The map — teaching the failsafe what consumes what

The most valuable thing the failsafe does is name the consumer a change failed to reach. In a repository with no stated coupling, it can only guess from imports and greps — which misses exactly the coupling grep cannot see: docs that quote code, fixtures, generated artifacts, deploy config. A consumer map fixes that, and this skill drafts one from the repository's own evidence.

Steps

1. Run the derivation:

   "${CLAUDE_PLUGIN_ROOT}/scripts/codex-failsafe.sh" map

   Codex reads the build config, import graph, CI, codegen scripts, test layout and docs, and returns edges — each with origin, must_reach, verified_by, and evidence (or the honest string "inferred") — plus unmapped_risks it could not pin down.

2. Adjudicate the draft with the user — never install it silently. A map nobody reviewed is a map nobody owns, and a wrong row misdirects every future review. For each edge: keep it, fix it, or strike it. Look twice at every "inferred" row. Resolve or strike each unmapped_risk.
3. Write CONSUMERS.md at the repo root using templates/CONSUMERS.template.md as the shape, and commit it. The runner also accepts .codex-failsafe/CONSUMERS.md or docs/CONSUMERS.md.
4. Keep it current the same way code is kept current: when a review's unreached_consumers surfaces a consumer the map missed, the map gets a row in the same change. The map is itself a surface with consumers — every future review reads it.

Without a map

The reviews still run: the runner tells Codex no map exists and instructs it to derive coupling from first principles. That is honest degradation, not failure — but the map is what turns "grep found these references" into "the repo says this schema is transcribed in three places; you moved two."