@windyroad/risk-scorer 0.17.3 → 0.17.4

package/.claude-plugin/plugin.json

@@ -310,5 +310,5 @@
     }
   },
   "name": "wr-risk-scorer",
-  "version": "0.17.3"
+  "version": "0.17.4"
 }

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "wr-risk-scorer",
-  "version": "0.17.3",
+  "version": "0.17.4",
   "description": "Pipeline risk scoring, commit/push gates, and secret leak detection",
   "author": {
     "name": "Windy Road Technology",

package/agents/policy.md

@@ -40,4 +40,4 @@ End your report with `RISK_VERDICT: PASS` or `RISK_VERDICT: FAIL` on its own lin
 | 4 Significant | 4 | 8 | 12 | 16 | 20 |
 | 5 Severe | 5 | 10 | 15 | 20 | 25 |
 
-Label Bands: 1-2 Very Low, 3-4 Low, 5-9 Medium, 10-16 High, 17-25 Very High.
+Label Bands: 1-2 Very Low, 3-5 Low, 6-9 Medium, 10-16 High, 17-25 Very High.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@windyroad/risk-scorer",
-  "version": "0.17.3",
+  "version": "0.17.4",
   "description": "Pipeline risk scoring, commit/push gates, and secret leak detection",
   "scripts": {
     "prepack": "node scripts/sync-codex-skills.mjs --pack",

package/scripts/sync-codex-skills.mjs

@@ -23,14 +23,30 @@ const restoreMode = process.argv.includes("--restore-pack");
 
 const preamble = `<!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
 
-> Codex runtime note: use \`request_user_input\` where this skill needs structured user input. If a step refers to Claude-style agent dispatch or \`subagent_type\`, invoke the matching installed Codex agent when available; in \`codex exec\` or any runtime without custom-agent dispatch, perform the same review inline from the plugin's sibling \`agents/*.md\` instructions and preserve the structured verdict blocks.
+> Codex runtime note: use \`request_user_input\` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or \`subagent_type\`, use a native Codex subagent workflow: spawn the matching installed Codex custom agent when available, otherwise spawn the built-in \`default\` subagent and instruct it to read the plugin's sibling \`agents/*.md\` instructions in full before returning the same structured verdict block.
 
 `;
 
+const updatePolicyCodexAgentStep = `Run the Codex policy reviewer with this prompt:
+
+> Review this draft risk policy for ISO 31000 compliance. Validate it.
+>
+> [paste the full draft policy content here]
+
+Use a native Codex subagent workflow. Prefer the installed plugin agent named \`wr-risk-scorer:policy\` when available. In this source repo, the generated project-local alias \`wr-risk-scorer-policy\` may also be available for dogfooding. If neither custom agent is available in the current Codex session, spawn the built-in \`default\` subagent and instruct it to read \`agents/policy.md\` from this plugin in full before performing the review.`;
+
 function transform(text) {
   return preamble + text
     .replaceAll("AskUserQuestion", "request_user_input")
-    .replaceAll("`.claude/agents/risk-scorer-pipeline.md`", "`agents/pipeline.md`");
+    .replaceAll("`.claude/agents/risk-scorer-pipeline.md`", "`agents/pipeline.md`")
+    .replace(
+      `Run the risk-scorer agent (subagent_type: "risk-scorer") with this prompt:
+
+> Review this draft risk policy for ISO 31000 compliance. Validate it.
+>
+> [paste the full draft policy content here]`,
+      updatePolicyCodexAgentStep,
+    );
 }
 
 function generatedFiles(sourceRoot, targetRoot) {

package/skills/assess-external-comms/SKILL.md

@@ -1,6 +1,6 @@
 <!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
 
-> Codex runtime note: use `request_user_input` where this skill needs structured user input. If a step refers to Claude-style agent dispatch or `subagent_type`, invoke the matching installed Codex agent when available; in `codex exec` or any runtime without custom-agent dispatch, perform the same review inline from the plugin's sibling `agents/*.md` instructions and preserve the structured verdict blocks.
+> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow: spawn the matching installed Codex custom agent when available, otherwise spawn the built-in `default` subagent and instruct it to read the plugin's sibling `agents/*.md` instructions in full before returning the same structured verdict block.
 
 ---
 name: wr-risk-scorer:assess-external-comms

package/skills/assess-inbound-report/SKILL.md

@@ -1,6 +1,6 @@
 <!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
 
-> Codex runtime note: use `request_user_input` where this skill needs structured user input. If a step refers to Claude-style agent dispatch or `subagent_type`, invoke the matching installed Codex agent when available; in `codex exec` or any runtime without custom-agent dispatch, perform the same review inline from the plugin's sibling `agents/*.md` instructions and preserve the structured verdict blocks.
+> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow: spawn the matching installed Codex custom agent when available, otherwise spawn the built-in `default` subagent and instruct it to read the plugin's sibling `agents/*.md` instructions in full before returning the same structured verdict block.
 
 ---
 name: wr-risk-scorer:assess-inbound-report

package/skills/assess-release/SKILL.md

@@ -1,6 +1,6 @@
 <!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
 
-> Codex runtime note: use `request_user_input` where this skill needs structured user input. If a step refers to Claude-style agent dispatch or `subagent_type`, invoke the matching installed Codex agent when available; in `codex exec` or any runtime without custom-agent dispatch, perform the same review inline from the plugin's sibling `agents/*.md` instructions and preserve the structured verdict blocks.
+> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow: spawn the matching installed Codex custom agent when available, otherwise spawn the built-in `default` subagent and instruct it to read the plugin's sibling `agents/*.md` instructions in full before returning the same structured verdict block.
 
 ---
 name: wr-risk-scorer:assess-release

package/skills/assess-wip/SKILL.md

@@ -1,6 +1,6 @@
 <!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
 
-> Codex runtime note: use `request_user_input` where this skill needs structured user input. If a step refers to Claude-style agent dispatch or `subagent_type`, invoke the matching installed Codex agent when available; in `codex exec` or any runtime without custom-agent dispatch, perform the same review inline from the plugin's sibling `agents/*.md` instructions and preserve the structured verdict blocks.
+> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow: spawn the matching installed Codex custom agent when available, otherwise spawn the built-in `default` subagent and instruct it to read the plugin's sibling `agents/*.md` instructions in full before returning the same structured verdict block.
 
 ---
 name: wr-risk-scorer:assess-wip

package/skills/bootstrap-catalog/SKILL.md

@@ -1,6 +1,6 @@
 <!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
 
-> Codex runtime note: use `request_user_input` where this skill needs structured user input. If a step refers to Claude-style agent dispatch or `subagent_type`, invoke the matching installed Codex agent when available; in `codex exec` or any runtime without custom-agent dispatch, perform the same review inline from the plugin's sibling `agents/*.md` instructions and preserve the structured verdict blocks.
+> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow: spawn the matching installed Codex custom agent when available, otherwise spawn the built-in `default` subagent and instruct it to read the plugin's sibling `agents/*.md` instructions in full before returning the same structured verdict block.
 
 ---
 name: wr-risk-scorer:bootstrap-catalog

package/skills/create-risk/SKILL.md

@@ -1,6 +1,6 @@
 <!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
 
-> Codex runtime note: use `request_user_input` where this skill needs structured user input. If a step refers to Claude-style agent dispatch or `subagent_type`, invoke the matching installed Codex agent when available; in `codex exec` or any runtime without custom-agent dispatch, perform the same review inline from the plugin's sibling `agents/*.md` instructions and preserve the structured verdict blocks.
+> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow: spawn the matching installed Codex custom agent when available, otherwise spawn the built-in `default` subagent and instruct it to read the plugin's sibling `agents/*.md` instructions in full before returning the same structured verdict block.
 
 ---
 name: wr-risk-scorer:create-risk

package/skills/external-comms/SKILL.md

@@ -1,6 +1,6 @@
 <!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
 
-> Codex runtime note: use `request_user_input` where this skill needs structured user input. If a step refers to Claude-style agent dispatch or `subagent_type`, invoke the matching installed Codex agent when available; in `codex exec` or any runtime without custom-agent dispatch, perform the same review inline from the plugin's sibling `agents/*.md` instructions and preserve the structured verdict blocks.
+> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow: spawn the matching installed Codex custom agent when available, otherwise spawn the built-in `default` subagent and instruct it to read the plugin's sibling `agents/*.md` instructions in full before returning the same structured verdict block.
 
 ---
 name: wr-risk-scorer:external-comms

package/skills/pipeline/SKILL.md

@@ -1,6 +1,6 @@
 <!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
 
-> Codex runtime note: use `request_user_input` where this skill needs structured user input. If a step refers to Claude-style agent dispatch or `subagent_type`, invoke the matching installed Codex agent when available; in `codex exec` or any runtime without custom-agent dispatch, perform the same review inline from the plugin's sibling `agents/*.md` instructions and preserve the structured verdict blocks.
+> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow: spawn the matching installed Codex custom agent when available, otherwise spawn the built-in `default` subagent and instruct it to read the plugin's sibling `agents/*.md` instructions in full before returning the same structured verdict block.
 
 ---
 name: wr-risk-scorer:pipeline

package/skills/update-policy/SKILL.md

@@ -1,6 +1,6 @@
 <!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
 
-> Codex runtime note: use `request_user_input` where this skill needs structured user input. If a step refers to Claude-style agent dispatch or `subagent_type`, invoke the matching installed Codex agent when available; in `codex exec` or any runtime without custom-agent dispatch, perform the same review inline from the plugin's sibling `agents/*.md` instructions and preserve the structured verdict blocks.
+> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow: spawn the matching installed Codex custom agent when available, otherwise spawn the built-in `default` subagent and instruct it to read the plugin's sibling `agents/*.md` instructions in full before returning the same structured verdict block.
 
 ---
 name: wr-risk-scorer:update-policy
@@ -162,12 +162,14 @@ If the user picked an appetite threshold below 5 in step 6, fire a second `reque
 
 Before writing the policy file, invoke the risk-scorer agent to validate the draft. This is the gate -- the enforce hook will only allow writes to RISK-POLICY.md after the scorer returns PASS.
 
-Run the risk-scorer agent (subagent_type: "risk-scorer") with this prompt:
+Run the Codex policy reviewer with this prompt:
 
 > Review this draft risk policy for ISO 31000 compliance. Validate it.
 >
 > [paste the full draft policy content here]
 
+Use a native Codex subagent workflow. Prefer the installed plugin agent named `wr-risk-scorer:policy` when available. In this source repo, the generated project-local alias `wr-risk-scorer-policy` may also be available for dogfooding. If neither custom agent is available in the current Codex session, spawn the built-in `default` subagent and instruct it to read `agents/policy.md` from this plugin in full before performing the review.
+
 The risk-scorer will check:
 - Impact levels describe business consequences (not file categories)
 - Impact labels match the risk matrix (Negligible, Minor, Moderate, Significant, Severe)

package/skills/wip/SKILL.md

@@ -1,6 +1,6 @@
 <!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
 
-> Codex runtime note: use `request_user_input` where this skill needs structured user input. If a step refers to Claude-style agent dispatch or `subagent_type`, invoke the matching installed Codex agent when available; in `codex exec` or any runtime without custom-agent dispatch, perform the same review inline from the plugin's sibling `agents/*.md` instructions and preserve the structured verdict blocks.
+> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow: spawn the matching installed Codex custom agent when available, otherwise spawn the built-in `default` subagent and instruct it to read the plugin's sibling `agents/*.md` instructions in full before returning the same structured verdict block.
 
 ---
 name: wr-risk-scorer:wip