feat: expand skills and harden runtime recovery - #27
Conversation
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Team Run ID: Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
This PR has 32,100 reviewable changed lines after ignored/generated files are excluded, above this repository's 10,000-changed-line automatic review limit. The raw diff is 51,949 lines before ignored/generated files are excluded. Most of the diff comes from:
Comment |
|
@codex review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
@coderabbitai review |
|
|
@cubic-dev-ai review this |
@boh5 I have started the AI code review. It will take a few minutes to complete. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 670aeb127b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
40 issues found across 318 files
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name=".codex/skills/ad-creative/assets/creative-review-template.html">
<violation number="1" location=".codex/skills/ad-creative/assets/creative-review-template.html:14">
P1: When generated copy contains `</script>`, this instruction leaves the close tag in `#review-data`, allowing the browser to execute injected markup after the data block. Tell generators to encode `<` as `\u003c` before embedding JSON.</violation>
</file>
<file name=".codex/skills/marketing-loops/references/loop-orchestration.md">
<violation number="1" location=".codex/skills/marketing-loops/references/loop-orchestration.md:39">
P1: Before Stage 1 or Stage 2 loops run, the rollout omits `analytics-anomaly` even though this section declares it foundational. This leaves revenue, spend, and tracking regressions without the daily safety-net while other loops are already acting; move `analytics-anomaly` into Stage 0 and remove it from Stage 3.</violation>
</file>
<file name="apps/web/src/components/features/ProjectTodoNavigator.tsx">
<violation number="1" location="apps/web/src/components/features/ProjectTodoNavigator.tsx:120">
P2: When the runtime, session inventory, or related dependency is loading or fails, the Running section disappears instead of showing recovery guidance. Render the group for non-ready states and pass its actual state plus the existing retry props.</violation>
</file>
<file name="apps/web/src/routes/project-todo-presentation.ts">
<violation number="1" location="apps/web/src/routes/project-todo-presentation.ts:133">
P2: When a Todo H1 ends with `#` without a separating space, `projectTodoDisplayLead` drops that character from the displayed title. Require whitespace before an optional closing hash sequence so titles such as `# C#` remain `C#`.</violation>
</file>
<file name=".codex/skills/customer-research/references/interviews-and-surveys.md">
<violation number="1" location=".codex/skills/customer-research/references/interviews-and-surveys.md:8">
P2: Broken relative link: from inside references/, `references/source-guides.md` resolves to references/references/source-guides.md, which doesn't exist. Use `source-guides.md` (lines 8, 36, 154). The model reading this Skill won't be able to load the source guide it's told to follow.</violation>
<violation number="2" location=".codex/skills/customer-research/references/interviews-and-surveys.md:153">
P2: Broken relative link: `SKILL.md` from inside references/ points to references/SKILL.md, which doesn't exist. Use `../SKILL.md` so the mode-1 extraction framework it points to is reachable.</violation>
</file>
<file name=".codex/skills/analytics/references/event-library.md">
<violation number="1" location=".codex/skills/analytics/references/event-library.md:43">
P2: The same event names appear in multiple sections with conflicting property schemas: `signup_completed`, `trial_started`, `checkout_started`, and `purchase_completed` each have two different property sets (e.g. `signup_completed`: `method, plan, source` vs `method, referral_source`). SKILL.md documents `signup_completed` with yet another set (`method, source`). Since this file is the canonical event reference and the skill itself stresses consistent naming, unify each event to one schema so generated tracking plans are internally consistent.</violation>
<violation number="2" location=".codex/skills/analytics/references/event-library.md:241">
P2: The Signup Funnel references `signup_step_completed`, but no table in this file defines that event; the Onboarding section only defines `onboarding_step_completed`. As the canonical event reference, this dangling name will lead the agent/user to emit an undefined event. Add a `signup_step_completed` definition (matching the onboarding pattern) or align the funnel to the defined events.</violation>
</file>
<file name=".codex/skills/ai-seo/references/platform-ranking-factors.md">
<violation number="1" location=".codex/skills/ai-seo/references/platform-ranking-factors.md:51">
P2: The ChatGPT section presents Reddit at 1.8% of ChatGPT citations as a stable current fact, but the rest of this skill documents the opposite: agent-readiness.md states ChatGPT's Aug 2026 retrieval changes "nearly wiped Reddit as a citation source" and that the "Reddit = 1.8%" figure is a dated snapshot, SKILL.md repeats the same note, and evals.json requires surfacing this volatility. An agent loading this reference in isolation would advise a user to bet on Reddit for ChatGPT citations, contradicting the skill's canonical guidance. Add the volatility caveat here, consistent with the other references.</violation>
</file>
<file name=".codex/skills/ads/references/meta-decision-system.md">
<violation number="1" location=".codex/skills/ads/references/meta-decision-system.md:39">
P2: The ad-count ceiling says each ad needs only 2× TCPL "to be judged," but Stage 2's Data gate requires 3× TCPL and calls 2× a 13% false-negative rate. At the ceiling's 2×-per-14-days allocation an ad can never reach the 3× TCPL gate within the 14-day evaluation window, so a reader following both rules gets contradictory spend requirements. Reconcile the two: keep 2× as the budget-allocation floor and state that quality judgment happens at the 3× TCPL gate (≈21 days at ceiling allocation).</violation>
</file>
<file name=".codex/skills/churn-prevention/references/dunning-playbook.md">
<violation number="1" location=".codex/skills/churn-prevention/references/dunning-playbook.md:87">
P2: Pre-billing notification timing contradicts the skill's own spec. This playbook says "Email 7 days before renewal" (line 87), but churn-prevention/SKILL.md:278 specifies "Email 3-5 days before charge for annual plans." Since this file is the authoritative reference that SKILL.md points to, the two numbers should agree so the agent schedules the same pre-billing email regardless of which doc it reads.</violation>
<violation number="2" location=".codex/skills/churn-prevention/references/dunning-playbook.md:243">
P2: The grace-period schedule is internally contradictory. The Dunning Timeline (line 25) ends the grace period at Day 10-14 and Email 4 (line 220) says the account "will be paused tomorrow" after the final retry at Day 7-10 (line 124), yet this Grace Period table recommends a 7-14 day grace "after final retry." If the final retry is at Day 10, a 7-14 day grace means pausing at Day 17-24, not "tomorrow"/Day 10-14. An agent implementing dunning from this playbook cannot determine when to pause, so align one set of numbers with the other.</violation>
</file>
<file name=".codex/skills/directory-submissions/SKILL.md">
<violation number="1" location=".codex/skills/directory-submissions/SKILL.md:131">
P2: The dofollow verification command cannot work. `curl -sIL` uses `-I`, a HEAD request that returns only response headers, so `grep -i rel=` never sees the HTML `<a rel=...>` attribute and always prints nothing — which the step then interprets as the link being dofollow. The check also fetches the listing page, not a page containing the backlink to the user's site, so it verifies neither backlink existence nor dofollow status. Use a GET request and test for the absence of `nofollow` instead, e.g. `curl -sL https://directory.com/your-listing | grep -i 'rel="nofollow"'` and treat dofollow as true only when that match is absent.</violation>
</file>
<file name=".codex/skills/marketing-plan/references/ops-stack-mapping.md">
<violation number="1" location=".codex/skills/marketing-plan/references/ops-stack-mapping.md:32">
P2: This doc is the source for Section 11 of every plan, but four skills it lists as part of the toolkit do not exist in this repo: `typefully`, `marketing-website-design`, `copycraft`, and `website-copy` (no matching directory under `.codex/skills/`, no references anywhere else). The model will emit plans referencing these non-existent skills, and the note's 'fall back when a skill isn't available' only covers optional adjacent-marketplace tools, not core toolkit entries. Either add the skills or remove/replace them with the real ones (e.g., `social`, `design`, `copywriting`/`copy-editing`).</violation>
</file>
<file name=".codex/skills/marketing-loops/SKILL.md">
<violation number="1" location=".codex/skills/marketing-loops/SKILL.md:84">
P2: The skill tells the agent the catalog holds "43 marketing loops," but `references/loop-catalog.md` actually defines 45 loops (45 `### The … loop` headings). The agent will repeat the wrong count to the user whenever it references the catalog size. Update the number to 45 in both places ("43 marketing loops" and "don't build 43 at once"), or recount and correct to the actual figure.</violation>
</file>
<file name=".codex/skills/ad-creative/references/hook-system.md">
<violation number="1" location=".codex/skills/ad-creative/references/hook-system.md:104">
P2: This references the **scraping** skill, but no skill named `scraping` exists anywhere in `.codex/skills/`, so an agent following this guidance will hunt for a tool that isn't present. Use the available `social` listening tooling instead (or `competitor-profiling`) and drop the `scraping` mention.</violation>
</file>
<file name=".codex/skills/marketing-plan/references/idea-cross-reference.md">
<violation number="1" location=".codex/skills/marketing-plan/references/idea-cross-reference.md:9">
P2: The counts don't match the tables. The tables sum to 143 rows (139 unique, only #79/#91/#114/#117 duplicated), but the header claims 144 entries and five cross-cut ideas. #134 is annotated '(cross-cuts Referral)' in the Retention table yet is missing from the Referral table, and #86 is listed among the cross-cutting five without being duplicated anywhere. Add a #134 Certifications row to the Referral table (making Referral 6 entries and the total 144, matching the header) or correct the header numbers and cross-cut list.</violation>
</file>
<file name=".codex/skills/analytics/references/gtm-implementation.md">
<violation number="1" location=".codex/skills/analytics/references/gtm-implementation.md:129">
P2: The data layer examples in this reference use camelCase property names (formName, formLocation, ctaText, ctaLocation) that diverge from the skill's canonical schema defined in event-library.md (form_name, form_location, button_text, cta_location) and in SKILL.md's data layer pattern. The FB pixel event at line 253 even references {{DL - form_name}} while the form example pushes 'formName', so an implementer copying these examples creates GTM data layer variables that never populate and tracking that doesn't match the skill's event library. Use the snake_case names from event-library.md for all data layer pushes here.</violation>
</file>
<file name=".codex/skills/attribution/SKILL.md">
<violation number="1" location=".codex/skills/attribution/SKILL.md:26">
P2: The reference `references/conversion-tracking.md` is broken: that file lives in the ads skill (`ads/references/conversion-tracking.md`), not in this skill's references directory. A model that resolves the relative path from this skill fails to find it. Point to the ads skill explicitly with `../ads/references/conversion-tracking.md` in both the Boundaries section (line 26) and the Related Skills section (line 221).</violation>
</file>
<file name=".codex/skills/marketing-plan/references/example-quietude.md">
<violation number="1" location=".codex/skills/marketing-plan/references/example-quietude.md:681">
P2: Section 12.1 states '88 mapped' / '88 ideas applicable to Acquisition', but the table below it lists 120 idea rows, and the canonical idea-cross-reference.md counts 116 Acquisition entries. Since this is the canonical reference example the skill uses to teach Section 12 cross-referencing, the miscount will propagate into generated client plans. Update the header and the summary line to 120 (matching this table), and re-check the other stage counts against the table rows.</violation>
</file>
<file name=".codex/skills/ab-testing/references/sample-size-guide.md">
<violation number="1" location=".codex/skills/ab-testing/references/sample-size-guide.md:46">
P2: The "Sample per Variant" values in the Quick Reference Tables are roughly 2.3x too high. Every entry overstates the standard two-proportion z-test sample size (95% two-sided significance, 80% power): e.g. 1%→1.05% is listed at 1,500,000 per variant but the standard formula gives ~636,000; 5%→5.5% is listed at 72,000 vs ~31,000; 10%→11% at 34,000 vs ~14,700. The overstatement is systematic (all 25 rows cluster ~2.1–2.5x), which points to a calculation error rather than rounding or a deliberately conservative choice. Since this Skill is read by the model to advise real test planning, the inflated numbers would lead users to commit to roughly double the required traffic/duration or abandon feasible tests. Recompute the tables against a standard calculator (e.g. Evan Miller) or cite the source method so the figures are defensible.</violation>
</file>
<file name=".codex/skills/copywriting/references/copy-frameworks.md">
<violation number="1" location=".codex/skills/copywriting/references/copy-frameworks.md:424">
P2: This section states specific conversion metrics (+81%, −38% sales cycle, −28% CAC, +175% referrals) and a SavvyCal "roughly tripled (3×)" figure as fact with no source and no practitioner-reported caveat. These reference files feed an LLM that writes customer-facing copy, and this skill's own SKILL.md forbids fabricating stats/testimonials (legal liability), so an uncited figure risks being reproduced verbatim into a client's copy. Follow the codebase convention used in ads/references/payback-period.md and attribute the source and/or mark the numbers as practitioner-reported to be recalibrated per-client.</violation>
</file>
<file name=".codex/skills/social/references/post-templates.md">
<violation number="1" location=".codex/skills/social/references/post-templates.md:49">
P2: In the List Post template the first placeholder bracket is never closed: `[X things I learned about [topic] after [credibility builder]:`. Every other placeholder in this file is a matched `[placeholder]` pair. An unclosed bracket in a template an agent fills in can make it treat the rest of the line/block as placeholder text and produce a garbled post. Close the bracket around the countable element, e.g. `[X things] I learned about [topic] after [credibility builder]:`.</violation>
</file>
<file name=".codex/skills/directory-submissions/references/positioning-variations.md">
<violation number="1" location=".codex/skills/directory-submissions/references/positioning-variations.md:5">
P2: The intro lists only five placeholders ([product], [category], [competitors], [use-case], [audience]), but the templates below use dozens of others ([outcome], [differentiator], [pain point], [friction], [timeframe], [url], [competitor 1..3], [metric], [percentage], etc.). An agent following the intro literally will leave most brackets unfilled in the generated copy, producing broken descriptions. Restate the intro so it covers all bracketed tokens (e.g. "replace every bracketed [token] with a real value") rather than enumerating only five.</violation>
</file>
<file name=".codex/skills/ads/references/audience-targeting.md">
<violation number="1" location=".codex/skills/ads/references/audience-targeting.md:164">
P2: The ABM minimum here (300 companies) contradicts the sibling reference abm-playbook.md, which recommends ~1,000 companies (5–10K optimal) for account-list audiences. The '300' appears to conflate LinkedIn's '300 matched members minimum to serve' (a member count, not a company count). Since both docs live in the same Skill and are pulled interchangeably, the model will return conflicting guidance on how large an ABM list must be. Align this figure with abm-playbook.md or explain the distinction.</violation>
</file>
<file name=".codex/skills/marketing-plan/references/funding-stage-unlocks.md">
<violation number="1" location=".codex/skills/marketing-plan/references/funding-stage-unlocks.md:214">
P2: The tier-gating example contradicts the canonical Tier 2 range defined earlier in this same doc. Tier 2 (Seed close) lists paid acquisition at $5–15K/mo and the B2B SaaS adjustment says signal is possible at $3–5K/mo, but the founder-facing script on this line asserts a Tier 2 move 'requires $10K+/mo paid budget.' A model applying this skill would gate $5–10K/mo moves as needing a future tier, producing inconsistent guidance. Align the figure with the Tier 2 range, e.g. 'requires $5–15K/mo paid budget'.</violation>
</file>
<file name=".codex/skills/marketing-plan/references/plan-template.md">
<violation number="1" location=".codex/skills/marketing-plan/references/plan-template.md:194">
P2: Section 5's Skills + tools list references a `marketing-website-design` skill that does not exist anywhere in `.codex/skills/`. A model generating a plan from this template will attempt to load a non-existent skill. Point the reader at an existing skill (`design` or `marketing-website-design` doesn't exist) or remove the reference, so the template's own cross-reference accuracy check (SKILL.md Phase 2) can pass.</violation>
</file>
<file name="design-system/prototypes/todos.html">
<violation number="1" location="design-system/prototypes/todos.html:35">
P2: The new Running nav section lists "Export a Todo with its complete run history" as live, but the same page stages that Todo in Ideas (neutral orbit, no running Session) and the design contract (design-system/pages/todos.md:25-31) allows a Running row only for a Todo whose linked root Session family activity is running/resuming/stopping. A discussion-new sample is a Discussion, not a running Session family, so this row violates both the contract and the page's own canvas. Replace it with a Todo that actually has a running Session, or drop the row and correct the section count.</violation>
</file>
<file name=".codex/skills/aso/references/scoring-criteria.md">
<violation number="1" location=".codex/skills/aso/references/scoring-criteria.md:106">
P2: The top Visual Assets score (9-10) requires 8-10 screenshots and the check calls 8-10 ideal, but the package's own references contradict this: Google Play caps screenshots at 8 per device, so 9-10 is unachievable there, and benchmarks.md states the optimal count is 4-5 (utility) / 5-6 (complex) with more than 6 causing diminishing returns. The guide would mis-score every Google Play listing's best case and steer challengers toward asset counts the package's own data says hurt conversion. Make the top score reachable on both stores (e.g., 6-8 on Play, 8-10 on Apple) and align the ideal count with the benchmark.</violation>
</file>
<file name=".codex/skills/content-strategy/SKILL.md">
<violation number="1" location=".codex/skills/content-strategy/SKILL.md:337">
P3: The worked scoring example shows Topic A with a Total of 8.0, but the weighted sum is 7.9 (8×0.4 + 9×0.3 + 7×0.2 + 6×0.1). The model treats this template as the reference for the 40/30/20/10 framework, so a wrong total in the only worked example propagates the error. Change the Total to 7.9.</violation>
</file>
<file name=".codex/skills/pricing/references/pricing-models.md">
<violation number="1" location=".codex/skills/pricing/references/pricing-models.md:62">
P2: Josh Pigford is not associated with SpyFu — he is the founder/CEO of Baremetrics (subscription analytics). Since this reference is what the pricing Skill's agent cites in generated marketing copy, the misattribution would be propagated verbatim. Correct the company to Baremetrics, or drop the company qualifier.</violation>
</file>
<file name=".codex/skills/cold-email/references/benchmarks.md">
<violation number="1" location=".codex/skills/cold-email/references/benchmarks.md:16">
P2: The funnel model converts 25 replies into 8 positive replies (30%), but the Core Performance Metrics table in this same file lists the average positive reply % as ~48% (and its open rate of 20% is below the table's 27.7% average). Because this reference is fed to a model that generates campaign forecasts, the contradictory numbers yield inconsistent guidance. Reconcile the funnel's rates with the table or annotate the funnel as deliberately conservative so a reader knows the 30%/20% figures are not the document's benchmarks.</violation>
</file>
<file name=".codex/skills/marketing-plan/references/growth-patterns.md">
<violation number="1" location=".codex/skills/marketing-plan/references/growth-patterns.md:177">
P2: This doc's phase list for Section 3 ($0–10K / $10K–100K / $100K–1M / $1M+) contradicts the canonical plan template, which names five phases ($0–10K / $10K–100K / $100K–1M / $1M–$10M / $10M+) and explicitly defers phase naming to this file. The doc's own Phase 3 section also stops at $1M, so companies above $1M get no distinct binding-constraint guidance. Align the phase taxonomy here with the template's five buckets so a model following both produces a consistent plan.</violation>
</file>
<file name=".codex/skills/attribution/references/first-party-tracking.md">
<violation number="1" location=".codex/skills/attribution/references/first-party-tracking.md:69">
P2: The `decorate` example rewrites `anchor.href` in place, so the anonymous `metadata[ph_distinct_id]` token persists on the element after the first click. On a later click after `identify()`, `getPostHogDistinctId()` returns `null` (the now-identified email fails `isAnonymousDistinctId`), so `decorate` early-returns without clearing the stale token — the param still ships to SavvyCal. This contradicts the runbook's own Verification checklist ("posthog.identify('test@x.com') → click again → the param must NOT appear") and weakens the fail-closed guarantee the file stresses. Always rewrite the token on every click so the branch that fails closed also removes a previously-injected id, or decorate without permanently mutating the href.</violation>
</file>
<file name=".codex/skills/referrals/references/affiliate-programs.md">
<violation number="1" location=".codex/skills/referrals/references/affiliate-programs.md:122">
P3: The relative link `../../../tools/integrations/introw.md` is broken. From `.codex/skills/referrals/references/`, `../../../` resolves to `.codex/`, so the target is `.codex/tools/integrations/introw.md`, which does not exist in the repo (the only `integrations` directory is `packages/agent-core/src/integrations`, and there is no `tools/` tree under `.codex/`). A Skill agent following this guide will hit a dead reference.</violation>
</file>
<file name=".codex/skills/marketing-psychology/SKILL.md">
<violation number="1" location=".codex/skills/marketing-psychology/SKILL.md:454">
P3: The Related Skills entry `pricing-page optimization` does not correspond to any skill in this repo (no `.codex/skills/pricing-page-optimization` exists). This skill exists to route the model to the right tool, and the frontmatter already points pricing work at `pricing`, so a router/model following this line would reference a non-existent skill. Rename the entry to `pricing` to match the actual skill.</violation>
</file>
<file name=".codex/skills/aso/references/report-template.md">
<violation number="1" location=".codex/skills/aso/references/report-template.md:34">
P3: Every dimension rubric in scoring-criteria.md allows a score of 0 ('Cannot assess'), but this grade scale maps only 1-10, leaving 0 with no defined grade. Extend the scale so an unassessable dimension isn't left ungraded in reports.</violation>
</file>
<file name=".codex/skills/marketing-plan/references/current-state-rubric.md">
<violation number="1" location=".codex/skills/marketing-plan/references/current-state-rubric.md:238">
P3: In the "Strong recent revenue, weak compounding" shape, "Referral mechanics" is listed as a Low section, but it is not one of the 17 scored rubric sections — every other item in every common shape is a rubric section with a (#N) reference. A model following this rubric would have no referral score to source that shape from, producing a shape interpretation inconsistent with the 17-row table it is told to derive it from. Drop it, or mark it explicitly as unscored (e.g. assess referral separately in the plan's Referral section).</violation>
</file>
<file name=".codex/skills/ads/evals/evals.json">
<violation number="1" location=".codex/skills/ads/evals/evals.json:90">
P2: Evals 7, 10, and 11 omit the `files` field that every other eval in this file and in every other skill evals file in the repo includes. If the eval harness validates a uniform schema, these three cases could fail to load. Add `"files": []` to evals 7, 10, and 11 for consistency.</violation>
</file>
<file name=".codex/skills/copywriting/SKILL.md">
<violation number="1" location=".codex/skills/copywriting/SKILL.md:44">
P2: This line presents specific quantitative claims (+81% conversions, 38% shorter sales cycle, 28% lower CAC, 175% more referrals) as established fact without any source, in a skill whose own principles forbid 'Fabricated statistics or testimonials [that] erode trust and create legal liability.' The model will relay these unverifiable numbers to the user as authoritative. Either cite the source study behind the figures or soften them to qualitative guidance so the skill does not instruct the model to repeat unsourced metrics.</violation>
</file>
Note: This PR contains a large number of files. cubic selects up to 200 of the highest-priority eligible files for this review, so some files may not have been reviewed.
Re-trigger cubic
Review triage and ownership decisionAll 42 original review threads were checked against the implementation and the approved product contracts. Findings are hypotheses, not instructions to change correct behavior.
The capacity fix is deliberately limited to 32 Session Todos, 24 KiB serialized Todo JSON, 64 unique direct children, and a non-blank child title of at most 80 Unicode code points. Seven speculative per-field/count limits were removed. Existing child identity enums and Runtime-generated IDs are reused; no prompt truncation, second admission state, migration framework, or compatibility path was introduced. Additional verified corrections: an answered-but-undelivered HITL request displays Validation: The repository's |
|
@codex review Please review the current head |
|
@cubic-dev-ai review this Please review current head |
@boh5 I have started the AI code review. It will take a few minutes to complete. |
There was a problem hiding this comment.
All reported issues were addressed across 343 files
Note: This PR contains a large number of files. cubic selects up to 200 of the highest-priority eligible files for this review, so some files may not have been reviewed.
Re-trigger cubic
|
Codex Review: Didn't find any major issues. Swish! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review Please review current head f3f11f2. The follow-up is limited to shared latest-child selection, model-visible Unicode title limits, and Session prototype navigator parity. All six prior findings have evidence-backed replies. Installed third-party Skill contents are unchanged from original installation 2f96ee9 and are not repository-owned remediation. Fresh forced gates: 4,734 tests, zero failures, 5/5 typechecks, production build and diff check passed. |
|
@cubic-dev-ai review Please review current head f3f11f2. Three small fixes address confirmed repository-owned findings; three recommendations were rejected with reproduction or installation-history evidence in their threads. The entire .codex/skills tree matches installation commit 2f96ee9 and must remain unchanged. No broad hardening or compatibility scope is requested. Fresh forced gates passed: 4,734 tests, typecheck, build, and diff check. |
@boh5 cubic can't start this review because your workspace has reached its free monthly review limit. cubic has reviewed 61,882 of the 40,000 allowed lines of code this month. Reviews resume on 1 October 2026 (in 26 days). Paid plans include much higher monthly review limits. Upgrade now to resume reviews. To help optimise your usage, you can tune cubic to get the most out of your usage limits:
|
|
Final acceptance audit for f3f11f2: the independent scope audit confirms I-01–I-10 and AC-01–AC-11 have implementation and decisive evidence, with no code or acceptance blocker. Fresh gates passed 4,734 tests / 0 failures, 8/8 tasks with no cache, 5/5 typechecks, build, and the complete PR diff check. Installed .codex/skills remains byte-for-byte equal to 2f96ee9. Existing targeted evidence also covers requiresInspection no longer being Pending or locking ordinary Composer/slash/Skill selection; disclosure reset; and Running announcing Working instead of leaking an earlier Failed status. The Plan records the historical 39-Session capacity scan (maximum 6 Todos, 3 direct children, 732-byte Todo JSON). Historical Risks notes describe intermediate corrections and are superseded by the completed Phase 3–6 results, not unresolved implementation work. Cubic completed its previous-head review, and all six new findings received individual evidence-backed triage. The latest manual Cubic request is unavailable due to its monthly free-review limit; no final-head Cubic approval is claimed. CodeRabbit skipped this large PR, so its status is not counted as substantive review. Final-head Codex review is running; merge will wait for its result and required CI/security gates. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f3f11f2a3d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review Please verify latest head 0fdf395, focusing on closure of your final prototype current-row finding. Production source is unchanged from the fully tested f3f11f2. This follow-up only fixes prototype Running/lifecycle selection and prevents lifecycle changes from moving the same-title Running row. Actual browser QA covers initial/reload single selection, Todo/Work/Session transitions, Enter navigation, and repeated Stage changes preserving Running; Web 883 tests pass. All earlier review findings have evidence-backed disposition. Do not request edits to installed third-party .codex/skills packages. |
|
Codex Review: Didn't find any major issues. Delightful! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
Merged as 63344a4 after exact-head verification. Final head 0fdf395: Codex completed with no major issues, Verify and all CodeQL checks succeeded, and unresolved review threads were zero. All confirmed findings were fixed; false positives and third-party content requests were rejected with evidence. The installed .codex/skills tree remains identical to installation 2f96ee9. Full production gate: 4,734 tests, 5/5 typechecks, build; final prototype-only follow-up: Web 883 tests and actual browser navigation/Stage QA. Cubic final re-review was quota-limited and CodeRabbit skipped; neither is represented as final-head approval. |
1 participant
Summary
Why
Recent real-work QA exposed failures that were individually small but shared one consequence: the model or user could be left with ambiguous recovery guidance, hidden/blocked work controls, or incorrect state after delegation and compression. This change closes those gaps without introducing compatibility fallbacks or a new abstraction layer. It also lands the already reviewed marketing Skill collection as the branch's first cohesive commit.
Validation
bun run typecheck --force(5/5 workspaces passed)bun run test --force(8/8 tasks, 0 cached, 4,734 tests / 0 failures)bun run buildgit diff --check origin/main...HEADDocumentation and security
Trust-boundary impact: invalid Skill resource/cursor calls now return specific recoverable errors and examples; repeated deterministic failures terminate without treating permission, cancellation, timeout, network, or unknown failures as deterministic model misuse. Compression keeps durable child state in structured runtime state instead of protecting transcript links.
Review remediation and scope
0fdf3950e8550216293aceb8161c91471a48e5ec(prototype-only current-row/Stage navigation correction; production source remains the fully testedf3f11f2a). The complete Web 883-test lane and actual browser navigation checks passed again..codex/skills/**remains exactly as committed in2f96ee99; no content-review fixes were applied to those packages. Repository-owned Skill tooling remains in scope.docs/goals/runtime-state-compression-skill-contract-progress.md.Related issue
None.