lukisch · Nov 8, 2026
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -0,0 +1,13 @@
+# Security-only: keine version-updates (limit 0), Security-Fixes gruppiert
+version: 2
+updates:
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 0
+    groups:
+      security:
+        applies-to: security-updates
+        patterns:
+          - "*"
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -4,6 +4,16 @@ All notable changes to this project are documented here.
 
 ## Unreleased
 
+- Software Pipeline Wartung, Universal Launcher, Standalone Executable, Terminal Workflow Asset, Dependabot & Contract Test Expansion (SOFTWARE_ICONS_WARTUNG_EXE_DOCU_GITHUB) on 2026-11-08:
+  - Preserved strict version freeze discipline per T-20260920-167562623 (version 1.1.6 unchanged across all runtime manifests, zero version bump).
+  - Deployed universal Windows batch launcher `START.bat` supporting compiled standalone executable priority (`dist\CodexSafeStart.exe`, fallback to system path `C:\_Local_DEV\codex-safe-start\bin\CodexSafeStart.exe`), full CLI argument pass-through (`%*`), and unprivileged fallback to Python standard launchers (`pythonw`, `py -3`, `python`).
+  - Compiled and verified fresh standalone Windows binary `dist\CodexSafeStart.exe` (63.5 MB) via `build_exe.py` (PyInstaller 6.21.0) with embedded application icon (`assets/codex_safe_start.ico`), pystray integration, and user-mode desktop execution.
+  - Authored dark-mode vector asset `assets/terminal-workflow.svg` (880x520) visualizing the 5-phase startup gating lifecycle, atomic snapshot staging, rate-limited batch release queue, and local web dashboard.
+  - Added GitHub Governance specification `.github/dependabot.yml` configured for weekly pip security updates and grouped automated vulnerability patches.
+  - Synchronized real-measurement test badges across `README.md` and `README_de.md`: updated pytest badge to 201 passed | 100% green (201 bestanden | 100% grün) and audit recency badge to `Last--Checked-2026--11--08`.
+  - Updated machine-readable discovery in `llms.txt` (Last checked: 2026-11-08, 201+ pytest tests passed baseline, `START.bat` and `CodexSafeStart.exe` documented).
+  - Expanded automated contract test suite in `tests/test_version_metadata.py`: added `test_start_bat_launcher`, `test_dependabot_configuration`, `test_terminal_workflow_asset_exists`, and updated `test_badges_recency_and_test_count_20261102` (full test suite expanded to 201 passed, 1 skipped, 100% green). [G 2026-11-08]
+
 - Discoverability, Real-Measurement Test Badges (198 passed | 100% green), Level 1 SBOM Stand 2026-11-02 Re-Audit & Contract Test Expansion (GITHUBBOT_ONE_REPO_MARKETING_AND_DESIGN / Pfad B) on 2026-11-02:
   - Preserved strict version freeze discipline per T-20260920-167562623 (version 1.1.6 unchanged across all runtime manifests, zero version bump).
   - Synchronized real-measurement test badges across README.md and README_de.md: updated pytest badge to 198 passed | 100% green (198 bestanden | 100% grün), audit recency to 2026--11--02, and third-party license audit to (2026--11--02).

diff --git a/README.md b/README.md
@@ -6,19 +6,23 @@ Unofficial Windows startup gate for Codex Desktop automations and catch-up pacin
   <img src="assets/safe_start_banner.svg" width="100%" alt="Safe Start for Codex Banner - Schutzhülle über dem Schriftzug" />
 </p>
 
+<p align="center">
+  <img src="assets/terminal-workflow.svg" width="100%" alt="Safe Start for Codex Terminal Workflow - Gating Sequence & Dashboard" />
+</p>
+
 <p align="center">
   <a href="pyproject.toml"><img src="https://img.shields.io/badge/version-1.1.6-blue.svg" alt="Version"></a>
   <a href="NOTICE"><img src="https://img.shields.io/badge/Attribution-NOTICE-blue.svg" alt="Attribution NOTICE"></a>
   <a href="https://github.com/dev-bricks/safe-start-for-codex/actions/workflows/ci.yml"><img src="https://img.shields.io/badge/CI-GitHub%20Actions-brightgreen.svg" alt="CI Status"></a>
   <a href="https://github.com/dev-bricks/safe-start-for-codex/actions/workflows/source-platform-smoke.yml"><img src="https://img.shields.io/badge/Smoke-macOS%20%7C%20Linux-brightgreen.svg" alt="Platform Smoke"></a>
-  <a href="tests/"><img src="https://img.shields.io/badge/pytest-198%20passed%20%7C%20100%25%20green-brightgreen.svg" alt="Pytest Status"></a>
+  <a href="tests/"><img src="https://img.shields.io/badge/pytest-201%20passed%20%7C%20100%25%20green-brightgreen.svg" alt="Pytest Status"></a>
   <img src="https://img.shields.io/badge/python-3.11%20%7C%203.12%20%7C%203.13-blue.svg" alt="Python Versions">
   <img src="https://img.shields.io/badge/platform-Windows%20%7C%20Linux%20%7C%20macOS-lightgrey.svg" alt="Platforms">
   <img src="https://img.shields.io/badge/architecture-100%25%20Local--First%20%7C%20Zero--Egress-success.svg" alt="Local-First Architecture">
   <img src="https://img.shields.io/badge/security-Non--Elevation%20%7C%20User--Mode-informational.svg" alt="Security Mode">
   <a href="SECURITY.md"><img src="https://img.shields.io/badge/security%20SLA-48h%20%7C%205d%20triage-success.svg" alt="Security SLA"></a>
   <a href="THIRD_PARTY_LICENSES.md"><img src="https://img.shields.io/badge/third--party%20licenses-100%25%20audited%20(2026--11--02)-success.svg" alt="Third-Party Licenses"></a>
-  <a href="CHANGELOG.md"><img src="https://img.shields.io/badge/Last--Checked-2026--11--02-informational.svg" alt="Audit Recency"></a>
+  <a href="CHANGELOG.md"><img src="https://img.shields.io/badge/Last--Checked-2026--11--08-informational.svg" alt="Audit Recency"></a>
   <a href="MARKETING-LOG.txt"><img src="https://img.shields.io/badge/marketing%20log-active-informational.svg" alt="Marketing Log"></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/License-MIT-yellow.svg" alt="License"></a>
   <a href="https://github.com/dev-bricks"><img src="https://img.shields.io/badge/ecosystem-dev--bricks-blue.svg" alt="dev-bricks"></a>
@@ -318,6 +322,10 @@ Safe Start for Codex features a cohesive visual design tailored for developer de
   <img src="assets/safe_start_banner.svg" width="100%" alt="Safe Start for Codex Banner - Schutzhülle über dem Schriftzug" />
 </p>
 
+<p align="center">
+  <img src="assets/terminal-workflow.svg" width="100%" alt="Safe Start for Codex Terminal Workflow - Gating Sequence & Dashboard" />
+</p>
+
 - **Protective Sleeve Motif:** The brand identity illustrates a glowing, crystal-clear protective sleeve enveloping the Codex typography, symbolizing non-invasive pre-boot gating, transparent isolation, and non-destructive process supervision.
 - **Unprivileged Windows Tray Identity:** The companion tray application sits discreetly in the Windows taskbar notifications area, providing immediate visual feedback on automation gating, snapshot backups, and staggered release pacing.
 
@@ -366,6 +374,24 @@ safe-start-for-codex status
 safe-start-for-codex start
 ```
 
+### One-Click Universal Launcher (`START.bat`)
+
+Windows workstations can utilize `START.bat` for automated binary detection (`dist\CodexSafeStart.exe`), argument forwarding, and Python fallback:
+
+```powershell
+# One-click start (launches compiled CodexSafeStart.exe in System Tray mode)
+.\START.bat
+
+# Launch Codex Desktop with pre-boot gating in foreground
+.\START.bat start
+
+# View live gating and queue status in console
+.\START.bat status
+
+# Launch lightweight local web dashboard
+.\START.bat dashboard
+```
+
 ---
 
 <a id="sec-12"></a><a id="cli-usage--subcommands"></a><a id="cli-nutzung--befehlsreferenz"></a>

diff --git a/README_de.md b/README_de.md
@@ -6,19 +6,23 @@ Inoffizielles Windows-Startup-Gate für Codex Desktop-Automatisierungen und gest
   <img src="assets/safe_start_banner.svg" width="100%" alt="Safe Start for Codex Banner - Schutzhülle über dem Schriftzug" />
 </p>
 
+<p align="center">
+  <img src="assets/terminal-workflow.svg" width="100%" alt="Safe Start for Codex Terminal Workflow - Gating-Ablauf und Dashboard" />
+</p>
+
 <p align="center">
   <a href="pyproject.toml"><img src="https://img.shields.io/badge/Version-1.1.6-blue.svg" alt="Version"></a>
   <a href="NOTICE"><img src="https://img.shields.io/badge/Attribution-NOTICE-blue.svg" alt="Attribution NOTICE"></a>
   <a href="https://github.com/dev-bricks/safe-start-for-codex/actions/workflows/ci.yml"><img src="https://img.shields.io/badge/CI-GitHub%20Actions-brightgreen.svg" alt="CI Status"></a>
   <a href="https://github.com/dev-bricks/safe-start-for-codex/actions/workflows/source-platform-smoke.yml"><img src="https://img.shields.io/badge/Smoke-macOS%20%7C%20Linux-brightgreen.svg" alt="Plattform Smoke"></a>
-  <a href="tests/"><img src="https://img.shields.io/badge/pytest-198%20bestanden%20%7C%20100%25%20gr%C3%BCn-brightgreen.svg" alt="Pytest Status"></a>
+  <a href="tests/"><img src="https://img.shields.io/badge/pytest-201%20bestanden%20%7C%20100%25%20gr%C3%BCn-brightgreen.svg" alt="Pytest Status"></a>
   <img src="https://img.shields.io/badge/python-3.11%20%7C%203.12%20%7C%203.13-blue.svg" alt="Python Versionen">
   <img src="https://img.shields.io/badge/plattform-Windows%20%7C%20Linux%20%7C%20macOS-lightgrey.svg" alt="Plattformen">
   <img src="https://img.shields.io/badge/architektur-100%25%20Local--First%20%7C%20Zero--Egress-success.svg" alt="Local-First Architektur">
   <img src="https://img.shields.io/badge/sicherheit-Non--Elevation%20%7C%20User--Mode-informational.svg" alt="Sicherheitsmodus">
   <a href="SECURITY.md"><img src="https://img.shields.io/badge/sicherheits--SLA-48h%20%7C%205d%20triage-success.svg" alt="Sicherheits SLA"></a>
   <a href="THIRD_PARTY_LICENSES.md"><img src="https://img.shields.io/badge/drittanbieter--lizenzen-100%25%20gepr%C3%BCft%20(2026--11--02)-success.svg" alt="Drittanbieter-Lizenzen"></a>
-  <a href="CHANGELOG.md"><img src="https://img.shields.io/badge/Last--Checked-2026--11--02-informational.svg" alt="Audit-Aktualit%C3%A4t"></a>
+  <a href="CHANGELOG.md"><img src="https://img.shields.io/badge/Last--Checked-2026--11--08-informational.svg" alt="Audit-Aktualit%C3%A4t"></a>
   <a href="MARKETING-LOG.txt"><img src="https://img.shields.io/badge/marketing%20log-aktiv-informational.svg" alt="Marketing Log"></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/Lizenz-MIT-yellow.svg" alt="Lizenz"></a>
   <a href="https://github.com/dev-bricks"><img src="https://img.shields.io/badge/ecosystem-dev--bricks-blue.svg" alt="dev-bricks"></a>
@@ -318,6 +322,10 @@ Safe Start for Codex verfügt über ein prägnantes visuelles Design für profes
   <img src="assets/safe_start_banner.svg" width="100%" alt="Safe Start for Codex Banner - Schutzhülle über dem Schriftzug" />
 </p>
 
+<p align="center">
+  <img src="assets/terminal-workflow.svg" width="100%" alt="Safe Start for Codex Terminal Workflow - Gating-Ablauf und Dashboard" />
+</p>
+
 - **Schutzhüllen-Motiv:** Die visuelle Markenidentität zeigt eine leuchtende, kristallklare Schutzhülle über dem Codex-Schriftzug, die für nicht-invasive Vorab-Sicherung, transparente Isolation und zerstörungsfreie Prozessüberwachung steht.
 - **Unprivilegierte Windows-Tray-Identität:** Die begleitende Tray-Anwendung integriert sich unaufdringlich in den Windows-Infobereich (System Tray) und liefert sofortiges visuelles Feedback über Gating-Zustände, Snapshot-Backups und gestaffelte Freigabezyklen.
 

diff --git a/START.bat b/START.bat
@@ -0,0 +1,50 @@
+@echo off
+setlocal EnableExtensions
+cd /d "%~dp0"
+
+REM If run without arguments, or with 'tray', prioritize the compiled standalone GUI executable
+if "%~1"=="" (
+    if exist "%~dp0dist\CodexSafeStart.exe" (
+        start "" "%~dp0dist\CodexSafeStart.exe"
+        exit /b 0
+    )
+    if exist "C:\_Local_DEV\codex-safe-start\bin\CodexSafeStart.exe" (
+        start "" "C:\_Local_DEV\codex-safe-start\bin\CodexSafeStart.exe"
+        exit /b 0
+    )
+)
+
+if /I "%~1"=="tray" (
+    if exist "%~dp0dist\CodexSafeStart.exe" (
+        start "" "%~dp0dist\CodexSafeStart.exe"
+        exit /b 0
+    )
+    if exist "C:\_Local_DEV\codex-safe-start\bin\CodexSafeStart.exe" (
+        start "" "C:\_Local_DEV\codex-safe-start\bin\CodexSafeStart.exe"
+        exit /b 0
+    )
+)
+
+REM CLI subcommands (start, status, dry-run, dashboard, backup, etc.)
+set "PYTHONPATH=%~dp0src"
+where py >nul 2>&1
+if not errorlevel 1 (
+    py -3 -m safe_start_for_codex %*
+    exit /b %ERRORLEVEL%
+)
+
+where python >nul 2>&1
+if not errorlevel 1 (
+    python -m safe_start_for_codex %*
+    exit /b %ERRORLEVEL%
+)
+
+where pythonw >nul 2>&1
+if not errorlevel 1 (
+    start "" pythonw -m safe_start_for_codex %*
+    exit /b 0
+)
+
+echo [FEHLER] Weder CodexSafeStart.exe noch Python gefunden!
+pause
+exit /b 1
diff --git a/assets/terminal-workflow.svg b/assets/terminal-workflow.svg
diff --git a/build_exe.py b/build_exe.py
@@ -0,0 +1,60 @@
+# -*- coding: utf-8 -*-
+"""Build standalone Windows executable for Safe Start for Codex using PyInstaller."""
+
+from __future__ import annotations
+
+import shutil
+from pathlib import Path
+
+import PyInstaller.__main__
+
+HERE = Path(__file__).resolve().parent
+SRC_DIR = HERE / "src"
+ASSETS_DIR = HERE / "assets"
+ICON_PATH = ASSETS_DIR / "codex_safe_start.ico"
+DIST_DIR = HERE / "dist"
+BUILD_DIR = Path(r"C:\_Local_DEV\codex_build\safe-start-for-codex")
+SPEC_DIR = Path(r"C:\_Local_DEV\codex_build\safe-start-for-codex-spec")
+SYSTEM_BIN_DIR = Path(r"C:\_Local_DEV\codex-safe-start\bin")
+
+def build() -> int:
+    DIST_DIR.mkdir(parents=True, exist_ok=True)
+    BUILD_DIR.mkdir(parents=True, exist_ok=True)
+    SPEC_DIR.mkdir(parents=True, exist_ok=True)
+    SYSTEM_BIN_DIR.mkdir(parents=True, exist_ok=True)
+
+    args = [
+        str(SRC_DIR / "safe_start_for_codex" / "tray_app.py"),
+        "--name", "CodexSafeStart",
+        "--noconfirm",
+        "--clean",
+        "--onefile",
+        "--windowed",
+        f"--icon={ICON_PATH}",
+        f"--add-data={ICON_PATH};.",
+        f"--paths={SRC_DIR}",
+        "--collect-submodules=pystray",
+        "--collect-submodules=PIL",
+        "--hidden-import=pystray._win32",
+        f"--distpath={DIST_DIR}",
+        f"--workpath={BUILD_DIR}",
+        f"--specpath={SPEC_DIR}",
+    ]
+
+    print("Running PyInstaller for CodexSafeStart...")
+    PyInstaller.__main__.run(args)
+
+    built_exe = DIST_DIR / "CodexSafeStart.exe"
+    if not built_exe.is_file():
+        print(f"[ERROR] Expected executable not found at {built_exe}")
+        return 1
+
+    # Also sync to local system bin dir
+    shutil.copy2(built_exe, SYSTEM_BIN_DIR / "CodexSafeStart.exe")
+    print("[SUCCESS] Standalone Windows executable built successfully:")
+    print(f"  - {built_exe} ({built_exe.stat().st_size} bytes)")
+    print(f"  - {SYSTEM_BIN_DIR / 'CodexSafeStart.exe'}")
+    return 0
+
+if __name__ == "__main__":
+    raise SystemExit(build())