95 tracked `.security-scan-passed` files are deleted, and `.gitignore` gains the
entry that makes them local artifacts like their three siblings.
How they came to be deleted: a sweep on 2026-09-05 01:48 ran
`find . -name ".skill-regression-reviewed" -o -name ".security-scan-passed"
| xargs -r rm -f`, intending only the first name; `-o` made the second a peer of
it. The first is a gitignored local receipt, the second was tracked. 91 of the 95
parent directories still carry that exact minute as their mtime, which is how the
timestamp was pinned. A restore was attempted 93 seconds later and stopped at the
guard, and the files have sat deleted since. The owner has now retried and the
decision was to let them go; this records it.
Why retiring is coherent rather than a loss: the marker is a four-line local
receipt (scan time, tool, content hash) that `security_scan.py` regenerates on
demand, and `packaging_policy.py` already excludes it from every package. Its
three siblings in that same EXCLUDE_FILES set -- `.DS_Store`,
`.skill-regression-reviewed`, `.skill-regression-baseline.json` -- were all
already gitignored; this one was the outlier. Its `Scanned at` timestamp also
means a regenerated copy never byte-matches a committed one, so tracking it
produced churn and no signal.
The cost is one command: packaging a skill whose marker is gone now needs
`security_scan.py` run first, which regenerates it locally.
No skill content changes, so no plugin version is bumped and no CHANGELOG entry is
added: that file's entries are skill releases, and nothing ships differently. The
three documentation statements about this marker (marketplace-health-check's
SKILL.md and its methodology reference) describe what a scan result means, not
where the file is stored, and remain true. CLAUDE.md never mentioned it.
Pre-checked against main's version gate, which now consumes the shipping policy:
the candidate passes with no bumps.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Teach git-safety-net and github-ops to converge branches by unique business behavior under moving refs and parallel PRs. Add an exact-tip bundle verifier, dirty-WIP/refset gates, mode-safe keeper commits, squash-aware landing proof, REST authority fallback, and superseded-PR closure instead of identity-driven conflict resolution.
Co-authored-by: Codex <noreply@openai.com>
SSOT-hygiene follow-ups from the post-v1.65.0 health-check:
- check_doc_skill_lists.py now asserts the README version badge == metadata.version.
That badge drifted twice (1.63->1.64, 1.64->1.65) when a metadata bump forgot it;
the drift guard enforces it now instead of relying on manual discipline.
daymade-claude-code suite 1.2.0 -> 1.2.1.
- marketplace.json metadata.description slimmed from a per-skill enumeration (it had
silently fallen ~11 skills behind) to a category summary pointing at the README.
- Removed a duplicate ## [1.56.0] CHANGELOG header.
- repomix-safe-mixer 1.0.0 -> 1.0.1: the "before" examples in SKILL.md +
references/common_secrets.md used a real-looking Supabase project ref + JWT, flagged
CRITICAL by the bundled scanner — which had never run on this skill (it shipped with
no .security-scan-passed marker). Replaced with neutral placeholders.
- Backfilled .security-scan-passed markers for 20 skills that shipped unscanned.
metadata.version unchanged (1.65.0 — no skills added/removed). check_marketplace.sh +
check_doc_skill_lists.py green.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
daymade