rldyourmnd · Oct 13, 2026 · Oct 13, 2026 · Oct 13, 2026 · Oct 13, 2026
diff --git a/.gds/bundle.lock.yaml b/.gds/bundle.lock.yaml
@@ -4,12 +4,12 @@ schema_version: 1
 bundle:
   version: "0.9.7-dev"
   release_sequence: 0
-  source_tree_digest: "sha256:ded7c4bf86c660a0c0a3836a58894b9c89499f56b04df854dfae7b45a1953b2d"
-  digest: "sha256:64bad36f22023c1fbb9cca7c53ec6280cb8d19da5866b038fd272d11fb1e17f7"
+  source_tree_digest: "sha256:55fd8cbc5bff26a6c719ed604c7e8124b88d5d584e73951ce0ad617eae831ead"
+  digest: "sha256:3d95d9514fbf5681ceadd059e8e0614b3a54c70f00801608e5fec7706efa1af7"
 
 projection:
-  input_digest: "sha256:cbb704aacb737d289beb059e60854fea90cbe93abac61a38c2cc872efe2fae73"
-  output_digest: "sha256:64176f613336b14946af312b0a02eb5ef35f713302e0088913c844c6dc8e19e4"
+  input_digest: "sha256:f27f694d156d4a166d3428152981b6928f21a100debf753764b2e85203a9d9a1"
+  output_digest: "sha256:f702b796c054c54bc8a0c47c14ce60c1d7257b10b777715a3872904facbe7b40"
   files:
     - path: ".gds/compiled-policy.json"
-      digest: "sha256:83aae3d9096c04f6a8eeb1b57dcea9a904a0ec125afa0a2cb551f8bf3bded3c3"
+      digest: "sha256:2a54bd5cc7d4dd38292e47e8d03ea2ca2b6d567f7182557d274f2d810e1b207c"
diff --git a/.gds/compiled-policy.json b/.gds/compiled-policy.json
@@ -3,7 +3,7 @@
   "compiled_policy": {
     "repository_id": "repo_01M31VT30CX00DFPH82QNQ0ZDH",
     "bundle_version": "0.9.7-dev",
-    "digest": "sha256:38b969c5141a57461038070a95372a849880e94b289292515605c6fa368b2810"
+    "digest": "sha256:5536ecfb4dcc2e890dc81b1eeb4c6a82bc69d43e7f38dda435a0644060b54ff7"
   },
   "sources": [
     {
@@ -15,12 +15,12 @@
       "digest": "sha256:0ea560cc2653184e07c6f744455f745a34f764a5c0dcda55f2dc76fa5296f2f0"
     },
     {
-      "id": "opennetwork-default",
+      "id": "organization-default",
       "tier": "owner",
-      "priority": 110,
+      "priority": 100,
       "distribution": "public",
-      "path": "policies/owners/opennetwork-default.yaml",
-      "digest": "sha256:096b9781b05c37fd5b440a171a6e5599cda3ef77983db72bf9c68d3d40b34ab4"
+      "path": "policies/owners/organization-default.yaml",
+      "digest": "sha256:fe271769a3e50404a5073ca6d045ad19f784069e7d6fdceab80254c06781ed55"
     }
   ],
   "effective": {
@@ -381,10 +381,10 @@
       "operation": "set"
     },
     "/effective/rollout/mode": {
-      "source": "opennetwork-default",
+      "source": "organization-default",
       "tier": "owner",
-      "priority": 110,
-      "file": "policies/owners/opennetwork-default.yaml",
+      "priority": 100,
+      "file": "policies/owners/organization-default.yaml",
       "operation": "set"
     },
     "/effective/security/external_write_requires_approval": {

diff --git a/.gds/repository.yaml b/.gds/repository.yaml
@@ -1,78 +1,71 @@
 schema_version: 1
-
 repository:
-  id: "repo_01M31VT30CX00DFPH82QNQ0ZDH"
-  display_name: "hack-setup"
+  id: repo_01M31VT30CX00DFPH82QNQ0ZDH
+  display_name: hack-setup
   roles:
-    - "project"
-    - "superproject"
-  lifecycle: "active"
-
+  - project
+  - superproject
+  lifecycle: active
 provider:
-  type: "github"
-  installation: "installation:github-opennetwork"
+  type: github
+  installation: installation:github-nddev-technocracy-opennetwork
   repository_id: 1377434323
-  owner: "NDDev-OpenNetwork"
-  name: "hack-setup"
-
+  owner: NDDev-Technocracy-OpenNetwork
+  name: hack-setup
+  aliases:
+  - owner: NDDev-OpenNetwork
+    name: hack-setup
+  - owner: NDDev-Technocracy-Archive
+    name: hack-setup
 classification:
   portfolios:
-    - "portfolio:opennetwork-projects"
-  visibility_contract: "public"
-  data_classification: "public"
-
+  - portfolio:nddev-technocracy-opennetwork
+  visibility_contract: public
+  data_classification: public
 product:
-  purpose: >-
-    The Saint Tibo hackathon operating setup: the pinned Codex toolchain,
-    plugins, standards, lane enforcement and server deploy watchers for the
-    three-person team. It carries toolchain and instructions, not product
-    code; the product skeleton is consumed as the `product/vibestrap`
-    submodule.
+  purpose: Shared agent setup and reproducible development tooling for hackathon teams.
+    Codex project surfaces and pinned toolchain.
   capabilities:
-    - "pinned Codex CLI, models, MCP servers, hooks and plugin marketplace"
-    - "lane enforcement, merge gate and hack-mode hooks for worker threads"
-    - "server-side pull deploy watchers for dev and prod"
+  - pinned Codex CLI, models, MCP servers, hooks and plugin marketplace
+  - lane enforcement, merge gate and hack-mode hooks for worker threads
+  - server-side pull deploy watchers for dev and prod
   entrypoints:
-    - change: "what this repository is and what it may do"
-      path: ".gds/repository.yaml"
-    - change: "the operating contract every session loads"
-      path: "AGENTS.md"
-    - change: "toolchain and product stack pins"
-      path: "build"
-    - change: "deploy watcher kit for the product repository"
-      path: "install/deploy"
-
+  - change: what this repository is and what it may do
+    path: .gds/repository.yaml
+  - change: the operating contract every session loads
+    path: AGENTS.md
+  - change: toolchain and product stack pins
+    path: build
+  - change: deploy watcher kit for the product repository
+    path: install/deploy
 policy:
   profiles:
-    - "repository-default"
-    - "opennetwork-default"
-  rollout_ring: "standard"
-
+  - repository-default
+  - organization-default
+  rollout_ring: standard
 git:
-  default_branch: "main"
-  integration: "pull-request"
-  branch_model: "task-branches"
-  handoff_pr: "preferred"
-  cleanup: "merged-only"
-
+  default_branch: main
+  integration: pull-request
+  branch_model: task-branches
+  handoff_pr: preferred
+  cleanup: merged-only
 agent:
-  context_profile: "project-default"
+  context_profile: project-default
   generated_agents: false
   serena:
     enabled: false
     provenance_required: false
-
 verification:
   commands:
-    test: ["just check"]
-    full: ["just gate"]
+    test:
+    - just check
+    full:
+    - just gate
   required:
-    - "test"
-
+  - test
 release:
-  mode: "none"
-
+  mode: none
 relationships:
-  - type: "git-submodule-consumer"
-    target: "repo_01M31VT2VXJ1V8S1SMKVZKHD2W"
-    gitmodules_name: "product/vibestrap"
+- type: git-submodule-consumer
+  target: repo_01M31VT2VXJ1V8S1SMKVZKHD2W
+  gitmodules_name: product/vibestrap
diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
@@ -212,7 +212,7 @@ jobs:
           git -C "$work" push -q /tmp/upstream.git HEAD:dev
           sudo touch /opt/hack-app/.env
           want=$(git -C "$work" rev-parse HEAD)
-          for i in $(seq 1 24); do
+          for _ in $(seq 1 24); do
             sudo test -f /opt/hack-app/.deployed-sha && break
             sleep 5
           done

diff --git a/.gitleaksignore b/.gitleaksignore
@@ -0,0 +1,6 @@
+# Official Telegram Ed25519 verification PUBLIC keys, not credentials. See https://core.telegram.org/bots/webapps#validating-data-for-third-party-use.
+# Fingerprints suppress only these reviewed historical findings; future findings remain enabled.
+7474f8e1c1f61b3bb910c1dc6a63a7517b86514a:build/stack-pin.json:generic-api-key:430
+7474f8e1c1f61b3bb910c1dc6a63a7517b86514a:build/stack-pin.json:generic-api-key:431
+fff17cd387b668042ee1e4a54aa741ed5a44a4af:devin-setup/build/stack-pin.json:generic-api-key:782
+fff17cd387b668042ee1e4a54aa741ed5a44a4af:devin-setup/build/stack-pin.json:generic-api-key:783
diff --git a/.serena/memories/CORE-01-INDEX.md b/.serena/memories/CORE-01-INDEX.md
@@ -42,7 +42,7 @@ Index durable knowledge for the Codex 0.157.1 team setup repository. No applicat
 
 ## Current Behavior
 
-Author remote is `NDDev-Archive/hack-setup`. Later working remote is `BAITC-Hacks/hack-a58598e0-saint-tibo` and is not pushed unless the owner asks. `./setup --member <name>` installs member identity + Codex + Node/bun/uv/Python/`just` + all five plugins (module 15 derives git identity from the authenticated `gh` login — wrong login fails the install). `devin-setup/` is the self-contained Devin CLI twin (own entries, checker, CI jobs). Web typescript is only `7.0.2`. Codex session models are `gpt-6-astra` / `gpt-6-sol` at `xhigh`, window `872000` / compact `700000`. Codex subagents are off. Setup owner stream is Danil. This public repo may land setup commits on `main` when Danil asked. The catalogue and layer skills exist. Product trees do not. All GitHub issues are closed as of 2026-09-21.
+Author remote is `NDDev-Technocracy-OpenNetwork/hack-setup`. Later working remote is `BAITC-Hacks/hack-a58598e0-saint-tibo` and is not pushed unless the owner asks. `./setup --member <name>` installs member identity + Codex + Node/bun/uv/Python/`just` + all five plugins (module 15 derives git identity from the authenticated `gh` login — wrong login fails the install). `devin-setup/` is the self-contained Devin CLI twin (own entries, checker, CI jobs). Web typescript is only `7.0.2`. Codex session models are `gpt-6-astra` / `gpt-6-sol` at `xhigh`, window `872000` / compact `700000`. Codex subagents are off. Setup owner stream is Danil. This public repo may land setup commits on `main` when Danil asked. The catalogue and layer skills exist. Product trees do not. All GitHub issues are closed as of 2026-09-21.
 
 ## Open Items (durable)
 

diff --git a/README.md b/README.md
@@ -1,5 +1,16 @@
+<!-- nddev-public-hackathon -->
 # hack-setup
 
+Shared agent setup and reproducible development tooling for hackathon teams. Codex project surfaces and pinned toolchain.
+
+[NDDev OpenNetwork](https://github.com/NDDev-Technocracy-OpenNetwork) · [Repository](https://github.com/NDDev-Technocracy-OpenNetwork/hack-setup)
+
+This repository is a hackathon prototype or supporting tool. Follow the project-specific setup below; cloud integrations require your own configuration and credentials.
+
+---
+
+## hack-setup
+
 Shared Codex `0.157.1` setup for a three-person team that will later work in
 one private repo: `BAITC-Hacks/hack-a58598e0-saint-tibo`.
 
@@ -24,7 +35,7 @@ cd hack-setup
 Windows (PowerShell):
 
 ```powershell
-git clone https://github.com/NDDev-Archive/hack-setup.git
+git clone https://github.com/NDDev-Technocracy-OpenNetwork/hack-setup.git
 cd hack-setup
 powershell -NoProfile -ExecutionPolicy Bypass -File .\setup.ps1 --member <danil|ivan|artem>
 . .\install\env.ps1

diff --git a/devin-setup/build/stack-pin.json b/devin-setup/build/stack-pin.json
@@ -195,7 +195,7 @@
         "SessionEnd",
         "Interrupt"
       ],
-      "note": "project-layer hooks; plugin manifests cannot carry hooks in 0.155.1 (plugin_hooks feature removed, openai/codex#39895). hack_mode.py: SessionStart (no matcher = every source: startup|resume|clear|compact) injects the ruleset \u2014 a forked/edited thread re-fires startup and DUPLICATES context (upstream #39951); compact sources queue until the next user turn (#28736); UserPromptSubmit emits reminder + git/issues STATUS; PreToolUse matcher 'Bash|exec_command|write_stdin|shell' (0.155.1 sends tool_name 'exec_command' with tool_input.cmd for exec, 'write_stdin' with .chars, 'Bash' is the PostToolUse normalized name) denies pushes whose tail names a protected branch, --all/--mirror, bare/HEAD pushes when HEAD is protected, gh pr merge, and gh api merge endpoints, unless the checkout carries .agent/orchestrator (lane law activates via tracked .codex/lanes.json); PostToolUse reminds ship-verify after git push; SessionEnd and Interrupt append .agent/session-log.ndjson (their timeout caps at 3s). commandWindows mirrors every command for hosts without python3. Non-managed hooks run only when a hooks.state trusted_hash in the USER config layer matches the definition hash \u2014 repair/module 20 write the managed block (ADR 0016). compact_prompt is ignored under remote compaction (openai/codex#34428) \u2014 SessionStart re-injection is the real channel; Codex App threads can shadow project developer_instructions (#33238). additionalContext only works on PreToolUse/PostToolUse/SessionStart/UserPromptSubmit/SubagentStart. Standalone 'normal mode'/'hack ultra'/'hack mode' toggles per-project state under ~/.codex/hack-mode-<repo>.json"
+      "note": "project-layer hooks; plugin manifests cannot carry hooks in 0.157.1 (plugin_hooks feature removed, openai/codex#39895). hack_mode.py: SessionStart (no matcher = every source: startup|resume|clear|compact) injects the ruleset \u2014 a forked/edited thread re-fires startup and DUPLICATES context (upstream #39951); compact sources queue until the next user turn (#28736); UserPromptSubmit emits reminder + git/issues STATUS; PreToolUse matcher 'Bash|exec_command|write_stdin|shell' (0.157.1 sends tool_name 'exec_command' with tool_input.cmd for exec, 'write_stdin' with .chars, 'Bash' is the PostToolUse normalized name) denies pushes whose tail names a protected branch, --all/--mirror, bare/HEAD pushes when HEAD is protected, gh pr merge, and gh api merge endpoints, unless the checkout carries .agent/orchestrator (lane law activates via tracked .codex/lanes.json); PostToolUse reminds ship-verify after git push; SessionEnd and Interrupt append .agent/session-log.ndjson (their timeout caps at 3s). commandWindows mirrors every command for hosts without python3. Non-managed hooks run only when a hooks.state trusted_hash in the USER config layer matches the definition hash \u2014 repair/module 20 write the managed block (ADR 0016). compact_prompt is ignored under remote compaction (openai/codex#34428) \u2014 SessionStart re-injection is the real channel; Codex App threads can shadow project developer_instructions (#33238). additionalContext only works on PreToolUse/PostToolUse/SessionStart/UserPromptSubmit/SubagentStart. Standalone 'normal mode'/'hack ultra'/'hack mode' toggles per-project state under ~/.codex/hack-mode-<repo>.json"
     },
     "deploy": {
       "model": "server-side pull watcher, no GitHub admin rights needed",
@@ -243,7 +243,7 @@
       },
       "context7": {
         "url": "https://mcp.context7.com/mcp",
-        "note": "keyless by default \u2014 Codex 0.155.1 hard-errors when a bearer_token_env_var is unset (rmcp_client.rs), so no env ref is declared; hosts wanting higher limits export CONTEXT7_API_KEY and add bearer_token_env_var in their USER config layer"
+        "note": "keyless by default \u2014 Codex 0.157.1 hard-errors when a bearer_token_env_var is unset (rmcp_client.rs), so no env ref is declared; hosts wanting higher limits export CONTEXT7_API_KEY and add bearer_token_env_var in their USER config layer"
       },
       "grep": {
         "url": "https://mcp.grep.app",