codeArbiter for Codex

Plugin ca-codex in arbiterForge/codeArbiter. Commands read from the repo's manifest — today.

Skills (53)

• brainstorming

  Refine feature and sprint intent into a useful specification. Capture scope, observable criteria and material choices without repeated artifact approval ceremonies.

• commit-gate

  Create a verified local Git commit when committing changes is requested. Not for explaining commit history, drafting a message only, or postponing a commit. Applies every commit gate and never implies a push or PR.

• context-check

  Inspect context drift and refresh selected source-backed documents under existing authorization.

• context-creation

  Build source-backed project context through bounded inspection, optional agents, and record-level knowledge writes.

• crypto-compliance

  The banned-primitive gate. Routed to when changed code hashes, signs, encrypts, derives keys, generates security-relevant randomness, configures TLS, or imports a crypto library. Rejects broken primitives, disabled TLS verification, and home-rolled crypto; the approved-primitive list lives in securi

• debug

  Investigate an unexplained defect or unexpected behavior without changing application code. Use for root-cause diagnosis and an evidence-backed handoff, including a bounded unresolved result. Not for implementing a known fix, new features, or explanation-only questions.

• decision-lifecycle

  Record user-decided ADRs or inspect their health read-only. Preserve attribution and acceptance evidence.

• decision-variance

  Inspect architectural variances with SMARTS; record only explicit user choices. Report-only requests make no changes.

• decompose

  Develop greenfield intent or initialized brownfield target and delta in existing decomposition and knowledge records.

• dispatching-parallel-agents

  Parallel fan-out for authors, scouts and reviewers. Collect every result; only explicit review batches use finding-triage and verdict-aggregator.

• executing-plans

  Assistive /feature coordinator. Select relevant tasks from a maintained spec/plan, delegate a useful batch when warranted, record verified versus pending checks honestly, and give progress summaries without default human-approval stops.

• finishing-a-development-branch

  Open a PR or finish branch disposition; route CI watching and post-merge cleanup to their owners. Merge and discard need explicit authority.

• post-merge-cleanup

  Clean up an already-merged local branch after proving containment. Confirm each discard and preserve unique work.

• refactor

  Restructure code without changing observable behavior: rename, extract, inline, move, deduplicate, or replace an internal implementation with an equivalent one. Prove parity through unchanged pre-existing tests. Not for new behavior, bug fixes, explanation-only questions, or committing finished work

• release

  Prepare a declared release target, or preview it with --dry-run. Derive its version and require authorization before publication.

• secret-handling

  The secret-source gate. Routed to when changed code reads, writes, or passes a secret — API key, token, password, connection string, signing key, certificate, or any value that grants access. Validates that every secret comes from the approved store and never lands in source, log, test fixture, erro

• security-architecture

  Threat-model a sensitive design with STRIDE on request. Read-only analysis of threats, controls, and implementation constraints.

• subagent-driven-development

  Assistive implementation engine for /sprint and scoped executing-plans work. Follow actual dependencies, implement or delegate coherently, run relevant checks, preserve honest evidence, and advance without artifact approval codes or compulsory reviewer cascades.

• tdd

  Verify authorized feature, fix, and refactor work with scoped obligations, regression-first fixes, behavioral checks, characterization baselines, coverage, and lint.

• tribunal

  Run an opt-in deep codebase audit with persisted findings. Confirm cost before dispatch; filing and telemetry need separate approval.

• using-git-worktrees

  OPTIONAL per-task isolation for autonomous parallel work. Routed to only on explicit opt-in by subagent-driven-development or dispatching-parallel-agents, so parallel units mutate files without colliding. Stands up one worktree per unit, works it in isolation, then integrates each unit back onto the

• writing-plans

  Turn the selected specification into a maintained implementation plan with clear outcomes, useful tasks, dependencies, and verification steps. Drafting uses the existing authorization and does not require artifact approval codes, reviewer receipts, or a frozen implementation script.

• ca-add-dep

  Vet a new or changed third-party dependency for license, provenance, and supply-chain risk before any install runs.

• ca-adr-status

  Inspect ADR health read-only; optionally select one ADR with --adr N.

• ca-adr

  Record user-decided ADRs or inspect their health read-only. Preserve attribution and acceptance evidence.

• ca-audit

  Assemble the governance record for a range — commits, overrides, ADRs, sprint auto-decisions, open questions, checkpoint findings — into one dated audit packet. Read-only.

• ca-checkpoint

  Periodic multi-reviewer sweep of the whole codebase — surfaces a triaged checkpoint report.

• ca-chore

  Sanctioned lane for non-behavioral work — docs-only edits, dependency bumps, reverts. Type-scaled gates; no TDD demanded of prose.

• ca-cleanup

  Clean up an already-merged local branch after proving containment. Confirm each discard and preserve unique work.

• ca-commit

  Create a verified local Git commit when committing changes is requested. Not for explaining commit history, drafting a message only, or postponing a commit. Applies every commit gate and never implies a push or PR.

• ca-conflict

  Stop everything and surface a rule conflict — persona vs. docs vs. code. Present both sides and the conflict-hierarchy level; the user resolves. No silent reconciliation.

• ca-context-check

  Inspect context drift and refresh selected source-backed documents under existing authorization.

• ca-create-context

  Build source-backed project context through bounded inspection, optional agents, and record-level knowledge writes.

• ca-debug

  Investigate an unexplained defect or unexpected behavior without changing application code. Use for root-cause diagnosis and an evidence-backed handoff, including a bounded unresolved result. Not for implementing a known fix, new features, or explanation-only questions.

• ca-decompose

  Develop greenfield intent or initialized brownfield target and delta in existing decomposition and knowledge records.

• ca-doctor

  Verify the active host install, package, command ownership, enforcement, and harmless live-fire probe. Read-only.

• ca-feature

  Build an authorized feature from a maintained specification, testable criteria and useful plan, without duplicating user approval.

• ca-fix

  Fix a confirmed bug: a failing regression test first, then a minimal fix, then the rest of the tdd gates.

• ca-init

  Opt this repo into codeArbiter — scaffold the root-level .codearbiter/ state store.

• ca-override

  Sanctioned, logged bypass of a gate or hard rule — one audit line, then proceed.

• ca-pr

  Open a PR or finish branch disposition; route CI watching and post-merge cleanup to their owners. Merge and discard need explicit authority.

• ca-reconcile

  Inspect architectural variances with SMARTS; record only explicit user choices. Report-only requests make no changes.

• ca-refactor

  Restructure code without changing observable behavior: rename, extract, inline, move, deduplicate, or replace an internal implementation with an equivalent one. Prove parity through unchanged pre-existing tests. Not for new behavior, bug fixes, explanation-only questions, or committing finished work

• ca-release

  Prepare a declared release target, or preview it with --dry-run. Derive its version and require authorization before publication.

• ca-review

  Review a diff with the reviewer fleet, funneled to one triaged verdict. Targets the current working diff, a path, or an inbound GitHub PR.

• ca-spike

  Exploratory spike on a throwaway branch — answer a named question with disposable code. Never merges; exits to a findings note or $ca-feature.

• ca-sprint

  Run an autonomous sprint from maintained specs and plans, with truthful verification and no duplicate artifact approval ceremonies.

• ca-standup

  Daily repo hygiene — review the day's repo state, then perform selected cleanups. Fast-forward only, never destructive without a yes.

• ca-status

  Show the project's current state at a glance — stage, open tasks, open questions, overrides since the last checkpoint, current branch. Read-only.

• ca-task

  Add, select, start, complete, or reopen local work through its owning store.

• ca-threat-model

  Threat-model a sensitive design with STRIDE on request. Read-only analysis of threats, controls, and implementation constraints.

• ca-tribunal

  Run an opt-in deep codebase audit with persisted findings. Confirm cost before dispatch; filing and telemetry need separate approval.

• ca-watch

  Watch a PR's CI to completion — diagnose on red, notify and offer the merge on green. Never auto-merges.

Subagents (20)

• INDEX
• architecture-drift-reviewer

  Read-only checkpoint reviewer. Surfaces drift between the codebase and accepted ADRs in .codearbiter/decisions/. Informational — never blocks.

• auth-crypto-reviewer

  Reviews authentication, cryptography, key handling, and secrets against <project-root>/.codearbiter/security-controls.md. Hard blocks on banned primitives, exposed secrets, disabled TLS verification, and shell injection. Read-only checkpoint reviewer.

• backend-author

  Implement backend/server-side code with scoped verification, input validation, framework conventions, and ORM usage. Reads tech stack from <project-root>/.codearbiter/tech-stack.md.

• checkpoint-aggregator

  Persists a complete verdict-aggregator output under the selected dated checkpoint filename in .codearbiter/checkpoints/. Writer, not a blocker.

• coverage-auditor

  Dispatched by the tdd skill (Phase 4) to audit test coverage against TDD obligations. Identifies untested source files, coverage below the maturity threshold, and logical test gaps.

• decision-challenger

  Adversarial red-team reviewer of ADRs. Builds the strongest case against each decision, names load-bearing assumptions, assigns confidence 1–5, and surfaces evidence that would prove a decision wrong. Read-only. Dispatched optionally by decision-variance. Reads ADRs from .codearbiter/decisions/.

• dependency-reviewer

  Dispatched when package.json, lock files, or container base images change. Verifies license, provenance, maintenance signal, and supply-chain posture against .codearbiter/security-controls.md and .codearbiter/tech-stack.md before merge.

• design-quality-reviewer

  Reviews generated, user-facing visual or formatted output (UI, reports, slides, charts, diagrams, CLI output) against the anti-slop-design reference. Read-only; surfaces design-slop findings. Dispatched by frontend-author on UI changes. Tier 2 document producers (/pr, release) apply the reference in

• finding-triage

  Post-processes reviewer reports — consolidates findings, classifies each by severity and whether it blocks the current change. Sequential. Produces a unified read-only triage report for the verdict-aggregator and explicit checkpoint persistence.

• frontend-author

  Implement frontend/UI code with scoped verification, component conventions, state management, and UI security. Reads tech stack from <project-root>/.codearbiter/tech-stack.md.

• grader

  INTERNAL SMARTS analyst dispatched by the decision-variance skill. Produces a SMARTS analysis and recommendation for one (artifact-position, scaffold-evidence) pair. Never decides — the user decides. Never dispatch directly.

• infra-author

  Use when writing or modifying IaC, containers, CI/CD manifests, or deployment configuration. Reads tech stack and security boundaries from <project-root>/.codearbiter/.

• map-deps

  Dispatched by Tribunal to classify unresolved integration relationships from a bounded inventory packet. Read-only; files no findings.

• map-structure

  Dispatched by Tribunal to classify unresolved structural relationships from a bounded inventory packet. Read-only; files no findings.

• migration-reviewer

  Dispatched when a database migration file is added or modified. Reviews migrations for safety, data-classification tagging, and immutability against .codearbiter/security-controls.md.

• scout

  INTERNAL evidence-gatherer dispatched by the decision-variance and context-creation skills. Scans an assigned code scope and reports evidence of architectural decisions — file paths and line numbers only. Never dispatch directly.

• security-reviewer

  Dispatch PROACTIVELY when a change touches authentication, authorization, cryptography, secrets, deployment manifests, network policies, or CI workflows. Reviews diffs against <project-root>/.codearbiter/security-controls.md. Read-only; produces findings.

• tribunal-lens-reviewer

  Dispatched by the tribunal deep-audit lane to review one lens or independently verify a candidate. Reads its mandate under routines/tribunal/references/lenses/. Never dispatch directly.

• verdict-aggregator

  Composes a complete finding-triage report into one structured in-memory verdict for the caller. Read-only; never persists a checkpoint or modifies project state.

Hooks (12)

• SessionStart

  python3 "${PLUGIN_ROOT}/hooks/session-start.py"

• PreToolUse

  python3 "${PLUGIN_ROOT}/hooks/pre-tool-adapter.py"

• PreToolUse

  python3 "${PLUGIN_ROOT}/hooks/pre-tool-adapter.py"

• PreToolUse

  python3 "${PLUGIN_ROOT}/hooks/artifact-authority-hook.py"

• PreToolUse

  python3 "${PLUGIN_ROOT}/hooks/artifact-authority-hook.py"

• PostToolUse

  python3 "${PLUGIN_ROOT}/hooks/post-write-edit.py"

• PostToolUse

  python3 "${PLUGIN_ROOT}/hooks/artifact-authority-hook.py"

• PostToolUse

  python3 "${PLUGIN_ROOT}/hooks/artifact-authority-hook.py"

• SubagentStart

  python3 "${PLUGIN_ROOT}/hooks/artifact-authority-hook.py"

• SubagentStop

  python3 "${PLUGIN_ROOT}/hooks/artifact-authority-hook.py"

• UserPromptSubmit

  python3 "${PLUGIN_ROOT}/hooks/prune-transcript.py"

• UserPromptSubmit

  python3 "${PLUGIN_ROOT}/hooks/prompt-submit.py"

Similar plugins