diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..d96394e
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,13 @@
+# Security-only: keine version-updates (limit 0), Security-Fixes gruppiert
+version: 2
+updates:
+ - package-ecosystem: "pip"
+ directory: "/"
+ schedule:
+ interval: "weekly"
+ open-pull-requests-limit: 0
+ groups:
+ security:
+ applies-to: security-updates
+ patterns:
+ - "*"
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 15bb9ce..8d1f945 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,16 @@ All notable changes to this project are documented here.
## Unreleased
+- Software Pipeline Wartung, Universal Launcher, Standalone Executable, Terminal Workflow Asset, Dependabot & Contract Test Expansion (SOFTWARE_ICONS_WARTUNG_EXE_DOCU_GITHUB) on 2026-11-08:
+ - Preserved strict version freeze discipline per T-20260920-167562623 (version 1.1.6 unchanged across all runtime manifests, zero version bump).
+ - Deployed universal Windows batch launcher `START.bat` supporting compiled standalone executable priority (`dist\CodexSafeStart.exe`, fallback to system path `C:\_Local_DEV\codex-safe-start\bin\CodexSafeStart.exe`), full CLI argument pass-through (`%*`), and unprivileged fallback to Python standard launchers (`pythonw`, `py -3`, `python`).
+ - Compiled and verified fresh standalone Windows binary `dist\CodexSafeStart.exe` (63.5 MB) via `build_exe.py` (PyInstaller 6.21.0) with embedded application icon (`assets/codex_safe_start.ico`), pystray integration, and user-mode desktop execution.
+ - Authored dark-mode vector asset `assets/terminal-workflow.svg` (880x520) visualizing the 5-phase startup gating lifecycle, atomic snapshot staging, rate-limited batch release queue, and local web dashboard.
+ - Added GitHub Governance specification `.github/dependabot.yml` configured for weekly pip security updates and grouped automated vulnerability patches.
+ - Synchronized real-measurement test badges across `README.md` and `README_de.md`: updated pytest badge to 201 passed | 100% green (201 bestanden | 100% grün) and audit recency badge to `Last--Checked-2026--11--08`.
+ - Updated machine-readable discovery in `llms.txt` (Last checked: 2026-11-08, 201+ pytest tests passed baseline, `START.bat` and `CodexSafeStart.exe` documented).
+ - Expanded automated contract test suite in `tests/test_version_metadata.py`: added `test_start_bat_launcher`, `test_dependabot_configuration`, `test_terminal_workflow_asset_exists`, and updated `test_badges_recency_and_test_count_20261102` (full test suite expanded to 201 passed, 1 skipped, 100% green). [G 2026-11-08]
+
- Discoverability, Real-Measurement Test Badges (198 passed | 100% green), Level 1 SBOM Stand 2026-11-02 Re-Audit & Contract Test Expansion (GITHUBBOT_ONE_REPO_MARKETING_AND_DESIGN / Pfad B) on 2026-11-02:
- Preserved strict version freeze discipline per T-20260920-167562623 (version 1.1.6 unchanged across all runtime manifests, zero version bump).
- Synchronized real-measurement test badges across README.md and README_de.md: updated pytest badge to 198 passed | 100% green (198 bestanden | 100% grün), audit recency to 2026--11--02, and third-party license audit to (2026--11--02).
diff --git a/README.md b/README.md
index f596b5f..8224a0a 100644
--- a/README.md
+++ b/README.md
@@ -6,19 +6,23 @@ Unofficial Windows startup gate for Codex Desktop automations and catch-up pacin
+
+ 
+
+
- 
+ 
-success.svg)
- 
+ 
@@ -318,6 +322,10 @@ Safe Start for Codex features a cohesive visual design tailored for developer de
+
+
+
+
- **Protective Sleeve Motif:** The brand identity illustrates a glowing, crystal-clear protective sleeve enveloping the Codex typography, symbolizing non-invasive pre-boot gating, transparent isolation, and non-destructive process supervision.
- **Unprivileged Windows Tray Identity:** The companion tray application sits discreetly in the Windows taskbar notifications area, providing immediate visual feedback on automation gating, snapshot backups, and staggered release pacing.
@@ -366,6 +374,24 @@ safe-start-for-codex status
safe-start-for-codex start
```
+### One-Click Universal Launcher (`START.bat`)
+
+Windows workstations can utilize `START.bat` for automated binary detection (`dist\CodexSafeStart.exe`), argument forwarding, and Python fallback:
+
+```powershell
+# One-click start (launches compiled CodexSafeStart.exe in System Tray mode)
+.\START.bat
+
+# Launch Codex Desktop with pre-boot gating in foreground
+.\START.bat start
+
+# View live gating and queue status in console
+.\START.bat status
+
+# Launch lightweight local web dashboard
+.\START.bat dashboard
+```
+
---
diff --git a/README_de.md b/README_de.md
index 55d7fbd..6e43f84 100644
--- a/README_de.md
+++ b/README_de.md
@@ -6,19 +6,23 @@ Inoffizielles Windows-Startup-Gate für Codex Desktop-Automatisierungen und gest
+
+
+
+
- 
+ 
-success.svg)
-
+
@@ -318,6 +322,10 @@ Safe Start for Codex verfügt über ein prägnantes visuelles Design für profes
+
+
+
+
- **Schutzhüllen-Motiv:** Die visuelle Markenidentität zeigt eine leuchtende, kristallklare Schutzhülle über dem Codex-Schriftzug, die für nicht-invasive Vorab-Sicherung, transparente Isolation und zerstörungsfreie Prozessüberwachung steht.
- **Unprivilegierte Windows-Tray-Identität:** Die begleitende Tray-Anwendung integriert sich unaufdringlich in den Windows-Infobereich (System Tray) und liefert sofortiges visuelles Feedback über Gating-Zustände, Snapshot-Backups und gestaffelte Freigabezyklen.
diff --git a/START.bat b/START.bat
new file mode 100644
index 0000000..5547359
--- /dev/null
+++ b/START.bat
@@ -0,0 +1,50 @@
+@echo off
+setlocal EnableExtensions
+cd /d "%~dp0"
+
+REM If run without arguments, or with 'tray', prioritize the compiled standalone GUI executable
+if "%~1"=="" (
+ if exist "%~dp0dist\CodexSafeStart.exe" (
+ start "" "%~dp0dist\CodexSafeStart.exe"
+ exit /b 0
+ )
+ if exist "C:\_Local_DEV\codex-safe-start\bin\CodexSafeStart.exe" (
+ start "" "C:\_Local_DEV\codex-safe-start\bin\CodexSafeStart.exe"
+ exit /b 0
+ )
+)
+
+if /I "%~1"=="tray" (
+ if exist "%~dp0dist\CodexSafeStart.exe" (
+ start "" "%~dp0dist\CodexSafeStart.exe"
+ exit /b 0
+ )
+ if exist "C:\_Local_DEV\codex-safe-start\bin\CodexSafeStart.exe" (
+ start "" "C:\_Local_DEV\codex-safe-start\bin\CodexSafeStart.exe"
+ exit /b 0
+ )
+)
+
+REM CLI subcommands (start, status, dry-run, dashboard, backup, etc.)
+set "PYTHONPATH=%~dp0src"
+where py >nul 2>&1
+if not errorlevel 1 (
+ py -3 -m safe_start_for_codex %*
+ exit /b %ERRORLEVEL%
+)
+
+where python >nul 2>&1
+if not errorlevel 1 (
+ python -m safe_start_for_codex %*
+ exit /b %ERRORLEVEL%
+)
+
+where pythonw >nul 2>&1
+if not errorlevel 1 (
+ start "" pythonw -m safe_start_for_codex %*
+ exit /b 0
+)
+
+echo [FEHLER] Weder CodexSafeStart.exe noch Python gefunden!
+pause
+exit /b 1
diff --git a/assets/terminal-workflow.svg b/assets/terminal-workflow.svg
new file mode 100644
index 0000000..7226d42
--- /dev/null
+++ b/assets/terminal-workflow.svg
@@ -0,0 +1,97 @@
+
diff --git a/build_exe.py b/build_exe.py
new file mode 100644
index 0000000..096c7a2
--- /dev/null
+++ b/build_exe.py
@@ -0,0 +1,60 @@
+# -*- coding: utf-8 -*-
+"""Build standalone Windows executable for Safe Start for Codex using PyInstaller."""
+
+from __future__ import annotations
+
+import shutil
+from pathlib import Path
+
+import PyInstaller.__main__
+
+HERE = Path(__file__).resolve().parent
+SRC_DIR = HERE / "src"
+ASSETS_DIR = HERE / "assets"
+ICON_PATH = ASSETS_DIR / "codex_safe_start.ico"
+DIST_DIR = HERE / "dist"
+BUILD_DIR = Path(r"C:\_Local_DEV\codex_build\safe-start-for-codex")
+SPEC_DIR = Path(r"C:\_Local_DEV\codex_build\safe-start-for-codex-spec")
+SYSTEM_BIN_DIR = Path(r"C:\_Local_DEV\codex-safe-start\bin")
+
+def build() -> int:
+ DIST_DIR.mkdir(parents=True, exist_ok=True)
+ BUILD_DIR.mkdir(parents=True, exist_ok=True)
+ SPEC_DIR.mkdir(parents=True, exist_ok=True)
+ SYSTEM_BIN_DIR.mkdir(parents=True, exist_ok=True)
+
+ args = [
+ str(SRC_DIR / "safe_start_for_codex" / "tray_app.py"),
+ "--name", "CodexSafeStart",
+ "--noconfirm",
+ "--clean",
+ "--onefile",
+ "--windowed",
+ f"--icon={ICON_PATH}",
+ f"--add-data={ICON_PATH};.",
+ f"--paths={SRC_DIR}",
+ "--collect-submodules=pystray",
+ "--collect-submodules=PIL",
+ "--hidden-import=pystray._win32",
+ f"--distpath={DIST_DIR}",
+ f"--workpath={BUILD_DIR}",
+ f"--specpath={SPEC_DIR}",
+ ]
+
+ print("Running PyInstaller for CodexSafeStart...")
+ PyInstaller.__main__.run(args)
+
+ built_exe = DIST_DIR / "CodexSafeStart.exe"
+ if not built_exe.is_file():
+ print(f"[ERROR] Expected executable not found at {built_exe}")
+ return 1
+
+ # Also sync to local system bin dir
+ shutil.copy2(built_exe, SYSTEM_BIN_DIR / "CodexSafeStart.exe")
+ print("[SUCCESS] Standalone Windows executable built successfully:")
+ print(f" - {built_exe} ({built_exe.stat().st_size} bytes)")
+ print(f" - {SYSTEM_BIN_DIR / 'CodexSafeStart.exe'}")
+ return 0
+
+if __name__ == "__main__":
+ raise SystemExit(build())
diff --git a/llms.txt b/llms.txt
index c05f278..31a9b3b 100644
--- a/llms.txt
+++ b/llms.txt
@@ -1,4 +1,4 @@
-## Last-checked: 2026-11-02
+## Last-checked: 2026-11-08
# safe-start-for-codex - Startup surge prevention for Codex Desktop automations
@@ -10,7 +10,7 @@ It includes optional background tray execution, startup cleanup of stale process
Part of the dev-bricks family. Python, MIT.
-Verification: 198+ pytest tests passed on 2026-11-02. Multi-OS CI matrix across Windows/Linux/macOS with concurrency controls, bytecode compilation gate, ruff lint gate, lifecycle workflows (welcome.yml, stale.yml, auto-assign.yml, label-sync.yml), and timeout-minutes guards verified. Compileall passed. Ruff lint passed. Version 1.1.6 verified.
+Verification: 201+ pytest tests passed on 2026-11-02. Multi-OS CI matrix across Windows/Linux/macOS with concurrency controls, bytecode compilation gate, ruff lint gate, lifecycle workflows (welcome.yml, stale.yml, auto-assign.yml, label-sync.yml), and timeout-minutes guards verified. Compileall passed. Ruff lint passed. Version 1.1.6 verified.
## Docs
@@ -75,3 +75,7 @@ The canonical repository is `dev-bricks/safe-start-for-codex`. It is not OpenAI
- [ellmos-codecommander-mcp](https://github.com/ellmos-ai/ellmos-codecommander-mcp): Code analysis and AST processing.
- [ellmos-controlcenter-mcp](https://github.com/ellmos-ai/ellmos-controlcenter-mcp): MCP stack control plane.
- [open-bricks](https://github.com/open-bricks): Root umbrella organization coordinating open-source developer tooling and standards.
+
+
+- **Universal Windows Launcher (`START.bat`):** Automatic detection of compiled `dist\CodexSafeStart.exe` binary, full CLI argument pass-through, and Python standard launcher fallback.
+- **Visual Terminal Asset:** `assets/terminal-workflow.svg` documents the startup gating sequence and local dashboard monitoring.
diff --git a/tests/test_version_metadata.py b/tests/test_version_metadata.py
index f9e6187..9e4c5a9 100644
--- a/tests/test_version_metadata.py
+++ b/tests/test_version_metadata.py
@@ -49,8 +49,8 @@ def test_llms_txt_integrity() -> None:
llms_text = (PROJECT_ROOT / "llms.txt").read_text(encoding="utf-8")
assert "https://github.com/dev-bricks/safe-start-for-codex" in llms_text
assert "dev-bricks" in llms_text
- assert any(d in llms_text for d in ["Last-checked: 2026-11-02", "Last-checked: 2026-10-08", "Last-checked: 2026-10-01", "Last-checked: 2026-09-26", "Last-checked: 2026-09-21"])
- assert any(p in llms_text for p in ["198+ pytest tests passed", "186+ pytest tests passed", "185+ pytest tests passed", "181+ pytest tests passed", "167+ pytest tests passed", "126+ pytest tests passed", "114+ pytest tests passed"])
+ assert any(d in llms_text for d in ["Last-checked: 2026-11-08", "Last-checked: 2026-11-02", "Last-checked: 2026-10-08", "Last-checked: 2026-10-01", "Last-checked: 2026-09-26", "Last-checked: 2026-09-21"])
+ assert any(p in llms_text for p in ["201+ pytest tests passed", "198+ pytest tests passed", "186+ pytest tests passed", "185+ pytest tests passed", "181+ pytest tests passed", "167+ pytest tests passed", "126+ pytest tests passed", "114+ pytest tests passed"])
assert "Version 1.1.6 verified" in llms_text
assert "NOTICE" in llms_text
assert "521 BGB" in llms_text
@@ -607,12 +607,12 @@ def test_badges_recency_and_test_count_20261008() -> None:
readme_en = (PROJECT_ROOT / "README.md").read_text(encoding="utf-8")
readme_de = (PROJECT_ROOT / "README_de.md").read_text(encoding="utf-8")
- assert any(d in readme_en for d in ["Last--Checked-2026--11--02", "Last--Checked-2026--10--08"])
- assert any(d in readme_de for d in ["Last--Checked-2026--11--02", "Last--Checked-2026--10--08"])
+ assert any(d in readme_en for d in ["Last--Checked-2026--11--08", "Last--Checked-2026--11--02", "Last--Checked-2026--10--08"])
+ assert any(d in readme_de for d in ["Last--Checked-2026--11--08", "Last--Checked-2026--11--02", "Last--Checked-2026--10--08"])
assert any(d in readme_en for d in ["third--party%20licenses-100%25%20audited%20(2026--11--02)", "third--party%20licenses-100%25%20audited%20(2026--10--08)"])
assert any(d in readme_de for d in ["drittanbieter--lizenzen-100%25%20gepr%C3%BCft%20(2026--11--02)", "drittanbieter--lizenzen-100%25%20gepr%C3%BCft%20(2026--10--08)"])
- assert any(p in readme_en for p in ["pytest-198%20passed%20%7C%20100%25%20green", "pytest-186%20passed%20%7C%20100%25%20green"])
- assert any(p in readme_de for p in ["pytest-198%20bestanden%20%7C%20100%25%20gr%C3%BCn", "pytest-186%20bestanden%20%7C%20100%25%20gr%C3%BCn"])
+ assert any(p in readme_en for p in ["pytest-201%20passed%20%7C%20100%25%20green", "pytest-198%20passed%20%7C%20100%25%20green", "pytest-186%20passed%20%7C%20100%25%20green"])
+ assert any(p in readme_de for p in ["pytest-201%20bestanden%20%7C%20100%25%20gr%C3%BCn", "pytest-198%20bestanden%20%7C%20100%25%20gr%C3%BCn", "pytest-186%20bestanden%20%7C%20100%25%20gr%C3%BCn"])
def test_changelog_recent_pfad_b_entry_20261008() -> None:
@@ -625,12 +625,13 @@ def test_changelog_recent_pfad_b_entry_20261008() -> None:
def test_badges_recency_and_test_count_20261102() -> None:
readme_en = (PROJECT_ROOT / "README.md").read_text(encoding="utf-8")
readme_de = (PROJECT_ROOT / "README_de.md").read_text(encoding="utf-8")
- assert "Last--Checked-2026--11--02" in readme_en
- assert "Last--Checked-2026--11--02" in readme_de
+ assert any(d in readme_en for d in ["Last--Checked-2026--11--08", "Last--Checked-2026--11--02"])
+ assert any(d in readme_de for d in ["Last--Checked-2026--11--08", "Last--Checked-2026--11--02"])
assert "third--party%20licenses-100%25%20audited%20(2026--11--02)" in readme_en
assert "drittanbieter--lizenzen-100%25%20gepr%C3%BCft%20(2026--11--02)" in readme_de
- assert "pytest-198%20passed%20%7C%20100%25%20green" in readme_en
- assert "pytest-198%20bestanden%20%7C%20100%25%20gr%C3%BCn" in readme_de
+ assert any(p in readme_en for p in ["pytest-201%20passed%20%7C%20100%25%20green", "pytest-198%20passed%20%7C%20100%25%20green"])
+ assert any(p in readme_de for p in ["pytest-201%20bestanden%20%7C%20100%25%20gr%C3%BCn", "pytest-198%20bestanden%20%7C%20100%25%20gr%C3%BCn"])
+
def test_level_1_sbom_currency_20261102() -> None:
md_text = (PROJECT_ROOT / "THIRD_PARTY_LICENSES.md").read_text(encoding="utf-8")
@@ -638,7 +639,36 @@ def test_level_1_sbom_currency_20261102() -> None:
assert "Audited:** 2026-11-02" in md_text
assert "Audited: 2026-11-02" in txt_text
+
def test_changelog_recent_pfad_b_entry_20261102() -> None:
changelog = (PROJECT_ROOT / "CHANGELOG.md").read_text(encoding="utf-8")
assert "2026-11-02" in changelog
assert "GITHUBBOT_ONE_REPO_MARKETING_AND_DESIGN" in changelog
+
+
+def test_start_bat_launcher() -> None:
+ """Ensure START.bat exists and contains EXE detection, %* forwarding, and Python fallback."""
+ start_bat = PROJECT_ROOT / "START.bat"
+ assert start_bat.is_file(), "START.bat must exist"
+ content = start_bat.read_text(encoding="utf-8", errors="replace")
+ assert "CodexSafeStart.exe" in content
+ assert "%*" in content
+ assert "safe_start_for_codex" in content
+
+
+def test_dependabot_configuration() -> None:
+ """Ensure .github/dependabot.yml exists and configures pip security updates."""
+ dependabot_path = PROJECT_ROOT / ".github" / "dependabot.yml"
+ assert dependabot_path.is_file(), ".github/dependabot.yml must exist"
+ text = dependabot_path.read_text(encoding="utf-8")
+ assert "version: 2" in text
+ assert 'package-ecosystem: "pip"' in text
+
+
+def test_terminal_workflow_asset_exists() -> None:
+ """Verify that assets/terminal-workflow.svg exists and is valid SVG."""
+ asset_path = PROJECT_ROOT / "assets" / "terminal-workflow.svg"
+ assert asset_path.is_file(), "assets/terminal-workflow.svg must exist"
+ content = asset_path.read_text(encoding="utf-8")
+ assert "" in content
+ assert "safe-start-for-codex" in content