its exact ID is one of the two audited IDs and is present in that frozen manifest; an unselected or lookalike Brave ID does not count.
+
+The frozen manifest binds selected tool IDs and their audited eligibility, not a remote provider implementation. An `@latest` Brave server can change behavior behind an unchanged ID, so pin the server when that residual drift is unacceptable. Brave query and LLM-context input are disclosed to the selected external provider; do not send secrets or sensitive brief/context material. Redacting raw MCP configuration and credentials from workflow state does not remove that disclosure risk.
 
 Initial and critique turns are each a fresh Claude turn with `--no-session-persistence`; they never resume or fork a prior session. Tracked progress is content-free until reveal: only phase, tool name, and model-fallback metadata may reach tracked jobs or logs. Text, thinking, tool input, prompt, memo, and terminal payload stay out of tracked state until the trusted reveal transition succeeds.
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "cc-plugin-codex",
-  "version": "1.7.1",
+  "version": "1.7.2",
   "description": "Claude Code Plugin for Codex (CBEPX fork)",
   "type": "module",
   "author": {

schemas/peer-critique-output.schema.json

@@ -0,0 +1,45 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "Peer critique output",
+  "description": "Strict output contract for the peer critique phase.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["content", "repoCitations", "webCitations"],
+  "properties": {
+    "content": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["critique", "agreements", "disagreements", "corrections"],
+      "properties": {
+        "critique": { "type": "string" },
+        "agreements": { "type": "array", "items": { "type": "string" } },
+        "disagreements": { "type": "array", "items": { "type": "string" } },
+        "corrections": { "type": "array", "items": { "type": "string" } }
+      }
+    },
+    "repoCitations": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["path", "line"],
+        "properties": {
+          "path": { "type": "string" },
+          "line": { "type": "integer" }
+        }
+      }
+    },
+    "webCitations": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["path", "line"],
+        "properties": {
+          "path": { "type": "string" },
+          "line": { "type": "integer" }
+        }
+      }
+    }
+  }
+}

schemas/peer-design-output.schema.json

@@ -0,0 +1,46 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "Peer design output",
+  "description": "Strict output contract for an initial peer design memo.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["content", "repoCitations", "webCitations"],
+  "properties": {
+    "content": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["alternatives", "tradeoffs", "decisionDrivers", "recommendation", "gaps"],
+      "properties": {
+        "alternatives": { "type": "array", "items": { "type": "string" } },
+        "tradeoffs": { "type": "array", "items": { "type": "string" } },
+        "decisionDrivers": { "type": "array", "items": { "type": "string" } },
+        "recommendation": { "type": "string" },
+        "gaps": { "type": "array", "items": { "type": "string" } }
+      }
+    },
+    "repoCitations": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["path", "line"],
+        "properties": {
+          "path": { "type": "string" },
+          "line": { "type": "integer" }
+        }
+      }
+    },
+    "webCitations": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["path", "line"],
+        "properties": {
+          "path": { "type": "string" },
+          "line": { "type": "integer" }
+        }
+      }
+    }
+  }
+}

schemas/peer-research-output.schema.json

@@ -0,0 +1,46 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "Peer research output",
+  "description": "Strict output contract for an initial peer research memo.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["content", "repoCitations", "webCitations"],
+  "properties": {
+    "content": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["findings", "sourceQuality", "contradictions", "confidence", "gaps"],
+      "properties": {
+        "findings": { "type": "array", "items": { "type": "string" } },
+        "sourceQuality": { "type": "string" },
+        "contradictions": { "type": "array", "items": { "type": "string" } },
+        "confidence": { "type": "string" },
+        "gaps": { "type": "array", "items": { "type": "string" } }
+      }
+    },
+    "repoCitations": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["path", "line"],
+        "properties": {
+          "path": { "type": "string" },
+          "line": { "type": "integer" }
+        }
+      }
+    },
+    "webCitations": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["path", "line"],
+        "properties": {
+          "path": { "type": "string" },
+          "line": { "type": "integer" }
+        }
+      }
+    }
+  }
+}