[codex] add monthly performance audit playbook

[fermatmind]

What changed

• Added a durable map of the 12 merged July 2026 performance PRs, the product/runtime areas they protect, their original failure modes, and monthly regression checks.
• Added a reusable monthly full-stack performance audit prompt covering Next.js/RSC/SSR/hydration, Laravel/API/query/cache/serialization, browser/network evidence, cache privacy boundaries, and PR-train output.
• Added a short monthly invocation that instructs Codex to audit first and generate a detailed report, scoped PR queue, and executable /goal prompt without changing production.

Why

The July performance train changed several independent layers across fap-web and fap-api. Future monthly reviews need a stable checklist so cache, JavaScript, degradation, payload, fanout, and monitoring regressions are evaluated with the same evidence boundaries instead of rediscovering the original scope.

Validation

• git diff --check
• Verified the worktree contains exactly the two new documentation files.
• Verified all 12 historical PR IDs are represented.
• Verified the reusable template contains the required /goal output, privacy exclusions, and no-warmup/no-deploy boundaries.

Intentionally deferred

• No runtime, CMS, database, cache, workflow, PR-train ledger, or deployment changes.
• No production scan or warmup was executed.

Repository rule impact

Documentation only. Backend/CMS authority, SEO enumeration, publishing policy, and deployment ownership are unchanged.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7cc4d535f8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Require manifest authorization before execution

For monthly scans that propose a new performance PR id not already present in docs/codex/pr-train.yaml, the root AGENTS.md planning rule requires the report to include exact manifest/state entries and a follow-up execution prompt that explicitly asks for manifest/state authorization first. This generated /goal goes straight into branch → implement → PR → merge, so pasting it for a newly proposed train item can bypass the required manifest/state authorization step.

Useful? React with 👍 / 👎.