devrites 3.2.28 → 4.0.0

package/pack/generated/codex/skills/rite-vet/reference/artifacts.md

@@ -1,25 +1,23 @@
 # `eng-review.md` + `test-plan.md` templates + fold-back rules
 
-`eng-review.md` records the review; `test-plan.md` is the build-readable coverage target.
-Fold findings into `plan.md`/`tasks.md`: review prose alone does not change the build.
+`eng-review.md` records review; `test-plan.md` drives Build. Fold accepted findings
+into `plan.md`/`tasks.md`; prose alone never changes Build.
 
 ## `eng-review.md`: the record
-Write to `.devrites/work/<slug>/eng-review.md`. If one exists for the slug, **update** it, don't
-clobber.
+Write/update `.devrites/work/<slug>/eng-review.md`; never clobber.
 
 ```markdown
 # Eng review: <slug>
 Vetted: <iso>   Cross-model: ran (codex) | off
-DevRites contract: devrites.readiness-artifacts.v2
 Implementation readiness: <READY | NEEDS CLARIFICATION | NEEDS REPLAN>
-Readiness inputs SHA-256: <exact value from `devrites-engine readiness-digest engineering <slug>`>
+Readiness inputs SHA-256: <64 lowercase hex>
 
 ## 1. Depth
 light | full (<trigger that escalated it>)     # every plan is vetted — light or full, never skipped (see depth.md)
 
 ## 2. Scope challenge
-- What already exists (reuse vs rebuild): <findings — each reuse the plan should adopt>
-- Minimum diff: scope accepted as-is | trimmed <n items, listed in NOT-in-scope>
+- Existing reuse: <findings adopted by the plan>
+- Minimum diff: <accepted | trimmed n; list in NOT-in-scope>
 - Complexity: ok | smell (<n files, m new services) → asked → <reduce|proceed, why>
 - Built-in / completeness / distribution: <flags, with source citations>
 
@@ -36,10 +34,12 @@ light | full (<trigger that escalated it>)     # every plan is vetted — light
 Inventory/currentness: <pass/gaps> · slice order/independence: <pass/gaps> ·
 UX/spec/architecture: <pass/n-a/gaps> · operations/rollout/rollback: <pass/n-a/gaps>
 
+Shared contract proof: <pass | gap: missing/one-sided/duplicated-contract/vague/non-consuming>
+
 ## 3. Axis findings (floor-gated)
 | Axis | Floor band | Findings (sev · confidence) |
 |---|---|---|
-| Architecture | strong/adequate/thin/broken | [Critical](9) … |
+| Architecture | strong/adequate/thin/broken | Critical (9) … |
 | Plan code-quality | … | … |
 | Test-coverage design | … | see test-plan.md |
 | Performance | … | … |
@@ -50,44 +50,53 @@ Suppressed (confidence ≤4, unverified): <count — one line each>
 |---|---|---|---|---|---|
 | <path> | timeout / nil / race / stale | y/n | y/n | y/n | ok / **CRITICAL gap** |
 
-## 5. Parallelization
-Sequential — no opportunity   # OR the dependency table + lanes + order + conflict flags
+## 5. Dependency safety
+<declared order is safe | exact dependency/order correction>
 
-## 6. Reviewer loop
-- iter 1: <findings → resolution> · iter 2: … (≤3)
+## 6. Native reviewer accounts
+- `devrites-plan-reviewer`: <findings + resolution | evidence-based No-findings>
+- `devrites-strategy-reviewer`: <current Temper verdict | Not-applicable: low-stakes skip>
+- `devrites-devex-reviewer`: <findings + resolution | No-findings | Not-applicable: no developer surface>
+- Recheck: <not-needed | one narrow recheck and result>
 - Cross-model (if --cross-model): <overlap / unique findings — informational until approved>
 - Final: floor = <band>; unresolved → <none | blocking qid>
 
 ## 7. Completion summary
-- Scope: accepted | reduced   · Architecture: <n>   · Code-quality: <n>
-- Coverage: <x/y> planned, <n> gaps, <n> regressions (Critical)
-- Build entry: preflight <pass/fail/blocked>; action-time checkpoints <none/list>
-- Failure modes: <n> mapped, <n> critical gaps
-- NOT in scope: written   · What already exists: written
-- Plan: hardened in place | <n> deltas via Spec Drift Guard
+- Outcome: <one sentence; REQ/AC refs>
+- Boundaries: <IN/OUT/must-NOT refs>
+- Design/flow: <UI/n-a; chosen seams/why; happy/error refs>
+- Delivery: <slice order + first>
+- Proof/gates: <test-plan rows; justified action-time gates>
+- Review: scope <accepted/reduced>; architecture <n>; quality <n>; coverage <x/y>,
+  gaps <n>, Critical regressions <n>; failure modes <n>, Critical gaps <n>.
+- Entry/records: preflight <pass/fail/blocked>; checkpoints <none/list>;
+  NOT-in-scope + existing written; plan <hardened | n Guard deltas>.
 ```
 
 ## `test-plan.md`: the build-readable coverage target
-Write to `.devrites/work/<slug>/test-plan.md`. `$rite-build` (the slice-wright) reads it to write
-tests alongside the code; `$rite-prove` walks it against `evidence.md`. Keep it about *what to
-test and where*, not implementation detail.
+Write/update `.devrites/work/<slug>/test-plan.md`. `$rite-build`'s slice-wright
+writes tests from it; `$rite-prove` walks it against `evidence.md`. Specify
+*what/where* to test, not implementation.
 
 ```markdown
 # Test plan: <slug>
 From $rite-vet on <iso>. Runner + conventions: <detected framework + command>.
-DevRites contract: devrites.readiness-artifacts.v2
 
 ## Build-entry preflight
 | Gate | Command | Cwd | Expected | Prerequisites | Provenance to recapture |
 |---|---|---|---|---|---|
 | <test/browser/package> | <exact command> | <path> | <exit/output> | <service/browser/credential owner> | <tool version + full SHA-256s> |
 
-Link any disposable parser fixture. Build evidence recomputes every digest; preflight values
-are not post-build proof.
+Link any disposable parser fixture. Preflight values are planning evidence, not post-build proof;
+Prove recaptures the observed command, candidate identity, and result.
 
 Commands in this durable artifact are portable repository commands: no RTK or local shell
-aliases, user-specific absolute paths, or temporary proof trees. A runtime packet may name
-an execution adapter, and evidence may record the portable and executed forms.
+aliases, user-specific absolute paths, or temporary proof trees. Evidence records
+the command actually executed.
+
+Every behavioral row names a positive, discriminating assertion and the decisive output it
+produces. A command or expected exit zero alone is not a behavioral assertion; static gates
+prove only their named static criterion.
 
 ## Coverage diagram
 <the ASCII code-paths + user-flows diagram from review-axes.md, with COVERAGE / GAPS / REGRESSIONS line>
@@ -114,6 +123,10 @@ Omit the whole section only for a slice with **no** interactive surface (pure ba
 - <spec acceptance criterion> → <T1, T3>   # every criterion maps to ≥1 test
 ```
 
+For every row in `plan.md`'s `Shared contract proof`, the per-gap requirements name both
+provider- and consumer-side asserting tests and state how each consumes the same canonical
+artifact. Reference the plan row; do not reproduce its contract table here.
+
 ## Parallelization table (in `eng-review.md` §5 when there's an opportunity)
 ```markdown
 | Step / workstream | Modules touched (dir-level) | Depends on |
@@ -133,15 +146,12 @@ acceptance/behavior changes route through the **Spec Drift Guard**.
 - **Write directly into `plan.md` / `tasks.md`** (single canonical writer: you, not the reviewer):
   - `plan.md` §Scope boundaries ← "NOT in scope" items.
   - `plan.md` §Architecture decisions ← reuse-over-rebuild calls + named failure scenarios.
-  - `plan.md` §Dependency graph / §Implementation order ← the parallel lanes + any ordering fix
+  - `plan.md` §Dependency graph / §Implementation order ← any dependency or ordering fix
     (e.g. refactor-before-feature split).
   - `plan.md` §Complexity & deviations gate ← any deviation the §0 challenge surfaced + its justification.
   - `tasks.md` slices ← added test requirements (point at `test-plan.md`), added error-handling /
     failure-mode coverage, tightened slice scope, a split of a refactor+behavior slice into two.
     Adjust a slice's `Gate:` upward when vet reveals higher stakes (e.g. an unflagged migration).
-    For an eligible architecture competition, set the canonical `Forge`, `Forge strategies`,
-    and `Forge scorecard` fields only after the acceptance→test map is final; otherwise keep
-    `no` / `none` / `none`.
   - Re-run the `plan.md` Readiness gate after edits; it must still pass.
 - **Route through the Spec Drift Guard** (record `drift.md` + a recorded decision, then `$rite-plan
   repair` for any structural reslice) for anything that **changes an acceptance criterion, product
@@ -153,24 +163,20 @@ acceptance/behavior changes route through the **Spec Drift Guard**.
   never smuggled into scope as a fact.
 
 ## Write discipline
-- **Single canonical writer.** The skill writes `eng-review.md` / `test-plan.md` and edits
-  `plan.md` / `tasks.md`; `devrites-plan-reviewer` is **read-only** and only returns findings + bands.
-- **No silent scope.** A plan refinement that grows acceptance without a recorded decision, or a
-  deferral that drops a criterion without the Guard, is a defect, not a convenience.
-- Add `eng-review.md` + `test-plan.md` to the workspace between `tasks.md` and `state.md`.
-  `$rite-build` (the slice-wright) and `$rite-prove` **read `test-plan.md`** as the coverage
-  target; `$rite-review` and `$rite-seal` may consult `eng-review.md` for the failure-mode +
-  scope record.
-- Write `test-plan.md` and finish all fold-back edits and rechecks first. If this pass changed
-  `brief.md`, `spec.md`, `decisions.md`, `assumptions.md`, or `questions.md`, revalidate the
+- **Single canonical writer.** The skill writes review/test-plan and edits plan/tasks;
+  `devrites-plan-reviewer` is **read-only** and returns findings + bands.
+- **No silent scope.** Growing acceptance without a decision, or dropping a criterion
+  without the Guard, is a defect.
+- Put `eng-review.md` + `test-plan.md` between `tasks.md` and `state.md`. Build/Prove
+  read test-plan as coverage; Review/Seal may consult eng-review for scope/failures.
+- Finish `test-plan.md`, fold-back, and rechecks first. Changes to `brief.md`, `spec.md`,
+  `decisions.md`, `assumptions.md`, or `questions.md` require revalidating the
   affected decision-coverage rows, assumption audit, residual uncertainty, and closed gates.
   Partial/Missing, an unowned material assumption, or an open blocking/escalating question routes
-  `$rite-clarify`/HITL; never hide it with a new digest. Once re-closed, run
-  `devrites-engine readiness-digest coverage <slug>` and replace the complete
-  `Coverage inputs SHA-256` line in `decision-coverage.md`. Only then run
-  `devrites-engine readiness-digest engineering <slug>` and copy its complete
-  field line into `eng-review.md`. Write
-  `DevRites contract: devrites.readiness-artifacts.v2` exactly once in both artifacts
-  only after their current-contract review is complete. The build gate rejects a stale digest,
-  placeholders, non-passing preflight/readiness rows, empty tables, or an
-  acceptance criterion with no test mapping.
+  `$rite-clarify`/HITL. Re-read affected rows with current evidence; repeat the exact
+  plan-reviewer and applicable strategy/DevEx after edits. Root writes READY only after
+  the checklist. Normal readiness rejects missing/stale bindings; empty tables,
+  placeholders, non-passing preflight rows, or an
+  acceptance criterion with no meaningful test mapping remain native review blockers.
+  After the final recheck, emit the binding with `devrites-engine check readiness
+  --emit-binding <slug>` and replace its one exact line. Never refresh it without Vet.

package/pack/generated/codex/skills/rite-vet/reference/cross-model.md

@@ -1,43 +1,19 @@
-# `--cross-model`: the outside voice (a genuinely different model)
+# `--cross-model`: explicit outside integration
 
-`devrites-plan-reviewer` gives an *independent* read (fresh context, no authoring reasoning):
-but it's still the same model family. `--cross-model` adds a second opinion from a **different**
-AI system, because two models agreeing on a plan is stronger signal than one model reviewing it
-thoroughly. It is **opt-in** for `$rite-vet` (the flag) and **off by default in
-`$rite-autocomplete`** unless the flag was armed. It costs latency and a second runtime.
+This optional pass runs only when the user supplies `--cross-model` and a
+different-model plugin, MCP server, or other native integration is explicitly
+connected. DevRites does not discover aliases, invent a fallback model, or wrap
+availability.
 
-## When it runs
-Only when `$ARGUMENTS` contains `--cross-model` **and** a different-model reviewer is available.
-First run `devrites-engine reviewers list`; configured aliases there are preferred over ad-hoc
-model choices. The default path (no flag) relies on `devrites-plan-reviewer` for independence:
-that is a complete review on its own; cross-model is an enhancement, not a requirement.
+Give the integration the same immutable `spec.md`, `plan.md`, and `tasks.md`
+candidate, without author reasoning. Ask for evidence-backed findings on
+boundaries, scope/reuse, proof design, performance, reversibility, and failure
+modes. The integration must remain read-only.
 
-## Dispatch
-After the in-model reviewer loop converges (or in parallel with its final iteration), hand the
-**same fresh inputs** to a different model: preferentially a configured `codex` reviewer alias,
-then the `codex:codex-rescue` agent if no alias exists. Give it only the contract, never the
-authoring reasoning:
+If no explicit integration is connected, record `requested but not configured`
+and continue with the native `devrites-plan-reviewer`; absence is neither a pass
+nor a blocker.
 
-> Independent engineering review of a defined implementation plan, before any code.
-> Read only `.devrites/work/<slug>/plan.md`, `tasks.md`, and `spec.md`. Judge: architecture &
-> boundaries, scope discipline & reuse, test-coverage design, performance, reversibility, and
-> failure-mode coverage. For every finding, quote the line that motivates it and give a 1-10
-> confidence; suppress anything you can't quote. Return labeled findings (Critical / Important /
-> Suggestion) with a concrete fix. Do not edit anything. Do not approve: find what will cost a redo.
-
-If the agent / runtime is unavailable, **skip and say so** in `eng-review.md` ("cross-model:
-requested but unavailable, in-model review only"); do not block on it and do not silently treat
-the absence as a pass.
-
-## Integration rule (the important one)
-Cross-model findings are **informational until the human approves each one**: even when you
-agree with them, even when they overlap the in-model reviewer. Cross-model **consensus** is a
-strong signal: surface it as such ("both reviewers flagged SLICE-003's missing timeout test"), but
-the human still makes the call via `AskUserQuestion`. In AFK, the same gate ceiling applies:
-a cross-model finding that *hardens* the plan auto-applies and is recorded; one that *grows
-scope* or changes acceptance is a blocking pause.
-
-## Recording
-In `eng-review.md` §6, note: which model ran, the overlap with the in-model reviewer (consensus
-findings), and any **unique** findings the outside voice caught that the in-model pass missed:
-those are the highest-value output of running it at all.
+Verify every returned finding against the project before accepting it. Record
+only the integration used and accepted evidence in `eng-review.md`; do not
+maintain availability aliases or outside-review telemetry.

package/pack/generated/codex/skills/rite-vet/reference/depth.md

@@ -23,7 +23,7 @@ recorded engineering verdict and a coverage plan.
 - **The user asked**, or `--full`.
 
 Full pass = §0 scope challenge + all four axes (each walked finding-by-finding) + the failure-mode
-table + parallelization + the reviewer loop. See [`review-axes.md`](review-axes.md).
+table + dependency-safety review + the reviewer loop. See [`review-axes.md`](review-axes.md).
 
 ## Light pass otherwise (the default for simple plans: still never a skip)
 When none of the full-pass triggers fire, run the **light pass**: a fast but real engineering
@@ -44,7 +44,7 @@ with the human, confidence-banded). Light means *less ceremony*, never *less hon
 Autocomplete runs `$rite-vet` after `$rite-define` on **every** feature: light or full per the
 triggers above, **never skipped**. Under the AFK gate ceiling:
 - **Auto-apply (no pause):** hardening findings: added test requirements, error-handling /
-  failure-mode coverage, tightened scope, reuse-over-rebuild, dependency-order / parallel-lane fixes
+  failure-mode coverage, tightened scope, reuse-over-rebuild, dependency-order fixes
   (these never grow acceptance). Record the rationale in `decisions.md`.
 - **Blocking pause:** any finding that **grows scope, adds a slice, changes an acceptance
   criterion, or alters product behavior**.

package/pack/generated/codex/skills/rite-vet/reference/review-axes.md

@@ -155,12 +155,9 @@ Use `AskUserQuestion` per the pack's standard. Plan-review specifics:
    covers it, (b) error handling exists, (c) the user sees a clear error or a silent failure. A
    failure with **no test AND no handling AND silent** is a **Critical gap**. (Shape in
    [`artifacts.md`](artifacts.md).)
-4. **Worktree parallelization strategy:** analyze the slices for parallel execution. **Skip** if
-   all slices touch the same module or there are <2 independent workstreams ("Sequential, no
-   parallelization opportunity"). Otherwise: a dependency table (module-level, not file-level),
-   parallel lanes (shared module → same lane/sequential; independent → separate lanes), execution
-   order, and conflict flags where two lanes touch the same module dir. This feeds `$rite-build`'s
-   isolation strategy and the autocomplete loop. (Shape in [`artifacts.md`](artifacts.md).)
+4. **Dependency safety:** verify the declared dependency graph, required execution order,
+   and conflicts where slices touch the same module. Correct unsafe or missing ordering in the
+   plan; do not create a lane/scheduler artifact—the native host schedules eligible work.
 5. **Build-entry preflight:** commands/cwds, tools, package state, parser/browser smoke,
    prerequisites, and provenance ([`artifacts.md`](artifacts.md)).
 6. **Implementation readiness:** goal-backward coverage, wiring, dependency simulation,

package/pack/generated/codex/skills/rite-zoom-out/SKILL.md

@@ -4,28 +4,8 @@ description: User-invoked read-only structural map of unfamiliar code: modules,
 argument-hint: "[symbol | file | area to map]"
 user-invocable: true
 disable-model-invocation: true
-required-agent-roles: none
 ---
 
-## Codex compatibility
-
-This is the Codex mirror of a DevRites skill. In Codex:
-
-- Load DevRites engineering standards from `.agents/skills/devrites-lib/reference/standards/`. Read `.agents/skills/devrites-lib/reference/standards/core.md` before workflow work, then load the other `.agents/skills/devrites-lib/reference/standards/*.md` files exactly when this skill asks for them.
-- Installed `.agents/` mirrors may be Git-ignored. If a repository-aware file tool refuses an ignored path, read it with a native filesystem command instead; a tool refusal is not a completed task.
-- For automatic Engram calls, omit optional `project` and `session_id` unless an exact value came from Engram or repository configuration. Never derive either from `task_name`, a run ID, directory name, or normalized slug. Call `mem_session_summary` without them by default; on `unknown_session` or `unknown_project`, retry once with both optional fields omitted. If auto-detection is ambiguous, ask the user instead of guessing.
-- Use the installed `devrites-engine` binary as the canonical runtime helper surface for orientation, gates, and state mutation.
-- **Invocation and dispatch are different:** invoke means run a skill in this context; dispatch means start a fresh agent with `spawn_agent`, await it, and reconcile its result. Never describe inline skill work as a dispatch.
-- On MultiAgent V2, call `spawn_agent` with the exact named `agent_type=devrites-<role>`, a unique `task_name`, and `fork_turns="none"`. A missing visible `agent_type` field is still V2—not capability loss, V1, or HITL—so send it anyway. If the named call rejects it, stop before any generic/default spawn. Codex loads the role TOML's `developer_instructions` natively; DevRites verifies the durable rollout, wait, completion, and delivered result.
-- Only after the runtime explicitly identifies MultiAgent V1, use generic `explorer` for a read-only role with `fork_turns="none"` and name exactly one `.codex/agents/devrites-<role>.toml` contract in the message. Trusted `.codex/hooks.json` injects that contract's exact `developer_instructions` and binds the child to the fail-closed reviewer read-only guard.
-- On explicitly identified MultiAgent V1, `devrites-slice-wright` uses generic `worker` with `fork_turns="none"` and the exact role TOML named in the message. Trusted `.codex/hooks.json` binds it to the active reconcile window and `.wright-allowlist`.
-- The invoked skill's `required-agent-roles` frontmatter arms the fail-closed Stop receipt. Every listed role must have a confirmed start, wait, and non-empty result in this turn.
-- If the required dispatch for the explicitly identified runtime is unavailable or rejected, stop for HITL. Never switch runtime lanes. Never execute a DevRites specialist role in the root context.
-- Wait for every required fresh-context dispatch before reconciling or advancing. A backgrounded or lost result is incomplete.
-- Codex project hooks are installed in `.codex/hooks.json`; declared-leaf hooks are scoped inside `.codex/agents/devrites-*.toml`. Review and trust them with `/hooks` before relying on hook enforcement.
-- When this skill asks a HITL question via `AskUserQuestion`: Codex's equivalent (`request_user_input`) exists only in Plan mode. Outside Plan mode, render the option set as a plain numbered list in chat and **end the turn** so the human answers: NEVER silently pick an option yourself; auto-picking is AFK's contract, gated by the `.devrites/AFK` sentinel.
-
-
 # $rite-zoom-out: step up one abstraction layer
 
 When the agent (or the user) is staring at unfamiliar code without a working mental
@@ -77,11 +57,6 @@ end; don't try to fix it here.
 - You want a project-wide architecture audit: use the project's normal architecture
   review process; this skill is a read-only feature-area map.
 
-## Output shape
-Reply-contract exception: read-only mapping utility. It skips `devrites-engine progress` when
-there is no active workspace, but follows
-[`devrites-lib/reference/reply-contract.md`](../devrites-lib/reference/reply-contract.md).
-
 ```
 Done: mapped <area> in the project's vocabulary.
 Changed: workspace only

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "devrites",
-  "version": "3.2.28",
+  "version": "4.0.0",
   "description": "DevRites: a disciplined senior-engineer workflow pack for Claude Code and Codex",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://github.com/ViktorsBaikers/DevRites#readme",
@@ -30,11 +30,12 @@
   "files": [
     "bin/",
     "engine/",
+    "!engine/devrites-engine",
+    "!engine/devrites-engine.exe",
     "pack/",
-    "scripts/",
-    "!scripts/__pycache__/",
-    "!scripts/*.pyc",
-    "!scripts/.cache/",
+    "scripts/build-host-artifacts.sh",
+    "scripts/codex-generate.sh",
+    "scripts/install-lib.sh",
     "install.sh",
     "uninstall.sh",
     "update.sh",

package/scripts/build-host-artifacts.sh

@@ -36,16 +36,12 @@ render_codex_skill_tree() {
     mkdir -p "$(dirname "$_out")"
     case "$_r" in
       SKILL.md)
-        _internal=0
         _implicit_disabled=0
-        if awk 'NR==1&&$0=="---"{fm=1;next} fm&&$0=="---"{exit} fm&&/^user-invocable:[[:space:]]*false/{u=1} END{exit !u}' "$f"; then
-          _internal=1
-        fi
         if awk 'NR==1&&$0=="---"{fm=1;next} fm&&$0=="---"{exit} fm&&/^disable-model-invocation:[[:space:]]*true/{u=1} END{exit !u}' "$f"; then
           _implicit_disabled=1
         fi
-        gen_codex_skill_file "$f" "$_out" "$_internal"
-        if [ "$_internal" -eq 1 ] || [ "$_implicit_disabled" -eq 1 ]; then
+        gen_codex_skill_file "$f" "$_out"
+        if [ "$_implicit_disabled" -eq 1 ]; then
           mkdir -p "$_dest/agents"
           printf 'policy:\n  allow_implicit_invocation: false\n' > "$_dest/agents/openai.yaml"
         fi
@@ -82,7 +78,7 @@ while IFS= read -r f; do
 done < <(find "$PACK_SRC/agents" -maxdepth 1 -type f -name '*.md')
 
 gen_codex_agents_bridge "$OUT_ROOT/codex/AGENTS.md"
-gen_codex_hooks_json "$OUT_ROOT/codex/hooks.json"
+gen_codex_config_toml "$OUT_ROOT/codex/config.toml"
 
 cat > "$OUT_ROOT/README.md" <<'EOF'
 # Generated DevRites Host Artifacts
@@ -90,8 +86,8 @@ cat > "$OUT_ROOT/README.md" <<'EOF'
 This directory is generated by `scripts/build-host-artifacts.sh`.
 
 - `claude/` contains Claude Code-native skills, agents, and settings.
-- `codex/` contains Codex-native skill mirrors, custom-agent TOML, hook
-  blocks, and AGENTS bridge content.
+- `codex/` contains Codex-native skill mirrors, custom-agent TOML, the
+  read-only-root permission profile, and AGENTS bridge content.
 
 Do not edit these files by hand. Edit `pack/.claude/` or
 `scripts/codex-generate.sh`, then rebuild.