[codex] Add automation config and diagnostics controls

.config/nextest.toml

@@ -5,22 +5,8 @@ flaky-result = "fail"
 slow-timeout = { period = "10s", terminate-after = 36 }
 final-status-level = "slow"
 
-[test-groups]
-windows-global-state = { max-threads = 1 }
-
 [[profile.ci.overrides]]
 filter = 'binary_id(tracedecay::mcp_handler_test)'
 platform = { host = 'cfg(windows)' }
-test-group = 'windows-global-state'
 retries = 2
 flaky-result = 'pass'
-
-[[profile.ci.overrides]]
-filter = 'binary_id(tracedecay::cli_non_interactive_test)'
-platform = { host = 'cfg(windows)' }
-test-group = 'windows-global-state'
-
-[[profile.ci.overrides]]
-filter = 'test(/^doctor::tests::/)'
-platform = { host = 'cfg(windows)' }
-test-group = 'windows-global-state'

.githooks/commit-msg

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+repo_root="$(git rev-parse --show-toplevel)"
+"$repo_root/scripts/check-conventional-commits.sh" --message-file "$1"

.github/workflows/ci.yml

@@ -76,6 +76,10 @@ jobs:
         with:
           node-version: 22
 
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+
       - name: Install ast-grep
         run: |
           npm install --global "@ast-grep/cli@${AST_GREP_VERSION}"
@@ -119,6 +123,10 @@ jobs:
         with:
           node-version: 22
 
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+
       - name: Install ast-grep
         shell: pwsh
         run: |

CONTRIBUTING.md

@@ -121,12 +121,21 @@ refactor: simplify reference resolver lookup
 
 Keep the first line under 72 characters. Add a body explaining *why* if the change isn't obvious.
 
+Install the local `commit-msg` hook once per checkout:
+
+```bash
+scripts/install-git-hooks.sh
+```
+
 CI validates commit subjects with:
 
 ```bash
 scripts/check-conventional-commits.sh origin/master..HEAD
 ```
 
+Run the same command locally before pushing to lint every non-merge commit in a
+branch range. Merge commits are skipped to match CI behavior.
+
 ## Pull Requests
 
 - Target `master` for bug fixes and stable features.

README.md

@@ -152,6 +152,22 @@ Each agent gets the integration that matches its host:
 
 All changes are idempotent -- safe to run again after upgrading. After agent setup, you'll be offered a global git post-commit hook.
 
+Managed skills generated by the self-improvement loop are exported through the
+host surface that each provider can load safely:
+
+| Host | Managed-skill surface |
+|---|---|
+| Cursor | Native skill overlay under the Cursor plugin's managed skill directory. |
+| Codex | Native skill overlay inside the Codex plugin bundle/cache; Codex sessions load approved skills after the plugin is installed or refreshed. |
+| Claude Code, Kimi, OpenCode, Copilot/Vibe, generic Agents targets | Prompt-index block that points the host at `tracedecay_skill_list` and `tracedecay_skill_view` instead of copying full skill bodies into global prompts. |
+| Kiro | Dedicated steering index at `~/.kiro/steering/tracedecay-managed-skills.md`, referenced by the tracedecay-managed Kiro agent. |
+| Hermes | Read-only bridge only. Hermes owns its native skill store; TraceDecay does not export or mutate Hermes skills. |
+
+The curation backend is provider-agnostic. Hermes remains a compatibility bridge
+and reference source, while TraceDecay's automation config can delegate
+intelligence to hosts such as the Codex app server without requiring Hermes to
+run.
+
 For project-scoped setup, run from the repository root:
 
 ```bash

cursor-plugin/README.md

@@ -55,6 +55,7 @@ per-call review, add the snippet below to `~/.cursor/permissions.json`
   "mcpAllowlist": [
     "tracedecay:tracedecay_active_project",
     "tracedecay:tracedecay_affected",
+    "tracedecay:tracedecay_automation_run_artifact_view",
     "tracedecay:tracedecay_body",
     "tracedecay:tracedecay_branch_diff",
     "tracedecay:tracedecay_branch_list",
@@ -89,6 +90,7 @@ per-call review, add the snippet below to `~/.cursor/permissions.json`
     "tracedecay:tracedecay_gini",
     "tracedecay:tracedecay_god_class",
     "tracedecay:tracedecay_health",
+    "tracedecay:tracedecay_hermes_skill_bridge",
     "tracedecay:tracedecay_hotspots",
     "tracedecay:tracedecay_impact",
     "tracedecay:tracedecay_implementations",
@@ -123,6 +125,8 @@ per-call review, add the snippet below to `~/.cursor/permissions.json`
     "tracedecay:tracedecay_signature_search",
     "tracedecay:tracedecay_similar",
     "tracedecay:tracedecay_simplify_scan",
+    "tracedecay:tracedecay_skill_list",
+    "tracedecay:tracedecay_skill_view",
     "tracedecay:tracedecay_status",
     "tracedecay:tracedecay_storage_status",
     "tracedecay:tracedecay_test_map",

dashboard/build.shared.mjs

@@ -237,6 +237,7 @@ export async function buildPlugin(
 export async function buildHolographicPlugin() {
   await buildPlugin("holographic", "holographic-memory", {
     tailwind: true,
+    primitives: true,
   });
 }
 

dashboard/graph/src/OverviewPanel.tsx

@@ -16,16 +16,23 @@ import {
 } from "./types";
 import type { GraphNode, GraphOverview } from "./types";
 
+// Language → design token (with the historical dark hex as fallback), mirroring
+// KIND_FAMILY_COLORS in ./types so the bar swatches re-theme with the shell's
+// light palette instead of pinning dark-only hex. Each language rides a
+// matching --ts-* accent token (javascript shares --ts-amber by hue family).
 const LANGUAGE_COLORS: Record<string, string> = {
-  rust: "#f7c76a",
-  typescript: "#7aa7ff",
-  javascript: "#ffd97a",
-  python: "#67e8a9",
-  markdown: "#a8c8c0",
-  json: "#6f9189",
-  toml: "#6f9189",
-  shell: "#75f4d2",
-  web: "#ff7ab6",
+  rust: "var(--ts-amber, #f7c76a)",
+  typescript: "var(--ts-blue, #7aa7ff)",
+  // Reuse the warm amber token (same hue family as the historical JS yellow)
+  // with the original dark hex as fallback, so the swatch re-themes in light
+  // mode instead of pinning a dark-only literal. See ./types KIND_FAMILY_COLORS.
+  javascript: "var(--ts-amber, #ffd97a)",
+  python: "var(--ts-green, #67e8a9)",
+  markdown: "var(--ts-text-2, #a8c8c0)",
+  json: "var(--ts-text-3, #6f9189)",
+  toml: "var(--ts-text-3, #6f9189)",
+  shell: "var(--ts-cyan, #75f4d2)",
+  web: "var(--ts-pink, #ff7ab6)",
 };
 
 export default function OverviewPanel({
@@ -84,7 +91,7 @@ export default function OverviewPanel({
               keyName="label"
               rows={overview.files_by_language.slice(0, 9).map((row) => ({
                 label: row.language,
-                color: LANGUAGE_COLORS[row.language] || "#6f9189",
+                color: LANGUAGE_COLORS[row.language] || "var(--ts-text-3, #6f9189)",
                 value: fmt(row.count),
               }))}
               onPick={(row) => onFilterLanguage(String(row.label))}

dashboard/hermes-wrapper/src/wrapper.css

@@ -127,6 +127,10 @@
   --color-muted: rgba(117, 244, 210, 0.1);
   --color-muted-foreground: var(--ts-text-3);
   --color-secondary: rgba(122, 167, 255, 0.1);
+  /* Gotcha: --color-secondary is a 10%-opacity blue TINT, not a readable text
+     color, so the Tailwind `text-secondary` utility is near-invisible as
+     foreground. Use `text-text-secondary` (maps to --ts-text-2) for copy;
+     reserve `bg-secondary`/`border-secondary` for surfaces. */
   --color-destructive: var(--ts-red);
   --color-warning: var(--ts-amber);
   --color-success: var(--ts-green);