fix: address Claude review findings

[ScriptedAlchemy]

Summary

• harden automation job loading, locking, webhook delivery, and forward-compatible job config round-trips
• fix daemon/project routing propagation across proxy/hook connections and stale route invalidation
• make managed skill exports, prompt cleanup, memory digest lifecycle, and host writes safer/atomic
• preserve unknown user config keys, tighten LCM recent-session evidence/replay behavior, and harden dashboard/LSP partial-refresh handling

Claude findings covered

• [codex] Add session-replay evidence for automation #220: recent-session ordering, evidence mode, include_summaries replay
• [codex] export approved managed skills immediately #222/Improve TraceDecay skill adoption steering #225: skill export atomicity, prompt marker collisions, retired-skill deletion guard, archive/auto-approve export paths
• Add user-defined automation jobs #223: webhook SSRF/DNS rebinding, manual/CLI job locking, corrupt/unknown job entries
• [codex] feat(dashboard): add Settings tab #227: settings panel partial saves, corrupt config handling, unknown config keys
• Export memory digest to agent hosts #228: project-local memory digest leak, uninstall cleanup, fact refreshes, atomic digest writes, duplicate injection cleanup
• Route MCP reader tools from initialize roots #231/Record hook route metadata #232/Preserve transcript location metadata across providers #239: daemon route propagation, hook route cache persistence, initialize-root routing, stale route invalidation
• [codex] Bound LSP diagnostics refresh hangs #237: LSP/dashboard cancellation, partial diagnostics, slow-write handling
• fix(lcm): default transcript reads to all providers #242/[codex] Speed up recent slow JUnit tests #243 were rechecked as clean in Claude transcripts

Extra transcript check

• Rechecked Claude transcript hits for missed findings; older [codex] docs: add agent memory and adoption research #215 docs staleness/path scrub was already handled on master.

Tests

• cargo fmt --check
• git diff --check
• scripts/check-conventional-commits.sh origin/master..HEAD
• cargo clippy --workspace --all-targets --locked -- -D warnings
• cargo test -q --test agent_suite
• cargo test -q --test automation_runner_test jobs
• cargo test -q --test dashboard_api_test automation_jobs
• cargo test -q --test session_suite recent_sessions
• cargo test -q --test hooks_lsp_suite lsp_code_diagnostics_test
• cargo test -q --test agent_suite memory_digest_test::
• cargo test -q --test mcp_suite mcp_handler_test::memory_fact_store_mutations_refresh_recorded_digest_exports -- --exact
• cargo test -q --test agent_suite skill_targets_test
• cargo test -q --test automation_runner_test session_reflector
• cargo test -q shared_route
• cargo test -q --features test-transport --test mcp_suite hook_event_workspace_context_routes_followup_graph_reads
• cargo test -q --test core_cli_suite user_config
• (cd dashboard && npm run test:dom -- settings-panel-patches)

TraceDecay transcript recall used to validate the missed-finding sweep.

[changeset-bot]

⚠️ No Changeset found

Latest commit: dd51572

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.