The first end-to-end verification exposed a mismatch between the documented .sops.yaml regex and the temporary plaintext filename used during bootstrap. The rule now matches both secrets.env and secrets.env.plain so the setup skill works exactly as documented.
Constraint: Setup docs must be mechanically correct, not just conceptually correct
Rejected: Change the bootstrap filename instead | broader docs churn for no practical gain
Confidence: high
Scope-risk: narrow
Reversibility: clean
Directive: Re-run the documented setup path after any future secret-handling doc edits
Tested: bash scripts/validate-skills.sh
Tested: sops --encrypt via .sops.yaml + sops exec-env with dummy secrets
Not-tested: Windows-specific setup commands beyond documentation review
Credential-bearing skills now point to a shared cross-platform setup based on sops plus age instead of a hosted password manager. The repo also gains a default setup skill and a small verification script so users can bring one encrypted secrets file to every relevant skill.
Constraint: The secret workflow must work on macOS, Linux, and Windows without mandatory vendor signup
Rejected: Keep 1Password CLI as the default | it requires account creation and sign-in
Rejected: Plaintext .env as the default | too easy to leak in a repo and too easy for tools to read at rest
Confidence: high
Scope-risk: moderate
Reversibility: clean
Directive: If a future skill needs stronger isolation than exec-env provides, expose a capability wrapper instead of injecting the raw secret
Tested: bash scripts/validate-skills.sh
Tested: npx --yes skills add . --list
Tested: bash scripts/check-setup.sh (expected failure without sops/age installed)
Not-tested: End-to-end sops encryption and exec-env flow on a machine with sops and age installed
The repo starts as a markdown-first multi-skill package with one shared security policy, one validation script, and lightweight install docs. This keeps v1 easy to publish and easy to review before any skill-specific automation grows deeper.
Constraint: Skills must stay compatible with the skills CLI package layout
Rejected: Add a repo-level manifest or build system | the package spec only requires per-skill SKILL.md
Confidence: high
Scope-risk: narrow
Reversibility: clean
Directive: Keep credential-bearing skills on 1Password CLI runtime injection, not plaintext env files
Tested: bash scripts/validate-skills.sh
Not-tested: Fresh-machine install via npx skills add
Jeffrey (Dongkyu) Kim