Your Tests Pass. So Does the Wrong Code

A green test suite tells you one thing: the implementation you wrote satisfies the tests you wrote. It doesn't tell you whether the version one small edit away would pass too. If swapping master) Prepare TestSlop for public release da6f88c Build attention-first Evil Twin OSS artifact 37f99a6 Complete POC-02 validation archive d5b635b feat(poc-02): behavioural alternatives, distinguishing inputs, sandboxed verification 894e31e docs(poc-01): PIVOT report, README repositioning, architecture update c2e237b feat(poc-01): coverage reporting, string expected-chasing, agent experiments 691535a feat(poc-01): layered test pairing and chai assertion support 03ba001 docs: POC-00 report, README, architecture; fix build output layout cf6713f feat: rule hardening from held-out repository history 230fa41 feat: evaluation corpus and evidence-driven rule tightening HEAD 163f0a4dec21a1d2855242dcf2e4e3f918235be7 REMOTES GITHUB_REPOSITORY {"default_branch":"main","full_name":"hyukvoid/TestSlop","html_url":"https://github.com/hyukvoid/TestSlop","private":true} REMOTE_REFS The local tree is clean at the expected sanitized commit. GitHub confirms the repository is private, its canonical casing is hyukvoid/TestSlop , and git ls-remote returned no refs, so I’m adding that origin and making the requested normal initial push. const r=await tools.exec_command({cmd:"git remote add origin https://github.com/hyukvoid/TestSlop.git","sandbox_permissions":"require_escalated","justification":"Add the verified canonical URL as o... Script completed Wall time 1.8 seconds Output: const r=await tools.exec_command({cmd:"git push -u origin master","sandbox_permissions":"require_escalated","justification":"Push the sanitized master branch normally to the verified private, empty... Script completed Wall time 8.6 seconds Output: {"chunk_id":"604136","wall_time_seconds":7.0600971,"exit_code":0,"original_token_count":33,"output":"branch 'master' set up to track 'origin/master'.\nTo https://github.com/hyukvoid/TestSlop.git\n * [new branch] master -> master\n"} const script=String.raw$ErrorActionPreference='Stop' 'STATUS'; git status --short --branch 'REMOTE'; git remote -v 'LOG'; git log --oneline --decorate -5 'HEAD'; $head = (git rev-parse HEAD).Trim(... Script completed Wall time 15.0 seconds Output: STATUS ## master...origin/master REMOTE origin https://github.com/hyukvoid/TestSlop.git (fetch) origin https://github.com/hyukvoid/TestSlop.git (push) LOG 163f0a4 (HEAD -> master, origin/master) Prepare TestSlop for public release da6f88c Build attention-first Evil Twin OSS artifact 37f99a6 Complete POC-02 validation archive d5b635b feat(poc-02): behavioural alternatives, distinguishing inputs, sandboxed verification 894e31e docs(poc-01): PIVOT report, README repositioning, architecture update HEAD 163f0a4dec21a1d2855242dcf2e4e3f918235be7 LS_REMOTE 163f0a4dec21a1d2855242dcf2e4e3f918235be7 HEAD 163f0a4dec21a1d2855242dcf2e4e3f918235be7 refs/heads/master REMOTE_HEAD_MATCH=verified API {"html_url":"https://github.com/hyukvoid/TestSlop/commit/163f0a4dec21a1d2855242dcf2e4e3f918235be7","sha":"163f0a4dec21a1d2855242dcf2e4e3f918235be7"} GitHub now tracks the exact sanitized HEAD, and the working tree is clean. I’m checking GitHub’s rendered README and its linked files next; I’ll use the computer-use skill for the first-screen view, then separately verify the repository files and privacy strings through the authenticated API. const r=await tools.exec_command({cmd:"Get-Content ' \\.codex\\plugins\\cache\\openai-bundled\\computer-use\\26.915.31945\\skills\\computer-use\\SKILL.md'","sandbox_permissions":"require_... Script completed Wall time 1.9 seconds Output: --- name: computer-use description: Control Windows apps from ChatGPT --- # Computer Use Use this skill to automate the UI of Microsoft Windows apps. It uses SendInput, UI Automation, and Windows.Graphics.Capture screenshots that work even when windows are occluded. If this plugin is available, read this entire SKILL.mdonce before Windows automation work, before saying Computer Use is unavailable, and before falling back to other Windows automation. Start with the directions in the Initialize section below. Read these bundled Markdown files relative to thisSKILL.mdwhen you need information about the specific topic they cover: -../../docs/guidance.md: core runtime behavior, target-window workflow, screenshot handling, and recovery guidance. You MUST read this before controlling Windows apps. - ../../docs/api.md: full skyAPI reference. Read this when you need method signatures or object shapes. -../../docs/confirmations.md: you MUST read this before deciding whether a Windows UI action needs confirmation ## Initialize The bundled cua_node @oai/skypackage is the core entry point for Computer Use. Import it directly by package name from the JavaScript session. Do not spawncodex-computer-use.exe, search for the helper executable, or build a custom helper protocol client. Run this once per fresh node_replJavaScript session: ```js if (!globalThis.sky) { const { sky } = await import("@oai/sky"); globalThis.sky = sky; } ``` const r=await tools.exec_command({cmd:"Get-Content ' \\.codex\\plugins\\cache\\openai-bundled\\computer-use\\26.915.31945\\docs\\guidance.md'; Get-Content ' \\.codex\\plugins\\c... Script completed Wall time 1.9 seconds Output: ## node_repl + @oai/sky - Usenode_replJavaScript for all Computer Use actions. - Thenode_replstate persists across calls. Store cross-cell values onglobalThis; top-level constandletnames cannot be redeclared by later retries. - For text output, callnodeRepl.write(...)with a string. UseJSON.stringify(...)for objects. ## Workflow ### Initialize target selection Run the Initialize setup cell fromSKILL.mdfirst. Then list apps and choose the target from returned app and window objects: ```js globalThis.apps = await sky.list_apps(); nodeRepl.write(JSON.stringify(apps, null, 2)); ``` Never reconstruct an app or window from guessed fields. Do not callget_window, activate_window, or any input method until selection has produced exactly one returned window. ```js { function escapeRegExp(value) { return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"); } function returnedWindowSummary(window) { return { id: window.id, app: window.app, title: window.title, }; } function requireUniqueWindow(windows, label) { if (windows.length !== 1) { nodeRepl.write( Returned candidate windows:\n${JSON.stringify(windows.map(returnedWindowSummary), null, 2)}, ); throw new Error(Expected exactly one target window for ${label}; found ${windows.length}); } return windows[0]; } globalThis.apps = await sky.list_apps(); globalThis.targetApp = apps.find((app) => app.id === " "); if (!targetApp) throw new Error("Target app was not returned by list_apps"); const targetAppId = targetApp.id; if (targetApp.windows.length === 0) { await sky.launch_app({ app: targetApp.id }); globalThis.apps = await sky.list_apps(); globalThis.targetApp = apps.find((app) => app.id === targetAppId); } if (!targetApp?.windows.length) { throw new Error("Target app did not expose a window after launch"); } const windowTitleHint = " "; const candidateWindows = windowTitleHint === " " ? targetApp.windows : targetApp.windows.filter((window) => new RegExp(^${escapeRegExp(windowTitleHint)}$, "i").test(window.title ?? ""), ); const returnedWindow = requireUniqueWindow(candidateWindows, targetApp.id); globalThis.targetWindow = await sky.get_window({ id: returnedWindow.id, app: returnedWindow.app, }); await sky.activate_window({ window: targetWindow }); globalThis.state = await sky.get_window_state({ window: targetWindow }); globalThis.targetWindow = state.window; } ``` Use list_windows()when inspecting currently open windows or recovering a known running app. If the intended app is absent fromlist_apps, launch it with an explicit .exepath or.exeprocess identifier, refreshlist_apps()orlist_windows(), filter to the intended returned windows, and stop unless the filtered list has exactly one window. Escape Windows path backslashes in JavaScript strings, for example await sky.launch_app({ app: " \build\MyApp.exe" });`. ### Act and refresh Use a two-cell loop for state-derived inputs: observe and stop, inspect the result, then perform exactly one action and refresh immediately. Element indexes, screenshot IDs, and coordinates are valid only for the observation that produced them. Interleaving or retry requires re-observation. Accessibility path, cell 1: observe and inspect. js globalThis.state = await sky.get_window_state({ window: targetWindow, include_screenshot: false, include_text: true, }); globalThis.targetWindow = state.window; nodeRepl.write(String(state.accessibility?.tree || state.accessibility?.document_text || "")); Stop here and inspect the emitted tree before choosing an index. Accessibility path, cell 2: one action and refresh. js { const observation = globalThis.state; if (observation?.accessibility == null) { throw new Error("No accessibility observation; reobserve before acting"); } const elementIndex = 12; // Replace with one index from the printed accessibility tree. globalThis.state = null; try { await sky.click({ window: observation.window, element_index: elementIndex }); globalThis.state = await sky.get_window_state({ window: observation.window, include_screenshot: true, include_text: true, }); } catch (error) { throw new Error("Input or refresh outcome is unknown; reobserve before retrying", { cause: error, }); } globalThis.targetWindow = state.window; nodeRepl.write(String(state.accessibility?.tree || state.accessibility?.document_text || "")); } Coordinate path, cell 1: observe and inspect. ```js globalThis.state = await sky.get_window_state({ window: targetWindow, include_screenshot: true, include_text: false, }); globalThis.targetWindow = state.window; nodeRepl.write("Inspect the displayed screenshot, then run the coordinat