Finish Codex productization, self-evolution, night mode, and modern README

[xicv]

Summary

This branch now applies the full improvement set from the review in one draft PR, plus follow-up audit/self-evolution hardening, a comic-style icon, $coco-queue, $coco-night, and a modern README rewrite.

Daily Codex.app productization

• Added root AGENTS.md with durable repo/agent guidance, commands, safety invariants, and merge expectations.
• Added .codex/config.toml.example for local Codex MCP wiring.
• Added docs/codex-daily-workflow.md for the daily Codex.app operating path.
• Added coco setup codex with dry-run/apply support for Codex MCP config + skill sync.
• Exposed coco-mcp as a package binary and aligned Node support to Node >=20.
• Added privacy and platform support docs.

Queue and night workflows

• Added $coco-queue to inspect the next ready backlog task without implementing.
• Added $coco-night as a safe one-task overnight workflow: queue + loop, no daemon, no batch, stops at merge-gate unless explicitly invoked with --auto.
• Documented $coco-night --plan-next for the case where the queue is empty and the user wants coco to plan one small next task first.
• Updated AGENTS.md, docs/codex-daily-workflow.md, command registry, and README with queue/night usage and safety rules.

Referee safety hardening

• Added schema validation/version stamping for persisted .coco/goals/*.json state.
• Added configurable goal base branch resolution through workflow.baseBranch, repo default detection, or explicit --base.
• Added collision-safe goal IDs for repeated same-minute objectives.
• Hardened verify.testCommand changes: merge now requires explicit --ack-verify-policy-change; auto-merge falls back to the human path.
• Made auto-merge user globs additive by default, with explicit replacement flags.
• Synced the MCP server version with the package version.

Audit-backed self-evolution

• Added audit record schema validation and detailed invalid-line reporting.
• Added coco audit validate for shape + cross-record invariant checks before self-improvement trusts the corpus.
• Added structured, redacted human feedback via coco audit feedback --kind ... --rating ... --tags ....
• Extended coco audit report with audit validity and feedback summaries.
• Extended coco improve digest with audit validity, goal-quality feedback, status-clarity feedback, and implementation-quality diagnostics.
• Updated $coco-improve so self-evolution starts with audit validation and follows “no eval, no improvement.”
• Added docs/self-evolution.md to document the trace → feedback → digest → eval-backed proposal loop.

Rich loop status / edge handling

• Extended goalStatus with base/branch/currentBranch, warning level, edge metadata, recovery commands, and a stable progress key.
• Enriched Codex.app progress cards with Branch, Risk, Recovery, and richer edge-state details.
• Added progress tests for wrong-branch recovery and merge-gate cards.

Branding and README

• Added assets/coco-icon.svg, a cuter comic-style coco mascot icon.
• Rewrote README into a modern, cleaner product overview with practical examples: vague intent, queue, loop, night mode, audit feedback, and self-improvement.

Extensibility / eval foundations

• Added a lightweight command descriptor registry exposed by coco commands.
• Added deterministic coco eval safety-regression fixtures, including audit invalidity detection.
• Included pnpm eval in pnpm ci and GitHub Actions.

Verification

CI passed on the current head (409a53b7ae834d6e76c1a6288d70c4ba947c0b60) with:

pnpm typecheck
pnpm test
pnpm eval
pnpm build

Matrix: Node 22/24 on Ubuntu and macOS.

Research/design basis

• Codex guidance: use AGENTS.md, reusable skills, MCP, tests/review, and only turn stable repeated workflows into automations.
• Skills define the method; Codex Automations define the schedule.
• Recent agent-safety research supports strict scope bounds, one-task execution, baseline-aware verification, and human review/merge gates.

Review focus

• Confirm $coco-night should stay skill-only for now rather than adding a scheduler/daemon.
• Confirm $coco-night --auto is acceptable as per-goal forward consent, still risk-gated.
• Confirm $coco-queue is the right user-facing name for next-task triage.
• Confirm Node >=20 remains the intended package support floor. CI runs Node 22/24 because GitHub-hosted Actions runners reject Node 20 setup without an insecure compatibility flag.
• Confirm coco setup codex defaults are right for your Codex.app setup (~/.codex/config.toml, ~/.agents/skills).
• Confirm the new README is clear enough for first-time users.

---

Review hardening (follow-up)

A follow-up production-quality pass found that the CI gate was false-green and
fixed three real defects plus documentation drift. pnpm run ci now passes locally
(327 tests, 8 eval fixtures, build) on Node 22 and the workflow now actually verifies.

Root cause — false-green CI. pnpm ≥11 ships a built-in pnpm ci command
(clean-install) that shadows the package ci script. The workflow and docs ran
pnpm ci, which silently reinstalled instead of running typecheck/test/eval/build —
so GitHub Actions was green without ever running the suite. Switched the workflow and
all docs to pnpm run ci.

Defects the false-green hid:

1. Schema false-block (58 tests). The fingerprint tracker returns key:'' as the
   "no active failure" sentinel, but the new goalSchema required a non-empty key, so
   any goal persisted with a reset failure-loop failed to reload. Loosened the top-level
   key (history entries stay non-empty) and added a coco eval reload-guard fixture.
2. Broken eval fixture. fingerprint-loop-escalates asserted escalate-human but
   omitted the plan event, so nextAction short-circuited to plan and never tested
   escalation. Added the missing precondition.
3. Stale improve test. The thin-history test asserted every signal is
   insufficient-data; the added audit-validity signal is intentionally not
   sample-gated. Rewrote the assertion around the real invariant (nothing actionable on
   a thin history) while keeping audit-validity non-actionable.

Also: fixed a $coco audit validate README typo (CLI command, no $ skill prefix).

Verified unchanged: referee invariants, propose-only self-improvement guards,
$coco-night one-task/merge-gate bounds, $coco-queue read-only behavior, new skills
published via files: ["dist","skills"], and the old PNG icons retained as fallbacks.