@webpresso/plugin-codex 0.0.10 → 0.0.11

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-kit",
-  "version": "0.0.10",
+  "version": "0.0.11",
   "description": "Webpresso agent-kit: blueprints, skills, hooks, and MCP server",
   "author": {
     "name": "Webpresso",

package/bin/wp

@@ -1,60 +1,54 @@
-#!/usr/bin/env node
-
-import { spawnSync } from "node:child_process";
-import { accessSync, constants, statSync } from "node:fs";
-import { dirname, join } from "node:path";
-import { homedir } from "node:os";
-import { fileURLToPath } from "node:url";
-
-const shimPath = fileURLToPath(import.meta.url);
-
-function isExecutableFile(candidate) {
-  try {
-    const stat = statSync(candidate);
-    if (!stat.isFile()) return false;
-    if (process.platform !== "win32") accessSync(candidate, constants.X_OK);
-    return true;
-  } catch {
-    return false;
-  }
+#!/bin/sh
+# Resolve the Webpresso `wp` executable and hand this process over to it.
+#
+# `exec` rather than a spawn wrapper: the MCP server this shim launches is a
+# long-lived stdio service, and a wrapper process that merely relays for it is a
+# layer that can die while leaving the server behind, orphaned and holding the
+# client's pipe. After `exec` there is no shim process left to strand — the
+# launcher IS this pid, so the host's signals and pipe closure reach it directly.
+# It also makes every non-MCP command a byte-exact passthrough, including TTY
+# behavior that a relay would otherwise disturb.
+#
+# Arguments are forwarded verbatim through the quoted "$@" expansion. The plugin
+# manifest invokes this file as `bin/wp mcp`, so dropping or word-splitting
+# arguments would silently break the only real launch surface.
+
+set -u
+
+fail() {
+  printf '%s\n' "$1" >&2
+  exit 1
 }
 
-function assertExecutableWp(candidate, label) {
-  if (isExecutableFile(candidate) && candidate !== shimPath) return candidate;
-  throw new Error(
-    `${label} points to ${candidate}, but that executable is not available. ` +
-      "Set WEBPRESSO_WP_BIN to the Webpresso wp executable, set WP_FORCE_JIT_PATH to an agent-kit checkout, or install the Webpresso app.",
-  );
-}
-
-function fixedAppWpLauncher() {
-  const home = process.platform === "win32" ? process.env.USERPROFILE || homedir() : homedir();
-  return process.platform === "win32"
-    ? join(home, ".webpresso", "bin", "wp.exe")
-    : join(home, ".webpresso", "bin", "wp");
-}
-
-function resolveWebpressoWp() {
-  const explicitPath = process.env.WEBPRESSO_WP_BIN;
-  const jitRoot = process.env.WP_FORCE_JIT_PATH;
-  if (explicitPath && jitRoot) {
-    throw new Error("WEBPRESSO_WP_BIN and WP_FORCE_JIT_PATH are both set; unset one.");
-  }
-  if (explicitPath) return assertExecutableWp(explicitPath, "WEBPRESSO_WP_BIN");
-  if (jitRoot) return assertExecutableWp(join(jitRoot, "bin", "wp"), "WP_FORCE_JIT_PATH");
-  return assertExecutableWp(fixedAppWpLauncher(), "Webpresso app launcher");
-}
-
-const result = spawnSync(resolveWebpressoWp(), process.argv.slice(2), {
-  stdio: "inherit",
-  env: {
-    ...process.env,
-    WP_SKIP_UPDATE_CHECK: process.env.WP_SKIP_UPDATE_CHECK ?? "1",
-  },
-});
-
-if (result.error) {
-  throw result.error;
-}
-
-process.exit(result.status ?? (result.signal ? 1 : 0));
+: "${WEBPRESSO_WP_BIN:=}"
+: "${WP_FORCE_JIT_PATH:=}"
+
+if [ -n "$WEBPRESSO_WP_BIN" ] && [ -n "$WP_FORCE_JIT_PATH" ]; then
+  fail "WEBPRESSO_WP_BIN and WP_FORCE_JIT_PATH are both set; unset one. Product path is the Webpresso app launcher (~/.webpresso/bin/wp) or monorepo JIT (WP_FORCE_JIT_PATH to a webpresso/app checkout). Do not dual-set overrides."
+fi
+
+if [ -n "$WEBPRESSO_WP_BIN" ]; then
+  target=$WEBPRESSO_WP_BIN
+  source_label=WEBPRESSO_WP_BIN
+elif [ -n "$WP_FORCE_JIT_PATH" ]; then
+  target=$WP_FORCE_JIT_PATH/bin/wp
+  source_label=WP_FORCE_JIT_PATH
+else
+  target=${HOME:-}/.webpresso/bin/wp
+  source_label="Webpresso app launcher"
+fi
+
+# Refuse to exec this shim again: a self-referential target would loop forever
+# instead of failing with a diagnostic.
+if [ "$target" = "$0" ]; then
+  fail "$source_label points to this shim ($target); set it to the Webpresso wp executable instead."
+fi
+
+if [ ! -f "$target" ] || [ ! -x "$target" ]; then
+  fail "$source_label points to $target, but that executable is not available. Set WEBPRESSO_WP_BIN to the Webpresso wp executable, set WP_FORCE_JIT_PATH to an agent-kit checkout, or install the Webpresso app."
+fi
+
+WP_SKIP_UPDATE_CHECK=${WP_SKIP_UPDATE_CHECK:-1}
+export WP_SKIP_UPDATE_CHECK
+
+exec "$target" "$@"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webpresso/plugin-codex",
-  "version": "0.0.10",
+  "version": "0.0.11",
   "private": false,
   "description": "Codex plugin adapter for Webpresso agent-kit skills, hooks, and MCP runtime.",
   "homepage": "https://github.com/webpresso/app#readme",

package/plugin-skill-ownership.json

@@ -2,14 +2,14 @@
   "schemaVersion": 1,
   "host": "codex",
   "packageName": "@webpresso/plugin-codex",
-  "packageVersion": "0.0.10",
+  "packageVersion": "0.0.11",
   "runtimeDirs": [".codex/skills", ".agents/skills"],
   "skills": {
     "ai-deslop": {
       "digest": "sha256:cf07df5835037f10401400e220c1c923f5325a6149d59c231ce316e10595fdfc"
     },
     "autopilot": {
-      "digest": "sha256:aeace230b2443b5e531179fa5bb5a7a9214d341c72199d8ada0211999627cbb8"
+      "digest": "sha256:fc0f77917bd7af3d6e99ce3a96067394308a3b8c94c416b5076167b19e00a754"
     },
     "autoresearch": {
       "digest": "sha256:b4d51cd53beb4a3271827172dfbd0b1d27bd58761ca07a35d49a5d6324b87fdf"
@@ -21,10 +21,10 @@
       "digest": "sha256:21fd24862e7f7c8a1feadea6bc376492b136b99fc381cf1b8927c9db80615431"
     },
     "claude": {
-      "digest": "sha256:908367f139d3c3e033248be5e4b003475b01b62d4851ad1ff271079af76a53f8"
+      "digest": "sha256:e1e97e5419249fbb0cb8446e96fc8e80c165c149db563784570f96ad629ab54d"
     },
     "codex": {
-      "digest": "sha256:9cf714ed78dafbb2370e8f6e4bee5f22db7d540444c4dd96540c8b8dd22bd4a4"
+      "digest": "sha256:1f93db92066e5b39ba334ec1d8c3af3de79dea13947dba97b8b7340302906d63"
     },
     "deep-interview": {
       "digest": "sha256:79fbf86a86024a311583a1500bb6960c82ad1383cc9f8ed3f04bbace41848ff7"
@@ -45,13 +45,13 @@
       "digest": "sha256:38ddebb82a73e9e18e5b9909585a8477285387ac7bbad2574e3708362c4d0475"
     },
     "grok": {
-      "digest": "sha256:796104b04f70c8dd48cf1056c8d72d9492648f89486a35515e00af1d0de42f0a"
+      "digest": "sha256:1a6bf596fde9ce50a06ea767c06e65d4845c52d5af085644c958964385363b1e"
     },
     "handoff": {
       "digest": "sha256:eb34b39fc6d416fe8203eea979b4b99ab3150c44da6dad3ca4afb8fe8fb75b85"
     },
     "hooks-doctor": {
-      "digest": "sha256:273bdb0ce597604301648c8c149f20bb92bfa64c9015f4a89e88e932c6501a9e"
+      "digest": "sha256:30286e9ef1c64f2c01d05b0e13a39c54741c7a3e02e5d18636795a7517c0b566"
     },
     "investigate": {
       "digest": "sha256:778b3a1f38323e8dd6101c6ace26ff8aada1246b20952b3641d5d1049bc50055"
@@ -60,7 +60,7 @@
       "digest": "sha256:a80fbacc765e8b886437b9fdf7dd71e1ceb1b98b939078ec90fc88d06a8b4c69"
     },
     "opencode-go": {
-      "digest": "sha256:c9d9e2c59a4e0c895ddd92c5bc5a55d9feb670a9d44cedb96a893eb2aa9cfd7b"
+      "digest": "sha256:c47cbe07f96510112d1bccae0a6319d3f74a5e2f3827a59865d45aea757c6dc6"
     },
     "plan-ceo-review": {
       "digest": "sha256:4d426158518dd71f8998770e8d4037bcbfa3c65d7265a93a4a78a9b015ba881e"
@@ -75,31 +75,31 @@
       "digest": "sha256:b728dad90254d4c9f81b3818321d34ab53519b79ce20ff3bfe08bfacb2aa3e86"
     },
     "plan-refine": {
-      "digest": "sha256:ff848de26414f9b0d015c75051d872db7d2c4de1893a9d5cd55b640392e3f836"
+      "digest": "sha256:cf2c0743a81b0d8954417482e7812212a6a90e5046926c44cd82a6a309dfdc26"
     },
     "ralplan": {
-      "digest": "sha256:36d54cf48f92f16cf23362b6616646f883651f0cf8d8ce1b98a386f0021bfe22"
+      "digest": "sha256:47cf47910b50471eb92f9487a018311442c95b26907c5b21c3f5b87947bf7e7e"
     },
     "team": {
       "digest": "sha256:c27107b46e0cd7b9c264a6f51f74f505920d63e7ee2a2d26d2f288592fd10bd2"
     },
     "tech-debt": {
-      "digest": "sha256:a34fa1039d68adc4c875af75cb79ddedcee3414a98b63194a9d8eca4671b5264"
+      "digest": "sha256:bec6c83a18e55d148af973dd84d34a8750d8a8fe4345e5fca7b9e8c3e876fd9a"
     },
     "testing-philosophy": {
-      "digest": "sha256:22533e26549b60494f042b5f4d7c97abf2019fc0a60697f84a395fa48ef0147f"
+      "digest": "sha256:23fdad944b089de3cfcd13957a5ac10c37bd3d136b192029af69368bca1470db"
     },
     "tooling-friction": {
-      "digest": "sha256:12a24fc747e3481aa857ace38993cd0324686ba70ffec115ff1a1955bd5999bc"
+      "digest": "sha256:569904882036df09b52864411332ad5ea53e2914bc58d90030a0676f50bee228"
     },
     "tph": {
       "digest": "sha256:bed3684a850651534f315d355cdeae50d951c429817df0f105cccdb7f4e1561b"
     },
     "ultragoal": {
-      "digest": "sha256:137a063d5e286934b92b1d87397b7183f8ea6c564cddc3bb7e6cde5f3f306aaf"
+      "digest": "sha256:caa61789eb5ce01940cfaccf7e70e9290c1f318cb31e25d038eb45b26970c39c"
     },
     "verify": {
-      "digest": "sha256:071c47c39e0881e381468cadbbd266f99d29c31eae2caf15c22d57591a1dbf94"
+      "digest": "sha256:03bd3b922a24d19ccc0b942d4f56d97f09e24939220a69d8fad8ba1144085d12"
     }
   }
 }

package/skills/autopilot/SKILL.md

@@ -25,7 +25,7 @@ using `wp_ultragoal_run` / `wp ultragoal run` and the current handoff.
 
 ## Outside-voice (required)
 
-After each ultragoal **phase or plan-gate milestone**, run an **OpenCode Go** outside-voice review and pick the model by purpose. The purpose→family ordering lives in one place — the committed reviewer policy rendered into the `opencode-go` skill — so follow that skill and do not restate the ordering here. Resolve IDs from live `opencode models opencode-go`. `wp_review_gate` is only for exact-version draft plan approval/auto-promotion; `wp_review_run` is advisory for implementation/phase review and never mutates blueprint approval state. Never self-approve. Full protocol: the `ultragoal` skill. Respect `review_budget` (default owned by `workflow-skills-routing.md`): one sequential path, no multi-host stampede.
+After each ultragoal **phase or plan-gate milestone**, run an **OpenCode Go** outside-voice review and pick the model by purpose. The purpose→family ordering lives in one place — the committed reviewer policy rendered into the `opencode-go` skill — so follow that skill and do not restate the ordering here. Resolve IDs from live `opencode models opencode-go`. `wp_review_gate` in the default authoritative mode is only for exact-version draft plan approval/auto-promotion; the same tool called with `mode: "advisory"` is for implementation/phase review and never mutates blueprint approval state on its own — a later authoritative call may promote a matching advisory approval without re-invoking a provider. Never self-approve. Full protocol: the `ultragoal` skill. Respect `review_budget` (default owned by `workflow-skills-routing.md`): one sequential path, no multi-host stampede.
 
 ## Vague gate
 

package/skills/claude/SKILL.md

@@ -1,186 +1,44 @@
 ---
 name: claude
-description: "Claude CLI outside-voice wrapper for review, adversarial challenge, or consultation from non-Claude hosts."
+description: "Claude outside-voice reviewer through Webpresso MCP."
 license: MIT
 ---
 
-# Claude outside voice
+# Claude outside-voice review
 
-Use when a non-Claude host needs Claude to review a diff, challenge a plan, or answer a focused repo question. Keep it bounded/read-only unless asked otherwise, and report Claude output as advice, not verified fact.
+Use only for a requested content-bound plan or delivery review. Treat output as external advice
+until independently verified.
 
-## Single-shot budget (anti-stampede)
+## MCP-only contract
 
-- Default: **one** review invocation per request.
-- Do **not** spawn parallel Claude + Codex + Grok + OpenCode reviews unless the user set `review_budget`/`N` > 1.
-- Prefer MCP `wp_review_run`, then the `wp review run` CLI fallback, over hand-rolled multi-agent loops.
-- Bounded payload only (see below). Split large diffs across sequential calls, never unbounded whole-PR dumps.
+- Call `wp_review_gate` exactly once for the real plan version or delivery diff.
+- Observe the same durable operation with `wp_review_gate_wait` when needed.
+- Never invoke a provider command, the legacy review CLI, or a removed review-run surface.
+- If the review MCP is unavailable, stop and report it unavailable. There is no CLI fallback.
 
-## Primary path: the `wp_review_run` MCP tool
-
-When the webpresso MCP server is available, call `wp_review_run` exactly once
-instead of any bash block below. It is the same `wp review run` typed runtime,
-called in-process, and takes a `prompt` string without `--prompt-file` bookkeeping.
-Use the default review stage.
+## Advisory call
 
 ```jsonc
-// wp_review_run MCP tool call
 {
-  "prompt": "<diff summary + what to look for>",
+  "project_id": "<project>",
+  "slug": "<blueprint-slug>",
+  "purpose": "delivery",
+  "base_ref": "<full-base-sha>",
+  "authority_ref": "<full-head-sha>",
   "provider": "claude",
-  // model, effort, artifactRoot, idleSeconds, and stage are optional and
-  // default the same way the `wp review run` CLI does. The default stage is
-  // review.
+  "repository_access": "none",
+  "mode": "advisory",
 }
 ```
 
-Use the requested provider for this invocation. Do not retry, use provider
-fallback, or rotate accounts within the invocation. Never shell into a
-provider CLI when MCP is available; that bypasses typed artifact capture under
-`.webpresso/reviews`.
-
-For long-running reviews, prefer the async MCP path: call `wp_review_run` with
-`"provider": "claude"` and `"background": true`, then poll `wp_review_wait`
-with the returned `runId`. Do not solve MCP transport limits by inflating
-synchronous review timeouts.
-
-The bash blocks in this skill (below) are the **MCP-unavailable fallback only**
-— use them when the webpresso MCP server itself is not reachable in the current
-host, not as a provider-fallback mechanism.
-
-## MCP-unavailable fallback: auth check
-
-Use local Claude CLI login directly; do not route through Anthropic API-key env vars.
-
-```bash
-AUTH_STATUS_FILE=$(mktemp -t wp-claude-auth.XXXXXX)
-trap 'rm -f "$AUTH_STATUS_FILE"' EXIT
-if ! claude auth status --json >"$AUTH_STATUS_FILE" 2>/dev/null; then
-  if ! claude auth status >"$AUTH_STATUS_FILE" 2>/dev/null; then
-    echo "CLAUDE_AUTH=missing: run claude auth login with the intended Claude Max account"
-    exit 1
-  fi
-fi
-if grep -E '"(authenticated|loggedIn|success)"[[:space:]]*:[[:space:]]*true' "$AUTH_STATUS_FILE" >/dev/null; then
-  echo "CLAUDE_AUTH=cli-login"
-else
-  echo "CLAUDE_AUTH=missing: claude auth status did not report a recognized Claude CLI login"
-  exit 1
-fi
-```
-
-## MCP-unavailable fallback: portable prompt file
-
-Use a suffix-free `mktemp -t` pattern so macOS and Linux both work:
-
-```bash
-PROMPT_FILE=$(mktemp -t wp-claude-review.XXXXXX)
-trap 'rm -f "$PROMPT_FILE"' EXIT
-```
-
-## Dashboard helper relation
-
-When this skill runs under `wp dash`, record the outside-voice lifecycle with
-`wp dash-helper-start --provider claude --role reviewer` and
-`wp dash-helper-complete --provider claude --role reviewer --outcome <completed|failed>`
-using the actual terminal outcome and artifact path.
-Outside the dashboard, skip helper emission. Claude's managed native subagent
-lifecycle is not parent-linked; this unsupported coverage must stay explicit,
-and completion must never be inferred from transcript text or timing.
-
-## Modes
-
-### Review
-
-Use single-file / single-question first for any non-trivial diff. Do not send a whole PR unless it already fits within the bounded payload below.
-
-**Model policy:** leave `CLAUDE_REVIEW_MODEL` unset unless the user requested a
-specific Claude model (for example `fable` for a lighter advisory pass). When it
-is unset, `wp review run` lets the Claude CLI choose its own default by omitting
-`--model`. The blueprint promotion/completion approval gate
-(`catalog/agent/rules/pre-implementation.md`) validates reviewer identity
-(`claude`/`codex`/`grok`/an OpenCode-Go model), not the reviewed model string, so do not
-claim the gate rejects a different Claude model.
-
-#### Bounded prompt payload
-
-Always include:
-
-- current branch and base branch
-- `git diff --stat`
-- changed file list
-- one targeted file diff or one narrow snippet/hunk only, capped to a fixed size
-
-Prefer ~12 KB or ~200 lines per call. Split large reviews instead of raising the cap.
-
-```bash
-BASE_BRANCH=${BASE_BRANCH:-origin/main}
-CURRENT_BRANCH=$(git rev-parse --abbrev-ref HEAD)
-TARGET_FILE=${TARGET_FILE:?set TARGET_FILE to one changed file}
-
-{
-  printf 'Outside review mode: focused diff review\n'
-  printf 'Base branch: %s\nCurrent branch: %s\n\n' "$BASE_BRANCH" "$CURRENT_BRANCH"
-  printf 'git diff --stat %s...HEAD\n' "$BASE_BRANCH"
-  git diff --stat "$BASE_BRANCH"...HEAD
-  printf '\nChanged files:\n'
-  git diff --name-only "$BASE_BRANCH"...HEAD
-  printf '\nTarget file: %s\n' "$TARGET_FILE"
-  printf 'Bounded target diff (max 12000 bytes):\n'
-  git diff --unified=3 "$BASE_BRANCH"...HEAD -- "$TARGET_FILE" | \
-    head -c 12000
-  printf '\n\nQuestion: Identify the highest-signal correctness, security, data-loss, or maintainability risk in %s. Quote only the smallest relevant excerpt. If context is insufficient, answer INSUFFICIENT_CONTEXT.\n' "$TARGET_FILE"
-} >"$PROMPT_FILE"
-```
-
-#### Progress-aware review runtime
-
-Run one review through the typed `wp review run` owner. Skills must not embed
-subprocess supervision. The runtime consumes Claude's streaming JSON events,
-advances its idle clock only on monotonic semantic progress, and has no total
-wall-clock cutoff.
-
-The artifact root contains private runtime diagnostics, not a recorded
-transcript or committable approval evidence. Direct `wp review run` output is
-advisory. `wp_review_gate` is plan-only exact-version draft approval/auto-promotion;
-implementation/phase reviews use advisory `wp_review_run` and never mutate
-blueprint approval state. CLI delivery gates are MCP-unavailable compatibility only.
-
-```bash
-CLAUDE_REVIEW_MODEL=${CLAUDE_REVIEW_MODEL:-}
-CLAUDE_MODEL_ARGS=()
-if [ -n "$CLAUDE_REVIEW_MODEL" ]; then
-  CLAUDE_MODEL_ARGS=(--model "$CLAUDE_REVIEW_MODEL")
-fi
-CLAUDE_REVIEW_EFFORT=${CLAUDE_REVIEW_EFFORT:-medium}
-CLAUDE_REVIEW_IDLE_SECONDS=${CLAUDE_REVIEW_IDLE_SECONDS:-180}
-CLAUDE_REVIEW_ARTIFACT_ROOT=${CLAUDE_REVIEW_ARTIFACT_ROOT:-"$(pwd)/.webpresso/reviews"}
-CLAUDE_REVIEW_CODE=0
-wp review run \
-  --provider claude \
-  --prompt-file "$PROMPT_FILE" \
-  "${CLAUDE_MODEL_ARGS[@]}" \
-  --effort "$CLAUDE_REVIEW_EFFORT" \
-  --stage review \
-  --artifact-root "$CLAUDE_REVIEW_ARTIFACT_ROOT" \
-  --idle-seconds "$CLAUDE_REVIEW_IDLE_SECONDS"
-CLAUDE_REVIEW_CODE=$?
-```
-
-Treat `true-idle`, `protocol-unsupported`, provider failure, abort, spawn failure, or artifact failure as an unavailable advisory result. Never replace them with a static timeout, arbitrary byte-growth heartbeat, or buffered-output fallback.
-
-#### Invocation policy
-
-Run one provider review per invocation. Do not retry, fall back to another
-provider, or rotate accounts within the invocation. A new invocation requires
-an explicit diagnosis and caller decision. Do not fall back to an unbounded
-whole-PR prompt.
-
-Summarize findings with severity, evidence, model, artifact path, and whether you independently verified them.
+Use authoritative mode only when formal plan or delivery approval is requested.
 
-### Challenge
+## Model policy
 
-Ask Claude to argue against the current plan: hidden assumptions, failure modes, missing tests, and simpler alternatives.
+When the user names an exact model, pass it in the MCP `model` field. Otherwise omit
+that field and let the MCP owner select the configured provider default.
 
-### Consult
+## Review quality
 
-Ask a focused repo question. Include only the necessary file paths and snippets; do not send secrets.
+Follow `catalog/agent/rules/review-methodology-sota.md`; report typed verdict, model,
+artifact, grounded findings, and independently verified conclusions.

package/skills/codex/SKILL.md

@@ -1,142 +1,44 @@
 ---
 name: codex
-description: "Codex CLI outside-voice wrapper for code review, plan challenge, or consultation from non-Codex hosts."
+description: "Codex outside-voice reviewer through Webpresso MCP."
 license: MIT
 ---
 
-# Codex outside voice
+# Codex outside-voice review
 
-Use this skill from Claude or another non-Codex host when the user wants Codex to independently review a diff, challenge a plan, or answer a repo question. Keep Codex read-only by default and treat its answer as external advice until independently verified.
+Use only for a requested content-bound plan or delivery review. Treat output as external advice
+until independently verified.
 
-## Primary path: the `wp_review_run` MCP tool
+## MCP-only contract
 
-When the webpresso MCP server is available, call `wp_review_run` exactly once instead of any bash block below. It is the same `wp review run` typed runtime, called in-process, and takes a `prompt` string without `--prompt-file` bookkeeping. Use the default review stage.
+- Call `wp_review_gate` exactly once for the real plan version or delivery diff.
+- Observe the same durable operation with `wp_review_gate_wait` when needed.
+- Never invoke a provider command, the legacy review CLI, or a removed review-run surface.
+- If the review MCP is unavailable, stop and report it unavailable. There is no CLI fallback.
+
+## Advisory call
 
 ```jsonc
-// wp_review_run MCP tool call
 {
-  "prompt": "<diff summary + what to look for>",
+  "project_id": "<project>",
+  "slug": "<blueprint-slug>",
+  "purpose": "delivery",
+  "base_ref": "<full-base-sha>",
+  "authority_ref": "<full-head-sha>",
   "provider": "codex",
-  // model, effort, artifactRoot, idleSeconds, and stage are optional and
-  // default the same way the `wp review run` CLI does. The default stage is
-  // review.
+  "repository_access": "none",
+  "mode": "advisory",
 }
 ```
 
-Use the requested provider for this invocation. Do not retry, use provider fallback, or rotate accounts within the invocation. Never shell into a provider CLI when MCP is available; that bypasses typed artifact capture under `.webpresso/reviews`. The pretool guard hook redirects provider review launches to MCP.
-
-For long-running reviews, prefer the async MCP path: call `wp_review_run` with
-`"provider": "codex"` and `"background": true`, then poll `wp_review_wait`
-with the returned `runId`. Do not solve MCP transport limits by inflating
-synchronous review timeouts.
-
-The bash blocks in this skill (below) are the **MCP-unavailable fallback only** — use them when the webpresso MCP server itself is not reachable in the current host, not as a provider-fallback mechanism.
-
-## Single-shot budget (anti-stampede)
-
-- Default: **one** review invocation per request.
-- Do **not** fan out parallel multi-host review matrices unless the user set `review_budget`/`N` > 1.
-- Prefer `wp_review_run` (MCP) or `wp review run` (CLI fallback) over spawn/wait agent loops for review.
-- Keep prompts bounded; no whole-repo paste.
-
-## MCP-unavailable fallback (raw CLI)
-
-Everything from here down is the manual `wp review run` CLI path documented for hosts or sessions where the webpresso MCP server is not reachable. Prefer `wp_review_run` above whenever MCP is available.
-
-## MCP-unavailable fallback: auth check
-
-```bash
-if ! codex login status >/dev/null 2>&1; then
-  echo "CODEX_AUTH=missing: run codex login before using the codex outside-voice skill"
-  exit 1
-fi
-echo "CODEX_AUTH=ok"
-```
-
-## MCP-unavailable fallback: portable prompt file
-
-```bash
-PROMPT_FILE=$(mktemp -t wp-codex-review.XXXXXX)
-trap 'rm -f "$PROMPT_FILE"' EXIT
-```
-
-## Dashboard helper relation
-
-When called by `wp dash`, record the outside-voice lifecycle with
-`wp dash-helper-start --provider codex --role reviewer` and
-`wp dash-helper-complete --provider codex --role reviewer --outcome <completed|failed>`
-using the actual terminal outcome and artifact path.
-Standalone calls skip helper emission. Codex native subagent events are not
-parent-linked in the managed lifecycle; this unsupported coverage must stay
-explicit, and completion must never be inferred from text, PIDs, or
-timestamps.
-
-## Options
-
-Every mode runs through the `wp review run` runtime and honors these environment
-overrides. Set them inline, e.g.
-`CODEX_REVIEW_MODEL=gpt-5.6-sol CODEX_REVIEW_EFFORT=high /codex`.
-
-- `CODEX_REVIEW_MODEL` — the Codex model. Defaults to the `model = "..."` in the
-  active Codex config (`${CODEX_HOME:-~/.codex}/config.toml`); if neither the
-  environment nor config names a model, `wp review run` lets the Codex CLI choose
-  its own default. It MUST be a model the current login is provisioned for: ChatGPT-account
-  logins use the config's codenamed ids (e.g. `gpt-5.6-sol`) and reject a bare
-  `gpt-5.6`. When the user names a model ("review with 5.6-sol"), pass it here.
-- `CODEX_REVIEW_EFFORT` — reasoning effort, default `medium`. The review stage
-  accepts only `medium` or `high`; any other value is rejected.
-- `CODEX_REVIEW_IDLE_SECONDS` — idle timeout in seconds for the review stage,
-  default `180`.
-- `CODEX_REVIEW_ARTIFACT_ROOT` — directory for private runtime diagnostics,
-  default `<cwd>/.webpresso/reviews`. Never commit files from this directory or
-  cite them as approval evidence.
-
-Direct `wp review run` output is advisory. `wp_review_gate` is plan-only
-exact-version draft approval/auto-promotion; implementation/phase reviews use
-advisory `wp_review_run` and never mutate blueprint approval state. CLI delivery
-gates are MCP-unavailable compatibility only.
-
-## Modes
-
-### Review
-
-1. Capture the current branch, base branch, and `git diff --stat`.
-2. Write a concise prompt asking Codex to find correctness, security, data-loss, and maintainability risks.
-3. Run Codex through the typed review runtime in read-only mode:
-
-```bash
-# CODEX_REVIEW_MODEL / CODEX_REVIEW_EFFORT are overridable — see ## Options for
-# the full option list, valid values, and how to pick a login-supported model.
-CODEX_REVIEW_MODEL=${CODEX_REVIEW_MODEL:-}
-CODEX_MODEL_ARGS=()
-if [ -n "$CODEX_REVIEW_MODEL" ]; then
-  CODEX_MODEL_ARGS=(--model "$CODEX_REVIEW_MODEL")
-fi
-CODEX_REVIEW_EFFORT=${CODEX_REVIEW_EFFORT:-medium}
-case "$CODEX_REVIEW_EFFORT" in
-  medium|high) ;;
-  *) echo "CODEX_REVIEW_EFFORT must be one of: medium, high" >&2; exit 2 ;;
-esac
-CODEX_REVIEW_IDLE_SECONDS=${CODEX_REVIEW_IDLE_SECONDS:-180}
-CODEX_REVIEW_ARTIFACT_ROOT=${CODEX_REVIEW_ARTIFACT_ROOT:-"$(pwd)/.webpresso/reviews"}
-CODEX_REVIEW_CODE=0
-wp review run \
-  --provider codex \
-  --prompt-file "$PROMPT_FILE" \
-  "${CODEX_MODEL_ARGS[@]}" \
-  --effort "$CODEX_REVIEW_EFFORT" \
-  --stage review \
-  --artifact-root "$CODEX_REVIEW_ARTIFACT_ROOT" \
-  --idle-seconds "$CODEX_REVIEW_IDLE_SECONDS"
-CODEX_REVIEW_CODE=$?
-```
-
-4. Summarize findings with severity, evidence, and whether you independently verified them.
+Use authoritative mode only when formal plan or delivery approval is requested.
 
-### Challenge
+## Model policy
 
-Ask Codex to argue against the current plan: hidden assumptions, failure modes, missing tests, and simpler alternatives.
+When the user names an exact model, pass it in the MCP `model` field. Otherwise omit
+that field and let the MCP owner select the configured provider default.
 
-### Consult
+## Review quality
 
-Ask a focused repo question. Include only the necessary file paths and snippets; do not send secrets.
+Follow `catalog/agent/rules/review-methodology-sota.md`; report typed verdict, model,
+artifact, grounded findings, and independently verified conclusions.