@windyroad/risk-scorer 0.13.5 → 0.14.0-preview.762

package/.claude-plugin/plugin.json

@@ -310,5 +310,5 @@
     }
   },
   "name": "wr-risk-scorer",
-  "version": "0.13.5"
+  "version": "0.14.0"
 }

package/README.md

@@ -113,8 +113,10 @@ Behaviour:
 3. If `RISK-POLICY.md` is absent, the gate runs in advisory-only mode and
    permits the call (graceful adoption).
 
-Override: `BYPASS_RISK_GATE=1` short-circuits the gate (consistent with
-`git-push-gate.sh`). Reserved for cases the user has confirmed safe.
+There is no env override of the gate (the `BYPASS_RISK_GATE` knob was removed —
+P377/RFC-029). Clear the gate by reducing risk to within appetite, or — for a
+false-positive leak flag — by letting the reviewer re-judge. A genuine gate
+misfire is recovered per ADR-048 (documented recovery), not an env bypass.
 
 The canonical hook lives at `packages/shared/hooks/external-comms-gate.sh` and
 is synced into each consumer plugin via `scripts/sync-external-comms-gate.sh`

package/agents/pipeline.md

@@ -26,7 +26,7 @@ If the action is risk-reducing or risk-neutral, add on a separate line:
 RISK_BYPASS: reducing
 ```
 
-For live incidents, use:
+For a live-outage restore-service release that must proceed despite red/unreadable CI (the narrow CI-gate short-circuit case — see Incident-context scoring below; the change must still be net-risk-reducing per ADR-042 Rule 1b, no appetite carve-out):
 ```
 RISK_BYPASS: incident
 ```
@@ -164,11 +164,11 @@ Acceptable `RISK_BYPASS_REASON:` values cite the ticket ID closed, the prior
 risk report remediated, or the removed risk — matching one of the three
 criteria above.
 
-For live incidents (outage, security, information disclosure), include `RISK_BYPASS: incident`.
+**Incident-context scoring (ADR-042 Rule 1b; P377/RFC-029 — no incident carve-out).** An active incident is a risk being realised (Likelihood already 5). Score the incident-response change against that live realised-risk baseline: weigh P(it increases impact) vs P(it reduces impact & likelihood / restores service) + P(it introduces a new incident). When net risk-reducing, emit `RISK_BYPASS: reducing` (the incident path collapses into the risk-reducing path — no separate appetite carve-out). `RISK_BYPASS: incident` is retained ONLY for the narrow operational case where a restore-service release must proceed despite red/unreadable CI during a live outage (it short-circuits the CI-status gate, which `reducing` does not); emit it only for a genuine live outage requiring immediate deployment AND only when the change is net-risk-reducing per the baseline scoring above.
 
 ## Below-Appetite Output Rule (ADR-013 Rule 5)
 
-When ALL cumulative scores are within appetite (≤ 4 per RISK-POLICY.md), your output MUST contain ONLY:
+When ALL cumulative scores are within appetite (≤ the appetite threshold in `RISK-POLICY.md` § Risk Appetite — read it; `Threshold: N`, default 4/Low when absent; do NOT hardcode 4), your output MUST contain ONLY:
 1. The Pipeline Risk Report structure (layers, risk items, summary table)
 2. `RISK_SCORES: commit=N push=N release=N`
 3. `RISK_BYPASS: reducing` (if applicable)
@@ -177,7 +177,7 @@ Do NOT emit: "Suggested Actions", "Your call:", advisory warnings, back-pressure
 
 ## Above-Appetite Remediations
 
-When ANY cumulative score exceeds appetite (> 4), the verbal verdict is **STOP**.
+When ANY cumulative score exceeds appetite (> the RISK-POLICY.md appetite threshold, default 4 — read it, do NOT hardcode), the verbal verdict is **STOP**.
 The scorer is not the primary decision-maker — the hook gate will block the
 action — but the scorer's verdict must match the structured score so the agent
 does not waste tool calls acting on an ambiguous nudge.
@@ -214,7 +214,7 @@ When a pipeline run identifies a **register-worthy risk shape**, emit a structur
 
 ### Trigger conditions (emit a hint when ANY fire)
 
-1. **Above-appetite residual** — any cumulative residual score exceeds appetite (> 4 per `RISK-POLICY.md`). A risk that breaches appetite on this change is a standing-risk candidate, not just a one-off remediation target.
+1. **Above-appetite residual** — any cumulative residual score exceeds the appetite threshold declared in `RISK-POLICY.md` § Risk Appetite (default 4; read it, do NOT hardcode). A risk that breaches appetite on this change is a standing-risk candidate, not just a one-off remediation target.
 2. **Confidentiality disclosure** — the Confidential Information Disclosure check (below) flagged business metrics (revenue, user counts, pricing, client names, traffic volumes) in the diff. Confidentiality leaks are standing-risk-shaped even after the immediate remediation.
 3. **User-stated precondition** — the User-Stated Preconditions Check (below) flagged an unmet paired capability as a standalone Risk item. Unmet preconditions are standing-risk-shaped because the dependency gap persists until the paired capability ships.
 

package/agents/wip.md

@@ -47,7 +47,7 @@ Always provide the cumulative risk picture:
 
 ### Below-Appetite Rule (ADR-013 Rule 5)
 
-If cumulative risk is **within appetite** (< 5): provide the assessment table and verdict only. Do NOT emit advisory prose, recommendations, or suggestions. The verdict is `RISK_VERDICT: CONTINUE`.
+If cumulative risk is **within appetite** (≤ the appetite threshold in `RISK-POLICY.md` § Risk Appetite — read it; `Threshold: N`, default 4/Low when absent; do NOT hardcode): provide the assessment table and verdict only. Do NOT emit advisory prose, recommendations, or suggestions. The verdict is `RISK_VERDICT: CONTINUE`.
 
 ### Above-Appetite Remediations
 
@@ -89,7 +89,7 @@ After assessing the risk profile, check whether uncommitted changes represent **
 - `packages/*/skills/**/*.bats`
 - `docs/decisions/*.md`
 
-AND cumulative risk is **within appetite** (≤ 4), AND at least one completion signal is present:
+AND cumulative risk is **within appetite** (≤ the RISK-POLICY.md appetite threshold, default 4; read it, do NOT hardcode), AND at least one completion signal is present:
 - A problem file diff contains "Fix Released" or a status transition keyword. Under the flat layout this surfaces as a `.known-error.md` / `.closed.md` filename suffix; under the per-state subdir layout it surfaces as a path move into `docs/problems/known-error/` or `docs/problems/closed/`.
 - A SKILL.md was modified alongside a problem file update
 

package/hooks/external-comms-gate.sh

@@ -24,7 +24,7 @@
 #                                                  PreToolUse, nothing to read.)
 #
 # Gate behaviour:
-#   1. BYPASS_RISK_GATE=1 short-circuits the gate (consistent with git-push-gate.sh).
+#   1. (removed P377/RFC-029) — BYPASS_RISK_GATE env override no longer exists; the gate is cleared only by delegating to the reviewer.
 #   2. POLICY_FILE absent → advisory-only mode (permits with systemMessage).
 #   3. Hybrid leak-pattern pre-filter (lib/leak-detect.sh) hard-fails on
 #      credentials, prod-URL prefixes, business-context-paired financial figures,
@@ -97,10 +97,11 @@ EXTERNAL_COMMS_POLICY_FILE="${EXTERNAL_COMMS_POLICY_FILE:-RISK-POLICY.md}"
 EXTERNAL_COMMS_LEAK_PREFILTER="${EXTERNAL_COMMS_LEAK_PREFILTER:-yes}"
 EXTERNAL_COMMS_SKIP_SURFACES="${EXTERNAL_COMMS_SKIP_SURFACES:-}"
 
-# ---------- Bypass ----------
-if [ "${BYPASS_RISK_GATE:-0}" = "1" ]; then
-    exit 0
-fi
+# P377/RFC-029: the BYPASS_RISK_GATE=1 env override is REMOVED (never
+# authorised). There is no env escape from the external-comms gate — clear it
+# by delegating to the wr-risk-scorer:external-comms reviewer (the gate marks
+# the draft reviewed on a PASS verdict). A genuine gate misfire is recovered
+# per ADR-048 (documented recovery), not an env bypass.
 
 INPUT=$(cat)
 
@@ -316,7 +317,7 @@ fi
 # EXTERNAL_COMMS_LEAK_PREFILTER=yes (risk) or =no (voice-tone).
 if [ "$EXTERNAL_COMMS_LEAK_PREFILTER" = "yes" ]; then
     if ! leak_detect_scan "$DRAFT"; then
-        REASON=$(printf 'BLOCKED (external-comms gate / %s evaluator): %s on %s. Remove the leak before retrying. Override only if intentional (pre-session env): BYPASS_RISK_GATE=1.' \
+        REASON=$(printf 'BLOCKED (external-comms gate / %s evaluator): %s on %s. Remove the leak before retrying. There is no env override (P377/RFC-029 — BYPASS_RISK_GATE removed).' \
             "$EXTERNAL_COMMS_EVALUATOR_ID" "$LEAK_DETECT_REASON" "$SURFACE")
         deny_with_reason "$REASON"
         exit 0
@@ -386,7 +387,7 @@ fi
 # PostToolUse mark hook can derive the canonical marker key locally
 # (sha256(DRAFT + '\n' + SURFACE)). Single fire per gate cycle.
 VERDICT_PREFIX="${EXTERNAL_COMMS_VERDICT_PREFIX:-EXTERNAL_COMMS_${EXTERNAL_COMMS_EVALUATOR_ID^^}}"
-REASON=$(printf 'BLOCKED (external-comms gate / %s evaluator): %s draft has not been reviewed by %s. Delegate to %s (subagent_type: '"'"'%s'"'"') with a prompt that starts with the line `SURFACE: %s` and wraps the draft body verbatim inside `<draft>...</draft>` markers (for the changeset-author surface the body is the changeset summary WITHOUT the leading `---` frontmatter block — the gate strips frontmatter before hashing the marker key). The PostToolUse hook derives the marker key from that structure and marks the draft reviewed when the subagent emits %s_VERDICT: PASS — single fire suffices. Use %s for an interactive walkthrough. Override only when intentional (pre-session env): BYPASS_RISK_GATE=1.' \
+REASON=$(printf 'BLOCKED (external-comms gate / %s evaluator): %s draft has not been reviewed by %s. Delegate to %s (subagent_type: '"'"'%s'"'"') with a prompt that starts with the line `SURFACE: %s` and wraps the draft body verbatim inside `<draft>...</draft>` markers (for the changeset-author surface the body is the changeset summary WITHOUT the leading `---` frontmatter block — the gate strips frontmatter before hashing the marker key). The PostToolUse hook derives the marker key from that structure and marks the draft reviewed when the subagent emits %s_VERDICT: PASS — single fire suffices. Use %s for an interactive walkthrough. There is no env override (P377/RFC-029 — BYPASS_RISK_GATE removed).' \
     "$EXTERNAL_COMMS_EVALUATOR_ID" "$SURFACE" "$EXTERNAL_COMMS_SUBAGENT_TYPE" "$EXTERNAL_COMMS_SUBAGENT_TYPE" "$EXTERNAL_COMMS_SUBAGENT_TYPE" "$SURFACE" "$VERDICT_PREFIX" "$EXTERNAL_COMMS_ASSESS_SKILL")
 deny_with_reason "$REASON"
 exit 0

package/hooks/lib/risk-gate.sh

@@ -146,7 +146,7 @@ print(('yes' if score > N else 'no') + ' ' + str(N))
   if [ "$DENIED" = "yes" ]; then
     RISK_GATE_CATEGORY="threshold"
     RISK_GATE_SCORE="$SCORE"
-    RISK_GATE_REASON="${ACTION} risk score ${SCORE}/25 exceeds the project appetite of ${APPETITE}/25 (RISK-POLICY.md). To proceed: (1) split the ${ACTION}, (2) add risk-reducing measures, or (3) for a LIVE INCIDENT, delegate to wr-risk-scorer:pipeline (subagent_type: 'wr-risk-scorer:pipeline') with incident context for an incident bypass."
+    RISK_GATE_REASON="${ACTION} risk score ${SCORE}/25 exceeds the project appetite of ${APPETITE}/25 (RISK-POLICY.md). Reduce risk or halt — there is no proceed-anyway path (P377/RFC-029). To proceed within appetite: (1) split the ${ACTION}, (2) add risk-reducing measures and re-score, or (3) if this is incident response, delegate to wr-risk-scorer:pipeline (subagent_type: 'wr-risk-scorer:pipeline') with incident context — it scores the change against the live realised-risk baseline (ADR-042 Rule 1b) and clears it via the risk-reducing path if it is net-risk-reducing."
     return 1
   fi
 
@@ -164,8 +164,7 @@ print(('yes' if score > N else 'no') + ' ' + str(N))
 # status,conclusion,databaseId,url` for the working branch's most recent
 # CI run.
 #
-# Decision table:
-#   - bypass marker present (${RDIR}/ci-bypass-${ACTION}) → allow, consume
+# Decision table (no override — ci-bypass removed P377/RFC-029):
 #   - gh failure (auth / timeout / API error) → DENY (fail-CLOSED, per
 #     P208 safe-high-fix-risk classifier — a buggy harden must NOT
 #     degrade to allow)
@@ -182,19 +181,16 @@ check_ci_status() {
   local ACTION="$2"
   local RDIR
   RDIR=$(_risk_dir "$SESSION_ID")
-  local BYPASS_MARKER="${RDIR}/ci-bypass-${ACTION}"
 
   CI_GATE_REASON=""
   CI_GATE_CATEGORY=""
 
-  # One-shot bypass marker — consumed on use, same family as
-  # reducing-push / incident-release. Documented override for the
-  # legitimate "first push triggers CI" edge case and infra incidents.
-  if [ -f "$BYPASS_MARKER" ]; then
-    rm -f "$BYPASS_MARKER"
-    CI_GATE_CATEGORY="bypass"
-    return 0
-  fi
+  # P377/RFC-029: the `ci-bypass-${ACTION}` one-shot override is REMOVED
+  # (never authorised). The CI-status gate is fail-closed per P208 with NO
+  # escape — red/unreadable CI hard-fails; fix the underlying CI / gh failure.
+  # The "first push triggers CI" case is handled by the empty-history natural
+  # allow below (no marker needed). Live-outage releases use the separate
+  # `incident-release` marker (git-push-gate.sh), justified by ADR-042 Rule 1b.
 
   # Resolve current branch. If we're not in a git repo or HEAD is
   # detached, skip the CI check (the surrounding push/release gate
@@ -220,7 +216,7 @@ check_ci_status() {
 
   if [ -n "${GH_EXIT:-}" ] && [ "$GH_EXIT" != "0" ]; then
     CI_GATE_CATEGORY="gh-error"
-    CI_GATE_REASON="CI status check failed (gh exit ${GH_EXIT}: auth / timeout / API error). Fail-closed per P208 safe-high-fix-risk. Fix the underlying gh failure, or to override for a legitimate first-push-triggers-CI run, create the bypass marker: touch ${BYPASS_MARKER}"
+    CI_GATE_REASON="CI status check failed (gh exit ${GH_EXIT}: auth / timeout / API error). Fail-closed per P208 safe-high-fix-risk. Fix the underlying gh / CI failure before pushing/releasing — there is no override (P377/RFC-029; the ci-bypass marker was removed)."
     return 1
   fi
 
@@ -256,14 +252,14 @@ except Exception:
 
   if [ "$STATUS" = "PARSE_ERROR" ]; then
     CI_GATE_CATEGORY="gh-error"
-    CI_GATE_REASON="CI status check returned unparseable response. Fail-closed per P208 safe-high-fix-risk. To override for a legitimate first-push case, create the bypass marker: touch ${BYPASS_MARKER}"
+    CI_GATE_REASON="CI status check returned unparseable response. Fail-closed per P208 safe-high-fix-risk. Fix the gh / CI failure before pushing/releasing — there is no override (P377/RFC-029)."
     return 1
   fi
 
   case "$STATUS" in
     queued|in_progress|pending|requested|waiting)
       CI_GATE_CATEGORY="pending"
-      CI_GATE_REASON="Latest CI run on branch '${BRANCH}' is still in flight (status: ${STATUS}). Wait for it to settle: ${URL}. To override, create the bypass marker: touch ${BYPASS_MARKER}"
+      CI_GATE_REASON="Latest CI run on branch '${BRANCH}' is still in flight (status: ${STATUS}). Wait for it to settle before pushing/releasing: ${URL} (no override — P377/RFC-029)."
       return 1
       ;;
     completed)
@@ -274,7 +270,7 @@ except Exception:
           ;;
         failure|cancelled|timed_out|action_required|startup_failure)
           CI_GATE_CATEGORY="red"
-          CI_GATE_REASON="Latest CI run on branch '${BRANCH}' concluded ${CONCLUSION}: ${URL}. Fix CI before pushing/releasing. To override for a legitimate first-push or infra-incident case, create the bypass marker: touch ${BYPASS_MARKER}"
+          CI_GATE_REASON="Latest CI run on branch '${BRANCH}' concluded ${CONCLUSION}: ${URL}. Fix CI before pushing/releasing — there is no override (P377/RFC-029; ci-bypass removed). A live-outage restore-service release uses the separate incident-release path."
           return 1
           ;;
         *)

package/hooks/plan-risk-guidance.sh

@@ -32,9 +32,17 @@ if [ -n "$SESSION_ID" ] && [ -f "$RELEASE_SCORE_FILE" ]; then
 fi
 
 # --- Read appetite from RISK-POLICY.md ---
-APPETITE="5"
+# Default 4 (Low) — MUST match the canonical gate parser default in
+# packages/risk-scorer/hooks/lib/risk-gate.sh (P377/RFC-029: a default of 5
+# here was an ADR-065 confirmation violation — the canonical default is 4).
+# The authoritative parser lives in risk-gate.sh; this guidance script mirrors
+# its 3 tolerated phrasings (Threshold: N | exceeds N | N / Low appetite).
+APPETITE="4"
 if [ -f "RISK-POLICY.md" ]; then
-  EXTRACTED=$(grep -oP 'Threshold:\s*\K[0-9]+' RISK-POLICY.md 2>/dev/null | head -1 || echo "")
+  EXTRACTED=$(grep -oP '(?:Threshold:\s*|exceeds\s+)\K[0-9]+' RISK-POLICY.md 2>/dev/null | head -1 || echo "")
+  if [ -z "$EXTRACTED" ]; then
+    EXTRACTED=$(grep -oP '[0-9]+(?=\s*/\s*Low appetite)' RISK-POLICY.md 2>/dev/null | head -1 || echo "")
+  fi
   if [ -n "$EXTRACTED" ]; then
     APPETITE="$EXTRACTED"
   fi

package/hooks/risk-score-commit-gate.sh

@@ -69,7 +69,8 @@ fi
 # TTL is unexpired; consumed on drift or TTL expiry so a genuine risk-
 # profile change forces a fresh wr-risk-scorer:pipeline rescore. Mirrors
 # the clean-marker persist-until-drift precedent (above) — distinct from
-# incident-release / ci-bypass, which remain deliberate one-time overrides.
+# incident-release, which remains the one-shot live-outage override
+# (ci-bypass was removed per P377/RFC-029).
 if [ -f "${RDIR}/reducing-commit" ]; then
     NOW=$(date +%s)
     MARK_TIME=$(_mtime "${RDIR}/reducing-commit")

package/hooks/test/ci-status-gate.bats

@@ -129,25 +129,19 @@ _run_check() {
   export FAKE_GH_EXIT=1
   result=$(_run_check "push")
   [[ "$result" == DENY:* ]]
-  # Must point at the ci-bypass marker for the documented override path.
-  [[ "$result" == *"ci-bypass-push"* ]]
+  # P377/RFC-029: ci-bypass removed — the deny states there is no override
+  # and does not instruct the user to create/touch a bypass marker.
+  [[ "$result" == *"no override"* ]]
+  [[ "$result" != *"touch "* ]]
 }
 
-@test "check_ci_status allows when ci-bypass marker is present and consumes it" {
+@test "P377/RFC-029: a ci-bypass marker is IGNORED — red CI still denies (override removed)" {
   : > "$RDIR/ci-bypass-push"
   export FAKE_GH_OUTPUT='[{"status":"completed","conclusion":"failure","databaseId":7,"url":"https://github.com/x/y/actions/runs/7"}]'
   result=$(_run_check "push")
-  [[ "$result" == "ALLOW" ]]
-  # Bypass markers are one-shot — same family as reducing-push / incident-release.
-  [ ! -f "$RDIR/ci-bypass-push" ]
-}
-
-@test "check_ci_status bypass marker is action-scoped (push marker does not bypass release)" {
-  : > "$RDIR/ci-bypass-push"
-  export FAKE_GH_OUTPUT='[{"status":"completed","conclusion":"failure","databaseId":8,"url":"https://github.com/x/y/actions/runs/8"}]'
-  result=$(_run_check "release")
+  # The marker no longer short-circuits; red CI is fail-closed regardless.
   [[ "$result" == DENY:* ]]
-  # push bypass must not have been consumed by a release check
+  # And the gate does not consume / act on the marker.
   [ -f "$RDIR/ci-bypass-push" ]
 }
 

package/hooks/test/external-comms-gate.bats

@@ -107,16 +107,15 @@ run_hook() {
   [[ "$output" == *"wr-risk-scorer:external-comms"* ]]
 }
 
-# P173: the BYPASS_RISK_GATE override is clarified as pre-session — it only
-# takes effect when set in Claude Code's process env before the session
-# started, not via a mid-session Bash export. The in-flight escape-hatch is
-# delegation to the external-comms subagent (already named in the deny).
-@test "P173 marker-absent deny clarifies the env override is pre-session" {
+# P377/RFC-029: the BYPASS_RISK_GATE env override was removed. The only
+# clearance path named in the deny is delegation to the external-comms subagent.
+@test "marker-absent deny names the reviewer and offers no env override (P377/RFC-029)" {
   INPUT=$(build_bash_input "gh issue create --title T --body 'we observed a build failure on Node 20'")
   run_hook "$INPUT"
   [ "$status" -eq 0 ]
   [[ "$output" == *"deny"* ]]
-  [[ "$output" == *"pre-session"* ]]
+  [[ "$output" == *"wr-risk-scorer:external-comms"* ]]
+  [[ "$output" != *"BYPASS_RISK_GATE=1"* ]]
 }
 
 @test "hard-fail credential pattern (GitHub token) denies immediately with leak reason" {
@@ -136,11 +135,14 @@ run_hook() {
   [[ "$output" == *"AWS"* ]] || [[ "$output" == *"credential"* ]]
 }
 
-@test "BYPASS_RISK_GATE=1 short-circuits the deny" {
+@test "BYPASS_RISK_GATE=1 does NOT bypass the gate (removed P377/RFC-029)" {
   INPUT=$(build_bash_input "gh issue create --title T --body 'we observed a build failure'")
   run bash -c "cd '$TEST_PROJECT_DIR' && BYPASS_RISK_GATE=1 printf '%s' \"\$1\" | BYPASS_RISK_GATE=1 '$HOOK'" _ "$INPUT"
   [ "$status" -eq 0 ]
-  [ -z "$output" ]
+  # The env override no longer short-circuits — the gate still denies the
+  # unreviewed external-comms draft.
+  [[ "$output" == *"deny"* ]]
+  [[ "$output" == *"wr-risk-scorer:external-comms"* ]]
 }
 
 @test "per-evaluator marker (external-comms-risk-reviewed-<KEY>) allows the call (ADR-028 amended 2026-05-14)" {
@@ -319,11 +321,15 @@ run_hook() {
   [ -z "$output" ]
 }
 
-@test "P082: BYPASS_RISK_GATE=1 short-circuits the git commit gate" {
-  INPUT=$(build_bash_input "git commit -m \"fix(foo): handle null input\"")
+@test "P082→P377/RFC-029: BYPASS_RISK_GATE=1 is inert — does not short-circuit the gate" {
+  # gh-issue is an unconditionally-gated external surface (no visibility
+  # precondition). Setting BYPASS_RISK_GATE=1 has no effect: the unreviewed
+  # draft still denies, identically to the no-env-var case.
+  INPUT=$(build_bash_input "gh issue create --title T --body 'we observed a build failure on Node 20'")
   run bash -c "cd '$TEST_PROJECT_DIR' && BYPASS_RISK_GATE=1 printf '%s' \"\$1\" | BYPASS_RISK_GATE=1 '$HOOK'" _ "$INPUT"
   [ "$status" -eq 0 ]
-  [ -z "$output" ]
+  [[ "$output" == *"deny"* ]]
+  [[ "$output" == *"wr-risk-scorer:external-comms"* ]]
 }
 
 @test "P082: per-evaluator marker keyed on (body, git-commit-message) permits the call" {

package/lib/install-utils.mjs

@@ -7,10 +7,12 @@ import { execSync } from "node:child_process";
 
 const MARKETPLACE_REPO = "windyroad/agent-plugins";
 const MARKETPLACE_NAME = "windyroad";
+const CODEX_MARKETPLACE_PATH = ".";
+const CODEX_MARKETPLACE_NAME = "windyroad-local";
 
 let _dryRun = false;
 
-export { MARKETPLACE_REPO, MARKETPLACE_NAME };
+export { MARKETPLACE_REPO, MARKETPLACE_NAME, CODEX_MARKETPLACE_PATH, CODEX_MARKETPLACE_NAME };
 
 export function setDryRun(value) {
   _dryRun = value;
@@ -35,16 +37,34 @@ export function run(cmd, label) {
   }
 }
 
-export function checkPrerequisites() {
+function runtimesFor(runtime = "claude") {
+  if (runtime === "both") return ["claude", "codex"];
+  return [runtime];
+}
+
+export function checkPrerequisites({ runtime = "claude" } = {}) {
   if (_dryRun) return;
 
-  try {
-    execSync("claude --version", { stdio: "pipe" });
-  } catch {
-    console.error(
-      "Error: 'claude' CLI not found. Install Claude Code first:\n  https://docs.anthropic.com/en/docs/claude-code\n"
-    );
-    process.exit(1);
+  for (const currentRuntime of runtimesFor(runtime)) {
+    if (currentRuntime === "claude") {
+      try {
+        execSync("claude --version", { stdio: "pipe" });
+      } catch {
+        console.error(
+          "Error: 'claude' CLI not found. Install Claude Code first:\n  https://docs.anthropic.com/en/docs/claude-code\n"
+        );
+        process.exit(1);
+      }
+    } else if (currentRuntime === "codex") {
+      try {
+        execSync("codex --version", { stdio: "pipe" });
+      } catch {
+        console.error(
+          "Error: 'codex' CLI not found. Install Codex CLI first:\n  https://developers.openai.com/codex\n"
+        );
+        process.exit(1);
+      }
+    }
   }
 }
 
@@ -55,6 +75,13 @@ export function addMarketplace() {
   );
 }
 
+export function addCodexMarketplace() {
+  return run(
+    `codex plugin marketplace add ${CODEX_MARKETPLACE_PATH}`,
+    `Codex marketplace: ${CODEX_MARKETPLACE_NAME}`
+  );
+}
+
 export function installPlugin(pluginName, { scope = "project" } = {}) {
   return run(
     `claude plugin install ${pluginName}@${MARKETPLACE_NAME} --scope ${scope}`,
@@ -62,6 +89,13 @@ export function installPlugin(pluginName, { scope = "project" } = {}) {
   );
 }
 
+export function installCodexPlugin(pluginName) {
+  return run(
+    `codex plugin add ${pluginName}@${CODEX_MARKETPLACE_NAME}`,
+    pluginName
+  );
+}
+
 export function updatePlugin(pluginName, { scope = "project" } = {}) {
   return run(
     `claude plugin update "${pluginName}@${MARKETPLACE_NAME}" --scope ${scope}`,
@@ -69,18 +103,36 @@ export function updatePlugin(pluginName, { scope = "project" } = {}) {
   );
 }
 
+export function updateCodexMarketplace() {
+  return run(
+    `codex plugin marketplace add ${CODEX_MARKETPLACE_PATH}`,
+    `Codex marketplace: ${CODEX_MARKETPLACE_NAME}`
+  );
+}
+
 export function uninstallPlugin(pluginName) {
   return run(`claude plugin uninstall ${pluginName}`, `Removing ${pluginName}`);
 }
 
+export function uninstallCodexPlugin(pluginName) {
+  return run(`codex plugin remove ${pluginName}`, `Removing ${pluginName}`);
+}
+
 /**
  * Install a single package: marketplace add + plugin install.
  */
-export function installPackage(pluginName, { deps = [], scope = "project" } = {}) {
+export function installPackage(pluginName, { deps = [], scope = "project", runtime = "claude" } = {}) {
   console.log(`\nInstalling @windyroad/${pluginName.replace("wr-", "")} (${scope} scope)...\n`);
 
-  addMarketplace();
-  installPlugin(pluginName, { scope });
+  if (runtime === "claude" || runtime === "both") {
+    addMarketplace();
+    installPlugin(pluginName, { scope });
+  }
+
+  if (runtime === "codex" || runtime === "both") {
+    addCodexMarketplace();
+    installCodexPlugin(pluginName);
+  }
 
   if (deps.length > 0) {
     console.log(`\nNote: This plugin works best with:`);
@@ -90,34 +142,47 @@ export function installPackage(pluginName, { deps = [], scope = "project" } = {}
   }
 
   console.log(
-    `\nDone! Restart Claude Code to activate.\n`
+    `\nDone! Restart ${runtime === "codex" ? "Codex" : runtime === "both" ? "Claude Code and Codex" : "Claude Code"} to activate.\n`
   );
 }
 
 /**
  * Update a single package.
  */
-export function updatePackage(pluginName, { scope = "project" } = {}) {
+export function updatePackage(pluginName, { scope = "project", runtime = "claude" } = {}) {
   console.log(`\nUpdating @windyroad/${pluginName.replace("wr-", "")}...\n`);
 
-  run(
-    `claude plugin marketplace update ${MARKETPLACE_NAME}`,
-    "Updating marketplace"
-  );
-  updatePlugin(pluginName, { scope });
+  if (runtime === "claude" || runtime === "both") {
+    run(
+      `claude plugin marketplace update ${MARKETPLACE_NAME}`,
+      "Updating marketplace"
+    );
+    updatePlugin(pluginName, { scope });
+  }
 
-  console.log("\nDone! Restart Claude Code to apply updates.\n");
+  if (runtime === "codex" || runtime === "both") {
+    updateCodexMarketplace();
+    installCodexPlugin(pluginName);
+  }
+
+  console.log(`\nDone! Restart ${runtime === "codex" ? "Codex" : runtime === "both" ? "Claude Code and Codex" : "Claude Code"} to apply updates.\n`);
 }
 
 /**
  * Uninstall a single package.
  */
-export function uninstallPackage(pluginName) {
+export function uninstallPackage(pluginName, { runtime = "claude" } = {}) {
   console.log(`\nUninstalling @windyroad/${pluginName.replace("wr-", "")}...\n`);
 
-  uninstallPlugin(pluginName);
+  if (runtime === "claude" || runtime === "both") {
+    uninstallPlugin(pluginName);
+  }
+
+  if (runtime === "codex" || runtime === "both") {
+    uninstallCodexPlugin(pluginName);
+  }
 
-  console.log("\nDone. Restart Claude Code to apply changes.\n");
+  console.log(`\nDone. Restart ${runtime === "codex" ? "Codex" : runtime === "both" ? "Claude Code and Codex" : "Claude Code"} to apply changes.\n`);
 }
 
 /**
@@ -131,6 +196,7 @@ export function parseStandardArgs(argv) {
     update: args.includes("--update"),
     dryRun: args.includes("--dry-run"),
     scope: "project",
+    runtime: "claude",
   };
   const scopeIdx = args.indexOf("--scope");
   if (scopeIdx !== -1 && args[scopeIdx + 1]) {
@@ -142,5 +208,15 @@ export function parseStandardArgs(argv) {
       process.exit(1);
     }
   }
+  const runtimeIdx = args.indexOf("--runtime");
+  if (runtimeIdx !== -1 && args[runtimeIdx + 1]) {
+    const val = args[runtimeIdx + 1];
+    if (["claude", "codex", "both"].includes(val)) {
+      flags.runtime = val;
+    } else {
+      console.error("--runtime requires: claude, codex, or both");
+      process.exit(1);
+    }
+  }
   return flags;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@windyroad/risk-scorer",
-  "version": "0.13.5",
+  "version": "0.14.0-preview.762",
   "description": "Pipeline risk scoring, commit/push gates, and secret leak detection",
   "bin": {
     "windyroad-risk-scorer": "./bin/install.mjs"

package/skills/assess-external-comms/SKILL.md

@@ -100,7 +100,7 @@ If the verdict is FAIL, do NOT auto-rewrite the draft. Use `AskUserQuestion`:
 - options:
   1. `Rewrite the draft and re-review` — return to step 1 with the rewritten body.
   2. `Move to a private channel` — direct the user to a non-public surface (vendor private email, internal Slack, etc.) where the leak does not apply.
-  3. `Override anyway` — set `BYPASS_RISK_GATE=1` for the next gated tool call. Reserved for cases where the user has confirmed the content is safe to publish (e.g. the "client name" is actually their own org).
+  3. `Re-review with context` — if the flag is a false positive (e.g. the "client name" is actually the user's own org), give that context to the `wr-risk-scorer:external-comms` reviewer and let it re-judge; a PASS verdict clears the gate via the review marker. There is no `BYPASS_RISK_GATE` env override (removed P377/RFC-029) — the reviewer's judgement, not an env knob, is the clearance path.
   4. `Cancel` — abandon the post.
 
 Do not make the decision unilaterally — per ADR-013 Rule 1, all leak/no-leak judgement calls outside the regex pre-filter belong to the user.

package/skills/assess-release/SKILL.md

@@ -82,11 +82,6 @@ Present the full risk report to the user. Highlight:
 - Any risks above appetite (score ≥ 5 per RISK-POLICY.md)
 - Whether the gate is now pre-satisfied for the current session (i.e., a subsequent `git commit` will reuse the bypass marker without re-triggering the scorer)
 
-If any score is above appetite, use `AskUserQuestion` to ask whether the user wants to:
-- (a) Proceed anyway (bypass)
-- (b) Remediate the identified risks first
-- (c) Cancel
-
-Do not make the decision unilaterally — per ADR-013 Rule 1, all above-appetite risk decisions are the user's.
+If any score is above appetite, the action is **framework-mediated, not a user decision** (P377/RFC-029; ADR-044 category-3 explicitly excludes above-appetite). Per **ADR-042 Rule 1**: auto-apply scorer remediations incrementally until residual risk is within appetite, OR halt per ADR-042 Rule 5 if the scorer cannot converge. **MUST NOT commit/push/release above appetite, and MUST NOT use `AskUserQuestion` to ask whether to proceed anyway** — there is no "proceed anyway (bypass)" option; the answer is always reduce-risk-or-halt. The only sanctioned non-blocking path is the risk-reducing path (a genuinely risk-reducing change clears via the `reducing` bypass). Under non-interactive contexts the ADR-013 Rule 6 fail-safe is the terminal fallback: skip the action and report the uncommitted/unreleased state.
 
 $ARGUMENTS

package/skills/update-policy/SKILL.md

@@ -162,6 +162,11 @@ Write the policy using the structure derived from the agent contract (step 1). T
 - The impact levels with project-specific descriptions from step 5
 - The likelihood levels (universal 1-5 scale)
 - The risk matrix (Impact × Likelihood table) and label bands
+- **An `## Authorized Bypass Scenarios` section** (P377/RFC-029) stating exactly which gate bypasses are sanctioned — and that nothing else is. The canonical text to write:
+  - **Risk-reducing / risk-neutral changes** proceed via the risk-reducing path (a change that lowers or holds residual risk is not blocked by the gate). The scorer emits `RISK_BYPASS: reducing`; the gate honours a drift-revalidated, TTL-bounded `reducing-*` marker.
+  - **Incident response** is NOT a separate carve-out — an active incident is a risk already being realised (Likelihood 5), so an incident-response change is scored against that live baseline and proceeds only if net-risk-reducing (per ADR-042 Rule 1b). The `incident-release` marker exists only to let a net-reducing restore-service release proceed despite red/unreadable CI during a live outage.
+  - **Above appetite is never bypassable by a prompt or an env var.** There is no "commit/release anyway" question and no `BYPASS_RISK_GATE` / `ci-bypass` override (removed P377/RFC-029) — above appetite, the action auto-remediates to within appetite or halts (ADR-042 Rule 1).
+  - **Default-permitted-when-silent**: a project whose RISK-POLICY.md predates this section still permits the risk-reducing and incident paths above; this section makes the policy the explicit single source of truth and SHOULD be added at the next review.
 - A note that both the risk-scorer agent and problem management process reference this policy
 
 ## Updating an existing policy