@windyroad/itil 2.1.0 → 2.1.1

package/.claude-plugin/plugin.json

@@ -497,5 +497,5 @@
     }
   },
   "name": "wr-itil",
-  "version": "2.1.0"
+  "version": "2.1.1"
 }

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "wr-itil",
-  "version": "2.1.0",
+  "version": "2.1.1",
   "description": "ITIL problem-management workflows for AI coding agents",
   "author": {
     "name": "Windy Road Technology",

package/lib/install-utils.mjs

@@ -4,11 +4,17 @@
  */
 
 import { execSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { cpSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
 
 const MARKETPLACE_REPO = "windyroad/agent-plugins";
 const MARKETPLACE_NAME = "windyroad";
 const CODEX_MARKETPLACE_PATH = ".";
 const CODEX_MARKETPLACE_NAME = "windyroad-local";
+const PACKAGE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 
 let _dryRun = false;
 
@@ -82,6 +88,132 @@ export function addCodexMarketplace() {
   );
 }
 
+function codexMarketplace(pluginName) {
+  return `windyroad-${pluginName.replace(/^wr-/, "")}-local`;
+}
+
+function codexMarketplaceRoot(pluginName) {
+  const version = JSON.parse(readFileSync(join(PACKAGE_ROOT, "package.json"), "utf8")).version;
+  return join(process.env.CODEX_HOME || join(homedir(), ".codex"), ".tmp", "marketplaces", `${pluginName}-${version}`);
+}
+
+function codexAgentDir(scope) {
+  return scope === "user"
+    ? join(process.env.CODEX_HOME || join(homedir(), ".codex"), "agents")
+    : join(process.cwd(), ".codex", "agents");
+}
+
+function codexTerms(text) {
+  return text
+    .replaceAll("AskUserQuestion", "request_user_input")
+    .replaceAll("Agent tool", "native Codex subagent tool")
+    .replaceAll("Skill tool", "installed skill invocation")
+    .replaceAll("Claude Code", "Codex")
+    .replace(/\bClaude\b/g, "Codex")
+    .replaceAll(".claude", ".codex");
+}
+
+function splitFrontmatter(markdown) {
+  const end = markdown.indexOf("\n---\n", 4);
+  return markdown.startsWith("---\n") && end !== -1
+    ? { frontmatter: markdown.slice(4, end), body: markdown.slice(end + 5) }
+    : { frontmatter: "", body: markdown };
+}
+
+function frontmatterDescription(frontmatter) {
+  const lines = frontmatter.split(/\r?\n/);
+  const start = lines.findIndex((line) => line.startsWith("description:"));
+  if (start === -1) return "Windy Road reviewer.";
+  const value = [lines[start].slice("description:".length).trim()];
+  for (let index = start + 1; index < lines.length && /^\s+/.test(lines[index]); index += 1) {
+    value.push(lines[index].trim());
+  }
+  return value.filter(Boolean).join(" ");
+}
+
+function renderCodexAgent(pluginName, agent) {
+  const source = join(PACKAGE_ROOT, agent.source);
+  const { frontmatter, body } = splitFrontmatter(readFileSync(source, "utf8"));
+  const codexInstructions = agent.name === "wr-voice-tone:external-comms"
+    ? `\n\n## Codex completion marker compatibility\n\nOn PASS, compute the lowercase SHA-256 marker key using the normalization specified above and append \`EXTERNAL_COMMS_VOICE_TONE_KEY: <64 lowercase hex characters>\`. Codex may hide the spawn prompt from PostToolUse hooks, so this emitted key is required. On FAIL, do not emit a key.`
+    : "";
+  const payload = [
+    `# Do not edit by hand; update ${agent.source} and reinstall.`,
+    `name = ${JSON.stringify(agent.name)}`,
+    `description = ${JSON.stringify(frontmatterDescription(frontmatter))}`,
+    'sandbox_mode = "read-only"',
+    'developer_instructions = """',
+    codexTerms(`${body.trimEnd()}${codexInstructions}`).replace(/\\/g, "\\\\").replace(/"""/g, '\\"\\"\\"').trimEnd(),
+    '"""',
+    "",
+  ].join("\n");
+  const owner = `# Generated by @windyroad/${pluginName.replace(/^wr-/, "")} from ${agent.source}.`;
+  const hash = createHash("sha256").update(payload).digest("hex");
+  return `${owner}\n# Generated content SHA-256: ${hash}\n${payload}`;
+}
+
+function isOwnedCodexAgent(content, pluginName, agent) {
+  const owner = `# Generated by @windyroad/${pluginName.replace(/^wr-/, "")} from ${agent.source}.`;
+  const lines = content.split("\n");
+  const hash = lines[1]?.match(/^# Generated content SHA-256: ([0-9a-f]{64})$/)?.[1];
+  return content.startsWith(`${owner}\n`) && Boolean(hash)
+    && createHash("sha256").update(lines.slice(2).join("\n")).digest("hex") === hash;
+}
+
+function installCodexAgents(pluginName, agents, scope) {
+  if (agents.length === 0 || _dryRun) return;
+  const targetDir = codexAgentDir(scope);
+  mkdirSync(targetDir, { recursive: true });
+  for (const agent of agents) {
+    const target = join(targetDir, agent.filename);
+    const expected = renderCodexAgent(pluginName, agent);
+    if (existsSync(target)) {
+      const current = readFileSync(target, "utf8");
+      if (current === expected) continue;
+      if (!isOwnedCodexAgent(current, pluginName, agent)) {
+        console.log(`Preserved user-managed Codex agent at ${target}.`);
+        continue;
+      }
+    }
+    writeFileSync(target, expected, "utf8");
+  }
+}
+
+function uninstallCodexAgents(pluginName, agents, scope) {
+  if (_dryRun) return;
+  for (const targetDir of new Set([codexAgentDir(scope), codexAgentDir("user")])) {
+    for (const agent of agents) {
+      const target = join(targetDir, agent.filename);
+      if (existsSync(target) && isOwnedCodexAgent(readFileSync(target, "utf8"), pluginName, agent)) rmSync(target);
+    }
+  }
+}
+
+function installPackedCodexPlugin(pluginName, { agents = [], scope = "project" } = {}) {
+  const marketplace = codexMarketplace(pluginName);
+  const root = codexMarketplaceRoot(pluginName);
+  if (!_dryRun) {
+    rmSync(root, { recursive: true, force: true });
+    mkdirSync(dirname(root), { recursive: true });
+    cpSync(PACKAGE_ROOT, root, { recursive: true });
+    const hooks = join(root, "hooks-codex", "hooks.json");
+    if (existsSync(hooks)) cpSync(hooks, join(root, "hooks", "hooks.json"));
+  }
+  if (!run(`codex plugin marketplace add ${JSON.stringify(root)}`, `Codex marketplace: ${marketplace}`)) return false;
+  if (!run(`codex plugin add ${pluginName}@${marketplace}`, pluginName)) return false;
+  installCodexAgents(pluginName, agents, scope);
+  return true;
+}
+
+function uninstallPackedCodexPlugin(pluginName, { agents = [], scope = "project" } = {}) {
+  const marketplace = codexMarketplace(pluginName);
+  const removed = run(`codex plugin remove ${pluginName}@${marketplace}`, `Removing ${pluginName}`);
+  run(`codex plugin marketplace remove ${marketplace}`, `Removing ${marketplace}`);
+  uninstallCodexAgents(pluginName, agents, scope);
+  if (!_dryRun) rmSync(codexMarketplaceRoot(pluginName), { recursive: true, force: true });
+  return removed;
+}
+
 export function installPlugin(pluginName, { scope = "project" } = {}) {
   return run(
     `claude plugin install ${pluginName}@${MARKETPLACE_NAME} --scope ${scope}`,
@@ -121,7 +253,7 @@ export function uninstallCodexPlugin(pluginName) {
 /**
  * Install a single package: marketplace add + plugin install.
  */
-export function installPackage(pluginName, { deps = [], scope = "project", runtime = "claude" } = {}) {
+export function installPackage(pluginName, { agents = [], deps = [], scope = "project", runtime = "claude" } = {}) {
   console.log(`\nInstalling @windyroad/${pluginName.replace("wr-", "")} (${scope} scope)...\n`);
 
   if (runtime === "claude" || runtime === "both") {
@@ -130,8 +262,7 @@ export function installPackage(pluginName, { deps = [], scope = "project", runti
   }
 
   if (runtime === "codex" || runtime === "both") {
-    addCodexMarketplace();
-    installCodexPlugin(pluginName);
+    if (!installPackedCodexPlugin(pluginName, { agents, scope })) process.exitCode = 1;
   }
 
   if (deps.length > 0) {
@@ -149,7 +280,7 @@ export function installPackage(pluginName, { deps = [], scope = "project", runti
 /**
  * Update a single package.
  */
-export function updatePackage(pluginName, { scope = "project", runtime = "claude" } = {}) {
+export function updatePackage(pluginName, { agents = [], scope = "project", runtime = "claude" } = {}) {
   console.log(`\nUpdating @windyroad/${pluginName.replace("wr-", "")}...\n`);
 
   if (runtime === "claude" || runtime === "both") {
@@ -161,8 +292,7 @@ export function updatePackage(pluginName, { scope = "project", runtime = "claude
   }
 
   if (runtime === "codex" || runtime === "both") {
-    updateCodexMarketplace();
-    installCodexPlugin(pluginName);
+    if (!installPackedCodexPlugin(pluginName, { agents, scope })) process.exitCode = 1;
   }
 
   console.log(`\nDone! Restart ${runtime === "codex" ? "Codex" : runtime === "both" ? "Claude Code and Codex" : "Claude Code"} to apply updates.\n`);
@@ -171,7 +301,7 @@ export function updatePackage(pluginName, { scope = "project", runtime = "claude
 /**
  * Uninstall a single package.
  */
-export function uninstallPackage(pluginName, { runtime = "claude" } = {}) {
+export function uninstallPackage(pluginName, { agents = [], scope = "project", runtime = "claude" } = {}) {
   console.log(`\nUninstalling @windyroad/${pluginName.replace("wr-", "")}...\n`);
 
   if (runtime === "claude" || runtime === "both") {
@@ -179,7 +309,7 @@ export function uninstallPackage(pluginName, { runtime = "claude" } = {}) {
   }
 
   if (runtime === "codex" || runtime === "both") {
-    uninstallCodexPlugin(pluginName);
+    if (!uninstallPackedCodexPlugin(pluginName, { agents, scope })) process.exitCode = 1;
   }
 
   console.log(`\nDone. Restart ${runtime === "codex" ? "Codex" : runtime === "both" ? "Claude Code and Codex" : "Claude Code"} to apply changes.\n`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@windyroad/itil",
-  "version": "2.1.0",
+  "version": "2.1.1",
   "description": "ITIL-aligned IT service management for Claude Code and Codex",
   "bin": {
     "windyroad-itil": "./bin/install.mjs"

package/skills-codex/capture-problem/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: wr-itil:capture-problem
+name: capture-problem
 description: Lightweight problem-capture skill for aside-invocation during foreground work — minimal duplicate-check, skeleton ticket file, single commit per capture (covers new ticket + inline README refresh per the "Problem 094: `/wr-itil:manage-problem` does not refresh `docs/problems/README.md` on ticket creation" problem per the "capture-problem → manage-problem same-session halts at Step 0 reconcile (HALT_ROUTE_RECONCILE on deferred-refresh seam)" problem Option 2 amendment 2026-06-05). Defers full duplicate analysis to /wr-itil:review-problems. Use this when the user (or agent mid-iter) wants to capture an observation quickly without disrupting current task flow. For full-intake new-problem creation, use /wr-itil:manage-problem.
 allowed-tools: Read, Write, Edit, Bash, Grep, Glob, request_user_input
 ---

package/skills-codex/capture-rfc/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: wr-itil:capture-rfc
+name: capture-rfc
 description: Draw a problem-traced RFC release row on a story map and attach at least one delivery story. Uses the existing delivery-planning vehicle instead of creating an RFC document.
 allowed-tools: Read, Write, Edit, Bash, Grep, Glob, Skill, request_user_input
 ---

package/skills-codex/capture-story/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: wr-itil:capture-story
+name: capture-story
 description: Lightweight story-capture skill for aside-invocation during foreground work — mandatory leading problem-trace AND JTBD-trace per the "Problem-RFC-Story framework with mandatory problem-trace and unified problem ontology" architecture rule I6 + I9 invariants, mandatory `--story-map` trace (I8 enforced AT CAPTURE per the "Story-map membership and story-content completeness are enforced at capture" architecture rule, refuse-and-route if absent) + optional `--rfc` (I7 at accepted) + real user-value + >=1 acceptance criterion at capture (I10 content subset / the "Story-map membership and story-content completeness are enforced at capture" architecture rule), skeleton story file at `docs/stories/draft/STORY-NNN-<slug>.md`, single commit per capture, no inline README refresh. Defers full INVEST shape + acceptance transition to /wr-itil:manage-story. Use when the user (or agent) wants to capture a story quickly with clear problem + JTBD anchoring. For full lifecycle management, use /wr-itil:manage-story.
 allowed-tools: Read, Write, Edit, Bash, Grep, Glob
 ---

package/skills-codex/capture-story-map/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: wr-itil:capture-story-map
+name: capture-story-map
 description: Lightweight story-map-capture skill for aside-invocation during foreground work — mandatory leading problem-trace AND JTBD-trace per the "Problem-RFC-Story framework with mandatory problem-trace and unified problem ontology" architecture rule I3 + I4 invariants, skeleton HTML file at `docs/story-maps/draft/STORY-MAP-NNN-<slug>.html` per the "Problem-RFC-Story framework with mandatory problem-trace and unified problem ontology" architecture rule § Phase 2 encoding amendment 2026-05-12, single commit per capture, no inline README refresh. Defers full backbone/ribs/slices authoring + lifecycle transitions to /wr-itil:manage-story-map. Use when the user (or agent) wants to capture a new story-map quickly with clear problem + JTBD anchoring.
 allowed-tools: Read, Write, Edit, Bash, Grep, Glob
 ---

package/skills-codex/check-upstream-responses/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: wr-itil:check-upstream-responses
+name: check-upstream-responses
 description: Poll upstream issues and pull requests we've filed via `/wr-itil:report-upstream` and surface new comments or reviews, state changes, or label changes since last check. Reads `## Reported Upstream` back-link sections in local problem tickets, queries GitHub read-only, diffs against `docs/problems/.outbound-responses-cache.json`, and appends an audit-log entry to `docs/audits/outbound-responses-log.md`. Outbound symmetric counterpart to the "Inbound upstream-report discovery + assessment pipeline (peer of )" architecture rule's inbound discovery pipeline (the "No process for issue reporters to check for responses — symmetric gap to inbound discovery" problem Phase 1).
 allowed-tools: Read, Edit, Write, Bash, Glob, Grep
 ---

package/skills-codex/close-incident/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: wr-itil:close-incident
+name: close-incident
 description: Close a restored incident — gated on the Linked Problem reaching Known Error, Verifying, or Closed (or a ## No Problem justification). Renames .restored.md to .closed.md.
 allowed-tools: Read, Write, Edit, Bash, Glob, Grep
 ---

package/skills-codex/link-incident/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: wr-itil:link-incident
+name: link-incident
 description: Link an incident to an existing problem — writes or updates the ## Linked Problem section on the incident file with the problem's ID, title, and current status.
 allowed-tools: Read, Write, Edit, Bash, Glob, Grep
 ---

package/skills-codex/list-incidents/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: wr-itil:list-incidents
+name: list-incidents
 description: List active incidents from docs/incidents/ sorted by severity. Read-only display of the incident backlog — no edits, no interaction. Shown as a markdown table with ID, title, severity, and status columns.
 allowed-tools: Read, Bash, Grep, Glob
 ---

package/skills-codex/list-problems/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: wr-itil:list-problems
+name: list-problems
 description: List open and known-error problem tickets from docs/problems/ sorted by WSJF priority. Read-only display of the current backlog — no edits, no interaction. Shown as a markdown table with ID, title, severity, status, and effort columns.
 allowed-tools: Read, Bash, Grep, Glob
 ---

package/skills-codex/list-stories/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: wr-itil:list-stories
+name: list-stories
 description: List INVEST-shaped story tickets from docs/stories/ as a markdown table. Read-only display — no edits, no interaction. Optional `--rfc RFC-<NNN>` filter to surface a specific RFC's ordered story list per the "Problem-RFC-Story framework with mandatory problem-trace and unified problem ontology" architecture rule Phase 2.
 allowed-tools: Read, Bash, Grep, Glob
 ---

package/skills-codex/list-story-maps/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: wr-itil:list-story-maps
+name: list-story-maps
 description: List story-map artefacts from docs/story-maps/ as a markdown table. Read-only display — no edits, no interaction. Renders <meta> block data (problems / rfcs / jtbd / status) from each HTML map per the "Problem-RFC-Story framework with mandatory problem-trace and unified problem ontology" architecture rule § Phase 2 encoding amendment 2026-05-12.
 allowed-tools: Read, Bash, Grep, Glob
 ---

package/skills-codex/manage-incident/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: wr-itil:manage-incident
+name: manage-incident
 description: Declare, triage, mitigate, and close an incident using an evidence-first workflow. Restores service first, then hands off to manage-problem for root-cause work.
 allowed-tools: Read, Write, Edit, Bash, Glob, Grep, request_user_input, Skill
 deprecated-arguments: true

package/skills-codex/manage-problem/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: wr-itil:manage-problem
+name: manage-problem
 description: Create, update, or transition a problem ticket using an ITIL-aligned problem management workflow with WSJF prioritisation. Supports creating new problems, updating root cause analysis, transitioning status, and closing problems.
 allowed-tools: Read, Write, Edit, Bash, Glob, Grep, request_user_input, Skill
 deprecated-arguments: true

package/skills-codex/manage-rfc/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: wr-itil:manage-rfc
+name: manage-rfc
 description: Heavyweight RFC intake + lifecycle management following the "Problem-RFC-Story framework with mandatory problem-trace and unified problem ontology" architecture rule Problem-RFC-Story framework. Creates new RFCs (delegates to /wr-itil:capture-rfc for the lightweight path), updates existing RFCs, transitions through proposed → accepted → in-progress → verifying → closed lifecycle, runs WSJF re-rank reviews, and refreshes docs/rfcs/README.md per the "Problem 062: `manage-problem` does not refresh `docs/problems/README.md` on single-ticket transitions; fast-path cache goes stale silently" problem / the "Problem 094: `/wr-itil:manage-problem` does not refresh `docs/problems/README.md` on ticket creation" problem contract pattern.
 allowed-tools: Read, Write, Edit, Bash, Grep, Glob, Task
 ---

package/skills-codex/manage-story/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: wr-itil:manage-story
+name: manage-story
 description: Heavyweight story intake + lifecycle management following the "Problem-RFC-Story framework with mandatory problem-trace and unified problem ontology" architecture rule Phase 2. Creates and updates story tickets, transitions through draft → accepted → in-progress → done → archived lifecycle, enforces I7 + I8 trace-gate at the accepted transition, runs INVEST checks per I10 at acceptance, auto-detects accepted→in-progress on the first implementing commit and in-progress→done on all-criteria-ticked + linked RFC closes (per the "A story cannot be implemented while in draft — implementation requires accepted" architecture rule a draft story is NEVER implementable — draft→in-progress is removed; the itil-no-implement-draft-gate blocks implementing a draft story), and refreshes docs/stories/README.md per the "Problem 062: `manage-problem` does not refresh `docs/problems/README.md` on single-ticket transitions; fast-path cache goes stale silently" problem / the "Problem 094: `/wr-itil:manage-problem` does not refresh `docs/problems/README.md` on ticket creation" problem contract pattern. Companion to /wr-itil:capture-story (lightweight aside surface).
 allowed-tools: Read, Write, Edit, Bash, Grep, Glob
 ---

package/skills-codex/manage-story-map/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: wr-itil:manage-story-map
+name: manage-story-map
 description: Heavyweight story-map intake + lifecycle management following the "Problem-RFC-Story framework with mandatory problem-trace and unified problem ontology" architecture rule Phase 2. Authors backbone × ribs × slices structure on draft maps, transitions through draft → accepted → in-progress → completed → archived, re-validates I3 + I4 invariants at every transition, and refreshes docs/story-maps/README.md per the "Problem 062: `manage-problem` does not refresh `docs/problems/README.md` on single-ticket transitions; fast-path cache goes stale silently" problem / the "Problem 094: `/wr-itil:manage-problem` does not refresh `docs/problems/README.md` on ticket creation" problem contract pattern. Companion to /wr-itil:capture-story-map (lightweight aside surface).
 allowed-tools: Read, Write, Edit, Bash, Grep, Glob
 ---

package/skills-codex/mitigate-incident/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: wr-itil:mitigate-incident
+name: mitigate-incident
 description: Record a mitigation attempt against an incident — transitions an investigating incident to mitigating on the first attempt, appends subsequent attempts to the Mitigation attempts timeline. Evidence-first gate enforced per the "Add `manage-incident` Skill to `wr-itil` Plugin" architecture rule.
 allowed-tools: Read, Write, Edit, Bash, Glob, Grep, request_user_input, Skill
 ---

package/skills-codex/reconcile-readme/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: wr-itil:reconcile-readme
+name: reconcile-readme
 description: Detect and correct drift between docs/problems/README.md and the on-disk ticket inventory. Wraps the diagnose-only `<itil-plugin-root>/scripts/reconcile-readme.sh` script with an agent-applied-edits pattern that preserves narrative content (the "Last reviewed" prose paragraph and Closed-section closure-via free text). Use when README WSJF Rankings, Verification Queue, or Closed sections drift from filesystem state — typically detected by manage-problem Step 0 preflight or work-problems Step 0 preflight.
 allowed-tools: Read, Edit, Write, Bash, Grep, Glob
 ---

package/skills-codex/reconcile-stories/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: wr-itil:reconcile-stories
+name: reconcile-stories
 description: Detect and correct drift between docs/stories/README.md and the on-disk story inventory. Wraps the diagnose-only <itil-plugin-root>/scripts/reconcile-stories.sh script with an agent-applied-edits pattern that preserves narrative content (the "Last reviewed" prose paragraph). Use when docs/stories/README.md Story Rankings or Done sections drift from filesystem state — typically detected by manage-story Step 0 preflight or work-problems preflight on RFC iters with story-tier traces.
 allowed-tools: Read, Write, Edit, Bash, Grep, Glob
 ---

package/skills-codex/reconcile-story-maps/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: wr-itil:reconcile-story-maps
+name: reconcile-story-maps
 description: Detect and correct drift between docs/story-maps/README.md and the on-disk story-map HTML inventory. Wraps the diagnose-only <itil-plugin-root>/scripts/reconcile-story-maps.sh script with an agent-applied-edits pattern preserving narrative content.
 allowed-tools: Read, Write, Edit, Bash, Grep, Glob
 ---

package/skills-codex/report-upstream/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: wr-itil:report-upstream
+name: report-upstream
 description: Report a local problem ticket as a structured issue against an upstream repository, with bidirectional cross-references and SECURITY.md-aware routing for security-classified tickets. Implements the contract in the "Cross-project problem-reporting contract — `report-upstream` skill in `@windyroad/itil`" architecture rule, with the "Report-upstream classifier is problem-first — supersedes Decision Outcome Steps 3 + 5" architecture rule governing problem-first classifier + default body shape.
 allowed-tools: Read, Write, Edit, Bash, Glob, Grep, request_user_input, Skill, Agent
 ---

package/skills-codex/restore-incident/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: wr-itil:restore-incident
+name: restore-incident
 description: Mark an incident as service-restored — transitions a mitigating incident to restored, appends a Timeline entry, and hands off to /wr-itil:manage-problem for linked-problem creation or update per the "Add `manage-incident` Skill to `wr-itil` Plugin" architecture rule.
 allowed-tools: Read, Write, Edit, Bash, Glob, Grep, request_user_input, Skill
 ---

package/skills-codex/review-problems/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: wr-itil:review-problems
+name: review-problems
 description: Re-assess every open and known-error problem ticket in docs/problems/ — re-read RISK-POLICY.md, re-rate Impact × Likelihood, re-estimate Effort, recalculate WSJF, surface pending verifications, auto-transition Open → Known Error where warranted, and rewrite docs/problems/README.md with the refreshed ranking. Writes to problem files and the README cache; commits the refresh per the "Governance Skills Commit Their Own Completed Work" architecture rule.
 allowed-tools: Read, Write, Edit, Bash, Glob, Grep, request_user_input, Skill
 ---

package/skills-codex/scaffold-intake/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: wr-itil:scaffold-intake
+name: scaffold-intake
 description: Scaffold the four OSS intake surfaces (.github/ISSUE_TEMPLATE/, SECURITY.md, SUPPORT.md, CONTRIBUTING.md) for a downstream project that adopts @windyroad/itil. Idempotent, foreground-synchronous, and respects the "Gate Marker Lifecycle: TTL + Drift, Not Stop-Hook Reset" architecture rule marker semantics. Implements the contract in the "Scaffold downstream OSS intake — skill + layered triggers" architecture rule.
 allowed-tools: Read, Write, Edit, Bash, Glob, Grep, request_user_input
 ---

package/skills-codex/transition-problem/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: wr-itil:transition-problem
+name: transition-problem
 description: Advance a problem ticket's lifecycle status — Open → Known Error, Known Error → Verification Pending (verifying), Verification Pending → Closed. Renames the ticket file, updates the Status field, and refreshes docs/problems/README.md in the same commit. Hosts the transition execution inline (pre-flight checks, the "Problem 057: `git mv` + Edit + `git add` staging-ordering trap drops content edits from the commit" problem staging-trap handling, the "Problem 063: manage-problem does not trigger /wr-itil:report-upstream when root cause is external" problem external-root-cause detection, the "Problem 062: `manage-problem` does not refresh `docs/problems/README.md` on single-ticket transitions; fast-path cache goes stale silently" problem README refresh, the "Governance Skills Commit Their Own Completed Work" architecture rule commit) per the "Rename `wr-problem` Plugin to `wr-itil`" architecture rule amended "Split-skill execution ownership". Use when the user asks to "transition", "close", "mark known-error", or "release" a specific ticket.
 allowed-tools: Read, Write, Edit, Bash, Glob, Grep, request_user_input, Skill
 ---

package/skills-codex/transition-problems/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: wr-itil:transition-problems
+name: transition-problems
 description: "Batch-advance multiple problem tickets through the lifecycle in one invocation — Open → Known Error, Known Error → Verification Pending, Verification Pending → Closed. Loops the per-ticket /wr-itil:transition-problem mechanic (rename, Status edit, the "Problem 057: `git mv` + Edit + `git add` staging-ordering trap drops content edits from the commit" problem re-stage, the "Problem 063: manage-problem does not trigger /wr-itil:report-upstream when root cause is external" problem external-root-cause detection, the "Problem 062: `manage-problem` does not refresh `docs/problems/README.md` on single-ticket transitions; fast-path cache goes stale silently" problem README refresh) without paying N× SKILL.md reload latency or violating split-skill execution ownership. Produces ONE shared commit covering all surviving transitions per the "Governance Skills Commit Their Own Completed Work" architecture rule batch-grain. Use when closing the Verification Queue at the end of a `/wr-retrospective:run-retro` Step 4a pass, batch-closing release-aged verifyings during `/wr-itil:work-problems` AFK orchestration, or confirming multiple Step 9d verifications in `/wr-itil:manage-problem review`. Singular sibling — `/wr-itil:transition-problem` (one ticket per invocation)."
 allowed-tools: Read, Write, Edit, Bash, Glob, Grep, request_user_input, Skill, Agent
 ---

package/skills-codex/update-upstream/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: wr-itil:update-upstream
+name: update-upstream
 description: Post a lifecycle-update comment to an upstream issue when a local problem ticket transitions. Drafts a transition-specific update (root-cause confirmed / fix released / closed), composes the prose through the external-comms risk gate + voice-tone gate, auto-posts within appetite, queues above-appetite. Reciprocal sibling to /wr-itil:report-upstream — initial-filing vs lifecycle-update split per the "Cross-project problem-reporting contract — `report-upstream` skill in `@windyroad/itil`" architecture rule amendment (the "Problem 080: No bidirectional update of upstream-reported problems — local lifecycle transitions never propagate back to the reporter" problem).
 allowed-tools: Read, Write, Edit, Bash, Glob, Grep, request_user_input, Skill, Agent
 ---

package/skills-codex/work-problem/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: wr-itil:work-problem
+name: work-problem
 description: Pick the highest-WSJF open or known-error problem ticket and work it — investigate, implement, commit, and release per the standard manage-problem workflow. Selection is framework-mediated (WSJF + documented tie-break ladder per the "— Decision-Delegation Contract: when agents act on the framework vs ask the user" architecture rule); singular variant; distinct from /wr-itil:work-problems (plural AFK orchestrator). Use this when the user asks to "work the next problem", "work the top of the queue", or "grind through one ticket".
 allowed-tools: Read, Write, Edit, Bash, Glob, Grep, request_user_input, Skill, Agent
 ---

package/skills-codex/work-problems/SKILL.md

@@ -1,6 +1,6 @@
 ---
-name: wr-itil:work-problems
-description: Drain the ITIL problem backlog in WSJF order using native Codex subagents, governed commits, pushes, and releases.
+name: work-problems
+description: Drain the ITIL problem backlog in WSJF order using isolated Codex CLI iterations, governed commits, pushes, and releases.
 ---
 
 <!-- Generated from the runtime-neutral skill source. Do not edit. -->
@@ -16,32 +16,85 @@ description: Drain the ITIL problem backlog in WSJF order using native Codex sub
 
 # Work Problems in Codex
 
-Continuously work the highest-priority actionable problem until the backlog is drained, the user stops, or a real governance dependency requires human direction. Use Codex's native subagent tools. Never invoke `codex exec`, start a nested Codex CLI, or implement process/PID polling.
+Continuously work the highest-priority actionable problem until the backlog is drained, the user stops, or a real governance dependency requires human direction. Run each selected problem in one fresh `codex exec` process and consume its structured result before continuing.
 
 ## Preflight
 
 1. If `docs/problems/` is absent, direct the user to `/wr-itil:scaffold-intake` and stop.
 2. Run the installed ITIL maintenance commands required by the repository, including layout migration, README reconciliation, catch-up scanning, stale upstream-cache checks, and unresolved-response checks. Resolve them from the plugin's bundled `bin/`; do not use source-repository paths.
-3. Preserve unrelated working-tree changes. Revert only changes created by a failed preflight.
-4. If the task has a persistent Codex goal, keep it active until this drain reaches a genuine terminal state. A slow tool or subagent is not a blocker.
+3. Resolve the exact checkout with `git rev-parse --show-toplevel`. Preserve unrelated working-tree changes and record the pre-iteration status. Revert only paths proven to have been created by a failed iteration.
+4. If the task has a persistent Codex goal, keep it active until this drain reaches a genuine terminal state. A slow process is not a blocker.
 
 ## Loop
 
 1. Read the problem index and current ticket files. Select the highest WSJF problem in the highest non-empty actionable tier. Use the documented tie-break rules.
 2. Skip tickets whose required JTBD, decision, risk, or story-map oversight is unconfirmed. Record one structured outstanding question for each genuinely user-answerable dependency; do not ask mid-loop.
 3. Run the relevance and stop-condition checks. Before declaring `ALL_DONE`, run the repository's unconditional pre-completion gates and rescan the backlog.
-4. Spawn one native Codex subagent for the selected ticket. Give it the exact checkout, ticket, applicable decisions, and this contract:
-   - invoke `/wr-itil:manage-problem` for the ticket and follow its lifecycle rules;
-   - make only in-scope changes and preserve unrelated work;
-   - run focused tests and the required architecture/risk checks;
-   - create the required changeset for shippable plugin behavior;
-   - commit the completed iteration, but do not push or release;
-   - return one `ITERATION_SUMMARY` JSON object containing ticket, action, commits, tests, risks, outstanding questions, and remaining work.
-5. Wait for that same subagent. Do not cancel, replace, retry, or fan out merely because Cruise or normal model execution makes the call slow. When it completes, consume its summary and close it.
-6. Validate the summary with `<itil-plugin-root>/bin/wr-itil-verify-iter-summary`. If the subagent failed after changing the checkout, inspect and safely complete or revert only its own partial work before continuing.
+4. Dispatch exactly the selected ticket through the isolated Codex command below. Do not select or work a second ticket inside that process.
+5. Wait for that same process. Do not cancel, replace, retry, or fan out merely because normal model execution is slow.
+6. Classify the exit and JSONL metadata before reading the final-output file. On success, validate the summary with `<itil-plugin-root>/bin/wr-itil-verify-iter-summary` and consume it. On failure, apply the recovery contract below and halt.
 7. Run inter-iteration verification. If the iteration produced committed shippable work, complete the repository's governed push and release cadence when risk is within appetite. Above-appetite risk is a remediation instruction: reduce scope or split the change; never ask the user to approve risk above appetite.
 8. Report only material progress, then rescan and repeat.
 
+## Isolated Codex iteration
+
+Build a self-contained prompt containing the selected ticket ID and title, the exact checkout, applicable confirmed decisions, and these requirements:
+
+- invoke `/wr-itil:manage-problem <number>` and work only that problem;
+- preserve unrelated work and use path-scoped staging;
+- load and obey the installed governance skills, agents, and hooks;
+- run focused tests and required architecture, JTBD, voice, accessibility, and risk checks when their gates apply;
+- add a changeset for shippable package behavior;
+- commit completed iteration work, but do not push or release;
+- invoke `/wr-retrospective:run-retro` before the final response, commit any retro-owned briefing refresh through its governed path, and continue to the summary even if retro reports a non-blocking failure;
+- end with one `ITERATION_SUMMARY` containing ticket, action, outcome, commit state, tests, risks, outstanding questions, remaining work, and notes.
+
+Run the nested process in the outer session's installed Codex environment. Do not replace `CODEX_HOME` or ignore user configuration: the inherited plugin registry and hooks are the governance surface. Export the three AFK guards so pending interactive questions, oversight nudges, and machine-authored correction text do not leak into the isolated turn.
+
+```bash
+ITERATION_CHECKOUT="$(git rev-parse --show-toplevel)"
+ITERATION_JSONL="$(mktemp)"
+ITERATION_FINAL="$(mktemp)"
+
+export WR_SUPPRESS_PENDING_QUESTIONS=1
+export WR_SUPPRESS_OVERSIGHT_NUDGE=1
+export WR_SUPPRESS_CORRECTION_DETECT=1
+
+codex exec \
+  --ephemeral \
+  --dangerously-bypass-approvals-and-sandbox \
+  --dangerously-bypass-hook-trust \
+  --cd "$ITERATION_CHECKOUT" \
+  --json \
+  --output-last-message "$ITERATION_FINAL" \
+  "$ITERATION_PROMPT" \
+  >"$ITERATION_JSONL" 2>&1
+ITERATION_EXIT=$?
+```
+
+The two output channels are load-bearing and must stay separate:
+
+- `ITERATION_JSONL` carries progress and error metadata only. Parse it as JSONL; never scrape the final agent message from this stream.
+- `ITERATION_FINAL` carries the final agent message. Read `ITERATION_SUMMARY` only from this file after the exit and metadata checks pass.
+
+Always remove both temporary files after their contents have been classified and consumed.
+
+## Error classification and recovery
+
+Classify in this order:
+
+1. A non-zero process exit halts the loop. Use the exit code plus JSONL error messages to report `quota exhausted`, `rate limited`, `authentication failed`, `service overloaded`, or `execution failed`; do not call a quota failure merely unavailable.
+2. Exit zero with a JSONL `error` or `turn.failed` event also halts before summary parsing. Apply the same message classification. A final-output file does not override an error event.
+3. Exit zero without an error event permits final-output parsing. The file must contain exactly one valid `ITERATION_SUMMARY` for the selected ticket; otherwise halt as `invalid iteration summary`.
+
+After every exit, record the checkout delta against the pre-iteration status for diagnosis, without mutation. Recovery may begin only after exit zero, error-free JSONL, and exactly one valid `ITERATION_SUMMARY` for the selected ticket. Missing, multiple, or wrong-ticket summaries halt without recovery. Then compare the checkout with the recorded pre-iteration status:
+
+- A clean checkout proceeds normally.
+- A coherent commit named by the valid summary proceeds to inter-iteration verification.
+- Coherent staged work attributable only to the selected ticket may be recovered only after its focused tests and governance gates pass again in the outer session.
+- Ambiguous, unstaged, or unrelated changes hard-block recovery. Report their paths and halt without mutation.
+- When a failed iteration created known disposable paths, restore only the explicit verified path list with path-scoped Git commands. Never use a broad reset, clean, checkout, restore, or stash operation.
+
 ## Fix Proposal Rule
 
 A fix proposal is a release row on an existing story map, never a new file under `docs/rfcs/`. The row has an identity from `<itil-plugin-root>/bin/wr-itil-next-rfc-id`, at least one story card, and a story whose `problems:` list names the driving problem. Creating a new map, activity column, job, or uncovered architectural choice requires a queued human decision rather than a silent edit.
@@ -50,9 +103,9 @@ A fix proposal is a release row on an existing story map, never a new file under
 
 - Batch outstanding questions at loop end with `request_user_input`, no more than four per call. Brief substance before IDs.
 - Continue past skipped tickets when another actionable ticket exists.
-- Stop only for an explicit user stop, a fully drained backlog, a governance dependency that blocks every remaining ticket, or an unrecoverable tool/repository failure.
-- Never describe a delayed native tool or subagent as unavailable, hung, or blocked without an actual error or terminal failure.
+- Stop only for an explicit user stop, a fully drained backlog, a governance dependency that blocks every remaining ticket, confirmed quota exhaustion, or an unrecoverable process or repository failure.
+- Never describe a delayed process as unavailable, hung, or blocked without an actual error or terminal failure.
 
 ## Final Report
 
-Report completed and skipped tickets, commits, tests, push/release outcomes, remaining backlog, and outstanding design questions. Preserve the distinction between committed, pushed, released, and production-verified states.
+Report completed and skipped tickets, commits, tests, push and release outcomes, remaining backlog, and outstanding design questions. Preserve the distinction between committed, pushed, released, and production-verified states.