/assess

name: assess
description: Analyze issue/PR/problem before implementation; produce source-backed findings and measurable gates.

> Before asking, read [User Questions](../../shared/codex-user-questions.md).

Assess

> Task-size routing follows [Proportional Execution](../../shared/native-skill-contract.md#proportional-execution); this skill's specialized lifecycle and acceptance checks remain authoritative.

Run evidence-first analysis: truth, risk, next action before implementation, review, release, sync.

Input Schema

{
  "question": "required analysis question",
  "scope": "required files, diff, issue text, report path, PR number, or repo area",
  "mode": "optional local|github|report|ecosystem; default local",
  "done_when": "findings are source-backed, ranked, and have explicit confidence"
}

Workflow

<!-- policy-sibling: skills/code-remediate/SKILL.md, skills/release/SKILL.md, skills/code-review/SKILL.md -->

For allowed GitHub reads, run the direct helper under current effective network and filesystem grants or request runtime approval for the complete owning command when required capability is unavailable. No separate workflow consent is needed. Apply [GitHub Read Execution](../../shared/native-skill-contract.md#github-read-execution); an explicit runtime denial or non-overridable restriction stops the attempt.

When runtime permissions show network access enabled and the helper's required paths writable, omit `sandbox_permissions` and `justification` on the direct helper call; give no approval brief. Apply GitHub Read Execution even when the active profile name is omitted. A missing label or failed lookup does not mean disabled access; do not run `codex execpolicy list` to detect a profile. Preserve explicit destination restrictions and check report, `.git`, and checkout paths separately where applicable.

Codex provides this selected `SKILL.md` path. Resolve `PLUGIN_ROOT` as directory two levels above containing skill directory, then use only helpers under `PLUGIN_ROOT/shared/` that are listed in `package-manifest.json`. Never guess cache version or fall back to source checkout.

01: Create run directory

Run `create_run.py --skill assess` per `../../shared/helper-cli-contract.md`.

02: Normalize the analysis mode

Select the analysis mode from the direct request and available evidence. Local-only work remains local.

• `local`: code, local diff/reports, pasted text.
• `github`: live issue/release/repository metadata through `github_read.py`; use only its audited built-in view groups (`gist`, `issue`, `pr`, `project`, `release`, `repo`, `ruleset`, `run`, `workflow`) or explicit read-only GraphQL query for Discussions. PR collection uses `collect_pr.py` only. Prefer `gh`; use public HTTPS fallback only as final public REST fallback.
• `report`: `.reports/**` or `.reports/codex/**` artifact.
• `ecosystem`: downstream/API/dependency impact; current external claims need live web evidence. Do not invoke `gh` outside `github_read.py`.

Use [GitHub Reader Runtime Boundary](../../shared/native-skill-contract.md#github-reader-runtime-boundary) for `github_read.py`. For PR evidence, use [PR Collection Runtime Boundary](../../shared/native-skill-contract.md#pr-collection-runtime-boundary) for `collect_pr.py`; the reader helper does not replace its outer collector. Bind a numeric PR target through `select-git-remote.py --canonical-pr-url`, preferring valid GitHub `origin` despite fork remotes and using the sole GitHub remote only when `origin` is absent. Use that canonical URL for collector `--target`, or stop if no safe default identity exists. A user-supplied canonical URL takes precedence and must match a configured remote. Do not create or modify runtime approval rules files. Runtime denial stops the current attempt under the existing recovery policy. Remote publication and other remote mutation remain forbidden.

Run `collect_pr.py` as the direct owning command per GitHub Read Execution. On an explicit denial or non-overridable restriction, stop and use only already-available local or pasted evidence when the selected mode permits it. Runtime web tools keep their own permission path.

If mode is unsupported, explain which supplied value is invalid and list accepted modes above. If request is ambiguous, name missing source or scope decision and ask one concrete question through User Questions with its supported choices or expected input format, such as a PR number/URL, issue number/URL, or local file path. Continue as `local` when pasted evidence supports requested analysis, stating its freshness limits; do not request mode choice that available evidence already resolves. Resume affected analysis when user supplies missing decision or evidence.

03: Capture scope and source inventory before drawing conclusions

Use `PLUGIN_ROOT/bin/python PLUGIN_ROOT/shared/collect_diff.py --help`; collect `working-tree` into `<run-directory>/baseline`. Scan references separately; record failed diff collection.

**Structural context (optional)**: for `local`/`ecosystem` scope naming Python module or symbol, probe codemap-py once: `PLUGIN_ROOT/bin/python PLUGIN_ROOT/shared/codemap_adapter.py context --category analysis [--target <qname>] --out <run-directory>/codemap-context.json`. Per `../../shared/codemap-contract.md`, absence/incompatibility is non-fatal — continue with evidence above. Persist result once here; step 05 specialist fan-out consumes `<run-directory>/codemap-context.json`; added queries only under the contract's bounded `Specialist follow-up queries` rule.

04: Gather evidence with a ledger. Write `<run-directory>/evidence.md` with one row per claim:

| Claim | Source | Freshness | Confidence | Notes |
| --- | --- | --- | --- | --- |

Evidence rules:

• Code claims: file/line refs.
• External/current: primary sources or unavailable-live-verification caveat.
• Thread/report: distinguish facts/hypotheses.
• List duplicate/related