chore(agents): adopt task-size workflow, CI guards and local review skills

.agents/skill-sources.json

@@ -41,21 +41,6 @@
         "SKILL.md": "2b3223a02c386d1263e1b08343cb8eb3a53e444cdafb1d79e26c8ec2a8fcad28"
       }
     },
-    {
-      "name": "grill-me",
-      "repository": "https://github.com/mattpocock/skills",
-      "revision": "5beb35b040e3de97e54fa9e386d7e42d15c295c2",
-      "path": "skills/productivity/grill-me",
-      "tree": "3df14e2d3a89459bf300614be9247e3ce74798f8",
-      "installedFrom": "daniel-tsx/fintech@95757b737fbbf3b88cdab2dc4fb16572555b0f31:.agents/skills/grill-me",
-      "license": "MIT",
-      "codexAdaptation": "Replace Claude Skill-tool call with reading ../grilling/SKILL.md; synchronization restores the upstream Claude entry point.",
-      "files": {
-        "LICENSE": "0e7ac423bf2c6e223b7c5b156f8cf72da49d748e56a1641402c31f22ad07dbb5",
-        "SKILL.md": "14b78da25bb1f4fd8cfb3183440a0f490e93dad0d94a390cc8e8fb0f073b50d7",
-        "agents/openai.yaml": "c061e39c3e0f9d865fb1b97556d485704af2a8a58f4b8221a8917a5c2074a32b"
-      }
-    },
     {
       "name": "grilling",
       "repository": "https://github.com/mattpocock/skills",
@@ -147,11 +132,116 @@
         "references/security-rls-performance.md": "2e1faeca7d5746e246b1c78f9492fe2a9cfa41c4d7fa1e23c402d58fa18ea014",
         "SKILL.md": "2fd96dd9d49dee7ae7147b0425355d1ca4021d300ad7ca8972f56ac037bb84c3"
       }
+    },
+    {
+      "name": "vercel-react-best-practices",
+      "repository": "https://github.com/vercel-labs/agent-skills",
+      "revision": "063bee94c3f4df8453406c830b0a7df0f2860278",
+      "path": "skills/react-best-practices",
+      "tree": "343db72180d05814949fef7d46be96b5c6ee86b3",
+      "installedFrom": "daniel-tsx/fintech@7f5e1c243f7bfba51e1928a0860c1d88188e8ab8:.agents/skills/vercel-react-best-practices",
+      "license": "MIT (declared upstream; no LICENSE file shipped)",
+      "adaptations": [
+        "Omit the compiled AGENTS.md (~108 KB): a nested AGENTS.md can be auto-loaded as directory instructions by agent hosts, and SKILL.md plus rules/ carry the same rules.",
+        "Point SKILL.md's 'Full Compiled Document' line at the individual rules/ files instead of AGENTS.md.",
+        "Add a repository-authored LICENSE note because upstream ships no LICENSE file."
+      ],
+      "files": {
+        "LICENSE": "4af1b2ac1e60723de1c22a1d3e3daf712f46ab7b77cb90bd5f5a8b8a0474d29f",
+        "README.md": "9eafb2123d3b8b2aef41fba0db2648a3f4f49996f8c7c8bb2c86263befd8b48a",
+        "SKILL.md": "3c22de3d334db300f34dea3bff405fda8151797888d2f816d05f83c5a9f2eed3",
+        "metadata.json": "c4e18bac3290fbe1b471a605867d4df68b03144ea26b8befdbe8f9d8fd124354",
+        "rules/_sections.md": "01c59969e4e867f0708c8f8ef9c6d87fab9a07d0586244f429ff84013db8a115",
+        "rules/_template.md": "99df2a3ea088c6c22de2484ddc7e964d0e9923846f44c63380343ecc64455442",
+        "rules/advanced-effect-event-deps.md": "55ed8f9f27a1bff803d6fa55828176207714b02123cbb97ddb8a90d88024a723",
+        "rules/advanced-event-handler-refs.md": "a3097edeecfb2ff6851cd66ed8cdf0617c3c88180504bee824aa6e75a215bbbc",
+        "rules/advanced-init-once.md": "3e4dc22173eb0e2b6dcf583e3babd862b8696328f8f59aee7c4d746c5bc05f6c",
+        "rules/advanced-use-latest.md": "8a3f64dfe5a77d1564248faf17fe662ae75b55d497a243cb30b38eb07ccbbf9a",
+        "rules/async-api-routes.md": "523338540d73427dc14c0cbb19f2741ebccdf8b105a7b2c1b33d2905cf237a42",
+        "rules/async-cheap-condition-before-await.md": "03107c1f70a293cd58a8abc5474c5548e20ea4efdf01b6d45aae7ad0ac1cb32c",
+        "rules/async-defer-await.md": "f3c142d090615abdcc99d31c123be37b31f0f1ed8d9ec9f7789a3bc6883ae0fb",
+        "rules/async-dependencies.md": "16ef469f877e30c6b8e1e1b4bc3e527312fa3c6318cb785a4eca186ea236131a",
+        "rules/async-parallel.md": "6d2f841896279e976dfcdc1ac89e70771ac188baadfd43c096b5706cb838b961",
+        "rules/async-suspense-boundaries.md": "de05fedac2eb7ae563b887b5a424464ec3dfaf84e5b7797467ebe2a796ac8afc",
+        "rules/bundle-analyzable-paths.md": "62090b5c815fd71bf1133dce754f51abc16a9456d0ccd025fd627de27726e92a",
+        "rules/bundle-barrel-imports.md": "e648f6d54525f07a691357040ca5bff6ea3424788a91ff63812adb29622a671b",
+        "rules/bundle-conditional.md": "09c8259c3efb04fc0abb8e412ccbda217c222ae8118516283e571c995fe3a7d4",
+        "rules/bundle-defer-third-party.md": "3719fb47b191e8db4fe22686ec88448ad5af9e6838585425abbe103d0b642e37",
+        "rules/bundle-dynamic-imports.md": "401817a7369f315fc5a68a1095742ff7d53d0461906880dc9d64a41495ee1986",
+        "rules/bundle-preload.md": "d1f7cc28da7cd5ab249acd287edc5b761afcfb194e9cb62cd44c5f3543db2de2",
+        "rules/client-event-listeners.md": "242a873349febc1ce685e85617994784dbab92c2eaa68aed7fed5a83e7680e93",
+        "rules/client-localstorage-schema.md": "0fb7cdf9dc93fdf22f87e3669f953fb9d4ac9b0be42eec4a29fe9a2560610b88",
+        "rules/client-passive-event-listeners.md": "1f35016f9053de69e884ee9be00654e37979c2ca85f5e57764dc2626ff7acb4b",
+        "rules/client-swr-dedup.md": "644652c39c6cc00de8d1c77a7273612e868dc3f7edda30764164c12ec0f764a3",
+        "rules/js-batch-dom-css.md": "480b891b9eaf96e929dc1e964274a4828e3a78009b7d00ccd965a0d425215959",
+        "rules/js-cache-function-results.md": "3daaa11d24f4295cb6be8bc6f407f2ce83cc7b5bd1f0e68891ea8ab835721dc7",
+        "rules/js-cache-property-access.md": "73e47431e74878a927061bf0ddc7cd91a7556cb35d2573f3421e82300d9ae311",
+        "rules/js-cache-storage.md": "11b826b0433898c1ece2d3547010d8e77db9fb240185748c45db91493de9b6cc",
+        "rules/js-combine-iterations.md": "71add08aeeb43091d4ff4c0b2842cce8b4bdef8ad3e732cc034bb5a84827e746",
+        "rules/js-early-exit.md": "925ce5ce87f3347186ca62212f29cc6baa2b8c85a96d2720ad07c3d0abf781c0",
+        "rules/js-flatmap-filter.md": "9e5b166a41914d975bef7635467f8fb32cd98b5c3126c0bc6f163490812fb5f0",
+        "rules/js-hoist-regexp.md": "f9e9aef2f7c2307dd7310f283df85dcada45fc43e9bb941b0c3aa414dec21ec4",
+        "rules/js-index-maps.md": "5df1bdc2cfabb2c98abd55d26762e5c18189535c2e686184f426082e62920391",
+        "rules/js-length-check-first.md": "8b54a311c826b299272f29187fc58bc55772a04c4a72eeb29456ee96dc9fc624",
+        "rules/js-min-max-loop.md": "87dfb67e2f39df6ad8bcfb5b78c5fb364d3c07554ad188a202408d99f3763421",
+        "rules/js-request-idle-callback.md": "ee08f83905b4011abbc33d594033157d77561b5bbd9b36b04f0f409581ffec32",
+        "rules/js-set-map-lookups.md": "a7fd781a6ba9ad49065961b6f9a90ef486bf6b648390e1a08704025f98e1642b",
+        "rules/js-tosorted-immutable.md": "d0a5e1b0fec48a0a81397957e2f068e224329f7c42cb5feeed8aae6fa64025e8",
+        "rules/rendering-activity.md": "1e5e7eaf3555e61d6a2e900089c676527d26259501db5594f59544b6c664f85a",
+        "rules/rendering-animate-svg-wrapper.md": "9c6ae0ca7a51434e803887c64cded760956579a1452ccb80a461a03f9c937c77",
+        "rules/rendering-conditional-render.md": "2ec2fa23c4148285144687050c52369adba3da2fbe3d486f8d3e0aad8f06f2bc",
+        "rules/rendering-content-visibility.md": "64eee6d5b916fe74df33363994b27fc7f71bea3bcedc7ee04bda23107ca3e6e4",
+        "rules/rendering-hoist-jsx.md": "93b229560fae92005ed9a2a829064607b39b2e984e92d221d05b2d41df2b7c0e",
+        "rules/rendering-hydration-no-flicker.md": "dc7ab358c67c177bca6e6f360fbc935ebe4efa928c0ba3ebd3f9f3d9e2000ca3",
+        "rules/rendering-hydration-suppress-warning.md": "915bacb934e2927d84b37a3f3d225a47b309ac8f9e494ed2bcb66ce07c5676a2",
+        "rules/rendering-resource-hints.md": "351b1095d641717b930f1b2253282b7120af3023bc74e06c17675168d4286864",
+        "rules/rendering-script-defer-async.md": "4cea07b7875ba7fc2c7465ff23b63a2bb334f90aaf2d9293d38d67b05fdb32ab",
+        "rules/rendering-svg-precision.md": "ed468533f6e95f622859c884b122cf21f9f593ed6bb3d500a54de4b9f9bcb9fb",
+        "rules/rendering-usetransition-loading.md": "3a1249c3f13026b6f54ab5712c388df219d6af01b12aa542749acd99a46f4bc1",
+        "rules/rerender-defer-reads.md": "234050a77faf50cb306be10a9e15bd4421134ab5907e75f13e6d78e2bd262dc9",
+        "rules/rerender-dependencies.md": "17eb5830956fb56486fd3cfc7431f5849d39751730c05ad9e77dd4f0c27169c5",
+        "rules/rerender-derived-state-no-effect.md": "cb11ec76f50aa7b6847269f02d79b120c889a30d9ecd2c1d578f75144419c77a",
+        "rules/rerender-derived-state.md": "1c326bb67b01fb084eb00c8911b0a7cff54681c2315b629f88e49b64eaa6481d",
+        "rules/rerender-functional-setstate.md": "5e68df6b2ae8058e67f476ff1ac67bde159f5a9d18df439e46eabcdeb7b52e58",
+        "rules/rerender-lazy-state-init.md": "4ae844740f266fc8cbf050701230286624a2440ec5be67b9a63d9edc3c580573",
+        "rules/rerender-memo-with-default-value.md": "81c47476564ad8a79fc68fc442734255ca7d6829424359464503fda0a9f9a0dd",
+        "rules/rerender-memo.md": "1f258990c2f27ff6256b3cc5c43300631bb3f0d81f749aed08d07fcdcc131dd1",
+        "rules/rerender-move-effect-to-event.md": "abc2cbf167bee056743023351e96806a411d3398da8802093620aecf0721f029",
+        "rules/rerender-no-inline-components.md": "1cc32907a770272524ba682eef9e7efdd8ad4533b6f89b718a1fcd7d1d0eb6a3",
+        "rules/rerender-simple-expression-in-memo.md": "5bdcf2d1558ba5204e643c887b7b4060f89630969425651eb68e96427d97f800",
+        "rules/rerender-split-combined-hooks.md": "6f45d703343484ef9acef9388397f3642966ae6a5a258899a0cf1f9977cfbf6c",
+        "rules/rerender-transitions.md": "60f4033909a62df5e5b8c601494f9e50a562e2f8c1c2d81eac24f38142265f1c",
+        "rules/rerender-use-deferred-value.md": "8c3579576a61a949884167745dcfaf1d5426ba305cc61fd0a79602d70fda4909",
+        "rules/rerender-use-ref-transient-values.md": "f1a649af9d1d0b5c762f6c9c4c1c70c90d7df82aa10296ee87aadb78c1b76c54",
+        "rules/server-after-nonblocking.md": "d0b8d24a3db9f0f65f9e2bddbf230b0e03a5f60e1229d93a4a18f5e7a991c7c2",
+        "rules/server-auth-actions.md": "a2ca8aa102839251c7971ec784560fab943c20b36fe6f80365d4110c13260c23",
+        "rules/server-cache-lru.md": "1924b64561841923b88a657085097a0aeba3e0ba2d5470b9f5c15cc10d6ae70f",
+        "rules/server-cache-react.md": "fddeea6c870bb3da4134b61d54b7d09b83d2603f929b7547cd3dc1dc269edd5c",
+        "rules/server-dedup-props.md": "c2747424cdac46be62f835f245a0aa887b0090b416d28e2ac8676702645eeb37",
+        "rules/server-hoist-static-io.md": "5abea4dd882b13661bd5f7dfb93f9e547d5f08176c61c448ade91b210ed5d49f",
+        "rules/server-no-shared-module-state.md": "4d869bf1cd2f1632e5ca4c0e64b1cf0e71c5f5a0f940bc8a22174d205e735ed7",
+        "rules/server-parallel-fetching.md": "569a2e9fc04f9606686cd75c5894ef8781b502786a7fffe241396846c7733472",
+        "rules/server-parallel-nested-fetching.md": "ad5d9656984d4a959997a2367bf59cc6632297b4634a1dd13a087939d83f30b3",
+        "rules/server-serialization.md": "f4c7d68b29c82381baad059c4a7f09e868e71ec9c3115a26ad3ae7d24c0dfe1f"
+      }
+    },
+    {
+      "name": "frontend-design",
+      "repository": "https://github.com/anthropics/skills",
+      "revision": "dbd4588f9e1033efb41dad4bef2f7947c8993d44",
+      "path": "skills/frontend-design",
+      "tree": "d79e2a5bb4df4a386c2adcdd9ab8709bba28c3f6",
+      "installedFrom": "daniel-tsx/fintech@7f5e1c243f7bfba51e1928a0860c1d88188e8ab8:.agents/skills/frontend-design",
+      "license": "Apache-2.0",
+      "files": {
+        "LICENSE.txt": "0d542e0c8804e39aa7f37eb00da5a762149dc682d7829451287e11b938e94594",
+        "SKILL.md": "d91970639e9f5c37682ac7ab60094d35f1c7c1f38d731bd56396563aee10c1d3"
+      }
     }
   ],
   "reference": {
     "repository": "https://github.com/daniel-tsx/fintech",
-    "revision": "95757b737fbbf3b88cdab2dc4fb16572555b0f31",
+    "revision": "7f5e1c243f7bfba51e1928a0860c1d88188e8ab8",
     "path": ".agents/skill-sources.json"
   }
 }

.agents/skills/codex-review/SKILL.md

@@ -0,0 +1,39 @@
+---
+name: codex-review
+description: Run an independent cross-model review with Codex on the current task branch or design, then triage its findings. Use when AGENTS.md requires an independent reviewer (T2, CI or guard changes) or when the user asks for a Codex review; not for self-review of T0/T1 work.
+---
+
+# Codex review
+
+Codex reviews; you (the implementer) prepare the package, run it, and triage. Codex never edits files.
+
+## 1. Prepare
+- Work is committed on your task branch inside your worktree: review a commit, not a dirty tree.
+- `git fetch origin`; rebase onto `origin/main` if it moved. Record the reviewed SHA: `git rev-parse HEAD`.
+- Write a short brief in `.tmp/<task-slug>/review-brief.md`: goal, non-goals, task size, invariants and boundaries touched, acceptance criteria. Facts only: no claims that the change is correct, minimal or safe.
+
+## 2. Run (read-only, from the worktree root)
+Write `.tmp/<task-slug>/review-prompt.md`: the brief, then this instruction:
+
+> You are an independent reviewer of the changes on this branch against origin/main (git diff origin/main...HEAD). Follow AGENTS.md: its task-size table, project invariants and review rules. Read the code and tests yourself; trust no summary. Check correctness, regressions, security, auth and user ownership, concurrency, retries and leases, migrations, AI-spend and notification side effects, and test adequacy as relevant. Report findings only, ordered by severity, each with: P0/P1/P2, file:line, a concrete failing scenario, actual versus required behavior. Say explicitly if you found nothing blocking. Do not modify files.
+
+Design (no diff yet): replace the diff sentence with "review this design for the repository" and append the design text or its `.tmp` path.
+
+The prompt is read from stdin, so the same command works in Command Prompt and in a POSIX shell:
+```sh
+codex exec -s read-only -c model_reasoning_effort="high" -o .tmp/<task-slug>/review-<n>.md - < .tmp/<task-slug>/review-prompt.md
+```
+`-o` saves Codex's final message. Never overwrite an earlier review file.
+
+## 3. If Codex cannot run
+Not installed, config or sandbox error, usage limit: report the error once, do not loop. Fall back to a fresh read-only subagent (or a fresh session) given the same brief and SHA, and label the reviewer as fallback. Your own re-read is not an independent review.
+
+## 4. Triage every finding
+- **Accept**: reproduce it (a failing test where feasible), then fix.
+- **Reject**: cite code or test evidence (file:line) showing why it does not apply.
+- **Human decision**: policy, product or data-semantics questions go to the user; do not resolve them by changing requirements.
+
+Fix accepted findings in one wave, rerun the affected checks, and review the new SHA again. At most two correction rounds; then stop and hand the remaining findings to the user.
+
+## 5. Report (PR Review section)
+Reviewer (Codex, model and effort, or fallback), reviewed SHA, a findings table with disposition, and open human decisions.