- Read dependency docs/source/types when the finding depends on external behavior.

- Reject unrealistic edge cases, speculative risks, broad rewrites, and fixes that over-complicate the codebase.

- Prefer small fixes at the right ownership boundary; no refactor unless it clearly improves the bug class.

- If a review-triggered fix changes code, rerun focused tests and rerun Codex review once.

- Keep going until Codex review returns no accepted/actionable findings.

- If a review-triggered fix changes code, rerun focused tests and rerun Codex review.

- If rejecting a finding as intentional/not worth fixing, add a brief inline code comment only when it explains a real invariant or ownership decision that future reviewers should know.

- Do not push just to review. Push only when the user requested push/ship/PR update.

## Pick Target

scripts/codex-review --parallel-tests "<focused test command>"

```

Tradeoff: tests may force code changes that stale the review. If tests or review lead to code edits, rerun the affected tests and rerun review once.

Tradeoff: tests may force code changes that stale the review. If tests or review lead to code edits, rerun the affected tests and rerun review until no accepted/actionable findings remain.

## Context Efficiency

- review command used

- tests/proof run

- findings accepted/rejected, briefly why

- whether review was rerun after review-triggered edits

- final clean review command, or why a remaining finding was consciously rejected

### Changes

- Maintainer tooling: add a repo-local `codex-review` skill for Codex closeout reviews, including local dirty-work and PR-branch review helpers.

- Maintainer tooling: add a repo-local `codex-review` skill for Codex closeout reviews, including local dirty-work and PR-branch review helpers that rerun until no accepted/actionable findings remain.

- Maintainer tooling: fail CI when pull requests add package patch files or pnpm patched dependencies, preserving the upstream-and-bump dependency workflow.

- Amazon Bedrock: externalize the Bedrock and Bedrock Mantle provider packages so core installs no longer pull AWS SDK dependencies unless those providers are installed.

- Plugins: externalize Slack, OpenShell sandbox, and Anthropic Vertex so their runtime dependency cones install only when those plugins are installed.