nobrainer-tech-flow 2.4.1 → 2.5.0

package/skills/nobrainer-tech-flow/references/routing.md

@@ -9,7 +9,7 @@ trigger applies.
 | Need | Primary method |
 |---|---|
 | lifecycle, brief requirements, visible progress and guarded autonomy | `nobrainer-tech-flow` |
-| project-local Codex instruction discovery, byte-budget audit and context readback | `nobrainer-codex-context` |
+| one project's instruction files across coding agents: what loads, size, duplicates, contradictions, one source of truth | `nobrainer-context` |
 | cross-project instruction, skill and task-prompt audit with coverage planning | `nobrainer-skill-doctor` |
 | capability selection, bounded native assignments or open-skill evaluation | `nobrainer-team` |
 | ready-set calculation, dependency batches, bounded dispatch and backpressure | `nobrainer-dispatcher` |

package/skills/nobrainer-tech-flow/scripts/typed_decisions.py

@@ -1,6 +1,7 @@
 #!/usr/bin/env python3
 """Bounded advisory typed decisions; never executes selected actions."""
 import argparse
+import functools
 import json
 import math
 import os
@@ -81,9 +82,8 @@ class NoRedirect(urllib.request.HTTPRedirectHandler):
         raise ValueError("redirect_not_allowed")
 
 
-def worker(provider, model, request):
+def worker(provider, model, request, key=None):
     if provider == "jev":
-        key = os.environ.get("TYPESAFE_API_KEY")
         if not key:
             return {"error": "MISSING_TYPESAFE_API_KEY"}
         payload = json.dumps(dict(request, model=model)).encode()
@@ -123,13 +123,19 @@ def worker(provider, model, request):
     return result
 
 
-def invoke(provider, model, request, timeout):
+def invoke(provider, model, request, timeout, key_env=None):
+    # The child gets no credential from the environment. The TypeSafe key is read only
+    # from the variable the caller names with --key-env, and passed on stdin.
     env = {k: v for k, v in os.environ.items()
            if not any(part in k.upper() for part in ("KEY", "TOKEN", "SECRET", "PASSWORD", "CREDENTIAL"))}
-    if provider == "jev" and os.environ.get("TYPESAFE_API_KEY"):
-        env["TYPESAFE_API_KEY"] = os.environ["TYPESAFE_API_KEY"]
+    if key_env:
+        # The named variable may not look like a credential (TYPESAFE_AUTH, FOO); drop it anyway.
+        # Windows treats variable names without regard to case.
+        for name in [k for k in env if k == key_env or (os.name == "nt" and k.upper() == key_env.upper())]:
+            del env[name]
+    key = os.environ.get(key_env) if provider == "jev" and key_env else None
     process = subprocess.run([sys.executable, str(Path(__file__).resolve()), "--worker", provider, model],
-                             input=json.dumps(request), capture_output=True, text=True,
+                             input=json.dumps({"request": request, "key": key}), capture_output=True, text=True,
                              timeout=timeout, env=env)
     if process.returncode:
         raise ValueError("provider_failed")
@@ -182,9 +188,11 @@ def main():
             # Third-party stdout may contain progress or input; contain it.
             import contextlib
             import io
-            request = validate_request(json.load(sys.stdin))
+            payload = json.load(sys.stdin)
+            request = validate_request(payload["request"])
+            key = payload.get("key") if isinstance(payload.get("key"), str) else None
             with contextlib.redirect_stdout(io.StringIO()), contextlib.redirect_stderr(io.StringIO()):
-                result = worker(sys.argv[2], sys.argv[3], request)
+                result = worker(sys.argv[2], sys.argv[3], request, key)
             print(json.dumps(result))
             return 0
         except Exception:
@@ -194,12 +202,15 @@ def main():
     parser.add_argument("--config", type=Path, default=Path(".nobrainer/flow.json"))
     parser.add_argument("--request", type=Path, help="JSON array of requests; otherwise stdin")
     parser.add_argument("--approved-data", action="store_true", help="Only with existing approval for this data and provider")
+    parser.add_argument("--key-env", metavar="NAME",
+                        help="Jev only: the environment variable that holds your TypeSafe key; nothing is read without it")
     args = parser.parse_args()
     try:
         data = json.loads(args.request.read_text()) if args.request else json.load(sys.stdin)
         if not isinstance(data, list) or len(data) > 100:
             raise ValueError("batch")
-        print(json.dumps(evaluate(data, read(args.config), args.approved_data), ensure_ascii=False))
+        call = functools.partial(invoke, key_env=args.key_env)
+        print(json.dumps(evaluate(data, read(args.config), args.approved_data, call), ensure_ascii=False))
         return 0
     except (OSError, ValueError, TypeError):
         print(json.dumps({"status": "CORE_FALLBACK", "reason": "INVALID_INPUT"}))

package/skills/nobrainer-codex-context/SKILL.md

@@ -1,111 +0,0 @@
----
-name: nobrainer-codex-context
-description: "Use when setting up, auditing or repairing one project's Codex context; use nb-codex-context to inspect AGENTS files, configured fallbacks and byte limits, then make one evidence-backed project-local context change without changing global Codex configuration by default."
----
-
-# NoBrainer Codex Context
-
-Prepare the smallest useful project context for Codex. This skill owns the
-project-instruction boundary that Codex reads before a turn; it does not own
-model selection, subagent topology, session transfer, or the whole delivery
-workflow.
-
-## Select a mode
-
-- `inspect` - read the current project root, instruction candidates, configured
-  fallbacks, byte cap and effective document set. Do not write.
-- `setup` - inspect first, reconcile the existing instruction files, and add or
-  update one marked project-local context block only when it improves the
-  actual repository. Run the inspection again after the edit.
-- `repair` - fix a known context defect such as duplicate managed markers,
-  stale generated content or a truncation-risk block. Do not rewrite unrelated
-  instructions.
-
-Use `inspect` for a question. Use `setup` only when the owner asks to prepare
-the project or the project has a demonstrated context gap. A clean result is
-`CURRENT`; absence, truncation or an unknown runtime is evidence to report, not
-permission to invent a fix.
-
-## Codex context contract
-
-Codex's effective project instructions are assembled from the nearest project
-root through the current directory. The normal candidates are
-`AGENTS.override.md` and `AGENTS.md`; configured fallback names are considered
-after them. The configured project-document byte budget applies to the loaded
-instruction set and defaults to the host's documented value when no override is
-read.
-
-Run the bundled read-only probe with Python 3.11+ before deciding what to change.
-Run it from the project, replacing `<context-skill-dir>` with this skill's
-directory wherever it is installed; the probe inspects the current directory,
-or the one given with `--cwd`:
-
-```bash
-python3 <context-skill-dir>/scripts/codex_context.py --check --json
-```
-
-The probe is an inventory and truncation check; its exit status does not prove
-that a live Codex client followed the instructions.
-
-When a project needs a durable NoBrainer context block, preserve all existing
-bytes and use exactly these markers in the applicable `AGENTS.md`:
-
-```markdown
-<!-- NOBRAINER-CODEX-CONTEXT:START -->
-## Project context
-
-- Source of truth: `<verified project files>`.
-- First checks: `<verified commands or tests>`.
-- Keep this block compact; link to deeper project docs instead of copying them.
-<!-- NOBRAINER-CODEX-CONTEXT:END -->
-```
-
-Replace the placeholders only with facts read from the current project. Do not
-put credentials, private machine paths, mutable runtime state, guessed commands
-or model names in the block. If an existing managed block is present, update it
-in place; do not create a second one. If an `AGENTS.md` is absent, create it
-only when setup is explicitly requested and the project has enough inspected
-source facts to make the block useful.
-
-Do not create a `CODEX_CONTEXT.md` file and call it automatically loaded. Codex
-will only use an alternate filename when the host's `project_doc_fallback_filenames`
-configuration actually includes it; changing that global configuration is an
-owner-gated action outside this skill's default setup.
-
-## Safe setup boundaries
-
-- Keep `AGENTS.override.md` precedence and client-managed blocks intact.
-- Never replace a whole `AGENTS.md` because it is long, old or from another
-  client. Reduce duplication only when the exact duplicate and its owner are
-  clear.
-- Do not edit `~/.codex/config.toml`, credentials, plugin installation or
-  client settings unless the owner explicitly requests that separate action.
-- Do not claim `RUNTIME_VERIFIED` from a file read, probe exit code or installed
-  skill. If `codex debug prompt-input` or `codex debug agents-md` is available,
-  use it for a fresh readback; otherwise report `RUNTIME_READBACK: UNKNOWN`.
-- Keep the context block below the project's own required instructions when the
-  file's structure makes that safer. Follow the nearest `AGENTS.md` rules.
-
-## Closeout
-
-Return a compact readback:
-
-```text
-CODEX_CONTEXT: CURRENT | UPDATED | BLOCKED
-PROJECT_ROOT: <path or UNKNOWN>
-DOCUMENTS: <ordered discovered files>
-FALLBACKS: <configured names or NONE>
-BYTE_BUDGET: <observed value or UNKNOWN>
-LOADED_BYTES: <observed value or UNKNOWN>
-TRUNCATED: YES | NO | UNKNOWN
-PROJECT_WRITE: NONE | AGENTS_BLOCK_UPDATED | AGENTS_CREATED
-RUNTIME_READBACK: VERIFIED | UNKNOWN | UNSUPPORTED
-OWNER_ACTION_REQUIRED: <one exact action or NONE>
-ROLLBACK: <exact preimage or NOT_APPLICABLE>
-```
-
-Route portfolio-wide semantic instruction or skill audits to
-`nobrainer-skill-doctor`; keep one-project Codex context setup and repair here.
-Route broader setup, installation or delivery work back to `nobrainer-tech-flow`.
-Use `nobrainer-sessions` for context transfer and `nobrainer-review` for a
-release or adversarial closeout; do not duplicate their contracts here.