codex-orchestrator 2.0.2 → 2.0.4

package/internal-workflow/skills/code-review/SKILL.md

@@ -0,0 +1,279 @@
+---
+name: "code-review"
+description: "Evidence-first review of code, PRs, commits, regressions, or review-and-fix work using correctness and standards/cleanup lenses. Auto-fix only qualifying high-confidence severe issues."
+---
+
+# Code Review
+
+This skill performs evidence-based code review. It is not a style pass and not a summary. Treat the change as potentially wrong until independent review tracks fail to break it.
+
+The review always covers two lenses:
+
+- **Correctness reviewer**: bugs, regressions, runtime behavior, security, contracts, caches, concurrency, framework rules, and failure paths.
+- **Spec & standards reviewer**: requested behavior, documented repo standards, architecture fit, duplication, cleanup, and workaround-shaped implementation.
+
+The main agent is the coordinator. It pins the review target, assigns both
+lenses to one reviewer for `simple` and `medium`, and splits them across two
+independent reviewers only for `high`. It verifies the strongest findings,
+applies only safe fixes, and returns a concise findings-first report.
+
+Full review is bounded to the settled diff, its authority, changed owners, and
+callers or contracts with plausible fan-out. `Full` means complete coverage of
+that assigned scope once; it does not mean a repository-wide audit. Do not load
+unrelated modules or activate optional lenses without a diff signal or mandatory
+Review Focus.
+
+## When To Use
+
+Use this skill when the user asks for:
+
+- code review, PR review, commit audit, regression scan, or bug hunt
+- review since a branch, commit, tag, merge-base, or working tree state
+- review and fix of critical or high-severity high-confidence defects
+- framework-focused review such as `NestJS`, `Next.js`, `Flutter`, or `Dart`
+
+For every implementation profile, the spec/standards lens includes bounded
+cleanup for duplication, obsolete paths, workaround branches, and unjustified
+abstractions. High-risk work assigns that lens to its own reviewer in the same
+parallel final wave. A concrete evidenced simplification risk named by the
+user, approved source, or repo policy amplifies this lens inside the same review
+activation; it never creates a separate cleanup gate.
+
+Exception for approved spec execution: follow
+`../spec-implementer/references/review-loop.md`. Intermediate code-review
+checkpoints activate only their assigned Review Focus; final cleanup coverage
+uses the durable Review Plan and canonical Defect Ledger.
+
+## Implementation Review Adapter
+
+When this skill is called from `$spec-implementer`:
+
+- read `../spec-implementer/references/review-loop.md` and the persisted
+  `## Implementation Review State`
+- accept the scheduled mode, session, revision, and lenses from that state
+- pin the target and give reviewers the owner-defined capsule
+- return the usable result and stable defect updates to the executor
+- keep cleanup findings in the spec/standards lineage and canonical Defect Ledger
+
+Do not infer a fresh review loop, choose another mode, or make the owner's
+terminal decision inside this Adapter.
+
+## Progressive References
+
+Read only the references the current review needs:
+
+- Detailed bug classes: `references/bug-classes.md`
+- Cleanup lens method: `references/cleanup-lens.md`
+- Framework lenses for Next.js, NestJS, Flutter, and Dart: `references/framework-lenses.md`
+- Targeted recipes for recurring diff shapes: `references/targeted-recipes.md`
+- Contract test ledger: `../../docs/agents/contract-test-ledger.md`
+- Shared confidence rubric: `../../docs/agents/confidence-rubric.md`
+
+Load `references/framework-lenses.md` when the user names a framework or files/configs strongly imply one. Load `references/targeted-recipes.md` and `../../docs/agents/contract-test-ledger.md` when the diff shape matches new fields, retries, DTO/schema/runtime contracts, caches, state merge precedence, ordering, evidence/snapshots, determinism, or aggregation summaries. Load `references/bug-classes.md` for substantial reviews or broad bug hunts.
+Load `references/cleanup-lens.md` when the spec/standards lens is assigned. Use
+its bounded method by default and its amplified method only for a concrete
+evidenced simplification risk supplied as mandatory Review Focus.
+
+## Coordinator Workflow
+
+### 1. Pin The Review Target
+
+Identify exactly what is being reviewed.
+
+- If the user gave a fixed point, use it directly: branch, commit SHA, tag, `main`, `HEAD~5`, etc.
+- If they did not, infer from context:
+  - current uncommitted work: `git diff` plus staged diff if relevant
+  - branch review: `git diff <base>...HEAD`
+  - commit review: `git show <commit>`
+- If there is no safe inference, ask one short question: "Review against which branch or commit?"
+
+Capture:
+
+- `git status --short`
+- diff stat
+- the exact diff command used
+- commit list when reviewing a branch range
+- changed files and nearest related tests/docs
+
+Use three-dot diff for branch/base reviews: `git diff <fixed-point>...HEAD`.
+
+### 2. Discover Spec And Standards
+
+Do this before reviewer tracks so both tracks receive bounded inputs.
+
+Spec sources, in priority order:
+
+1. Issue or PR references in commit messages, branch names, PR metadata, or user prompt.
+2. A spec/PRD/plan path supplied by the user.
+3. Matching files under `docs/`, `specs/`, `.scratch/`, or local issue folders.
+4. If none exists, continue and mark the spec axis as "no spec found" instead of inventing requirements.
+
+Standards sources:
+
+- `AGENTS.md`, `CLAUDE.md`, `CONTRIBUTING.md`
+- `CONTEXT.md`, context maps, domain docs, ADRs
+- `STYLE.md`, `STANDARDS.md`, style guides, review checklists
+- `.editorconfig`, ESLint, Biome, Prettier, TypeScript, analyzer, or framework configs
+- relevant test files and existing examples in the touched area
+
+Machine-enforced config matters as context, but do not spend review findings on issues a required formatter/linter would already catch unless the tool is absent or failing.
+
+### 3. Activate Lenses
+
+Before deep review, decide which lenses apply.
+
+- Always activate the general correctness and spec/standards lenses.
+- Always apply bounded cleanup inside spec/standards; amplify it only for a
+  concrete evidenced Review Focus, never from size or risk labels alone.
+- Add framework lenses when explicit or strongly implied by files/configs.
+- Add targeted recipes when the diff shape matches them.
+- If the user, plan, or implementation spec provides `Review Focus`, treat each listed lens, targeted recipe, invariant, and risk as mandatory. Do not replace it with a generic review; report any focus item that cannot be verified as a verification gap.
+- If inference is uncertain, say so and continue with the best-supported review instead of pretending certainty.
+
+Mandatory delta lenses:
+
+- **Contract Delta Review:** If the diff expands a shared contract, enum/status, schema, DTO, permission, capability, token, or scope, search old consumers and report `changed contract -> searched call sites -> risky fallback/default branches -> tests or fix`.
+- **Backend Trust Boundary Review:** If the diff adds a credential, OAuth scope, permission, role-sensitive write, or external capability, verify the backend-side guard. UI controls, query/state flags, and caller intent are not authorization.
+
+Common framework signals:
+
+- **Next.js**: `next.config.*`, `app/**`, `pages/**`, route handlers, server actions, `use server`, `use client`, revalidation APIs.
+- **NestJS**: `@nestjs/*`, controllers, providers, modules, guards, pipes, interceptors, DTOs, `nest-cli.json`.
+- **Flutter**: `pubspec.yaml`, `lib/**`, widgets, navigation, bloc/provider/riverpod/notifiers.
+- **Dart**: `.dart`, `Future`, `Stream`, isolates, generated serializers, null-safety constructs.
+
+### 4. Run Profile-Selected Reviewers
+
+For `simple`, run one `reviewer_fast`; for `medium`, run one
+`reviewer_standard`. Assign that child both correctness and spec/standards
+lenses in one bounded Full review. For `high`, run two `reviewer_deep` children
+in parallel with one disjoint lens each. Invoking `$code-review` authorizes
+these reviewers. Preserve every fulfilled launch handle if a parallel peer
+fails, then close all launched children. Tell every reviewer not to edit or
+revert unrelated work.
+
+For spec-driven checkpoints, obey the track assignment in the persisted Review
+Plan instead of automatically launching both default tracks.
+
+Medium is the normal review profile. API, persistence, multiple files, or a
+shared-looking name do not select `high` unless evidence proves both a material
+failure consequence and an uncertainty amplifier.
+
+When already inside an assigned reviewer child, execute its assigned lens set
+inline and return it to root; do not spawn a grandchild.
+If the user forbids delegation, report the independent review gate as waived or
+unavailable according to the parent workflow; root must not self-review inline.
+
+#### Correctness Reviewer Brief
+
+Include the exact diff command or commit under review, changed file list, commit list, active references, any `Review Focus`, and an instruction to read surrounding execution paths.
+
+> Review runtime correctness adversarially. Hunt concrete bugs in control flow, state, async/concurrency, security, auth, contracts, schemas, caching, persistence, UI/API integration, and framework-specific behavior. If a Review Focus is provided, explicitly test the named risks first, such as duplicate side effects, retry/idempotency, ordering, source-of-truth ownership, partial failure, DTO/schema drift, or false user-facing state. For each finding, provide file/line, trigger path, impact, why guards do not prevent it, severity, and confidence. Do not report style nits or generic "needs tests" comments.
+> For bugfixes, check claim boundaries: what changed tests prove, what they do not prove, and whether sibling execution paths can still violate the claimed invariant.
+> When Contract Delta Review applies, follow new values through old consumers and default/fallback branches before trusting local tests. When Backend Trust Boundary Review applies, verify the server-side authorization predicate at the write/callback boundary.
+
+#### Spec & Standards Reviewer Brief
+
+Include the exact diff command or commit under review, spec source path/content or "no spec found", standards source list, changed file list, commit list, any `Review Focus`, and an instruction to cite the spec or standard behind each finding.
+
+> Review the change against the requested work and repo standards. Check missing requirements, partial behavior, scope creep, undocumented contract changes, architecture drift, duplicate source-of-truth logic, dead/legacy branches, and workaround-shaped implementation. If a Review Focus is provided, explicitly verify each named ownership, scope, validation, and invariant risk against the spec. Cite the spec or standard when available. If there is no spec, skip requirement claims and focus on documented standards and architecture evidence.
+> Apply `references/cleanup-lens.md`: use bounded cleanup by default, or the amplified method when a concrete evidenced simplification risk is mandatory Review Focus. Keep cleanup findings in this review's normal Defect Ledger. Do not create a cleanup-only verdict or separate pass.
+
+### 5. Aggregate And Verify
+
+The coordinator must not blindly relay reviewer output.
+
+1. Deduplicate findings across tracks.
+2. Re-read the relevant code for the strongest findings.
+3. Drop findings that lack a concrete trigger path.
+4. Reclassify severity/confidence using `../../docs/agents/confidence-rubric.md` if evidence does not support the label.
+5. For real contract defects, identify the missing or inadequate Contract Test Ledger invariant when TDD/spec evidence is available.
+6. Confirm every mandatory `Review Focus` item and mandatory delta lens was reviewed; if not, report the unverified item as a verification gap.
+7. Decide whether auto-fix is allowed.
+8. Run the narrowest meaningful verification after any fix.
+
+Keep the two axes visible in your own notes, but present the final report by severity unless the user explicitly asked for side-by-side Standards/Spec output.
+
+After repairs, verify medium or low findings through the coordinator's direct
+failure-path check plus affected validation. Launch Closure only for the
+severity, protected-contract, or invalidated-coverage triggers owned by
+`review-protocol.md`. For a scheduled Closure, send the bounded capsule to the
+selected reviewer lineage and return its defect updates.
+
+## Evidence Standard
+
+A valid finding explains:
+
+- what breaks
+- why it breaks
+- the input, sequence, role, tenant, environment, or timing that triggers it
+- where the defect lives
+- why existing guards do not prevent it
+- severity and confidence
+
+Do not file:
+
+- style nits disguised as correctness issues
+- speculative races without a shared-state path
+- generic "needs tests" comments without a concrete regression risk
+- architecture discomfort without wrong ownership, duplication, leakage, or a regression path
+- performance comments without a hot path or failure mode
+
+## Auto-Fix Policy
+
+Automatically fix only when all are true:
+
+- severity is critical or high
+- confidence is high under `../../docs/agents/confidence-rubric.md`
+- root cause is clear
+- correct fix is narrow and low-risk
+- fix matches local project patterns
+- verification is available, or the edit is obviously safe and syntax-checkable
+
+When auto-fixing:
+
+- patch only the bug
+- add/update behavior tests when regression risk is meaningful and the codebase supports it; for contract defects, add the missing ledger invariant first when a ledger exists or is being created
+- rerun relevant verification
+- never revert unrelated user changes
+
+Do not auto-fix ambiguous semantics, product decisions, broad refactors, or low-confidence concerns. Report them with evidence.
+
+## Output Contract
+
+For review-only tasks:
+
+1. Findings first, ordered by severity.
+2. File and line references for each finding.
+3. Trigger path, impact, severity, confidence, and evidence.
+4. Open questions, assumptions, or verification gaps.
+5. Short summary only after findings.
+
+For review-and-fix tasks:
+
+1. State which critical or high-severity high-confidence issues were fixed.
+2. Report remaining findings that were not fixed.
+3. Give one short verification note and any blocked checks.
+4. Keep the closing summary user-facing and outcome-based.
+
+If there are no findings, say so clearly and mention residual test or verification gaps.
+
+For spec-driven review checkpoints or final review gates, include a compact review handoff that can feed the executor's Final Risk Handoff: reviewed target, Review Focus status, high/critical findings fixed or remaining, skipped checks, and residual verification gaps. Keep findings first.
+
+If inline review comments are requested, emit one `::code-comment{...}` directive per actionable finding.
+
+## Tooling Defaults
+
+- Use `rg`/`rg --files` for code search.
+- Prefer parallel reads for status, diff, changed files, related modules, tests, repo docs, and standards.
+- Use official docs or Context7 only when a finding depends on version-sensitive framework/library behavior.
+- Run the narrowest meaningful tests first, then required lint/build/analyzer checks for touched areas.
+- Keep raw command output out of the final response unless the user asks for it.
+
+## Decision Defaults
+
+- If the user says "review", default to findings-first review.
+- If the user says "review and fix", auto-fix only critical or high-severity high-confidence issues that satisfy the auto-fix policy.
+- If the user provides a framework focus, explicitly use it.
+- If no focus is provided, infer active lenses from the diff and say when they materially affected findings.
+- Ask clarification only when the correct review target or fix would otherwise be risky or ambiguous.

package/internal-workflow/skills/code-review/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Code Review"
+  short_description: "Profile-routed correctness and standards review"
+  default_prompt: "Use $code-review for one final profile-selected wave; high risk uses two parallel reviewers and the spec/standards lens includes bounded cleanup."

package/internal-workflow/skills/code-review/references/bug-classes.md

@@ -0,0 +1,56 @@
+# Code Review Bug Classes
+
+Use this reference for substantial reviews and broad bug hunts.
+
+## Review Mindset
+
+- Findings first; summary second.
+- Prefer a few high-signal findings over a long speculative list.
+- Read enough surrounding code to understand the real execution path.
+- Include pre-existing bugs only when they materially affect the reviewed path.
+- Treat workaround-shaped code as a review target.
+- Treat duplicated business rules, builders, cleanup rules, normalization, cache keys, restart paths, and persistence math as likely drift vectors.
+- Treat "tests pass" as insufficient when contracts, ownership, or source-of-truth logic moved.
+- Do not stop after the edited hunk unless the change is truly trivial.
+
+## Non-Negotiable Passes
+
+Every substantial review covers:
+
+1. **Scope**: exact diff/commit/branch/files under review.
+2. **Execution path**: entrypoints, callers, callees, side effects, state writes, network/DB boundaries, cleanup.
+3. **Architecture fit**: correct owning layer, no leaky abstractions, no duplicate source of truth, no symptom patch in the wrong layer.
+4. **Invariants**: validation, authorization, ordering, idempotency, data shape, permissions, cache visibility, and lifecycle rules.
+5. **Failure modes**: empty, null, duplicate, stale, delayed, retried, timeout, cancellation, partial failure, concurrent execution.
+6. **Blast radius**: DTOs, schemas, cache keys, feature flags, config, metrics, tests, consumers, migrations, and backward compatibility.
+7. **Verification**: narrow tests/lint/build/analyzer for touched areas, or a clear note when a check cannot run.
+
+## Bug Classes To Hunt
+
+- Control-flow mistakes: wrong branch, inverted predicate, missing return, incorrect default, off-by-one, pagination errors.
+- State/lifecycle bugs: stale state, forgotten reset, double writes, orphaned cleanup, leaks, inconsistent derived state.
+- Async/concurrency bugs: missing `await`, race windows, non-idempotent retries, shared mutable state, closure mutation in retryable callbacks.
+- Partial-failure bugs: one side effect succeeds while durable follow-up fails.
+- Contract drift: DTO/schema/type mismatch, nullable changes, enum drift, serialization differences, `ObjectId`/`Date` runtime mismatch.
+- Cache bugs: stale reads, bad cache keys, cross-tenant leakage, missed invalidation, TTL mismatch.
+- Auth regressions: missing actor checks, wrong tenant scope, optional-param bypass, client-only enforcement.
+- Data correctness: timezones, DST, rounding, units, locale parsing, duplicate filtering, sort instability.
+- UI/API regressions: optimistic state not rolled back, loading/error/empty states broken, incompatible response handling.
+- Observability gaps: critical failures suppressed without logs, metrics, retries, or surfaced errors.
+- Workarounds: magic delays, one-off guards, forced ordering, duplicated normalization, cross-layer patches.
+- Architecture drift: business logic in the wrong layer, source-of-truth splits, unnecessary coupling.
+- Deep-module drift: shallow pass-through modules, hypothetical one-adapter seams, lost locality, weak leverage, or tests reaching inside the implementation instead of crossing the Module Interface.
+
+## Mandatory Questions
+
+Ask the relevant subset for each meaningful path:
+
+- What happens with empty, null, duplicated, delayed, retried, stale, or out-of-order input?
+- What happens when a dependency throws, times out, returns partial data, or returns stale data?
+- Can two executions interleave and corrupt state, leak data, or duplicate work?
+- Are validation and authorization enforced before side effects?
+- Does the change rely on a type guarantee that is weaker at runtime?
+- Do all readers and writers agree on field names, units, nullability, and semantics?
+- If state is rebuilt, cloned, merged, normalized, serialized, or persisted, are all required fields preserved?
+- Can feature flags, optional params, defaults, or fallback paths bypass intended behavior?
+- If failure happens halfway through, what durable state remains and who repairs it?

package/internal-workflow/skills/code-review/references/cleanup-lens.md

@@ -0,0 +1,52 @@
+# Cleanup Lens
+
+Use this method inside the code-review spec/standards lens. Its job is to reduce
+maintenance surface without changing required observable behavior. It is never
+a standalone gate, activation, verdict, or coverage class.
+
+## Depth
+
+- **Bounded:** inspect material additions and replacements for obvious duplicate
+  owners, obsolete paths, workaround branches, dead code, and unjustified
+  abstractions.
+- **Amplified:** when mandatory Review Focus names a concrete evidenced
+  simplification risk, inventory every material addition, replacement,
+  compatibility path, and runtime owner related to that risk. Do not amplify
+  from file count, implementation size, or review profile alone.
+
+## In Scope
+
+- duplicated logic, sources of truth, registrations, or old/new paths kept in parallel
+- dead helpers, flags, adapters, branches, comments, tests, or documentation left by the change
+- workaround-shaped conditionals, magic ordering, symptom patches, and unnecessary state
+- compatibility or fallback behavior without current repository, source-authority, or production evidence
+- new services, events/listeners, adapters, or indirection with one current consumer and only speculative reuse
+- ownership placement when moving or deleting code restores an existing owner without redesigning the system
+
+Do not turn functional correctness, security, performance, product decisions,
+missing regression proof, broad architecture redesign, or style preferences
+into cleanup findings. Route them to the applicable code-review lens.
+
+## Method
+
+Classify each material complexity decision:
+
+- `KEEP`: a current invariant requires it and evidence or a boundary proof supports it.
+- `SIMPLIFY`: required behavior can use a smaller existing seam or fewer states or branches.
+- `REMOVE`: no current behavior, authority, consumer, or compatibility evidence requires it.
+
+A one-producer/one-consumer abstraction defaults to `SIMPLIFY` unless a concrete
+lifecycle, transaction, dependency-direction, or fanout invariant requires the
+boundary. Do not request a new abstraction unless it reduces current
+duplication or restores an existing owner now.
+
+Report a finding only with exact evidence, concrete maintenance cost, and a
+behavior-preserving fix. Uncertain removal is a non-blocking follow-up. In
+amplified mode, include concise `KEEP | SIMPLIFY | REMOVE` decisions in the
+spec/standards handoff; bounded mode needs decisions only when they explain a
+finding or protected invariant.
+
+Cleanup repairs retain the same defect IDs. Medium or low cleanup repairs use coordinator verification plus affected validation. Launch affected-lens Closure
+only when the shared review protocol requires it for severity, protected
+contract impact, or invalidated mandatory coverage; add correctness whenever
+that Closure repair may alter observable behavior.

package/internal-workflow/skills/code-review/references/framework-lenses.md

@@ -0,0 +1,34 @@
+# Code Review Framework Lenses
+
+Load this reference when a framework is explicit or strongly implied by files/configs.
+
+## Next.js
+
+- Server/client component boundaries, hydration assumptions, browser APIs on server.
+- `fetch` cache modes, route segment caching, `revalidatePath`/`revalidateTag`, stale data behavior.
+- Route handlers/server actions: input validation, auth, serialization of dates/errors/nullables.
+- Loading, empty, error, navigation, optimistic update, rollback, back/refresh behavior.
+- SSR/client mismatch from locale, feature flags, sessions, params, and search params.
+
+## NestJS
+
+- Request flow through controller, guard, pipe, interceptor, service, repository, events/queues.
+- DTO validation versus runtime payload, especially transforms, enums, optionals, nested objects.
+- Server-side auth and tenant scope before side effects.
+- Transaction boundaries, partial writes, outbox/queue ordering, retry safety.
+- Exception mapping, HTTP status behavior, cache decorators, request scope, singleton mutable state, cron/queue concurrency.
+
+## Flutter
+
+- Widget lifecycle: `init`, `build`, async callbacks, `dispose`, state updates after unmount.
+- Navigation/back stack, dialog/sheet dismissal, duplicate submit from rapid taps.
+- State management transitions, stale emissions, missed listeners, dropped fields.
+- Loading, offline, empty, error, retry states.
+- Platform permissions, keyboard insets, small-screen overflow, animation/controller/stream cleanup.
+
+## Dart
+
+- Null-safety assumptions, casts, `late`, `!`, JSON parsing, generated serializers.
+- `Future`, `Stream`, timer, isolate ordering, cancellation, uncaught errors.
+- Equality, copy semantics, immutable updates, mutation during iteration.
+- Date/duration/timezone handling, numeric precision, parsing, generic runtime assumptions.

package/internal-workflow/skills/code-review/references/targeted-recipes.md

@@ -0,0 +1,49 @@
+# Code Review Targeted Recipes
+
+Load this reference when the diff shape matches one of these recurring risks.
+
+## Activation
+
+- new field or contract: run **New Field Threading**
+- transaction/retry/queue/background job: run **Retryable Persistence**
+- DTO/schema/type/persistence change: run **Runtime Contract Alignment**
+- cache or invalidation change: run **Cache Coherence**
+- server/AI/cache/fallback state merged into client state: run **State Merge Precedence**
+- preview/trace/summary/score/winner field: run **Aggregation Cardinality**
+
+## New Field Threading
+
+1. Search for the field name.
+2. Search nearby `build`, `apply`, `adjust`, `replan`, `normalize`, `merge`, `compile`, `serialize`, `clone`, and fallback helpers.
+3. Confirm the field survives primary construction, correction/replan paths, persistence reload, response serialization, and externally visible tests.
+
+## Retryable Persistence
+
+1. Read the whole transaction/retry callback.
+2. List outer-scope variables referenced inside it.
+3. Flag mutation of outer arrays, counters, iterators, derived inputs, or one-shot streams that changes behavior on retry.
+4. Compare transactional and non-transactional paths for parity.
+
+## Runtime Contract Alignment
+
+1. Compare DTO validation, internal type, persistence schema, normalization, API response shape, and frontend/state consumers.
+2. Treat `string` versus `ObjectId`, `Date` versus string, enum drift, and nested optional mismatches as review targets.
+3. Prefer boundary validation when malformed input should be rejected.
+
+## Cache Coherence
+
+1. Identify cache key inputs, tenant/user scope, feature flags, locale, and permissions.
+2. Confirm invalidation covers every write path and revalidation timing matches user-visible expectations.
+3. Check stale reads, cross-tenant leakage, and optimistic UI/cache rollback.
+
+## State Merge Precedence
+
+1. Identify precedence between user-entered state, server state, AI-generated state, fallback state, cache state, and defaults.
+2. Verify omitted fields, empty objects, `false`, `0`, or `null` cannot erase stronger user choices unless intended.
+3. Check both backend merge logic and frontend state update logic.
+
+## Aggregation Cardinality
+
+1. Determine whether source data is global, per-group, per-item, per-step, or per-tenant.
+2. Verify top-level summary/trace/score/winner fields do not collapse multiple meaningful entities into one misleading value.
+3. Treat `.find()`, first-selected, `sort()[0]`, and flat-array winner logic as suspicious when multiple groups can each have a result.

package/internal-workflow/skills/diagnosing-bugs/SKILL.md

@@ -0,0 +1,138 @@
+---
+name: diagnosing-bugs
+description: Debug hard, flaky, unclear, or performance bugs through reproduce, minimize, hypothesize, instrument, fix, and regression-test. Trigger for nondeterministic failures, unclear breakage, or performance regressions.
+---
+
+# Diagnosing Bugs
+
+A discipline for hard bugs. Skip phases only when explicitly justified.
+
+Routing precedence: use `$CODEX_ORCHESTRATOR_WORKFLOW_ROOT/docs/agents/bug-workflow-routing.md`. This skill owns the feedback loop; after the loop proves the bug, return to the original intent: diagnosis-only output or implementation through `code-debugger`.
+
+Use `$CODEX_ORCHESTRATOR_WORKFLOW_ROOT/docs/agents/confidence-rubric.md` when deciding whether a hypothesis, root cause, or fix is high-confidence enough to act on. Low-confidence concerns are questions or verification gaps, not proven causes.
+
+When exploring the codebase, read `CONTEXT.md` (if it exists) to get a clear mental model of the relevant modules, and check ADRs in the area you're touching.
+
+## Phase 1 — Build a feedback loop
+
+**This is the skill.** Everything else is mechanical. If you have a **tight** pass/fail signal for the bug — one that goes red on _this_ bug — you will find the cause; bisection, hypothesis-testing, and instrumentation all just consume it. If you don't have one, no amount of staring at code will save you.
+
+Spend disproportionate effort here. **Be aggressive. Be creative. Refuse to give up.**
+
+### Ways to construct one — try them in roughly this order
+
+1. **Failing test** at whatever seam reaches the bug — unit, integration, e2e.
+2. **Curl / HTTP script** against a running dev server.
+3. **CLI invocation** with a fixture input, diffing stdout against a known-good snapshot.
+4. **Headless browser script** (Playwright / Puppeteer) — drives the UI, asserts on DOM/console/network.
+5. **Replay a captured trace.** Save a real network request / payload / event log to disk; replay it through the code path in isolation.
+6. **Throwaway harness.** Spin up a minimal subset of the system (one service, mocked deps) that exercises the bug code path with a single function call.
+7. **Property / fuzz loop.** If the bug is "sometimes wrong output", run 1000 random inputs and look for the failure mode.
+8. **Bisection harness.** If the bug appeared between two known states (commit, dataset, version), automate "boot at state X, check, repeat" so you can `git bisect run` it.
+9. **Differential loop.** Run the same input through old-version vs new-version (or two configs) and diff outputs.
+10. **HITL bash script.** Last resort. If a human must click, drive _them_ with `scripts/hitl-loop.template.sh` so the loop is still structured. Captured output feeds back to you.
+
+Build the right feedback loop, and the bug is 90% fixed.
+
+### Tighten the loop
+
+Treat the loop as a product. Once you have _a_ loop, **tighten** it:
+
+- Can I make it faster? (Cache setup, skip unrelated init, narrow the test scope.)
+- Can I make the signal sharper? (Assert on the specific symptom, not "didn't crash".)
+- Can I make it more deterministic? (Pin time, seed RNG, isolate filesystem, freeze network.)
+
+A 30-second flaky loop is barely better than no loop; a 2-second deterministic one is tight — a debugging superpower.
+
+### Non-deterministic bugs
+
+The goal is not a clean repro but a **higher reproduction rate**. Loop the trigger 100×, parallelise, add stress, narrow timing windows, inject sleeps. A 50%-flake bug is debuggable; 1% is not — keep raising the rate until it's debuggable.
+
+### When you genuinely cannot build a loop
+
+Stop and say so explicitly. List what you tried. Ask the user for: (a) access to whatever environment reproduces it, (b) a captured artifact (HAR file, log dump, core dump, screen recording with timestamps), or (c) permission to add temporary production instrumentation. Do **not** proceed to hypothesise without a loop.
+
+### Completion criterion — a tight loop that goes red
+
+Phase 1 is done when the loop is **tight** and **red-capable**: you can name **one command** — a script path, a test invocation, a curl — that you have **already run at least once** (paste the invocation and its output), and that is:
+
+- [ ] **Red-capable** — it drives the actual bug code path and asserts the **user's exact symptom**, so it can go red on this bug and green once fixed. Not "runs without erroring" — it must be able to _catch this specific bug_.
+- [ ] **Deterministic** — same verdict every run (flaky bugs: a pinned, high reproduction rate, per above).
+- [ ] **Fast** — seconds, not minutes.
+- [ ] **Agent-runnable** — you can run it unattended; a human in the loop only via `scripts/hitl-loop.template.sh`.
+
+If you catch yourself reading code to build a theory before this command exists, **stop — jumping straight to a hypothesis is the exact failure this skill prevents.** No red-capable command, no Phase 2.
+
+## Phase 2 — Reproduce + minimise
+
+Run the loop. Watch it go red — the bug appears.
+
+Confirm:
+
+- [ ] The loop produces the failure mode the **user** described — not a different failure that happens to be nearby. Wrong bug = wrong fix.
+- [ ] The failure is reproducible across multiple runs (or, for non-deterministic bugs, reproducible at a high enough rate to debug against).
+- [ ] You have captured the exact symptom (error message, wrong output, slow timing) so later phases can verify the fix actually addresses it.
+
+### Minimise
+
+Once it's red, shrink the repro to the **smallest scenario that still goes red**. Cut inputs, callers, config, data, and steps **one at a time**, re-running the loop after each cut — keep only what's load-bearing for the failure.
+
+Why bother: a minimal repro shrinks the hypothesis space in Phase 3 (fewer moving parts left to suspect) and becomes the clean regression test in Phase 5.
+
+Done when **every remaining element is load-bearing** — removing any one of them makes the loop go green.
+
+Do not proceed until you have reproduced **and** minimised.
+
+## Phase 3 — Hypothesise
+
+Generate **3–5 ranked hypotheses** before testing any of them. Single-hypothesis generation anchors on the first plausible idea.
+
+Each hypothesis must be **falsifiable**: state the prediction it makes.
+
+> Format: "If <X> is the cause, then <changing Y> will make the bug disappear / <changing Z> will make it worse."
+
+If you cannot state the prediction, the hypothesis is a vibe — discard or sharpen it.
+
+**Show the ranked list to the user before testing.** They often have domain knowledge that re-ranks instantly ("we just deployed a change to #3"), or know hypotheses they've already ruled out. Cheap checkpoint, big time saver. Don't block on it — proceed with your ranking if the user is AFK.
+
+## Phase 4 — Instrument
+
+Each probe must map to a specific prediction from Phase 3. **Change one variable at a time.**
+
+Tool preference:
+
+1. **Debugger / REPL inspection** if the env supports it. One breakpoint beats ten logs.
+2. **Targeted logs** at the boundaries that distinguish hypotheses.
+3. Never "log everything and grep".
+
+**Tag every debug log** with a unique prefix, e.g. `[DEBUG-a4f2]`. Cleanup at the end becomes a single grep. Untagged logs survive; tagged logs die.
+
+**Perf branch.** For performance regressions, logs are usually wrong. Instead: establish a baseline measurement (timing harness, `performance.now()`, profiler, query plan), then bisect. Measure first, fix second.
+
+## Phase 5 — Fix + regression test
+
+Write the regression test **before the fix** — but only if there is a **correct seam** for it.
+
+A correct seam is one where the test exercises the **real bug pattern** as it occurs at the call site. If the only available seam is too shallow (single-caller test when the bug needs multiple callers, unit test that can't replicate the chain that triggered the bug), a regression test there gives false confidence.
+
+**If no correct seam exists, that itself is the finding.** Note it. The codebase architecture is preventing the bug from being locked down. Flag this for the next phase.
+
+If a correct seam exists:
+
+1. Turn the minimised repro into a failing test at that seam.
+2. Watch it fail.
+3. Apply the fix.
+4. Watch it pass.
+5. Re-run the Phase 1 feedback loop against the original (un-minimised) scenario.
+
+## Phase 6 — Cleanup + post-mortem
+
+Required before declaring done:
+
+- [ ] Original repro no longer reproduces (re-run the Phase 1 loop)
+- [ ] Regression test passes (or absence of seam is documented)
+- [ ] All `[DEBUG-...]` instrumentation removed (`grep` the prefix)
+- [ ] Throwaway prototypes deleted (or moved to a clearly-marked debug location)
+- [ ] The hypothesis that turned out correct is stated in the commit / PR message — so the next debugger learns
+
+**Then ask: what would have prevented this bug?** If the answer involves architectural change (no good test seam, tangled callers, hidden coupling) hand off to the `$improve-codebase-architecture` skill with the specifics. Make the recommendation **after** the fix is in, not before — you have more information now than when you started.

package/internal-workflow/skills/diagnosing-bugs/agents/openai.yaml

@@ -0,0 +1,6 @@
+interface:
+  display_name: "Diagnosing Bugs"
+  short_description: "Run a disciplined hard-bug investigation loop"
+  default_prompt: "Use $diagnosing-bugs to reproduce, minimise, diagnose, and verify this difficult bug."
+policy:
+  allow_implicit_invocation: true