@atollhq/skill-codex 0.4.31 → 0.4.32

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atollhq/skill-codex",
-  "version": "0.4.31",
+  "version": "0.4.32",
   "description": "Install the Atoll project management integration for Codex CLI",
   "bin": {
     "skill-codex": "bin/install.mjs"

package/skill/SKILL.md

@@ -36,6 +36,8 @@ Read only the references required for the current task:
   [integrations-and-api.md](references/integrations-and-api.md)
 - GitHub pull-request delivery context, required checks, and exact-head evidence:
   [api-fields.md](references/api-fields.md#external-operational-delivery-context)
+  A `plan_restricted` required-check error is actionable plan-unavailable
+  evidence; keep configured workflows separate because they remain `required: false`.
 - Cross-resource authorization, privacy, automation, attachment, feedback, and
   other platform-specific rules: [platform-rules.md](references/platform-rules.md)
 - Exact endpoint inventory: [api-endpoints.md](references/api-endpoints.md)

package/skill/references/api-endpoints.md

@@ -714,6 +714,12 @@ collection and stale, ambiguous, or missing evidence remain `unknown` and set
 enables the provider GET collection; it is disabled by default. The collector does not
 change GitHub hooks or other provider state and does not prove merge,
 deployment, production testing, or human acceptance.
+A policy endpoint returning GitHub's exact plan-limit HTTP 403 is classified
+as `plan_restricted`; other 401/403 responses remain permission failures.
+The collection is `partial` if one policy source succeeds, or `unavailable`
+if both fail, and its aggregate remains `unknown`. The first policy error
+(rulesets before classic protection) supplies `error_code` when errors differ.
+Configured workflow results remain separate evidence with `required: false`.
 The selected PR-link state is authoritative. If a same-head PR observation
 disagrees, Atoll clears its observation/provider provenance, uses the link URL
 as `source_url`, excludes it from freshness, and sets `partial`.

package/skill/references/api-fields.md

@@ -1188,6 +1188,12 @@ provider collection; disabled is the default. With reads disabled, state
 `disabled` and aggregate `none` do not set `partial`. When enabled, partial or
 unavailable collection, stale, ambiguous, or missing evidence remains `unknown`
 and sets `partial`.
+A policy endpoint returning GitHub's exact plan-limit HTTP 403 is classified
+as `plan_restricted`; other 401/403 responses remain permission failures.
+The collection is `partial` if one policy source succeeds, or `unavailable`
+if both fail, and its aggregate remains `unknown`. The first policy error
+(rulesets before classic protection) supplies `error_code` when errors differ.
+Configured workflow results remain separate evidence with `required: false`.
 
 Review aggregation keeps each reviewer's latest exact-head opinion, ignores
 comments, and removes dismissed opinions. Change requests win; `approved`

package/skill/references/integrations-and-api.md

@@ -238,6 +238,12 @@ collection or aggregate `unknown` sets `partial`. The server-only
 off by default. This evidence does not grant merge, deployment, production
 testing, or acceptance authority, and the endpoint does not change GitHub
 state. Configured Atoll workflow paths remain `required: false`.
+A policy endpoint returning GitHub's exact plan-limit HTTP 403 is classified
+as `plan_restricted`; other 401/403 responses remain permission failures.
+The collection is `partial` if one policy source succeeds, or `unavailable`
+if both fail, and its aggregate remains `unknown`. The first policy error
+(rulesets before classic protection) supplies `error_code` when errors differ.
+Configured workflow results remain separate evidence with `required: false`.
 
 ## Planning Artifacts
 

package/skill/references/platform-rules.md

@@ -137,6 +137,12 @@ server-only
 `ATOLL_GITHUB_REQUIRED_CHECKS_READ_ENABLED=1` flag. This namespace is separate
 from heartbeat `signals[]`, never changes provider state, and never changes
 tasks or dispatches agents.
+A policy endpoint returning GitHub's exact plan-limit HTTP 403 is classified
+as `plan_restricted`; other 401/403 responses remain permission failures.
+The collection is `partial` if one policy source succeeds, or `unavailable`
+if both fail, and its aggregate remains `unknown`. The first policy error
+(rulesets before classic protection) supplies `error_code` when errors differ.
+Configured workflow results remain separate evidence with `required: false`.
 The selected PR-link state is authoritative. If a same-head PR observation
 disagrees, Atoll clears its observation/provider provenance, falls back to the
 link URL, excludes it from freshness, and sets `partial`.