Use case / PAS-002

Audit an unfamiliar codebase before making changes

User Problem

A user inherited a project and needs Codex to understand the architecture, risks, and safe next steps before changing code.

Proof Claim Boundary

First-party operator dogfooding and product capability evidence only. The repository was synthetic and is not a customer case. Independent verification has not been completed, third-party corroboration is absent, and no evidence of natural user demand has been established. This does not establish SEO or GEO success, AI citation, AI recommendation, traffic, lead, revenue, or conversion improvement.

Manual install only: yes. Hosted execution: false.

Sanitized Prompt

I want Codex to look at a project I inherited and explain the architecture, important files, risks, and safe next steps before anything changes.

Direct answer

What Workflow Fits This Scenario?

Problem: Use this analysis-first workflow to understand an inherited or unfamiliar codebase before proposing any change.
Suitable workflow: The suitable workflow maps architecture, entry points, key files, dependencies, data flow, risks, uncertainties, and a safe follow-up plan from repository evidence.
Codex + GetSkillary MCP: Codex can use GetSkillary MCP to select the unfamiliar-codebase solution and its analysis bundle, then perform an authorized read-only inspection. The workflow separates understanding from later modification.
When to use: Use it when a maintainer needs an evidence-backed codebase map and risk register before deciding what to change.
When not to use: Do not use it as a customer case study, a complete security audit, or permission to edit private or production code.
Next step: Review the architecture map, entry points, key files, dependencies, data flow, risks, assumptions, and safe follow-up; authorize any source change separately.

Neutral selection criteria

Choose The Smallest Suitable Workflow

Use the coding agent's native capability

Use when: The repository is small, authorized, and already familiar enough that a one-off read-only explanation is sufficient.

Boundary: The user must still define scope, permissions, and evidence expectations.

Use one skill

Use when: The exact need is narrow, such as a repository map or a quality checklist, and scenario routing is unnecessary.

Boundary: A single skill may not cover architecture, dependency, data-flow, risk, and follow-up outputs together.

Use the GetSkillary solution, bundle, and MCP workflow

Use when: The request is expressed as an unfamiliar-codebase problem and needs a repeatable analysis-first route plus objective checks.

Boundary: Read-only discovery and manual installation support only; no hosted execution or automatic source modification.

Use a human expert or independent security reviewer

Use when: The repository is safety-critical, regulated, high-value, incident-affected, or needs assurance beyond structural analysis.

Boundary: The workflow does not provide independent security validation, completeness, or defect-free assurance.

Bounded first-party evidence

What The Operator Test Supports

Evidence status: bounded_first_party_operator_evidence_verified
Test date: 2026-07-09
operator_tested: true
Verification: 8/8 listed artifacts and 6/6 bounded evidence sources were present, and the synthetic-repository verifier passed the defined checks.
manual_install_only: true
hosted_execution: false
third_party_corroboration_status: absent
Natural user demand: Not proven
Independent validation of GetSkillary: None

Allowed Bounded Claims

PAS-002-C01: Operator-run evidence shows the MCP workflow matching a sanitized unfamiliar-codebase request to the documented solution and skill bundle.
PAS-002-C02: A local operator test produced an architecture map, key-file notes, dependency and data-flow notes, risks, and safe follow-up steps from a synthetic repository.
PAS-002-C03: The listed local verifier passed the defined synthetic-repository checks, and SHA-256 hashes are included for reproducibility.

These are local operator dogfooding and product capability facts from synthetic or sanitized fixtures. They are not independent certification, market-effect evidence, or natural-user outcome evidence.

Reproducibility contract

Repeat The Bounded Test

With an authorized synthetic repository, repeat the MCP discovery path, inspect the repository before changing it, and verify the architecture map and safe follow-up against file evidence.

Safe Input

Provide an authorized synthetic repository and request an explanation of architecture, entry points, key files, dependencies, data flow, risks, and safe follow-up. Keep source modification out of scope.

MCP Call Path

search_solutions -> get_solution_detail -> recommend_solution_skills -> get_solution_install_plan

Codex Steps

Confirm that the repository is synthetic or explicitly authorized and that inspection is read-only.
Read package metadata, documentation, entry points, routes, services, data sources, and dependencies.
Trace data flow and tie architecture and risk statements to observable file evidence.
Produce the map, key-file notes, risk register, and safe follow-up before requesting permission for edits.

Confirmation Points

Confirm repository authorization and synthetic or sanitized status.
Confirm read-only scope and allowed verification commands.
Require new authorization before any source change, deployment, or production action.

Expected Outputs

Architecture map
Entry-point and key-file notes
Dependency and data-flow notes
Risk register
Safe follow-up plan

Acceptance Checklist

Architecture, entry points, key files, dependencies, data flow, risks, and safe next steps are covered.
Every architecture statement is tied to repository evidence.
No source file is changed.
The synthetic result is not presented as a customer case.

Actions Not Run

private repository disclosure
source modification
deployment
production mutation
customer-case publication

Cleanup And Rollback Boundary

The read-only run does not change tracked source or production state. Any separately authorized synthetic fixture regeneration must stay inside its verified fixture/output scope.

Sources and boundaries

Separate Background From Product Evidence

Background And Reference Sources

Anthropic Claude Code: How Claude Code works Official background on gathering context, verifying results, permissions, and exploring before implementation. General coding-agent method background only. Anthropic does not validate or endorse this GetSkillary workflow. Verification status: available_read_only_2026-07-13.

GetSkillary First-Party Evidence

Three bounded operator-run claims, 8/8 listed artifacts, and 6/6 bounded evidence sources from a synthetic repository.

Independent Validation Of GetSkillary

None. third_party_corroboration_status=absent.

Background sources explain the surrounding method or tool category. They are not third-party corroboration of GetSkillary.

When To Use

Use it when a maintainer needs an evidence-backed codebase map and risk register before deciding what to change.

When Not To Use

Do not use it as a customer case study, a complete security audit, or permission to edit private or production code.

Matched Solution

Audit an unfamiliar codebase before making changes is the canonical solution route for this scenario.

MCP Workflow

search_solutions -> get_solution_detail -> recommend_solution_skills -> get_solution_install_plan

Endpoint: https://mcp.getskillary.com/mcp
Manual install only: Yes
Hosted execution: No

Recommended Skill Bundle

primary skill

Codebase Analysis Probe

codebase-analysis-probe

Skill detail Download skill

supporting skill

Code Quality Standards

code-quality-standards

Skill detail

supporting skill

Markdown Authoring Helper

markdown-authoring-helper

Skill detail

How Codex Explains And Executes The Plan

Confirm that the repository is synthetic or explicitly authorized and that inspection is read-only. Read package metadata, documentation, entry points, routes, services, data sources, and dependencies. Trace data flow and tie architecture and risk statements to observable file evidence. Produce the map, key-file notes, risk register, and safe follow-up before requesting permission for edits.

What You Need To Confirm

Confirm repository authorization and synthetic or sanitized status.
Confirm read-only scope and allowed verification commands.
Require new authorization before any source change, deployment, or production action.

Expected Output

Codebase map; risk notes; recommended implementation plan.

Verification Checklist

Architecture, entry points, key files, dependencies, data flow, risks, and safe next steps are covered.
Every architecture statement is tied to repository evidence.
No source file is changed.
The synthetic result is not presented as a customer case.

Risk Boundary

L1 local analysis. No code changes, install commands, deploys, credential handling, or account actions are implied.

manual_install_only: true
hosted_execution: false

What Was Not Done

No repository was modified, no dependencies were installed, and no external service was contacted.

Readiness By GEO Stage

crawl: No URL or sitemap-count change; existing crawl support only, classified as SEO supporting diagnostics.
index: Existing canonical remains indexable with no new URL; index state is not GEO evidence.
understand: Adds an analysis-first answer, neutral selection logic, and synthetic-repository evidence boundaries.
retrieve: Strengthens unfamiliar-codebase intent match and concrete architecture outputs; actual retrieval remains unproven until live observation.
cite: Adds attributable, bounded facts and source-role labels; actual citation evidence remains absent.
click: Keeps existing solution, skill, install, MCP, and inquiry routes; no click evidence is created.
convert: No conversion evidence or conversion-improvement claim.

Next Actions

View solution View primary skill Install guide MCP usage guide Inquiry

Tracking readiness only; no click or conversion evidence is generated by this local gate.