@orderful/droid 0.35.4 → 0.37.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (60) hide show
  1. package/.claude-plugin/marketplace.json +6 -6
  2. package/CHANGELOG.md +36 -0
  3. package/README.md +34 -19
  4. package/dist/tools/brain/.claude-plugin/plugin.json +1 -1
  5. package/dist/tools/brain/TOOL.yaml +1 -1
  6. package/dist/tools/brain/commands/brain.md +3 -2
  7. package/dist/tools/brain/skills/brain/SKILL.md +35 -7
  8. package/dist/tools/brain/skills/brain/references/templates.md +61 -0
  9. package/dist/tools/brain/skills/brain/references/workflows.md +69 -4
  10. package/dist/tools/codex/.claude-plugin/plugin.json +2 -2
  11. package/dist/tools/codex/TOOL.yaml +2 -2
  12. package/dist/tools/codex/commands/codex.md +1 -1
  13. package/dist/tools/codex/skills/codex/SKILL.md +120 -329
  14. package/dist/tools/codex/skills/codex/references/reading-workflows.md +56 -0
  15. package/dist/tools/codex/skills/codex/references/review/prd.md +49 -0
  16. package/dist/tools/codex/skills/codex/references/review/workflow.md +40 -230
  17. package/dist/tools/comments/.claude-plugin/plugin.json +1 -1
  18. package/dist/tools/comments/TOOL.yaml +1 -1
  19. package/dist/tools/comments/skills/comments/SKILL.md +6 -4
  20. package/dist/tools/plan/.claude-plugin/plugin.json +1 -1
  21. package/dist/tools/plan/TOOL.yaml +1 -1
  22. package/dist/tools/plan/commands/plan.md +3 -1
  23. package/dist/tools/plan/skills/plan/SKILL.md +21 -9
  24. package/dist/tools/plan/skills/plan/references/workflows.md +57 -20
  25. package/dist/tools/tech-design/.claude-plugin/plugin.json +1 -1
  26. package/dist/tools/tech-design/TOOL.yaml +1 -1
  27. package/dist/tools/tech-design/skills/tech-design/SKILL.md +6 -4
  28. package/package.json +1 -1
  29. package/src/tools/brain/.claude-plugin/plugin.json +1 -1
  30. package/src/tools/brain/TOOL.yaml +1 -1
  31. package/src/tools/brain/commands/brain.md +3 -2
  32. package/src/tools/brain/skills/brain/SKILL.md +35 -7
  33. package/src/tools/brain/skills/brain/references/templates.md +61 -0
  34. package/src/tools/brain/skills/brain/references/workflows.md +69 -4
  35. package/src/tools/codex/.claude-plugin/plugin.json +2 -2
  36. package/src/tools/codex/TOOL.yaml +2 -2
  37. package/src/tools/codex/commands/codex.md +1 -1
  38. package/src/tools/codex/skills/codex/SKILL.md +120 -329
  39. package/src/tools/codex/skills/codex/references/reading-workflows.md +56 -0
  40. package/src/tools/codex/skills/codex/references/review/prd.md +49 -0
  41. package/src/tools/codex/skills/codex/references/review/workflow.md +40 -230
  42. package/src/tools/comments/.claude-plugin/plugin.json +1 -1
  43. package/src/tools/comments/TOOL.yaml +1 -1
  44. package/src/tools/comments/skills/comments/SKILL.md +6 -4
  45. package/src/tools/plan/.claude-plugin/plugin.json +1 -1
  46. package/src/tools/plan/TOOL.yaml +1 -1
  47. package/src/tools/plan/commands/plan.md +3 -1
  48. package/src/tools/plan/skills/plan/SKILL.md +21 -9
  49. package/src/tools/plan/skills/plan/references/workflows.md +57 -20
  50. package/src/tools/tech-design/.claude-plugin/plugin.json +1 -1
  51. package/src/tools/tech-design/TOOL.yaml +1 -1
  52. package/src/tools/tech-design/skills/tech-design/SKILL.md +6 -4
  53. package/dist/tools/codex/skills/codex/references/creating.md +0 -112
  54. package/dist/tools/codex/skills/codex/references/decisions.md +0 -124
  55. package/dist/tools/codex/skills/codex/references/loading.md +0 -292
  56. package/dist/tools/codex/skills/codex/references/topics.md +0 -215
  57. package/src/tools/codex/skills/codex/references/creating.md +0 -112
  58. package/src/tools/codex/skills/codex/references/decisions.md +0 -124
  59. package/src/tools/codex/skills/codex/references/loading.md +0 -292
  60. package/src/tools/codex/skills/codex/references/topics.md +0 -215
@@ -14,6 +14,7 @@ allowed-tools:
14
14
  Bash(ls:*),
15
15
  Bash(mkdir:*),
16
16
  Bash(droid:*),
17
+ Bash(cat:*),
17
18
  ]
18
19
  ---
19
20
 
@@ -23,399 +24,189 @@ allowed-tools:
23
24
 
24
25
  Shared organizational knowledge for humans and droids alike. Product requirements documents, tech designs, patterns, and explored topics - structured for AI-assisted development.
25
26
 
26
- ## Prerequisites
27
-
28
- Before using codex, verify:
29
-
30
- 1. **Repo cloned:** Check if `codex_repo` path exists
31
- 2. **gh CLI:** Required for PR workflows (CONTEXT.md auto-generation)
32
-
33
- ```bash
34
- # Check repo exists
35
- ls -la {codex_repo}
36
-
37
- # Check gh CLI
38
- gh --version
39
- ```
40
-
41
- If prerequisites fail, guide user to fix:
42
-
43
- - Repo missing: `git clone git@github.com:orderful/orderful-codex.git {path}`
44
- - gh missing: `brew install gh && gh auth login`
45
-
46
- ## Git Hygiene (CRITICAL)
47
-
48
- **Users should never see git complexity.** Use the deterministic scripts below - they handle all git operations silently and recover gracefully. Non-engineers use this tool - if they hit a git error, they're stuck.
49
-
50
- ### Scripts
51
-
52
- The codex skill includes three git scripts. **Always use these instead of raw git commands.**
53
-
54
- | Script | Purpose | When to use |
55
- | ------------------ | ------------------------------- | ----------------------- |
56
- | `git-preamble` | Ensure clean main + pull latest | Before ANY operation |
57
- | `git-start-write` | Preamble + create branch | Before write operations |
58
- | `git-finish-write` | Commit + PR + return to main | After write operations |
59
-
60
- ### Read Operations (search, load, list)
27
+ ## Self-Describing Architecture
61
28
 
62
- ```bash
63
- droid config --get tools.codex | droid exec codex git-preamble --config -
64
- # Then proceed with the read
65
- ```
29
+ **The codex repo defines its own structure and workflows.** The skill reads these on each operation instead of having hardcoded assumptions.
66
30
 
67
- ### Write Operations (new, decision, snapshot, artifact)
31
+ **On every codex operation:**
68
32
 
69
- ```bash
70
- # 1. Start write (runs preamble + creates branch)
71
- droid config --get tools.codex | droid exec codex git-start-write --config - --branch codex/{action}-{name}
33
+ 1. **Read structure:** `{codex_repo}/.codex/manifest.yaml` defines categories, scaffolding rules, frontmatter schema
34
+ 2. **Read workflow:** `{codex_repo}/.codex/workflows/{operation}.md` provides step-by-step instructions
35
+ 3. **Execute:** Follow the workflow instructions using your tools
72
36
 
73
- # 2. Make your changes (write files)
37
+ **Workflow mapping:**
74
38
 
75
- # 3. Finish write (commit + PR + return to main)
76
- droid config --get tools.codex | droid exec codex git-finish-write --config - \
77
- --message "{commit message}" \
78
- --pr-title "{PR title}" \
79
- --pr-body "{PR description}"
80
- ```
39
+ | Operation | Workflow File |
40
+ |-----------|---------------|
41
+ | Load/search/list operations | .codex/workflows/loading.md |
42
+ | Create new entries | .codex/workflows/creating.md |
43
+ | Add to existing entries | .codex/workflows/adding.md |
44
+ | Review documents | .codex/workflows/reviewing.md |
81
45
 
82
- The scripts return JSON with success/failure status. Check the result before proceeding.
83
-
84
- ### Error Handling
85
-
86
- The scripts handle errors internally:
87
-
88
- - Silent recovery for transient issues
89
- - Clear error messages in JSON output
90
- - Automatic return to main even on partial failure
91
-
92
- If a script fails, check the JSON `error` field and report a user-friendly message:
46
+ **Example - creating a project:**
93
47
 
94
- - "I hit a sync issue with the codex. Let me try again..."
95
- - Only escalate as last resort: "The codex repo needs manual attention."
96
-
97
- ## Security
48
+ # 1. Read workflow
49
+ cat {codex_repo}/.codex/workflows/creating.md
98
50
 
99
- ### Input Validation
51
+ # 2. Read manifest for scaffold rules
52
+ cat {codex_repo}/.codex/manifest.yaml
53
+ # Extract: categories.projects.minimal_scaffold
100
54
 
101
- **Always validate user-provided names before using in paths:**
55
+ # 3. Follow procedure in creating.md
102
56
 
103
- ```bash
104
- # REJECT names containing path traversal attempts
105
- if [[ "{name}" == *".."* ]] || [[ "{name}" == *"/"* ]]; then
106
- echo "Invalid name: must not contain '..' or '/'"
107
- exit 1
108
- fi
57
+ See `references/reading-workflows.md` for detailed guidance on interpreting workflows.
109
58
 
110
- # REJECT names with shell metacharacters
111
- if [[ "{name}" =~ [\$\`\|\;\&\>\<] ]]; then
112
- echo "Invalid name: contains unsafe characters"
113
- exit 1
114
- fi
115
- ```
116
-
117
- ### Safe Git Commits
59
+ ## Prerequisites
118
60
 
119
- **Use heredoc for commit messages to prevent injection:**
61
+ Before using codex, verify:
120
62
 
121
- ```bash
122
- # GOOD - safe from injection
123
- git commit -F - <<EOF
124
- decision({active}): {summary}
125
- EOF
63
+ 1. **Repo cloned:** Check if `codex_repo` path exists
64
+ 2. **gh CLI:** Required for PR workflows
126
65
 
127
- # BAD - vulnerable to injection
128
- git commit -m "decision({active}): {summary}"
129
- ```
66
+ # Check repo exists
67
+ ls -la {codex_repo}
130
68
 
131
- ### Access Control
69
+ # Check gh CLI
70
+ gh --version
132
71
 
133
- **Check repo access before attempting write operations:**
72
+ If prerequisites fail, guide user to fix:
134
73
 
135
- ```bash
136
- # Verify push access before making changes
137
- if ! git -C {codex_repo} push --dry-run 2>/dev/null; then
138
- echo "Error: No push access to codex repo. Check your permissions."
139
- exit 1
140
- fi
141
- ```
74
+ - Repo missing: `git clone git@github.com:orderful/orderful-codex.git {path}`
75
+ - gh missing: `brew install gh && gh auth login`
142
76
 
143
77
  ## Configuration
144
78
 
145
79
  **ALWAYS run `droid config --get tools.codex` first and parse the JSON output.**
146
80
 
147
- | Setting | Default | Description |
148
- | ---------------- | --------------------------------- | ----------------------------- |
149
- | `codex_repo` | `~/src/github.com/orderful-codex` | Path to local codex repo |
150
- | `freshness_days` | `30` | Days before staleness warning |
151
-
152
- ## Categories
153
-
154
- The codex has five categories:
155
-
156
- | Category | Path | Purpose |
157
- | ----------- | ------------------------- | ----------------------------------------------------- |
158
- | `projects` | `{codex_repo}/projects/` | Feature/project context (PRD, tech design, decisions) |
159
- | `domains` | `{codex_repo}/domains/` | Business domain knowledge - the "what" and "why" |
160
- | `proposals` | `{codex_repo}/proposals/` | Ideas and future direction - not yet committed |
161
- | `patterns` | `{codex_repo}/patterns/` | Cross-cutting technical patterns |
162
- | `topics` | `{codex_repo}/topics/` | Explored codebase areas with freshness tracking |
81
+ | Setting | Default | Description |
82
+ |---------|---------|-------------|
83
+ | codex_repo | ~/src/github.com/orderful-codex | Path to local codex repo |
84
+ | freshness_days | 30 | Days before staleness warning |
163
85
 
164
86
  ## Commands
165
87
 
166
- | Command | Action |
167
- | -------------------------------------- | ----------------------------------------------- |
168
- | `/codex` | Show categories overview |
169
- | `/codex projects` | List all projects |
170
- | `/codex domains` | List all domains |
171
- | `/codex proposals` | List all proposals |
172
- | `/codex patterns` | List all patterns |
173
- | `/codex topics` | List all topics |
174
- | `/codex search {query}` | Search and load entry (searches all categories) |
175
- | `/codex search {query} -- {instruction}` | Search, load, then execute follow-up instruction |
176
- | `/codex {category} search {query}` | Search within a specific category only |
177
- | `/codex review {type} --pr {number}` | Conversational review of a document PR |
178
- | `/codex new {category} {name}` | Scaffold new entry (project/domain/proposal/pattern/topic) |
179
- | `/codex decision {text}` | Append to active project's DECISIONS.md |
180
- | `/codex snapshot {type} {file} {name}` | Import PDF/markdown to codex (uses agent) |
181
- | `/codex artifact {file} {project}` | Add supporting artifact to project (uses agent) |
182
-
183
- ## Loading an Entry
184
-
185
- **Trigger:** `/codex search {query}` or user asks to load/check codex for something
186
-
187
- **Category-scoped search:** Narrow search to a specific category:
188
- ```bash
189
- /codex topics search auth # Search within topics only
190
- /codex patterns search webhook # Search within patterns only
191
- /codex projects search transaction # Search within projects only
192
- ```
193
-
194
- **Follow-up instructions:** Use `--` to add an instruction to execute after loading:
195
- ```bash
196
- /codex search transaction-templates -- summarize the PRD
197
- /codex topics search auth -- is this still accurate?
198
- ```
199
- Parse args by splitting on ` -- `. First part = search terms, second part = instruction to execute after loading.
200
-
201
- **Procedure:**
202
-
203
- 1. **Run preamble first:**
204
- ```bash
205
- droid config --get tools.codex | droid exec codex git-preamble --config -
206
- ```
207
- 2. **Read `{codex_repo}/index.yaml`** - this contains all entry names and aliases for fast lookup
208
- 3. Match `{name}` against index keys and aliases (case-insensitive, partial match)
209
- 4. If multiple matches → show list, let user pick
210
- 5. If single match → load directly from the matched path
211
- 6. **For projects → use progressive disclosure:**
212
- - If CONTEXT.md exists → load it automatically (layer 1)
213
- - Offer deeper files only if user needs more detail
214
- - If no CONTEXT.md → synthesise one first (see below)
215
- 7. Check freshness (see below)
216
- 8. Output loaded content with "need more detail?" options
217
-
218
- **Why index?** Avoids expensive file-by-file searching. One read to find any entry by name or alias.
219
-
220
- **Progressive disclosure:** CONTEXT.md is the first layer - a synthesised summary (~2KB) that handles most queries. Only load full PRD/TECH-DESIGN/DECISIONS files when deeper detail is explicitly needed. This avoids loading 30KB+ of docs for simple context questions.
221
-
222
- **If no CONTEXT.md exists for a project:**
223
-
224
- - Synthesise one from PRD.md + TECH-DESIGN.md + DECISIONS.md
225
- - Create branch, commit CONTEXT.md, open PR
226
- - Output the new CONTEXT.md with "need more detail?" options
227
- - **OPTIONAL:** You may use a background agent (Task tool with `run_in_background: true`) to avoid blocking the user, but synchronous generation is fine too
228
-
229
- Full procedure: `references/loading.md`
230
-
231
- ## Freshness Checking
232
-
233
- All codex files have frontmatter:
234
-
235
- ```yaml
236
- ---
237
- title: Feature Name
238
- type: prd | tech-design | context | decisions | pattern | topic | domain | proposal
239
- status: draft | active | complete | archived
240
- created: 2026-01-07
241
- updated: 2026-01-07
242
- confidence: high | medium | low
243
- source: confluence | exploration | implementation
244
- codebase_paths:
245
- - apps/platform-api/src/...
246
- ---
247
- ```
248
-
249
- **Status values (unified across all categories):**
250
-
251
- - `draft` - Initial capture, not ready for consumption
252
- - `active` - Current, being used for implementation
253
- - `complete` - Project shipped, kept for reference
254
- - `archived` - No longer relevant, kept for history
255
-
256
- **When loading any file:**
257
-
258
- 1. Parse frontmatter for `updated` date
259
- 2. Calculate days since update
260
- 3. If > `freshness_days` (default 30):
261
- - Warn: "This doc was last updated {date} ({n} days ago). Want me to verify it's still accurate?"
262
- 4. If `codebase_paths` present:
263
- - Check if those paths have commits since `updated` date
264
- - If yes: "Files in {paths} have changed since this doc was updated. Want me to review?"
265
- 5. If `confidence: low`:
266
- - Note: "This was a quick exploration and may be incomplete"
267
-
268
- ## Active Project Tracking
269
-
270
- Scoped operations (`decision`, `snapshot`) require an active project:
271
-
272
- - When user loads a project via `/codex search {project-name}`, set it as active
273
- - Store active project name in session context
274
- - If scoped operation called with no active project → show project list, let user pick
275
-
276
- ## Adding Decisions
277
-
278
- **Trigger:** `/codex decision {text}` or user wants to capture a decision
279
-
280
- **Procedure:**
281
-
282
- 1. Verify active project exists (if not, prompt to select)
283
- 2. **Run `git-start-write`** with branch `codex/decision-{short-summary}`
284
- 3. Read and append to `{codex_repo}/projects/{active}/DECISIONS.md`
285
- 4. Update `updated` date in frontmatter
286
- 5. **Run `git-finish-write`** with appropriate commit message and PR title
88
+ All codex operations follow workflows defined in the codex repo's `.codex/workflows/` folder.
287
89
 
288
- Full procedure: `references/decisions.md`
90
+ Commands listed below are **convenience aliases** to common workflow operations. Natural language like "add this decision to the codex" works equally well - the AI will map your intent to the appropriate workflow.
289
91
 
290
- ## Adding Topics
92
+ ### Loading & Searching
291
93
 
292
- **Trigger:** `/codex new topic {name}` or user wants to save exploration
94
+ - `/codex` List categories (workflows/loading.md)
95
+ - `/codex {category}` → List entries in category (workflows/loading.md)
96
+ - `/codex search {query}` → Search and load entry (workflows/loading.md)
97
+ - `/codex search {query} -- {instruction}` → Search, load, then execute follow-up (workflows/loading.md)
98
+ - `/codex {category} search {query}` → Category-scoped search (workflows/loading.md)
293
99
 
294
- **Procedure:**
100
+ ### Creating New Entries
295
101
 
296
- 1. **Run `git-start-write`** with branch `codex/topic-{name}`
297
- 2. Create `{codex_repo}/topics/{name}.md` from template
298
- 3. Fill in frontmatter (explored, confidence, codebase_paths)
299
- 4. Fill in content from current exploration/conversation
300
- 5. **Run `git-finish-write`** with appropriate commit message and PR title
102
+ - `/codex new {category} {name}` → Scaffold new entry (workflows/creating.md)
103
+ - Categories are defined in manifest: projects, domains, proposals, patterns, topics
104
+ - Run: `cat {codex_repo}/.codex/manifest.yaml` to see full structure
301
105
 
302
- Full procedure: `references/topics.md`
106
+ ### Adding to Existing Entries
303
107
 
304
- ## Importing Documents
108
+ These are convenience aliases - workflows/adding.md defines the behaviour:
305
109
 
306
- **Trigger:** `/codex snapshot {type} {file} {name}` or user wants to add a file to the codex
110
+ - `/codex decision {text}` - Append decision to active project
111
+ - `/codex action {text}` - Add action item to active project
112
+ - `/codex artifact {file} {project}` - Add supporting artifact
113
+ - `/codex snapshot {type} {file} {name}` - Import document
307
114
 
308
- **IMPORTANT:** Always use the `codex-document-processor` agent to process documents. This keeps the main conversation context lean by offloading heavy document processing.
115
+ ### Reviewing Documents
309
116
 
310
- **Procedure:**
117
+ - `/codex review {type} --pr {number}` → Conversational review
118
+ - Generic flow: workflows/reviewing.md (codex repo)
119
+ - Type-specific facilitation: `references/review/{type}.md` (droid)
311
120
 
312
- 1. Determine the document type (required): `prd`, `tech-design`, `topic`, or `pattern`
313
- 2. **Run `git-start-write`** with branch `codex/snapshot-{name}`
314
- 3. Spawn the `codex-document-processor` agent with:
315
- - File path to the source document
316
- - Document type
317
- - Project/entry name
318
- - Codex repo path from config
319
- 4. Agent writes the processed document to codex repo
320
- 5. **Run `git-finish-write`** with appropriate commit message and PR title
321
- 6. Share PR link with user
121
+ **Architecture:** Codex defines the generic review flow (load PR, navigate sections, provide feedback). Droid defines type-specific facilitation guidance (file patterns, section parsing, consistency checks). This separation ensures the core flow stays in codex while specialized AI instructions stay in droid.
322
122
 
323
- **Example invocations:**
123
+ **Available types:** `tech-design`, `prd`
324
124
 
325
- ```bash
326
- # Explicit snapshot command
327
- /codex snapshot prd ~/Downloads/transaction-templates-prd.pdf transaction-templates
125
+ **Important:** The workflows define behaviour, not the command names. When the codex structure evolves (new file types, new operations), only the codex repo's workflows need updating - the droid skill stays stable.
328
126
 
329
- # Natural language (still uses the agent)
330
- "Add this PRD to the transaction-templates project" + attach file
331
- "Import this tech design to generic-scenario-testing"
332
- ```
333
-
334
- The agent handles: PDF reading, content extraction, frontmatter generation, file writing.
335
- The main conversation handles: git branch, commit, PR creation, user interaction.
336
-
337
- ## Adding Artifacts
127
+ ## Git Hygiene (CRITICAL)
338
128
 
339
- **Trigger:** `/codex artifact {file} {project}` or user wants to add supporting material to a project
129
+ **Users should never see git complexity.** Use the deterministic scripts below - they handle all git operations silently and recover gracefully. Non-engineers use this tool - if they hit a git error, they're stuck.
340
130
 
341
- Artifacts are supplementary documents that support a project but aren't core document types (PRD, TECH-DESIGN, DECISIONS). Examples:
131
+ ### Scripts
342
132
 
343
- - Customer interviews / transcripts
344
- - Research notes
345
- - Meeting summaries
346
- - Spike findings
347
- - Competitor analysis
133
+ The codex skill includes three git scripts. **Always use these instead of raw git commands.**
348
134
 
349
- **Procedure:**
135
+ | Script | Purpose | When to use |
136
+ |--------|---------|-------------|
137
+ | git-preamble | Ensure clean main + pull latest | Before ANY operation |
138
+ | git-start-write | Preamble + create branch | Before write operations |
139
+ | git-finish-write | Commit + PR + return to main | After write operations |
350
140
 
351
- 1. **Run `git-start-write`** with branch `codex/artifact-{project}-{filename}`
352
- 2. Use the `codex-document-processor` agent with type `artifact`
353
- 3. Agent writes to `{codex_repo}/projects/{project}/artifacts/{filename}.md`
354
- 4. **Run `git-finish-write`** with appropriate commit message and PR title
141
+ ### Read Operations
355
142
 
356
- **Example invocations:**
143
+ droid config --get tools.codex | droid exec codex git-preamble --config -
144
+ # Then proceed with the read
357
145
 
358
- ```bash
359
- /codex artifact ~/Downloads/customer-interview-acme.pdf transaction-templates
360
- /codex artifact ~/notes/spike-handlebars-perf.md partnership-automation
361
- ```
146
+ ### Write Operations
362
147
 
363
- Artifacts get lighter frontmatter with `type: artifact` and source like `interview`, `transcript`, `notes`, `meeting`, `research`, `spike`, or `analysis`.
148
+ # 1. Start write (runs preamble + creates branch)
149
+ droid config --get tools.codex | droid exec codex git-start-write --config - --branch codex/{action}-{name}
364
150
 
365
- ## Reviewing Documents
151
+ # 2. Make your changes (write files)
366
152
 
367
- **Trigger:** `/codex review {type} --pr {number}`
153
+ # 3. Finish write (commit + PR + return to main)
154
+ droid config --get tools.codex | droid exec codex git-finish-write --config - \
155
+ --message "{commit message}" \
156
+ --pr-title "{PR title}" \
157
+ --pr-body "{PR description}"
368
158
 
369
- **Procedure:**
159
+ The scripts return JSON with success/failure status. Check the result before proceeding.
370
160
 
371
- 1. **Run preamble:** `droid config --get tools.codex | droid exec codex git-preamble --config -`
372
- 2. **Fetch PR info:** `gh pr view {number} --json files,title`
373
- 3. **Filter & Load:** Identify the primary document (e.g., `TECH-DESIGN.md`) and context (e.g., `thought-doc.md`) based on the `{type}` definition.
374
- 4. **Interactive Review:** Guide the user through the document sections.
161
+ ### Error Handling
375
162
 
376
- Full procedure: `references/review/workflow.md`
377
- Type definitions: `references/review/{type}.md`
163
+ The scripts handle errors internally:
378
164
 
379
- ## Creating New Entries
165
+ - Silent recovery for transient issues
166
+ - Clear error messages in JSON output
167
+ - Automatic return to main even on partial failure
380
168
 
381
- **Trigger:** `/codex new {category} {name}`
169
+ If a script fails, check the JSON `error` field and report a user-friendly message:
382
170
 
383
- **Categories:** `project` | `domain` | `proposal` | `pattern` | `topic`
171
+ - "I hit a sync issue with the codex. Let me try again..."
172
+ - Only escalate as last resort: "The codex repo needs manual attention."
384
173
 
385
- **Procedure** (same for all categories):
174
+ ## Security
386
175
 
387
- 1. **Run `git-start-write`** with branch `codex/{category}-{name}`
388
- 2. Create entry from template:
389
- - `project` → folder with PRD.md, TECH-DESIGN.md, DECISIONS.md
390
- - Others → single file at `{codex_repo}/{category}s/{name}.md`
391
- 3. Fill in frontmatter with today's date
392
- 4. **Run `git-finish-write`** with appropriate commit message and PR title
176
+ ### Input Validation
393
177
 
394
- Full procedure: `references/creating.md`
178
+ **Always validate user-provided names before using in paths:**
395
179
 
396
- ## Integration with /project
180
+ # REJECT names containing path traversal attempts
181
+ if [[ "{name}" == *".."* ]] || [[ "{name}" == *"/"* ]]; then
182
+ echo "Invalid name: must not contain '..' or '/'"
183
+ exit 1
184
+ fi
397
185
 
398
- The codex holds **shared** organizational knowledge. The `/project` skill holds **personal** working memory.
186
+ # REJECT names with shell metacharacters
187
+ if [[ "{name}" =~ [\$\`\|\;\&\>\<] ]]; then
188
+ echo "Invalid name: contains unsafe characters"
189
+ exit 1
190
+ fi
399
191
 
400
- ```
401
- /codex search transaction-templates → load shared context
402
- /project create --from codex:{name} → seed personal PROJECT.md
403
- /codex publish → promote learnings back (future)
404
- ```
192
+ ### Safe Git Commits
405
193
 
406
- When user runs `/project create --from codex:{name}`:
194
+ **Use heredoc for commit messages to prevent injection:**
407
195
 
408
- 1. Load the codex entry
409
- 2. Extract key context for personal PROJECT.md
410
- 3. Create project in user's projects_dir
196
+ # GOOD - safe from injection
197
+ git commit -F - <<EOF
198
+ decision({active}): {summary}
199
+ EOF
411
200
 
412
- ## Git Workflow
201
+ # BAD - vulnerable to injection
202
+ git commit -m "decision({active}): {summary}"
413
203
 
414
- **See "Git Hygiene (CRITICAL)" section above.** All codex changes go through PRs (main branch is protected).
204
+ ### Access Control
415
205
 
416
- **Key points:**
206
+ **Check repo access before attempting write operations:**
417
207
 
418
- - Always run the preamble before any operation (ensures clean main + latest)
419
- - Write operations: branch commit PR → **return to main**
420
- - Safe changes (new files, decision appends) auto-merge via GitHub Action
421
- - Never leave the repo on a feature branch
208
+ # Verify push access before making changes
209
+ if ! git -C {codex_repo} push --dry-run 2>/dev/null; then
210
+ echo "Error: No push access to codex repo. Check your permissions."
211
+ exit 1
212
+ fi
@@ -0,0 +1,56 @@
1
+ # Reading Codex Workflows
2
+
3
+ Codex workflows are AI-readable markdown files that describe how to perform operations.
4
+
5
+ ## Workflow Structure
6
+
7
+ Each workflow file follows this pattern:
8
+
9
+ ### Trigger
10
+ When to use this workflow (command pattern or user intent)
11
+
12
+ ### Procedure
13
+ Step-by-step instructions with bash commands and file operations
14
+
15
+ ### Output
16
+ What to show the user
17
+
18
+ ## Reading a Workflow
19
+
20
+ 1. **Read entire workflow file:**
21
+
22
+ cat {codex_repo}/.codex/workflows/{operation}.md
23
+
24
+ 2. **Parse the Procedure section** - Follow steps sequentially
25
+
26
+ 3. **Reference manifest when needed:**
27
+ - Scaffold rules: categories.{type}.minimal_scaffold
28
+ - Frontmatter schema: file_types.{type}
29
+ - Templates location: templates_dir
30
+
31
+ 4. **Execute using your tools** (Read, Write, Bash, etc.)
32
+
33
+ ## Example: Creating a Project
34
+
35
+ # 1. Read workflow
36
+ cat {codex_repo}/.codex/workflows/creating.md
37
+
38
+ # 2. Read manifest for scaffold
39
+ cat {codex_repo}/.codex/manifest.yaml
40
+ # Extract: categories.projects.minimal_scaffold → ["CONTEXT.md", "DECISIONS.md"]
41
+
42
+ # 3. Follow workflow procedure
43
+ # - Start git write
44
+ # - mkdir projects/{name}
45
+ # - Copy templates
46
+ # - Update frontmatter
47
+ # - Finish git write
48
+
49
+ ## Workflow Files
50
+
51
+ | File | Purpose |
52
+ |------|---------|
53
+ | loading.md | Search, match, progressive disclosure, freshness checking |
54
+ | creating.md | Scaffold new entries (projects, domains, patterns, topics, proposals) |
55
+ | adding.md | Write to existing entries (decisions, actions, artifacts, snapshots) |
56
+ | reviewing.md | Conversational PR review with section navigation |
@@ -0,0 +1,49 @@
1
+ # PRD Document Type
2
+
3
+ Configuration for reviewing Product Requirements Documents via `/codex review prd`.
4
+
5
+ ## File Patterns
6
+
7
+ | Role | Pattern | Description |
8
+ | --- | --- | --- |
9
+ | **Primary** | `**/PRD.md` | The main document being reviewed. Sections are parsed from here. |
10
+ | **Context** | `**/artifacts/*.md` | Supporting materials. Check frontmatter for type/source to identify purpose. |
11
+
12
+ **Context file types** (identified by frontmatter):
13
+ - `type: artifact` with `source: interview` → Customer interviews
14
+ - `type: artifact` with `source: research` → Research notes
15
+ - `type: artifact` with `source: analysis` → Competitive analysis
16
+ - `type: artifact` with `source: meeting` → Meeting notes
17
+
18
+ *Note: In the MVP, we assume a single PRD.md per PR.*
19
+
20
+ ## Section Parsing
21
+
22
+ **Parse sections flexibly based on the document's actual structure.** Different PMs have different organisational preferences.
23
+
24
+ **Suggested approach:**
25
+ - Try H2 headers (`## `) as top-level sections first
26
+ - If the document uses H3 (`###`) as primary sections, adapt to that
27
+ - Look at the document hierarchy and follow what the author used
28
+
29
+ **The tool dynamically discovers ALL sections present in the document.** It does not filter for specific section names - let the PM's structure guide the review navigation.
30
+
31
+ **Common sections** (examples, not exhaustive):
32
+ - Overview
33
+ - Problem Statement
34
+ - User Stories
35
+ - Requirements
36
+ - Success Metrics
37
+ - Timeline
38
+ - Out of Scope
39
+ - Open Questions
40
+ - Competitive Analysis
41
+
42
+ Authors may include additional sections (e.g., "Security Requirements", "Compliance", "Business Impact") and the tool will present them for navigation.
43
+
44
+ ## Consistency Checks (Deferred)
45
+
46
+ *Future feature: Rules to automatically check consistency.*
47
+ - "Success Metrics" section must have measurable criteria
48
+ - "Requirements" should distinguish functional vs non-functional
49
+ - "Out of Scope" should reference items mentioned elsewhere