change-analysis

Change Analysis

Run evidence-first analysis: truth, risk, next action before implementation, review, release, sync.

Input Schema

{
  "question": "required analysis question",
  "scope": "required files, diff, issue text, report path, PR number, or repo area",
  "mode": "local|github|report|ecosystem",
  "done_when": "findings are source-backed, ranked, and have explicit confidence"
}

Workflow

Codex provides this selected SKILL.md path. Resolve PLUGIN_ROOT as the directory two levels above the containing skill directory, then use only helpers under PLUGIN_ROOT/shared/ that are listed in package-manifest.json. Never guess a cache version or fall back to a source checkout.

01: Create run directory

Run create_run.py --skill change-analysis per ../../shared/helper-cli-contract.md.

02: Normalize the analysis mode

• local: code, local diff/reports, pasted text.
• github: live issue/release/repository metadata through github_read.py; use only its audited built-in view groups (gist, issue, pr, project, release, repo, ruleset, run, workflow) or an explicit read-only GraphQL query for Discussions. PR collection uses collect_pr.py only. Prefer gh; use the public HTTPS fallback only as a final public REST fallback.
• report: .reports/** or .reports/codex/** artifact.
• ecosystem: downstream/API/dependency impact; current external claims need live web evidence. Do not invoke gh outside github_read.py.

For every github_read.py or collect_pr.py execution, apply the full networked CLI approval and denial contract in ../../shared/native-skill-contract.md to the complete owning command from its first attempt. The operation-specific brief is: Action and purpose: collect current GitHub analysis evidence; External capability: read-only GitHub network access; Credential behavior: gh, when used, is an opaque local credential broker; Filesystem and worktree effects: write evidence only to the analysis run directory, except a selected PR collector may create its documented local checkout; Retry policy and safe denial outcome: stop the turn on denial and use only already-available local or pasted evidence when the selected mode permits it. Runtime web tools keep their own permission path and receive no shell escalation.