@windyroad/risk-scorer 0.18.7 → 0.18.8-preview.1042

package/.claude-plugin/plugin.json

@@ -310,5 +310,5 @@
     }
   },
   "name": "wr-risk-scorer",
-  "version": "0.18.7"
+  "version": "0.18.8"
 }

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "wr-risk-scorer",
-  "version": "0.18.7",
+  "version": "0.18.8",
   "description": "Pipeline risk scoring, commit/push gates, and secret leak detection",
   "author": {
     "name": "Windy Road Technology",

package/hooks/codex-agent-completion.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
@@ -28,8 +28,14 @@ function riskDir(sessionId) {
   return join(process.env.TMPDIR || "/tmp", `claude-risk-${sessionId}`);
 }
 
-function statePath(input, target) {
-  return join(riskDir(input.session_id), `codex-agent-${Buffer.from(target).toString("base64url")}`);
+function statePath(input, target, suffix = "") {
+  return join(riskDir(input.session_id), `codex-agent-${Buffer.from(target).toString("base64url")}${suffix}`);
+}
+
+function clearTarget(input, target) {
+  for (const suffix of ["", ".claim", ".done"]) {
+    rmSync(statePath(input, target, suffix), { force: true });
+  }
 }
 
 function spawnTarget(input) {
@@ -42,11 +48,25 @@ function rememberSpawn(input) {
   const target = spawnTarget(input);
   if (typeof target !== "string" || !target) return;
   mkdirSync(riskDir(input.session_id), { recursive: true });
-  rmSync(statePath(input, target), { force: true });
+  clearTarget(input, target);
   if (!riskAgentRoles.has(role)) return;
   writeFileSync(statePath(input, target), role, "utf8");
 }
 
+function claimTarget(input, target) {
+  const claim = statePath(input, target, ".claim");
+  const done = statePath(input, target, ".done");
+  if (existsSync(done)) return null;
+  mkdirSync(riskDir(input.session_id), { recursive: true });
+  try {
+    writeFileSync(claim, "", { flag: "wx" });
+  } catch (error) {
+    if (error?.code === "EEXIST") return null;
+    throw error;
+  }
+  return { claim, done };
+}
+
 function markTarget(input, target, output) {
   if (typeof target !== "string" || typeof output !== "string" || !output) return;
 
@@ -54,6 +74,8 @@ function markTarget(input, target, output) {
   if (!existsSync(state)) return;
   const role = readFileSync(state, "utf8");
   if (!riskAgentRoles.has(role)) return;
+  const claim = claimTarget(input, target);
+  if (!claim) return;
 
   const synthetic = {
     ...input,
@@ -67,7 +89,13 @@ function markTarget(input, target, output) {
     input: JSON.stringify(synthetic),
     encoding: "utf8",
   });
-  if (result.status === 0) rmSync(state, { force: true });
+  if (result.status === 0) {
+    renameSync(claim.claim, claim.done);
+    rmSync(state, { force: true });
+  } else {
+    rmSync(claim.claim, { force: true });
+    process.exitCode = 1;
+  }
 }
 
 function markClose(input) {
@@ -82,6 +110,10 @@ function markWait(input) {
   }
 }
 
+function markSubagentStop(input) {
+  markTarget(input, input.agent_id, input.last_assistant_message);
+}
+
 let body = "";
 process.stdin.setEncoding("utf8");
 for await (const chunk of process.stdin) body += chunk;
@@ -104,3 +136,6 @@ if (["collaborationinterrupt_agent", "close_agent", "multi_agent_v1__close_agent
 if (["collaborationwait_agent", "wait_agent", "multi_agent_v1__wait_agent"].includes(input.tool_name)) {
   markWait(input);
 }
+if (input.hook_event_name === "SubagentStop") {
+  markSubagentStop(input);
+}

package/hooks/external-comms-gate.sh

@@ -407,10 +407,15 @@ fi
 # Marker absent — deny + delegate.
 # P166: instruct the orchestrator to structure the agent prompt with a
 # leading `SURFACE: <name>` line and a `<draft>...</draft>` block so the
-# PostToolUse mark hook can derive the canonical marker key locally
+# Claude PostToolUse mark hook can derive the canonical marker key locally
 # (sha256(DRAFT + '\n' + SURFACE)). Single fire per gate cycle.
 VERDICT_PREFIX="${EXTERNAL_COMMS_VERDICT_PREFIX:-EXTERNAL_COMMS_${EXTERNAL_COMMS_EVALUATOR_ID^^}}"
-REASON=$(printf 'BLOCKED (external-comms gate / %s evaluator): %s draft has not been reviewed by %s. Delegate to %s (subagent_type: '"'"'%s'"'"') with a prompt that starts with the line `SURFACE: %s` and wraps the draft body verbatim inside `<draft>...</draft>` markers (for the changeset-author surface the body is the changeset summary WITHOUT the leading `---` frontmatter block — the gate strips frontmatter before hashing the marker key). The PostToolUse hook derives the marker key from that structure and marks the draft reviewed when the subagent emits %s_VERDICT: PASS — single fire suffices. Dispatch the reviewer SYNCHRONOUSLY (run_in_background: false): a background-launched reviewer does not fire its PostToolUse mark hook, so the marker never persists and this gate re-blocks (P402). Use %s for an interactive walkthrough. There is no env override (P377/RFC-029 — BYPASS_RISK_GATE removed).' \
-    "$EXTERNAL_COMMS_EVALUATOR_ID" "$SURFACE" "$EXTERNAL_COMMS_SUBAGENT_TYPE" "$EXTERNAL_COMMS_SUBAGENT_TYPE" "$EXTERNAL_COMMS_SUBAGENT_TYPE" "$SURFACE" "$VERDICT_PREFIX" "$EXTERNAL_COMMS_ASSESS_SKILL")
+if [ -n "${CODEX_THREAD_ID:-}" ]; then
+    COMPLETION_GUIDANCE='On Codex, wait for the reviewer to finish, then close that completed agent once before retrying; the PostToolUse compatibility hook consumes the completed close response and persists its structured verdict, with no transcript parsing or nested codex exec.'
+else
+    COMPLETION_GUIDANCE='On Claude Code, dispatch the reviewer SYNCHRONOUSLY (run_in_background: false): a background-launched reviewer does not fire its PostToolUse mark hook, so the marker never persists and this gate re-blocks (P402).'
+fi
+REASON=$(printf 'BLOCKED (external-comms gate / %s evaluator): %s draft has not been reviewed by %s. Delegate to %s (subagent_type: '"'"'%s'"'"') with a prompt that starts with the line `SURFACE: %s` and wraps the draft body verbatim inside `<draft>...</draft>` markers (for the changeset-author surface the body is the changeset summary WITHOUT the leading `---` frontmatter block — the gate strips frontmatter before hashing the marker key). The completion hook marks the draft reviewed when the subagent emits %s_VERDICT: PASS — single fire suffices. %s Use %s for an interactive walkthrough. There is no env override (P377/RFC-029 — BYPASS_RISK_GATE removed).' \
+    "$EXTERNAL_COMMS_EVALUATOR_ID" "$SURFACE" "$EXTERNAL_COMMS_SUBAGENT_TYPE" "$EXTERNAL_COMMS_SUBAGENT_TYPE" "$EXTERNAL_COMMS_SUBAGENT_TYPE" "$SURFACE" "$VERDICT_PREFIX" "$COMPLETION_GUIDANCE" "$EXTERNAL_COMMS_ASSESS_SKILL")
 deny_with_reason "$REASON"
 exit 0

package/hooks/hooks.json

@@ -11,6 +11,9 @@
     ],
     "PostToolUse": [
       { "matcher": "Agent|Bash|Edit|Skill|Write|collaborationspawn_agent|collaborationwait_agent|collaborationinterrupt_agent|spawn_agent|wait_agent|close_agent|multi_agent_v1__spawn_agent|multi_agent_v1__wait_agent|multi_agent_v1__close_agent", "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/risk-scorer-dispatch.sh post-tool" }] }
+    ],
+    "SubagentStop": [
+      { "matcher": "^wr-risk-scorer:", "hooks": [{ "type": "command", "command": "${CLAUDE_PLUGIN_ROOT}/hooks/risk-scorer-dispatch.sh subagent-stop" }] }
     ]
   }
 }

package/hooks/lib/risk-gate.sh

@@ -38,7 +38,11 @@ check_risk_gate() {
   # 1. Score file must exist (fail-closed)
   if [ ! -f "$SCORE_FILE" ]; then
     RISK_GATE_CATEGORY="missing"
-    RISK_GATE_REASON="No ${ACTION} risk score found. Delegate to wr-risk-scorer:pipeline (subagent_type: 'wr-risk-scorer:pipeline') to assess cumulative pipeline risk. Dispatch the scorer SYNCHRONOUSLY (run_in_background: false): a background-launched scorer does not fire its PostToolUse:Agent mark hook, so no marker persists and this gate re-blocks despite a within-appetite score (P402)."
+    if [ -n "${CODEX_THREAD_ID:-}" ]; then
+      RISK_GATE_REASON="No ${ACTION} risk score found. Delegate to the native Codex agent wr-risk-scorer:pipeline to assess cumulative pipeline risk, wait for it to finish, then close that completed agent once before retrying. The PostToolUse compatibility hook consumes the completed close response and persists its structured verdict; no transcript parsing or nested codex exec is required."
+    else
+      RISK_GATE_REASON="No ${ACTION} risk score found. Delegate to wr-risk-scorer:pipeline (subagent_type: 'wr-risk-scorer:pipeline') to assess cumulative pipeline risk. Dispatch the scorer SYNCHRONOUSLY (run_in_background: false): a background-launched scorer does not fire its PostToolUse:Agent mark hook, so no marker persists and this gate re-blocks despite a within-appetite score (P402)."
+    fi
     return 1
   fi
 

package/hooks/risk-score-mark.sh

@@ -240,7 +240,7 @@ except Exception:
     # Fallback: cached old SKILL.md still instructs the agent to emit
     # EXTERNAL_COMMS_RISK_KEY. Honour it during the deprecation window.
     KEY_LINE=$(echo "$AGENT_OUTPUT" | grep -E '^EXTERNAL_COMMS_RISK_KEY:' | tail -1) || true
-    KEY=$(echo "$KEY_LINE" | sed 's/^EXTERNAL_COMMS_RISK_KEY:[[:space:]]*//' | tr -d '[:space:]')
+    KEY=$(echo "$KEY_LINE" | sed 's/^EXTERNAL_COMMS_RISK_KEY:[[:space:]]*//' | tr -d '[:space:]`')
   fi
 
   # Validate key: 64 hex chars (sha256 output). Reject anything else.

package/hooks/risk-scorer-dispatch.sh

@@ -92,6 +92,9 @@ if messages:
         ;;
     esac
     ;;
+  subagent-stop)
+    printf '%s' "$INPUT" | node "$SCRIPT_DIR/codex-agent-completion.mjs"
+    ;;
   *)
     exit 0
     ;;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@windyroad/risk-scorer",
-  "version": "0.18.7",
+  "version": "0.18.8-preview.1042",
   "description": "Pipeline risk scoring, commit/push gates, and secret leak detection",
   "scripts": {
     "prepack": "node scripts/sync-codex-skills.mjs --pack",

package/scripts/sync-codex-skills.mjs

@@ -24,7 +24,7 @@ const restoreMode = process.argv.includes("--restore-pack");
 
 const preamble = `<!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
 
-> Codex runtime note: use \`request_user_input\` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or \`subagent_type\`, use a native Codex subagent workflow and spawn the matching installed \`wr-risk-scorer:<mode>\` custom agent. Wait for it, then close that same agent so the completion hook receives its final response. Do not substitute the built-in \`default\` agent when a hook consumes the subagent identity; restart Codex if the installed agent is not yet visible.
+> Codex runtime note: use \`request_user_input\` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or \`subagent_type\`, use a native Codex subagent workflow and spawn the matching installed \`wr-risk-scorer:<mode>\` custom agent. Wait for it to finish, then close that completed agent once so the PostToolUse compatibility hook can persist its structured verdict. Do not parse transcripts or launch nested \`codex exec\`. Do not substitute the built-in \`default\` agent when a hook consumes the subagent identity; restart Codex if the installed agent is not yet visible.
 
 `;
 

package/skills/assess-external-comms/SKILL.md

@@ -6,7 +6,7 @@ allowed-tools: Read, Glob, Grep, Bash, request_user_input, Skill
 
 <!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
 
-> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow and spawn the matching installed `wr-risk-scorer:<mode>` custom agent. Wait for it, then close that same agent so the completion hook receives its final response. Do not substitute the built-in `default` agent when a hook consumes the subagent identity; restart Codex if the installed agent is not yet visible.
+> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow and spawn the matching installed `wr-risk-scorer:<mode>` custom agent. Wait for it to finish, then close that completed agent once so the PostToolUse compatibility hook can persist its structured verdict. Do not parse transcripts or launch nested `codex exec`. Do not substitute the built-in `default` agent when a hook consumes the subagent identity; restart Codex if the installed agent is not yet visible.
 
 
 # External-Comms Risk Assessment Skill

package/skills/assess-inbound-report/SKILL.md

@@ -6,7 +6,7 @@ allowed-tools: Read, Glob, Grep, Bash, request_user_input, Skill
 
 <!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
 
-> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow and spawn the matching installed `wr-risk-scorer:<mode>` custom agent. Wait for it, then close that same agent so the completion hook receives its final response. Do not substitute the built-in `default` agent when a hook consumes the subagent identity; restart Codex if the installed agent is not yet visible.
+> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow and spawn the matching installed `wr-risk-scorer:<mode>` custom agent. Wait for it to finish, then close that completed agent once so the PostToolUse compatibility hook can persist its structured verdict. Do not parse transcripts or launch nested `codex exec`. Do not substitute the built-in `default` agent when a hook consumes the subagent identity; restart Codex if the installed agent is not yet visible.
 
 
 # Inbound-Report Risk Assessment Skill

package/skills/assess-release/SKILL.md

@@ -6,7 +6,7 @@ allowed-tools: Read, Glob, Grep, Bash, request_user_input, Skill
 
 <!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
 
-> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow and spawn the matching installed `wr-risk-scorer:<mode>` custom agent. Wait for it, then close that same agent so the completion hook receives its final response. Do not substitute the built-in `default` agent when a hook consumes the subagent identity; restart Codex if the installed agent is not yet visible.
+> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow and spawn the matching installed `wr-risk-scorer:<mode>` custom agent. Wait for it to finish, then close that completed agent once so the PostToolUse compatibility hook can persist its structured verdict. Do not parse transcripts or launch nested `codex exec`. Do not substitute the built-in `default` agent when a hook consumes the subagent identity; restart Codex if the installed agent is not yet visible.
 
 
 # Release Risk Assessment Skill

package/skills/assess-wip/SKILL.md

@@ -6,7 +6,7 @@ allowed-tools: Read, Glob, Grep, Bash, request_user_input, Skill
 
 <!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
 
-> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow and spawn the matching installed `wr-risk-scorer:<mode>` custom agent. Wait for it, then close that same agent so the completion hook receives its final response. Do not substitute the built-in `default` agent when a hook consumes the subagent identity; restart Codex if the installed agent is not yet visible.
+> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow and spawn the matching installed `wr-risk-scorer:<mode>` custom agent. Wait for it to finish, then close that completed agent once so the PostToolUse compatibility hook can persist its structured verdict. Do not parse transcripts or launch nested `codex exec`. Do not substitute the built-in `default` agent when a hook consumes the subagent identity; restart Codex if the installed agent is not yet visible.
 
 
 # WIP Risk Assessment Skill

package/skills/bootstrap-catalog/SKILL.md

@@ -7,7 +7,7 @@ maturity: proposed
 
 <!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
 
-> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow and spawn the matching installed `wr-risk-scorer:<mode>` custom agent. Wait for it, then close that same agent so the completion hook receives its final response. Do not substitute the built-in `default` agent when a hook consumes the subagent identity; restart Codex if the installed agent is not yet visible.
+> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow and spawn the matching installed `wr-risk-scorer:<mode>` custom agent. Wait for it to finish, then close that completed agent once so the PostToolUse compatibility hook can persist its structured verdict. Do not parse transcripts or launch nested `codex exec`. Do not substitute the built-in `default` agent when a hook consumes the subagent identity; restart Codex if the installed agent is not yet visible.
 
 
 # Risk Catalog Bootstrap

package/skills/create-risk/SKILL.md

@@ -6,7 +6,7 @@ allowed-tools: Read, Write, Edit, Bash, Glob, Grep, request_user_input
 
 <!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
 
-> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow and spawn the matching installed `wr-risk-scorer:<mode>` custom agent. Wait for it, then close that same agent so the completion hook receives its final response. Do not substitute the built-in `default` agent when a hook consumes the subagent identity; restart Codex if the installed agent is not yet visible.
+> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow and spawn the matching installed `wr-risk-scorer:<mode>` custom agent. Wait for it to finish, then close that completed agent once so the PostToolUse compatibility hook can persist its structured verdict. Do not parse transcripts or launch nested `codex exec`. Do not substitute the built-in `default` agent when a hook consumes the subagent identity; restart Codex if the installed agent is not yet visible.
 
 
 # Risk Register Entry Generator

package/skills/external-comms/SKILL.md

@@ -6,7 +6,7 @@ allowed-tools: Read, Glob, Grep, Bash, Agent
 
 <!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
 
-> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow and spawn the matching installed `wr-risk-scorer:<mode>` custom agent. Wait for it, then close that same agent so the completion hook receives its final response. Do not substitute the built-in `default` agent when a hook consumes the subagent identity; restart Codex if the installed agent is not yet visible.
+> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow and spawn the matching installed `wr-risk-scorer:<mode>` custom agent. Wait for it to finish, then close that completed agent once so the PostToolUse compatibility hook can persist its structured verdict. Do not parse transcripts or launch nested `codex exec`. Do not substitute the built-in `default` agent when a hook consumes the subagent identity; restart Codex if the installed agent is not yet visible.
 
 
 # External-Comms Leak Review Skill (Wrapper)

package/skills/pipeline/SKILL.md

@@ -6,7 +6,7 @@ allowed-tools: Read, Glob, Bash, Agent
 
 <!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
 
-> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow and spawn the matching installed `wr-risk-scorer:<mode>` custom agent. Wait for it, then close that same agent so the completion hook receives its final response. Do not substitute the built-in `default` agent when a hook consumes the subagent identity; restart Codex if the installed agent is not yet visible.
+> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow and spawn the matching installed `wr-risk-scorer:<mode>` custom agent. Wait for it to finish, then close that completed agent once so the PostToolUse compatibility hook can persist its structured verdict. Do not parse transcripts or launch nested `codex exec`. Do not substitute the built-in `default` agent when a hook consumes the subagent identity; restart Codex if the installed agent is not yet visible.
 
 
 # Pipeline Scoring Skill (Wrapper)

package/skills/update-policy/SKILL.md

@@ -6,7 +6,7 @@ allowed-tools: Read, Write, Edit, Bash, Glob, Grep, request_user_input, Agent
 
 <!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
 
-> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow and spawn the matching installed `wr-risk-scorer:<mode>` custom agent. Wait for it, then close that same agent so the completion hook receives its final response. Do not substitute the built-in `default` agent when a hook consumes the subagent identity; restart Codex if the installed agent is not yet visible.
+> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow and spawn the matching installed `wr-risk-scorer:<mode>` custom agent. Wait for it to finish, then close that completed agent once so the PostToolUse compatibility hook can persist its structured verdict. Do not parse transcripts or launch nested `codex exec`. Do not substitute the built-in `default` agent when a hook consumes the subagent identity; restart Codex if the installed agent is not yet visible.
 
 
 # Risk Policy Generator

package/skills/wip/SKILL.md

@@ -6,7 +6,7 @@ allowed-tools: Read, Glob, Bash, Agent
 
 <!-- Generated from packages/risk-scorer/skills/*/SKILL.md by packages/risk-scorer/scripts/sync-codex-skills.mjs during npm pack. Do not edit packaged output directly. -->
 
-> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow and spawn the matching installed `wr-risk-scorer:<mode>` custom agent. Wait for it, then close that same agent so the completion hook receives its final response. Do not substitute the built-in `default` agent when a hook consumes the subagent identity; restart Codex if the installed agent is not yet visible.
+> Codex runtime note: use `request_user_input` only in Plan Mode where this skill needs structured user input. Outside Plan Mode, ask one concise direct question only when no safe assumption exists. If a step refers to Claude-style agent dispatch or `subagent_type`, use a native Codex subagent workflow and spawn the matching installed `wr-risk-scorer:<mode>` custom agent. Wait for it to finish, then close that completed agent once so the PostToolUse compatibility hook can persist its structured verdict. Do not parse transcripts or launch nested `codex exec`. Do not substitute the built-in `default` agent when a hook consumes the subagent identity; restart Codex if the installed agent is not yet visible.
 
 
 # WIP Scoring Skill (Wrapper)