toki: Skill for Codex

Toki Codex Review Loop

Run an rvw-compatible lane review, then apply the codex-lb-style approval, atomic-fix, verification, and bounded re-review loop.

Core Contract

• Treat every review request as read-only until the user explicitly approves a write mode.
• Never infer permission to edit or commit from phrases such as "review this" or from a GitHub @codex review request.
• Never push, submit a GitHub review, comment, resolve threads, label, merge, or otherwise mutate remote state from this skill.
• Preserve unrelated staged, unstaged, and untracked changes. Never use git reset, git checkout, or broad restoration to undo a finding fix.
• Treat local usage logs, databases, audit findings, prompts, transcripts, and credentials as sensitive. Do not print raw matched diff content.
• Apply project-conventions and read its task-specific references before fixing Toki source, tests, resources, or project configuration.
• Apply .agents/conventions/git-workflow.md before any commit. A commit requires explicit user authorization separate from review authorization.

Trust Boundary

Scope resolution runs before any review and must survive a hostile repository. Treat this section as the contract a finding is measured against: report a finding when it breaks an invariant below, and classify it wont_fix with this section as the reason when it only restates a non-goal.

Untrusted Inputs

• Repository file contents and tree layout, including untracked and ignored paths.
• Repository Git configuration: .git/config, .gitattributes, .gitmodules, and any configured hook or helper program.
• The inherited PATH and every GIT_* environment variable.
• Lane result JSON, including every path and line number it reports.

Enforced Invariants

1. Only trusted executables run. git and the review binary resolve from the platform default path, never from an inherited PATH, and the runner narrows PATH before invoking any external command.
2. No repository-configured program executes. Content filters, textconv, external diff, core.fsmonitor, core.hooksPath, and lazy fetch are overridden to inert values or the scope is refused.
3. Workspace confinement is derived from the filesystem, not from Git. The inventory walks the real tree from the repository root and validates every symbolic link target, so ignore rules and index modes cannot hide a path.
4. Every scope fails closed. A submodule, embedded repository, escaping symlink, non-UTF-8 path, or unbounded inventory marks the scope unsafe and stops before Codex is invoked.
5. Paths keep byte fidelity across process boundaries. Roots and path lists cross as NUL-terminated data and are never trimmed.
6. Reported findings are untrusted data. A finding path must be repository-relative, free of NUL, and free of empty, current, or parent segments before it is used.
7. The baseline lane is always on. A registry that marks it otherwise is rejected.