feat: rulebook-driven agents, jev-eval and onboarding skills, prescan (P4, 1.3.0)

[joao-oliveira-softtor]

Summary

P4 of the Jev plan: the agents and skills are driven by the rulebook, and the plugin is prepared as 1.3.0.

• Six layer agents: the rulebook slice comes from the SubagentStart hook; the layer skill is loaded for patterns; new sections "When the SubagentStop hook blocks" and "Before finishing" (run nestjs-hexagonal-check --strict on the files they created).
• architecture-reviewer: checker first (--format json --classes static,semantic --explain), Opus judgment limited to uncertain/uncalibrated/undecided outcomes, WARN semantic findings and cross-file concerns; findings cite rule ids.
• review-subdomain in three steps (static CLI, semantic CLI, residual review); the rubric's 35 checks annotated with their rule id or "residual".
• Package runner: lockfile detection (bun.lock, pnpm-lock.yaml, package-lock.json, yarn.lock) documented once in using-nestjs-hexagonal; 21 hardcoded pnpm sites replaced by <runner>/<add>; optional userConfig.package_runner override (non-sensitive values are substituted in skill text per the docs).
• New skills jev-eval (calibrate or evaluate a semantic rule; why deny needs ≥ 30/30) and onboard-project (stamp → rulebook → key → dependency → baseline); new subcommands stamp and prescan (layer/kind map per file, optional one choice per file with Jev); new read-only explore-agent (model haiku) that runs prescan (issue feat: Haiku explore agent for cheap BC scanning #2, partial).
• CI job frontmatter (issue ci: validate skill/agent frontmatter and links #7): validates agent and skill frontmatter, nestjs-hexagonal:<id> references and relative links; it caught an invalid YAML description in skills/application/SKILL.md.
• Release prep: version 1.3.0, CHANGELOG.md, ROADMAP, README and CLAUDE.md updated.

331 tests offline, tsc --noEmit clean, claude plugin validate . passes, examples pass --strict.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-09-21T00:17:46.837806Z	506b286	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.