@windyroad/risk-scorer 0.17.2 → 0.17.3

package/.agents/plugins/marketplace.json

@@ -0,0 +1,20 @@
+{
+  "name": "windyroad-local",
+  "interface": {
+    "displayName": "Windy Road Risk Scorer"
+  },
+  "plugins": [
+    {
+      "name": "wr-risk-scorer",
+      "source": {
+        "source": "local",
+        "path": "."
+      },
+      "policy": {
+        "installation": "AVAILABLE",
+        "authentication": "ON_INSTALL"
+      },
+      "category": "Developer Tools"
+    }
+  ]
+}

package/.claude-plugin/plugin.json

@@ -310,5 +310,5 @@
     }
   },
   "name": "wr-risk-scorer",
-  "version": "0.17.2"
+  "version": "0.17.3"
 }

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "wr-risk-scorer",
-  "version": "0.17.2",
+  "version": "0.17.3",
   "description": "Pipeline risk scoring, commit/push gates, and secret leak detection",
   "author": {
     "name": "Windy Road Technology",

package/bin/install.mjs

@@ -8,6 +8,7 @@ const utils = await import(resolve(__dirname, "../lib/install-utils.mjs"));
 
 const PLUGIN = "wr-risk-scorer";
 const DEPS = [];
+const PACKAGE_ROOT = resolve(__dirname, "..");
 
 const flags = utils.parseStandardArgs(process.argv);
 
@@ -35,10 +36,37 @@ if (flags.dryRun) {
 
 utils.checkPrerequisites({ runtime: flags.runtime });
 
+function codexInstall() {
+  utils.run(`codex plugin marketplace add ${PACKAGE_ROOT}`, "Codex marketplace: windyroad-local");
+  utils.run(`codex plugin add ${PLUGIN}@windyroad-local`, PLUGIN);
+}
+
+function codexUninstall() {
+  utils.run(`codex plugin remove ${PLUGIN}`, `Removing ${PLUGIN}`);
+}
+
 if (flags.uninstall) {
-  utils.uninstallPackage(PLUGIN, { runtime: flags.runtime });
+  if (flags.runtime === "claude" || flags.runtime === "both") {
+    utils.uninstallPackage(PLUGIN, { runtime: "claude" });
+  }
+  if (flags.runtime === "codex" || flags.runtime === "both") {
+    codexUninstall();
+  }
 } else if (flags.update) {
-  utils.updatePackage(PLUGIN, { scope: flags.scope, runtime: flags.runtime });
+  if (flags.runtime === "claude" || flags.runtime === "both") {
+    utils.updatePackage(PLUGIN, { scope: flags.scope, runtime: "claude" });
+  }
+  if (flags.runtime === "codex" || flags.runtime === "both") {
+    codexInstall();
+  }
+} else if (flags.runtime === "codex") {
+  console.log(`\nInstalling @windyroad/risk-scorer (${flags.scope} scope)...\n`);
+  codexInstall();
+  console.log("\nDone! Restart Codex to activate.\n");
+} else if (flags.runtime === "both") {
+  utils.installPackage(PLUGIN, { deps: DEPS, scope: flags.scope, runtime: "claude" });
+  codexInstall();
+  console.log("\nDone! Restart Claude Code and Codex to activate.\n");
 } else {
-  utils.installPackage(PLUGIN, { deps: DEPS, scope: flags.scope, runtime: flags.runtime });
+  utils.installPackage(PLUGIN, { deps: DEPS, scope: flags.scope, runtime: "claude" });
 }

package/hooks/hooks.json

@@ -10,7 +10,7 @@
       { "matcher": "Bash|Edit|Write|ExitPlanMode|EnterPlanMode", "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/risk-scorer-dispatch.sh pre-tool" }] }
     ],
     "PostToolUse": [
-      { "matcher": "Agent|Bash|Skill", "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/risk-scorer-dispatch.sh post-tool" }] }
+      { "matcher": "Agent|Bash|Edit|Skill|Write", "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/risk-scorer-dispatch.sh post-tool" }] }
     ]
   }
 }

package/hooks/risk-scorer-dispatch.sh

@@ -56,6 +56,9 @@ case "$EVENT" in
         run_hook risk-hash-refresh.sh
         run_hook risk-slide-marker.sh
         ;;
+      Edit|Write)
+        run_hook wip-risk-mark.sh
+        ;;
       Skill)
         run_hook risk-slide-marker.sh
         ;;

package/hooks/test/risk-scorer-hook-dispatch.bats

@@ -43,3 +43,35 @@ PY
   [[ "$output" == *"deny"* ]]
   [[ "$output" == *"AWS access key"* ]]
 }
+
+@test "dispatcher routes PostToolUse Write through the WIP nudge" {
+  local dir input orig
+  dir="$(mktemp -d)"
+  orig="$PWD"
+  mkdir -p "$dir/repo" "$dir/tmp"
+  cd "$dir/repo"
+  git init -q
+  git config user.email test@example.com
+  git config user.name "Test User"
+  printf 'base\n' > base.txt
+  git add base.txt
+  git commit -q -m initial
+  mkdir -p src
+  printf 'one\n' > src/one.txt
+  printf 'two\n' > src/two.txt
+  printf 'three\n' > src/three.txt
+  input="$(python3 - <<'PY'
+import json
+print(json.dumps({
+    "tool_name": "Write",
+    "session_id": "dispatch-wip",
+    "tool_input": {"file_path": "src/three.txt"},
+}))
+PY
+)"
+  run env TMPDIR="$dir/tmp" bash "$HOOKS/risk-scorer-dispatch.sh" post-tool <<<"$input"
+  cd "$orig"
+  rm -rf "$dir"
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"Batching risk rising"* ]]
+}

package/hooks/test/wip-risk-mark.bats

@@ -0,0 +1,64 @@
+#!/usr/bin/env bats
+
+setup() {
+  REPO_ROOT="$(cd "$(dirname "$BATS_TEST_FILENAME")/../../../.." && pwd)"
+  HOOK="$REPO_ROOT/packages/risk-scorer/hooks/wip-risk-mark.sh"
+  ORIG_DIR="$PWD"
+  TEST_DIR="$(mktemp -d)"
+  TMPDIR="$TEST_DIR/tmp"
+  export TMPDIR
+  mkdir -p "$TMPDIR"
+  mkdir -p "$TEST_DIR/repo"
+  cd "$TEST_DIR/repo"
+  git init -q
+  git config user.email test@example.com
+  git config user.name "Test User"
+  printf 'base\n' > base.txt
+  git add base.txt
+  git commit -q -m initial
+  SESSION_ID="wip-mark-$$"
+}
+
+teardown() {
+  cd "$ORIG_DIR"
+  rm -rf "$TEST_DIR"
+}
+
+run_hook() {
+  python3 - "$SESSION_ID" <<'PY' | bash "$HOOK"
+import json
+import sys
+print(json.dumps({
+    "tool_name": "Write",
+    "session_id": sys.argv[1],
+    "tool_input": {"file_path": "src/example.txt"},
+}))
+PY
+}
+
+@test "wip-risk-mark nudges once when accumulated WIP crosses the small-batch threshold" {
+  mkdir -p src
+  printf 'one\n' > src/one.txt
+  printf 'two\n' > src/two.txt
+  printf 'three\n' > src/three.txt
+
+  run run_hook
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"Batching risk rising: 3 changed files"* ]]
+  [[ "$output" == *"committing a coherent slice now"* ]]
+  [[ "$output" == *"push and release small batches"* ]]
+
+  run run_hook
+  [ "$status" -eq 0 ]
+  [ -z "$output" ]
+}
+
+@test "wip-risk-mark stays silent below threshold" {
+  mkdir -p src
+  printf 'one\n' > src/one.txt
+  printf 'two\n' > src/two.txt
+
+  run run_hook
+  [ "$status" -eq 0 ]
+  [ -z "$output" ]
+}

package/hooks/wip-risk-mark.sh

@@ -1,7 +1,5 @@
 #!/bin/bash
-# PostToolUse hook: Manages the WIP-reviewed marker.
-# - After Edit/Write on non-doc files: clears the marker (blocks next edit)
-# - After Agent (risk-scorer) completion: creates the marker (unblocks next edit)
+# PostToolUse hook: soft nudge for accumulated WIP.
 
 set -euo pipefail
 
@@ -15,10 +13,47 @@ TOOL_NAME=$(_get_tool_name)
 SESSION_ID=$(_get_session_id)
 [ -n "$SESSION_ID" ] || exit 0
 
-MARKER="$(_risk_dir "$SESSION_ID")/wip-reviewed"
+case "$TOOL_NAME" in
+  Edit|Write) ;;
+  *) exit 0 ;;
+esac
 
-# WIP marker persists after assessment — allows multiple edits.
-# Marker lifecycle: TTL + drift detection (ADR-009).
-# Agent case (marker creation) handled by risk-score-mark.sh.
+ROOT=$(git rev-parse --show-toplevel 2>/dev/null || true)
+[ -n "$ROOT" ] || exit 0
+cd "$ROOT"
+
+STATUS_COUNT=$(git status --short --untracked-files=all 2>/dev/null | wc -l | tr -d ' ')
+SHORTSTAT=$(git diff HEAD --shortstat 2>/dev/null || true)
+INSERTIONS=$(printf '%s' "$SHORTSTAT" | sed -n 's/.* \([0-9][0-9]*\) insertion.*/\1/p')
+DELETIONS=$(printf '%s' "$SHORTSTAT" | sed -n 's/.* \([0-9][0-9]*\) deletion.*/\1/p')
+INSERTIONS=${INSERTIONS:-0}
+DELETIONS=${DELETIONS:-0}
+TOTAL_LINES=$((INSERTIONS + DELETIONS))
+
+# ponytail: fixed early nudge threshold; make project-configurable only after real false positives.
+if [ "$STATUS_COUNT" -lt 3 ] && [ "$TOTAL_LINES" -lt 80 ]; then
+  exit 0
+fi
+
+RDIR=$(_risk_dir "$SESSION_ID")
+KEY="${STATUS_COUNT}:${INSERTIONS}:${DELETIONS}"
+KEY_FILE="${RDIR}/wip-nudge-key"
+if [ -f "$KEY_FILE" ] && [ "$(cat "$KEY_FILE" 2>/dev/null || true)" = "$KEY" ]; then
+  exit 0
+fi
+printf '%s\n' "$KEY" > "$KEY_FILE"
+
+python3 - "$STATUS_COUNT" "$INSERTIONS" "$DELETIONS" <<'PY'
+import json
+import sys
+
+files, insertions, deletions = sys.argv[1:4]
+print(json.dumps({
+    "systemMessage": (
+        f"Batching risk rising: {files} changed files, +{insertions}/-{deletions} since HEAD. "
+        "Keep risk low by committing a coherent slice now; push and release small batches instead of accumulating them."
+    )
+}))
+PY
 
 exit 0

package/package.json

@@ -1,7 +1,11 @@
 {
   "name": "@windyroad/risk-scorer",
-  "version": "0.17.2",
+  "version": "0.17.3",
   "description": "Pipeline risk scoring, commit/push gates, and secret leak detection",
+  "scripts": {
+    "prepack": "node scripts/sync-codex-skills.mjs --pack",
+    "postpack": "node scripts/sync-codex-skills.mjs --restore-pack"
+  },
   "bin": {
     "windyroad-risk-scorer": "./bin/install.mjs"
   },
@@ -23,6 +27,7 @@
     "agents/",
     "hooks/",
     "skills/",
+    ".agents/",
     ".claude-plugin/",
     ".codex-plugin/",
     "lib/",

package/scripts/sync-codex-skills.mjs

@@ -0,0 +1,87 @@
+#!/usr/bin/env node
+
+import {
+  existsSync,
+  mkdirSync,
+  readdirSync,
+  readFileSync,
+  renameSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+const packageRoot = resolve(__dirname, "..");
+const skillsRoot = join(packageRoot, "skills");
+const backupRoot = join(packageRoot, ".pack-claude-skills");
+const mode = process.argv.includes("--check") ? "check" : "sync";
+const packMode = process.argv.includes("--pack");
+const restoreMode = process.argv.includes("--restore-pack");
+
+const preamble = `<!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
+
+> Codex runtime note: use \`request_user_input\` where this skill needs structured user input. If a step refers to Claude-style agent dispatch or \`subagent_type\`, invoke the matching installed Codex agent when available; in \`codex exec\` or any runtime without custom-agent dispatch, perform the same review inline from the plugin's sibling \`agents/*.md\` instructions and preserve the structured verdict blocks.
+
+`;
+
+function transform(text) {
+  return preamble + text
+    .replaceAll("AskUserQuestion", "request_user_input")
+    .replaceAll("`.claude/agents/risk-scorer-pipeline.md`", "`agents/pipeline.md`");
+}
+
+function generatedFiles(sourceRoot, targetRoot) {
+  const entries = readdirSync(sourceRoot, { withFileTypes: true })
+    .filter((entry) => entry.isDirectory())
+    .map((entry) => entry.name)
+    .sort();
+
+  const generated = [];
+  for (const entry of entries) {
+    const source = join(sourceRoot, entry, "SKILL.md");
+    if (!existsSync(source)) {
+      continue;
+    }
+    generated.push({
+      path: join(targetRoot, entry, "SKILL.md"),
+      text: transform(readFileSync(source, "utf8")),
+    });
+  }
+  return generated;
+}
+
+function writeGenerated(sourceRoot, targetRoot) {
+  const generated = generatedFiles(sourceRoot, targetRoot);
+  rmSync(targetRoot, { recursive: true, force: true });
+  for (const { path, text } of generated) {
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, text, "utf8");
+  }
+  return generated.length;
+}
+
+if (restoreMode) {
+  if (existsSync(backupRoot)) {
+    rmSync(skillsRoot, { recursive: true, force: true });
+    renameSync(backupRoot, skillsRoot);
+    console.log("Restored Claude skill source after pack.");
+  }
+  process.exit(0);
+}
+
+if (packMode) {
+  if (existsSync(backupRoot)) {
+    console.error(`Refusing to pack: backup already exists at ${backupRoot}`);
+    process.exit(1);
+  }
+  renameSync(skillsRoot, backupRoot);
+  const count = writeGenerated(backupRoot, skillsRoot);
+  console.log(`Packed ${count} Codex-facing risk-scorer skill file(s).`);
+  process.exit(0);
+}
+
+console.error("Usage: sync-codex-skills.mjs --pack | --restore-pack");
+process.exit(mode === "check" ? 0 : 2);

package/skills/assess-external-comms/SKILL.md

@@ -1,7 +1,11 @@
+<!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
+
+> Codex runtime note: use `request_user_input` where this skill needs structured user input. If a step refers to Claude-style agent dispatch or `subagent_type`, invoke the matching installed Codex agent when available; in `codex exec` or any runtime without custom-agent dispatch, perform the same review inline from the plugin's sibling `agents/*.md` instructions and preserve the structured verdict blocks.
+
 ---
 name: wr-risk-scorer:assess-external-comms
 description: On-demand external-comms risk review. Reviews a draft of an outbound prose tool call (gh issue/pr body, security advisory, npm publish content, or .changeset/*.md body) for confidential-information leaks per RISK-POLICY.md. Delegates to wr-risk-scorer:external-comms and pre-satisfies the external-comms-gate marker for the current session.
-allowed-tools: Read, Glob, Grep, Bash, AskUserQuestion, Skill
+allowed-tools: Read, Glob, Grep, Bash, request_user_input, Skill
 ---
 
 # External-Comms Risk Assessment Skill
@@ -32,11 +36,11 @@ If both draft and surface are present, proceed to step 3. If either is missing,
 
 ### 2. Resolve missing context
 
-If the draft is missing, use `AskUserQuestion`:
+If the draft is missing, use `request_user_input`:
 
 > "What draft do you want me to review? Paste the body verbatim — I will pass it to the external-comms reviewer."
 
-If the surface is missing AND cannot be inferred from context (e.g. user just said "before I post this comment"), use `AskUserQuestion`:
+If the surface is missing AND cannot be inferred from context (e.g. user just said "before I post this comment"), use `request_user_input`:
 
 - header: "Target surface"
 - options:
@@ -94,7 +98,7 @@ Present the full review report to the user. Highlight:
 
 ### 6. Above-appetite handling (ADR-013 Rule 6)
 
-If the verdict is FAIL, do NOT auto-rewrite the draft. Use `AskUserQuestion`:
+If the verdict is FAIL, do NOT auto-rewrite the draft. Use `request_user_input`:
 
 - header: "Leak detected — next step"
 - options:

package/skills/assess-inbound-report/SKILL.md

@@ -1,7 +1,11 @@
+<!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
+
+> Codex runtime note: use `request_user_input` where this skill needs structured user input. If a step refers to Claude-style agent dispatch or `subagent_type`, invoke the matching installed Codex agent when available; in `codex exec` or any runtime without custom-agent dispatch, perform the same review inline from the plugin's sibling `agents/*.md` instructions and preserve the structured verdict blocks.
+
 ---
 name: wr-risk-scorer:assess-inbound-report
 description: On-demand inbound-report risk review. Reviews a third-party submission against this repo's intake (problem-report issue body, Q&A discussion, security-advisory body) for Request-risk (info-extraction / backdoor request / malicious-code injection) and Fix-risk (privilege escalation / removal of load-bearing safety check / adopter-attack-surface expansion) per RISK-POLICY.md. Delegates to wr-risk-scorer:inbound-report and emits the structured verdict consumed by ADR-062's assessment-pipeline branch routing.
-allowed-tools: Read, Glob, Grep, Bash, AskUserQuestion, Skill
+allowed-tools: Read, Glob, Grep, Bash, request_user_input, Skill
 ---
 
 # Inbound-Report Risk Assessment Skill
@@ -39,13 +43,13 @@ If the body is missing AND a `gh issue URL` / `<repo>#<issue-number>` reference
 gh issue view "$ref" --json body,author,title,labels --jq '.'
 ```
 
-Cache the JSON for downstream steps. Fail-soft on GH API errors — surface the error to the user and fall back to AskUserQuestion.
+Cache the JSON for downstream steps. Fail-soft on GH API errors — surface the error to the user and fall back to request_user_input.
 
-If the body is still missing, use `AskUserQuestion`:
+If the body is still missing, use `request_user_input`:
 
 > "What report do you want me to review? Paste the body verbatim, or give me a `gh issue URL`."
 
-If the surface is missing AND cannot be inferred (from the URL pattern or context), use `AskUserQuestion`:
+If the surface is missing AND cannot be inferred (from the URL pattern or context), use `request_user_input`:
 
 - header: "Inbound surface"
 - options:
@@ -86,9 +90,9 @@ Present the full review report to the user. Highlight:
 
 ### 6. Above-appetite handling (ADR-013 Rule 6 + ADR-062 mechanical-stage carve-out)
 
-The branch decision itself is **mechanical** per ADR-062 § Mechanical-stage carve-out (P132). When invoked as a pipeline pre-satisfier, this skill does NOT use `AskUserQuestion` to ask the maintainer "which branch?" — the verdict + class determine the branch deterministically. The maintainer's role is to accept or override the verdict via re-running with corrections, not to pick the branch.
+The branch decision itself is **mechanical** per ADR-062 § Mechanical-stage carve-out (P132). When invoked as a pipeline pre-satisfier, this skill does NOT use `request_user_input` to ask the maintainer "which branch?" — the verdict + class determine the branch deterministically. The maintainer's role is to accept or override the verdict via re-running with corrections, not to pick the branch.
 
-When invoked manually as an on-demand pre-flight (NOT as a pipeline pre-satisfier), surface a single `AskUserQuestion` for what the maintainer wants to do next:
+When invoked manually as an on-demand pre-flight (NOT as a pipeline pre-satisfier), surface a single `request_user_input` for what the maintainer wants to do next:
 
 - header: "Next step"
 - options:
@@ -110,14 +114,14 @@ This skill and the assessment-pipeline (ADR-062 § Decision Outcome) invoke the
 | Branch decision | Per ADR-062 § Decision Outcome; mechanical | Same |
 | Audit-log append | Yes (via PostToolUse hook) | Yes (via PostToolUse hook) |
 | README rankings impact | None (skill is read-only) | Refreshes `## Inbound Upstream Reports` section in `docs/problems/README.md` Step 9e |
-| AskUserQuestion authority | step 6 above (manual only) | None (mechanical-stage carve-out per P132) |
+| request_user_input authority | step 6 above (manual only) | None (mechanical-stage carve-out per P132) |
 
 ## ADR cross-references
 
 - **ADR-062** (Inbound upstream-report discovery + assessment pipeline) — § Sibling subagent + § Mechanical-stage carve-out.
 - **ADR-015** (On-demand assessment skills) — § Scope table extended with the `assess-inbound-report` row; § Naming Convention `assess-<artifact>` pattern; § Gate Marker Interaction (no skill-side marker writes).
 - **ADR-009** (Gate marker lifecycle) — per-report marker TTL + drift discipline; same as the existing `external-comms-gate` marker.
-- **ADR-013 Rule 1** + Rule 6 — `AskUserQuestion` only at maintainer-direction branches; mechanical-stage carve-out applies to pipeline invocations.
+- **ADR-013 Rule 1** + Rule 6 — `request_user_input` only at maintainer-direction branches; mechanical-stage carve-out applies to pipeline invocations.
 - **ADR-014** — assessment skills are read-only and exempt from commit obligation.
 - **ADR-028** (External-comms gate, amended) — the pushback / clear-malicious-verdict comments the assessment-pipeline posts after this skill's FAIL verdict ride the P064 + P038 evaluator halves.
 - **ADR-029** (Diagnose before implement) — verdict follows hypothesis / evidence / structured-verdict discipline.

package/skills/assess-release/SKILL.md

@@ -1,7 +1,11 @@
+<!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
+
+> Codex runtime note: use `request_user_input` where this skill needs structured user input. If a step refers to Claude-style agent dispatch or `subagent_type`, invoke the matching installed Codex agent when available; in `codex exec` or any runtime without custom-agent dispatch, perform the same review inline from the plugin's sibling `agents/*.md` instructions and preserve the structured verdict blocks.
+
 ---
 name: wr-risk-scorer:assess-release
 description: On-demand release risk assessment. Scores commit, push, and release risk for the current unpushed changes. Delegates to wr-risk-scorer:pipeline and satisfies the commit gate for the current session.
-allowed-tools: Read, Glob, Grep, Bash, AskUserQuestion, Skill
+allowed-tools: Read, Glob, Grep, Bash, request_user_input, Skill
 ---
 
 # Release Risk Assessment Skill
@@ -44,7 +48,7 @@ Summarise what you find:
 
 ### 3. Resolve ambiguity
 
-If the scope is genuinely ambiguous (e.g., no unpushed commits but the user said "assess the release"), use `AskUserQuestion` to ask:
+If the scope is genuinely ambiguous (e.g., no unpushed commits but the user said "assess the release"), use `request_user_input` to ask:
 
 > "I don't see any unpushed commits. What scope should I assess?
 > (a) All commits since the last git tag
@@ -82,6 +86,6 @@ Present the full risk report to the user. Highlight:
 - Any risks above appetite (score ≥ 5 per RISK-POLICY.md)
 - Whether the gate is now pre-satisfied for the current session (i.e., a subsequent `git commit` will reuse the bypass marker without re-triggering the scorer)
 
-If any score is above appetite, the action is **framework-mediated, not a user decision** (P377/RFC-029; ADR-044 category-3 explicitly excludes above-appetite). Per **ADR-042 Rule 1**: auto-apply scorer remediations incrementally until residual risk is within appetite, OR halt per ADR-042 Rule 5 if the scorer cannot converge. **MUST NOT commit/push/release above appetite, and MUST NOT use `AskUserQuestion` to ask whether to proceed anyway** — there is no "proceed anyway (bypass)" option; the answer is always reduce-risk-or-halt. The only sanctioned non-blocking path is the risk-reducing path (a genuinely risk-reducing change clears via the `reducing` bypass). Under non-interactive contexts the ADR-013 Rule 6 fail-safe is the terminal fallback: skip the action and report the uncommitted/unreleased state.
+If any score is above appetite, the action is **framework-mediated, not a user decision** (P377/RFC-029; ADR-044 category-3 explicitly excludes above-appetite). Per **ADR-042 Rule 1**: auto-apply scorer remediations incrementally until residual risk is within appetite, OR halt per ADR-042 Rule 5 if the scorer cannot converge. **MUST NOT commit/push/release above appetite, and MUST NOT use `request_user_input` to ask whether to proceed anyway** — there is no "proceed anyway (bypass)" option; the answer is always reduce-risk-or-halt. The only sanctioned non-blocking path is the risk-reducing path (a genuinely risk-reducing change clears via the `reducing` bypass). Under non-interactive contexts the ADR-013 Rule 6 fail-safe is the terminal fallback: skip the action and report the uncommitted/unreleased state.
 
 $ARGUMENTS

package/skills/assess-wip/SKILL.md

@@ -1,7 +1,11 @@
+<!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
+
+> Codex runtime note: use `request_user_input` where this skill needs structured user input. If a step refers to Claude-style agent dispatch or `subagent_type`, invoke the matching installed Codex agent when available; in `codex exec` or any runtime without custom-agent dispatch, perform the same review inline from the plugin's sibling `agents/*.md` instructions and preserve the structured verdict blocks.
+
 ---
 name: wr-risk-scorer:assess-wip
 description: On-demand WIP risk nudge. Scores the current uncommitted diff for pipeline risk. Use during development to catch high-risk changes before committing.
-allowed-tools: Read, Glob, Grep, Bash, AskUserQuestion, Skill
+allowed-tools: Read, Glob, Grep, Bash, request_user_input, Skill
 ---
 
 # WIP Risk Assessment Skill
@@ -65,6 +69,6 @@ Present the WIP risk nudge to the user. The wip subagent provides guidance and r
   > "The uncommitted changes look like completed governance work. Commit now to reduce WIP and feed the pipeline."
   > *Reason: `<RISK_COMMIT_REASON from subagent>`*
   
-  Use `AskUserQuestion` to offer: "Commit completed governance work now?" — Yes (user confirms and runs `git commit`) or "Not yet" (user defers).
+  Use `request_user_input` to offer: "Commit completed governance work now?" — Yes (user confirms and runs `git commit`) or "Not yet" (user defers).
 
 $ARGUMENTS

package/skills/bootstrap-catalog/SKILL.md

@@ -1,3 +1,7 @@
+<!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
+
+> Codex runtime note: use `request_user_input` where this skill needs structured user input. If a step refers to Claude-style agent dispatch or `subagent_type`, invoke the matching installed Codex agent when available; in `codex exec` or any runtime without custom-agent dispatch, perform the same review inline from the plugin's sibling `agents/*.md` instructions and preserve the structured verdict blocks.
+
 ---
 name: wr-risk-scorer:bootstrap-catalog
 description: Bootstrap docs/risks/ standing-risk catalog from existing .risk-reports/ corpus. Walks reports, dedupes by ADR-056 slug, emits one R<NNN>-<slug>.active.md per unique slug with ## Source Evidence block citing originating reports. Idempotent — re-runs are no-ops by file-existence per slug. One-shot per project lifetime; install-updates Step 6.5 auto-triggers when catalog is empty AND .risk-reports/ is non-empty AND RISK-POLICY.md is present.
@@ -158,7 +162,7 @@ ADR-026 (grounding sentinel), ADR-047 (Phase 1 directory scaffold
 parent), P168 (driver).
 ```
 
-The commit goes through architect / JTBD / risk-scorer review per ADR-014. Per ADR-013 Rule 5, the bootstrap action is policy-authorised silent proceed — no `AskUserQuestion` round-trip needed; the catalog framing in `RISK-POLICY.md` IS the policy authorisation, and the skill's pre-conditions (Step 0) verify the project opted in.
+The commit goes through architect / JTBD / risk-scorer review per ADR-014. Per ADR-013 Rule 5, the bootstrap action is policy-authorised silent proceed — no `request_user_input` round-trip needed; the catalog framing in `RISK-POLICY.md` IS the policy authorisation, and the skill's pre-conditions (Step 0) verify the project opted in.
 
 ### 9. Report
 

package/skills/create-risk/SKILL.md

@@ -1,7 +1,11 @@
+<!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
+
+> Codex runtime note: use `request_user_input` where this skill needs structured user input. If a step refers to Claude-style agent dispatch or `subagent_type`, invoke the matching installed Codex agent when available; in `codex exec` or any runtime without custom-agent dispatch, perform the same review inline from the plugin's sibling `agents/*.md` instructions and preserve the structured verdict blocks.
+
 ---
 name: wr-risk-scorer:create-risk
 description: Create a new standing-risk entry in docs/risks/. Examines existing risks, gathers impact/likelihood/controls from the user, writes a file using the entry shape inlined in this skill (no TEMPLATE.md dependency — the entry shape is owned by this skill per user direction 2026-05-04), and updates the register index.
-allowed-tools: Read, Write, Edit, Bash, Glob, Grep, AskUserQuestion
+allowed-tools: Read, Write, Edit, Bash, Glob, Grep, request_user_input
 ---
 
 # Risk Register Entry Generator
@@ -57,15 +61,15 @@ Aggregated from N `.risk-reports/` entries (slug: `<slug>`):
 Re-rate when human curation lands or when controls change.
 ```
 
-**Skip AskUserQuestion** under this path entirely. Per CLAUDE.md P132 (inverse-P078): the framework has resolved the decision via ADR-056 queue + ADR-013 Rule 5 policy authorisation. Per-class consent gates re-ask decisions the user already made.
+**Skip request_user_input** under this path entirely. Per CLAUDE.md P132 (inverse-P078): the framework has resolved the decision via ADR-056 queue + ADR-013 Rule 5 policy authorisation. Per-class consent gates re-ask decisions the user already made.
 
-**Existing AskUserQuestion path preserved for human invocation** (no `--slug` / `--prefill` flags) — fall through to Step 2 below for full interactive authoring.
+**Existing request_user_input path preserved for human invocation** (no `--slug` / `--prefill` flags) — fall through to Step 2 below for full interactive authoring.
 
 **README.md update**: under flag-driven path, append a row to `docs/risks/README.md` Register table with stub scoring (`—` em-dash) and Treatment column = `pending`. Same shape as Step 6 below but auto-applied without user prompts.
 
 ### 2. Gather context from the user
 
-You MUST use the AskUserQuestion tool to collect context that cannot be derived. Do not proceed to step 3 until you have answers. Apply ADR-013 Rule 6 non-interactive defaults if the tool is unavailable (AFK mode): choose the most conservative option for each question and note auto-selection in the output.
+You MUST use the request_user_input tool to collect context that cannot be derived. Do not proceed to step 3 until you have answers. Apply ADR-013 Rule 6 non-interactive defaults if the tool is unavailable (AFK mode): choose the most conservative option for each question and note auto-selection in the output.
 
 Auto-derive where possible (do not ask):
 - **ID number** — next free slot per step 3 (do not ask per `feedback_dont_ask_trivial_id_choices.md`).
@@ -73,7 +77,7 @@ Auto-derive where possible (do not ask):
 - **Category** — infer from description keywords where unambiguous: "token", "secret", "leak" → `infosec`; "install", "hook", "pipeline" → `operational`. Confirm only if ambiguous.
 - **Next review** — default to 6 months from today.
 
-Ask the user (one AskUserQuestion call with grouped questions):
+Ask the user (one request_user_input call with grouped questions):
 
 1. **What is the risk?** A short title and 1-2 paragraph description — what could go wrong, for whom, and why it matters. This is the condition, not the control.
 2. **Impact level (from `RISK-POLICY.md`)?** 1 Negligible · 2 Minor · 3 Moderate · 4 Significant · 5 Severe. Read the policy's Impact table to the user if they need the descriptions.
@@ -190,7 +194,7 @@ This step is not optional: the README drifts from the register without it, and t
 
 ### 7. Confirm with the user
 
-Present the written file path, inherent/residual bands, and any `Within appetite?: No` flag. Ask via AskUserQuestion:
+Present the written file path, inherent/residual bands, and any `Within appetite?: No` flag. Ask via request_user_input:
 
 1. Does the description accurately capture the risk?
 2. Are the inherent and residual scores defensible?

package/skills/external-comms/SKILL.md

@@ -1,3 +1,7 @@
+<!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
+
+> Codex runtime note: use `request_user_input` where this skill needs structured user input. If a step refers to Claude-style agent dispatch or `subagent_type`, invoke the matching installed Codex agent when available; in `codex exec` or any runtime without custom-agent dispatch, perform the same review inline from the plugin's sibling `agents/*.md` instructions and preserve the structured verdict blocks.
+
 ---
 name: wr-risk-scorer:external-comms
 description: Invokable SKILL wrapper around the wr-risk-scorer:external-comms leak-review agent. Delegates to the agent via the Agent tool and returns the agent's structured EXTERNAL_COMMS_RISK_VERDICT. Internal-use plumbing used by `/wr-risk-scorer:assess-external-comms` per ADR-015's Confirmation literal phrasing. End users should invoke `/wr-risk-scorer:assess-external-comms` instead.
@@ -8,7 +12,7 @@ allowed-tools: Read, Glob, Grep, Bash, Agent
 
 This SKILL is an **invokable wrapper** around the `wr-risk-scorer:external-comms` agent. It exists so consumer SKILLs can invoke the leak reviewer via the **Skill tool** with `skill: wr-risk-scorer:external-comms` — matching ADR-015's Confirmation literal phrasing.
 
-**End users**: invoke `/wr-risk-scorer:assess-external-comms` instead. This wrapper is internal-use plumbing — calling it directly returns the raw verdict without the structured AskUserQuestion above-appetite handling (Rewrite / Move to private channel / Override / Cancel) that `/wr-risk-scorer:assess-external-comms` provides.
+**End users**: invoke `/wr-risk-scorer:assess-external-comms` instead. This wrapper is internal-use plumbing — calling it directly returns the raw verdict without the structured request_user_input above-appetite handling (Rewrite / Move to private channel / Override / Cancel) that `/wr-risk-scorer:assess-external-comms` provides.
 
 ## Contract
 

package/skills/pipeline/SKILL.md

@@ -1,3 +1,7 @@
+<!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
+
+> Codex runtime note: use `request_user_input` where this skill needs structured user input. If a step refers to Claude-style agent dispatch or `subagent_type`, invoke the matching installed Codex agent when available; in `codex exec` or any runtime without custom-agent dispatch, perform the same review inline from the plugin's sibling `agents/*.md` instructions and preserve the structured verdict blocks.
+
 ---
 name: wr-risk-scorer:pipeline
 description: Invokable SKILL wrapper around the wr-risk-scorer:pipeline scoring agent. Delegates to the agent via the Agent tool and returns the agent's structured RISK_SCORES output. Internal-use plumbing used by `/wr-risk-scorer:assess-release` and any other consumer SKILL that needs Skill-tool-shaped invocation of the pipeline scorer per ADR-015's Confirmation literal phrasing. End users should invoke `/wr-risk-scorer:assess-release` instead.
@@ -8,7 +12,7 @@ allowed-tools: Read, Glob, Bash, Agent
 
 This SKILL is an **invokable wrapper** around the `wr-risk-scorer:pipeline` agent. It exists so consumer SKILLs can invoke the pipeline scorer via the **Skill tool** with `skill: wr-risk-scorer:pipeline` — matching ADR-015's Confirmation literal phrasing.
 
-**End users**: invoke `/wr-risk-scorer:assess-release` instead. This wrapper is internal-use plumbing — calling it directly returns raw scoring output without the gate-satisfaction wrap-up, AskUserQuestion above-appetite handling, or release-context resolution that `/wr-risk-scorer:assess-release` provides.
+**End users**: invoke `/wr-risk-scorer:assess-release` instead. This wrapper is internal-use plumbing — calling it directly returns raw scoring output without the gate-satisfaction wrap-up, request_user_input above-appetite handling, or release-context resolution that `/wr-risk-scorer:assess-release` provides.
 
 ## Contract