docs: add self-contained code review agent skill

[BenCodez]

Summary

Add the AdvancedCore counterpart to BenCodez/SimpleAPI#74 as one self-contained file: .github/skills/code-review/SKILL.md.

• Independent, source-read-only review of the exact PR/commit snapshot, with explicit local-overlay, stale-input, incomplete-history, and connector-only handling.
• AdvancedCore-specific checks for shared/public API compatibility, downstream consumers, reward execution, offline/delayed work, user data, placeholders/JavaScript trust boundaries, GUI edits, and platform scheduling.
• Inline concurrency, durability, security, packaging, and test-review checklists; concrete P0-P3 findings with precise changed-line locations.
• Local validation example verified against the current JDK 21 CI workflow: mvn -B -f AdvancedCore/pom.xml package.
• Fixes and publishing remain coordinator actions; incomplete validation cannot become a clean verdict, and review rounds respect the authorized budget.

Scope

Exactly one added file, .github/skills/code-review/SKILL.md (262 lines).

No scripts, reference files, agent profiles, installers, workflows, application code, model/provider settings, or other repository changes. Existing open non-Dependabot PRs, review-named branches, root contents, and the .github tree were inspected before branching from master at 615a4a846ae377dffb95dbb1bde2cb7e7cc77717. The base was rechecked before publication.

The skill needs no companion files and makes no promise that every agent host automatically discovers this location.

Validation

• PASS: 14 local static checks: UTF-8/BOM, LF/final newline, whitespace, frontmatter delimiters, metadata schema/name-directory match, metadata bounds, repository heading/trigger, workflow sections, balanced Markdown fences, absence of companion-file references, correct build example, shell syntax, one-file fixture scope, and git diff --cached --check.
• Shell examples were parsed with bash -n, not executed. Git checks used a disposable fixture containing the proposed Markdown file, not a full repository clone.
• PASS: GitHub comparison shows one commit and only the requested file added. Uploaded blob fb6446857d940348679b1b169b5e25182072398e matches the locally validated bytes.
• NOT RUN: Maven tests/JAR build. Maven is unavailable in this environment; a direct GitHub repository access probe also failed DNS resolution. The GitHub connector was available for reads and publication.
• NOT RUN: A separate fresh reviewer or live agent-discovery test. Inspection was same-context plus the static checks above.

Kept as a draft. This is not a successful build or independent clean-review claim. No external review was manually requested.

AI disclosure: This pull request was prepared with assistance from ChatGPT.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-06T00:01:51.841779Z	5118ea8	Draft marked ready
🔒 Security Review	✅ Completed 2026-09-06T00:02:37.885646Z	5118ea8	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5118ea85bc

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Don't mark complete reviews incomplete when findings exist

On hosts without a required output schema, a fully validated review that finds any defect fails the only No findings. condition, so this Otherwise branch mandates Review incomplete. and asks for limitations even though coverage is complete. Separate review completeness from the clean/readiness verdict so completed reviews can report findings without falsely claiming a coverage limitation.

Useful? React with 👍 / 👎.

[BenCodez]

Implemented in follow-up #308 (commit 9129d31), since #307 was already merged.

The skill now explicitly separates complete reviews with findings, complete reviews without findings, and incomplete reviews with or without findings. Finding a defect no longer forces Review incomplete. or invented limitations. Missing/unresolved/stale coverage or validation evidence still requires an incomplete result, and unresolved defects still block publishing.

Only .github/skills/code-review/SKILL.md changed. Local document/syntax checks and git diff --check passed; the uploaded blob matches the validated bytes. Maven/JAR and live-agent tests were not run. Leaving this thread unresolved while the follow-up is unmerged.