Platform behavior can change. Compare this guide with the original repository at commit 3af1d6d62f3a.

Quick answer

A transparent Codex theme package should contain data only: wallpaper, recipe, manifest, tokens, install/restore/verify notes, and complete SHA-256 checksums. A valid package is still not a live compatibility certification or one-click installer.

01Inspect the package root

02Read manifest.json

03Verify SHA256SUMS

04Choose the current platform-specific upstream workflow

One transparent package root

Package v1 contains one wallpaper, canonical theme.json, an identical recipe.json compatibility alias, manifest.json, theme-tokens.css, install.md, restore.md, verify.md, README.md, and SHA256SUMS. The ZIP contains no installer, executable, script, credential, hidden file, or remote image reference. The wallpaper and archive are created in the same browser session that holds the selected image.

The manifest records evidence, not a marketing badge

manifest.json names the package format, generation time, source recipe, theme mode, creator and license provenance, wallpaper media type and resolution, checked upstream commit, privacy assertions, and the current compatibility status. Unverified remains Unverified until a repeatable site-owned device run records the exact Codex version, OS, architecture, routes, native controls, upstream commit, and Restore result.

Every payload is covered by SHA-256

The manifest lists a hash for each primary payload. SHA256SUMS also covers manifest.json and every readable instruction file. This detects corruption or replacement after generation, but it does not prove authorship, licensing, compatibility, or the safety of a separate third-party executable workflow.

Install and Restore stay separate

install.md and restore.md explain the boundary and point to the current original upstream repository. They do not contain platform scripts. Review the latest macOS or Windows documentation, keep the restore path ready, and treat the browser preview, the data package, and a live runtime result as three different evidence states.

Do not convert package integrity into a Verified compatibility badge. Verification requires a recorded live device result, not only a valid ZIP or matching hash.

Completion checklist

manifest format is package.v1
No executable paths exist
Every SHA-256 value matches
Rights and creator fields are present
Compatibility status matches available evidence

Codex theme package standard: manifest, hashes, install, and restore