codex

Open-source compliance audit of a repository: run it before the repository is made public, and re-run it after fixes or periodically to confirm an already-public repository still complies. Use when asked to check, review, audit, or prepare a repo for open-sourcing, publication, or a switch from private/internal to public visibility. Checks compliance with the ECMWF Codex (licensing, copied/third-party code and attribution, README, maturity badge, contribution setup) and industry best practices (secret scanning, git history audit, dependency licences, CI hygiene), and prompts the operator to run a separate security audit. Produces a pass/fail Markdown report; does not flip visibility itself.

Security audit of a repository, tiered by risk — run before it is made public and periodically afterwards. Use when asked to run a security audit or review, or to complete the mandatory security step of the open-source audit. Builds a threat model, runs SAST / dependency / supply-chain tooling, manually reviews security-sensitive surfaces (deserialization, injection, memory safety / FFI, crypto, ML model loading), and for high-risk repositories adds threat-model-driven adversarial tests and bounded fuzzing. Produces a pass/fail Markdown report with CWE-tagged findings. Reports findings and gates publication; it does not fix code or flip repository visibility itself.