chore: docs, CI, and dependency updates

[aanishs]

Summary

• Update README with v3 architecture and onramp documentation
• Add biome and knip to CI workflow
• Update CONTRIBUTING guide
• Bump package.json dependencies

Test plan

• CI passes with new biome/knip steps
• README renders correctly on GitHub

🤖 Generated with Claude Code

[greptile-apps]

Greptile Summary

This PR updates documentation (README, CONTRIBUTING), CI workflow, .gitignore, and TODOS.md as part of the in-progress Codex host support. The CI additions (biome, knip, skill:check) are correctly wired. The main concern is that the README's new Codex install section documents ./setup --host codex, a flag that the setup bash script does not implement — causing a silent, incomplete install for any user who follows those instructions.

• CI: Adds bun run skill:check, bunx biome check ., and bunx knip steps before bun test, fulfilling the PR description
• .gitignore: Adds .agents/, .em-dash/, .gstack/, .mcp.json — consistent with new Codex and tooling artifacts
• README: New Codex install section (global and repo-local paths) references ./setup --host codex, which the setup script silently ignores (no argument parsing of any kind)
• CONTRIBUTING.md: Clarifies Codex wrappers are gitignored output; also references bun run gen:skill-docs -- --host codex, a flag not implemented in gen-skill-docs.ts
• TODOS.md: New P3 items for comply-db contract spec, E2E fixtures, and multi-host expansion; explicitly notes Codex support depends on landing generator/install/smoke tests

Confidence Score: 4/5

Safe to merge after addressing the README/CONTRIBUTING Codex install instructions that reference unimplemented --host flags

One P1 finding: README documents ./setup --host codex and CONTRIBUTING documents gen:skill-docs -- --host codex, but neither script implements the --host flag. Users following these instructions will get a silent incomplete install. The fix is straightforward — either implement the flag or add an in-progress callout before merging.

README.md (Codex install section) and CONTRIBUTING.md (gen:skill-docs --host codex reference) need attention before merge

Important Files Changed

Filename	Overview
README.md	Adds Codex install section referencing ./setup --host codex, which the setup script does not implement — users following these instructions will get an incomplete, silent install
.github/workflows/ci.yml	Adds bun run skill:check, bunx biome check ., and bunx knip CI steps as described in the PR description — correctly wired
CONTRIBUTING.md	Updates contributor checklist and documents Codex wrapper workflow; references bun run gen:skill-docs -- --host codex which is not implemented in gen-skill-docs.ts
.gitignore	Adds .agents/, .em-dash/, .gstack/, .mcp.json — consistent with new Codex and tooling artifacts
TODOS.md	Documents new P3 infrastructure items and correctly flags Codex support as depending on generator/install/smoke tests landing

Sequence Diagram

sequenceDiagram
    participant User
    participant setup as ./setup script
    participant gen as gen-skill-docs.ts
    participant agents as .agents/skills/
    participant codex as ~/.codex/skills/

    Note over User,codex: README-documented Codex flow (currently broken)
    User->>setup: ./setup --host codex
    Note over setup: --host flag silently ignored
    setup->>gen: bun run gen:skill-docs (no --host)
    gen-->>setup: SKILL.md files generated (Claude only)
    setup-->>User: em-dash ready. exit 0
    Note over agents,codex: .agents/skills/ wrappers NOT created
    Note over agents,codex: ~/.codex/skills/ NOT linked

    Note over User,codex: Claude Code flow (works correctly)
    User->>setup: ./setup
    setup->>gen: bun run gen:skill-docs
    gen-->>setup: SKILL.md files generated
    setup-->>User: Skills linked in ~/.claude/skills/

Loading

_{Reviews (4): Last reviewed commit: "fix: remove nonexistent codex test files..." | Re-trigger Greptile}

[aanishs]

Rebased onto main and fixed the gates this PR introduces so CI can actually be green: skill-check validator updated to v3 conventions (package compliance.*, check_id+severity), knip config corrected (checks-registry is a bin/-loaded entry; canonicalize is load-bearing for Ed25519 signing), 6 biome lint errors fixed, test invocation unified (bun run test = bun test test/ in CI and locally), and the dead hipaa-scan.yml workflow deleted (v1 skill names). All four gates verified green locally: gen-docs dry-run, skill:check, biome, knip, plus 243/245 tests (2 env-gated skips).

[github-actions]

em-dash Compliance Check

Compliance Summary — aanishs-em-dash
══════════════════════════════════════════════════
  Controls:    59 total, 0 complete (0%)
  Evidence:    0 items
  Signatures:  0

This is an informational check — it does not block merging.
Run /hipaa locally for a full interactive compliance audit.