* fix(git-worktree-isolation): canonicalize workspace_root and drop stale helper wording
* fix(review-request): use one UNASSESSED literal across all verdicts
* docs(web-debug): align heading with skill name and gate Playwright install
* fix(branch-finish): separate cleanup status from outcome labels
* docs(parallel-agents): drop agent-count anchor next to the no-hardcoding rule
* docs(typescript): mark Python optional for helper scripts
* docs(vitest): mark Python optional and name the tdd boundary
* docs(echarts): use project package manager and name the debugging boundary
* fix(commit-all): detect the default branch instead of assuming main or master
* docs(frontend-crafting): name the debugging boundary for unexpected UI behavior
* docs(tdd): name verification-gate as completion owner and narrow the trigger
* feat(debugging): record symptom provenance explicitly in step 0
* docs(scope-triage): verify compatibility in the repo before asking in Route B
* refactor: narrow trigger boundaries for dashfix, negafix, and maintaining-agent-context
* fix(skill-crafting): require a should-not-trigger case and shorten the description
* feat(plan-dev): report plan progress as a counted status line
* docs: record the small-fixes release across skills
* docs: adopt the single-table skill index and record the 1.39.0 release
Take README.md from docs/readme-ascii-workflow, which merges the four skill
tables into one and reorders the install commands, then re-apply the version
bumps for the nineteen skills changed on this branch and set their Release
column to v1.39.0.
* docs: describe skill-crafting by what the skill does
The README row carried the eval package's summary instead of the skill's own
purpose; align it with the frontmatter description.
* revert(skill-crafting): restore the measured description
The trigger-eval run of 2026-09-16 shows the shortened description loses four
positive cases that the previous one routed correctly (7/8 to 4/8 on cases clean
in both arms), with no reduction in false positives. Per the plan's acceptance
criterion a drop rolls the edit back, so line 3 returns to the measured baseline.
The should-not-trigger requirement from the same task is behavior the run did not
contest and stays in place, so 1.1.1 keeps a real package change. The skill and
root changelogs drop their claims about the shortening.
* docs: date the 1.39.0 release entry to its release day
The name now says which mechanism the workflow reaches for most often. Nothing about
the selection hierarchy changes: section 4 still ranks reusing existing safe isolation
first, a harness-native workspace second, a manual Git worktree third, and safe work in
place remains a legitimate outcome. The paragraph that introduces the skill says so
against the stronger name, so a run ending without a worktree still reads as complete.
Eight referencing skills follow the rename, both registries move with the directory,
and the frozen changelog entries from v1.35.0 keep the previous name as the historical
record.
The skill keeps its full scope: the name states the mechanism it reaches for most
often, while existing isolated checkouts, harness-native workspaces, containers and
safe work in place stay equally valid outcomes. The sentence that called the skill
"not a Git worktree tutorial" would have read as a denial of its own name and now
states the same boundary positively.
Eight skills that reference it follow the rename, registry entries in skills.sh.json
and marketplace.json move with the directory, and frozen changelog entries keep the
old name as the historical record it is.
Separately, scope-triage and plan-crafting now save specs and plans as
`YYYYMMDD-HHMM-<topic>.md`, matching docs/feedbacks, so several documents written on
one day order by creation time. The `-design` suffix is dropped as redundant.
Every skill documents a Security Model section with the same four components: user-controlled inputs, untrusted inputs, tool output treated as data rather than instructions, and whether the skill runs shell commands or network calls. Five skills gained a section, nine had theirs renamed or gathered from an existing rule, five had missing components filled in. Versions bumped in 19 skills. Release v1.34.3.
plan-crafting and tdd were the only two forks of obra/superpowers whose
LICENSE lacked the fork maintainer line alongside the upstream notice.
Both files are now byte-identical to the other ten forks; the upstream
copyright is preserved.
Bump plan-crafting to 1.3.1 and tdd to 1.0.3 as patch releases: the
change is non-behavioral, leaving triggers, descriptions and
responsibilities untouched.
* Fix two report templates and the MERGE_BASE wording in branch-finish
- Report Verification: <verdict> where the outcome does not require a PASS
- State that MERGE_BASE answers only with exactly one candidate branch
* Move the 1.34.1 changelog entry above 1.34.0
The repository changelog is strictly reverse-chronological, but the new
release section was inserted below 1.34.0. Reading the top entry is how
the release version is derived, so the misplaced section would have
yielded an already-tagged version.
Add a Development Workflow section to README.md that names scope-triage as the
entry point, diagrams the main flow and the failure path in Mermaid, and lists
the composability properties and conditional capabilities. Regroup the skill
table to match the registries and move the install block above it.
Consolidate skills.sh.json and .claude-plugin/marketplace.json from sixteen
groups to ten, replacing the single-skill groups the workflow chain created.
Every published skill still appears exactly once in each registry, and plugin
name values are preserved as install identity.
Bump scope-triage to 1.0.4: Route A now names tdd and debugging as backticked
skill references instead of bare words, so the handoff into implementation is
unambiguous. Routing semantics are unchanged.
Ignore .sdd/ so subagent-plan-dev state does not surface in release diffs.
- debugging 1.0.6: route a review finding with an unclear cause to review-resolution
instead of the upstream receiving-code-review name.
- tdd 1.0.2: route root-cause investigation to debugging instead of the upstream
systematic-debugging name, in three places.
- README.md, both skill CHANGELOGs and the repository CHANGELOG updated for v1.33.1.
Add the branch-finish skill 1.0.0, an integration and completion layer that
decides what happens to verified work and executes that decision safely, with
read-only environment detection, six-level base-branch resolution by evidence
precedence, four environment-filtered finish options, merge-conflict
classification, idempotent resumption, separate gates for workspace removal and
branch deletion, a seven-label outcome vocabulary, and a read-only state
inspector with its test.
Bump debugging to 1.0.5 so its routing table points at review-request and
branch-finish instead of the upstream requesting-code-review and
finishing-a-development-branch names.
Register the skill in a new Completion group in skills.sh.json and the mirrored
marketplace catalog, and record the release in README.md and the
repository-level CHANGELOG.md.
Introduce two plan execution modes as a new Plan Execution registry group:
- inline-plan-dev 1.0.0: execute a plan inline in the current session, with
plan-versus-reality reconciliation, a two-value blocker taxonomy, proportional
verification depth, a deterministic scope check, and durable resume.
- subagent-plan-dev 1.0.0: execute a plan through scoped subagents under a
controller, with per-task risk classification, controller-owned verification
before acceptance, three-value review verdicts, and a four-step escalation
ladder over plan-scoped state in .sdd/.
Route the existing skills at the new names:
- plan-crafting 1.2.0 -> 1.3.0
- tdd 1.0.0 -> 1.0.1
- debugging 1.0.3 -> 1.0.4
Also rebuild the known Snyk baseline findings table in AGENTS.md from a full
local pre-flight, and document the scanner's nondeterminism across runs.
The v1.31.0 release bumped debugging 1.0.2 to 1.0.3 in the skill's
metadata.version and CHANGELOG, but left the README table row at 1.0.2.
Update the row to 1.0.3 and point its tag column at v1.31.1.
Add `parallel-agents` 1.0.0, a stateless concurrency primitive that proves work
units independent, maps mutable state requiring isolation, dispatches one bounded
wave of agents with focused briefs, and reconciles results before integration.
Sequential execution stays a legitimate successful outcome.
Register the skill in README.md, skills.sh.json and the mirrored plugin
marketplace catalog under a new Orchestration group.
Bump `debugging` to 1.0.3 so independent evidence streams route to
`parallel-agents`, which owns independence assessment, isolation topology and
bounded dispatch.
* Add evidence-driven debugging skill
- Add the canonical root-cause-first methodology and field techniques.
- Register the skill and release metadata for v1.26.0.
- Clarify the complementary boundary with web-debug.
* Correct debugging skill composition identifiers
* Add tdd skill and planning handoff
Add the framework-neutral TDD workflow and test-quality reference.
Teach plan-crafting to hand behavior changes to tdd and publish the skill
in repository metadata.
* Finalize tdd release metadata
* Evaluate a directory-scoped split before compression in Phase 3
* Add the directory-scoped split procedure to the root criteria
* Read the restructuring checklist in Phase 5 and verify created files and written limits in Phase 6
* Bump to 1.3.0 and record the changelog and README entries
* Let the repository map reach the split decision
* Allow composite Step 0 mode for a single surface
* Add composite-surface guidance to direction.md
* Add pass/fail/unavailable status for static-only checks
* Mark quality-gate checks that need a browser as unavailable-eligible
* Add first-audit clause, baseline/finding boundary, absence-check class rule and composite fit-to-mode
* Add Persisting the review contract and extend the delivery checklist
* Bump to 1.3.0 and record the changelog and README entries
* Scope the static-only status rule and align routing notes after review
* Keep unavailable out of the severity field
* Route ECharts audits without a dependency
* Add applicability, repeat audits, DOM proxies and render criteria to the echarts audit reference
* Release echarts 1.2.0
* Add stdout, threshold headroom, e2e gate and isolated timing checks to the vitest audit reference
* Add a repeat audits section to the vitest audit reference
* Qualify the Vitest 5 isolate advice, add the keyed useAsyncData teardown and tighten the cross-env wording
* Release vitest 1.3.0
* Warn about the Nuxt program, solution configs and traced numbers in the typescript performance section
* Add dedupe, dry run, companion program, counting and repeat audit recipes to the typescript audit reference
* Release typescript 1.4.0
Two clarifications to existing rules. No new files, no new behaviour.
- `references/quality-gate.md` - the colour-alone rule now says what to do when the
non-colour cue needs a threshold the brief does not set: prefer a cue that needs no
threshold, and where one is unavoidable, name it as an assumption instead of burying
it in code as a silent number.
- `references/polish.md` - a change stays within the side, edge, element or region the
request named. A matching opposite-side adjustment, or an unrequested threshold,
counter or badge, is proposed rather than applied.
Paired eval cycle on 9d717f5: 48 runs, harness verification clean, completeness gate
exit 0. See docs/reviews/2026-09-02-frontend-crafting-1.2.1.md in skills-aiassist for
the full comparison.
* Add structural announcement step and prior-review guidance to frontend-crafting
* Clarify the Step 0 trigger and add prior reviews to the review checklist
* Trigger Step 0 on the first write or verdict, not on first prose
Four independent graders found the same thing across 21 runs: the session
opens with an orientation sentence and only then invokes the skill, so by
the time SKILL.md loads, 'the first visible prose of the reply' is already
spent. No wording inside the skill can reach text emitted before the skill
exists, and the control group shares the habit, so this was measuring the
model rather than the skill. Step 0 now fires before the first file write
and before any finding or verdict - the second trigger keeps the review
workflow covered, which writes nothing.
Also name the polish/redesign boundary. The evals ask for polish on a
console described as working but unfinished, which is the polish row
verbatim, but the redesign row admitted the same request and all three
runs took it, then elaborated: battery thresholds, chip counters, a fault
KPI card. Both rows now say which side that request falls on.
* Define a finding as an itemised entry in review.md
Two graders read 'every reported finding carries every field' differently:
one counted only itemised entries, the other also counted the Layer 1
theme paragraphs. That split, not the skill, produced a 2/3 against 0/3
gap between versions on the same expectation, so the criterion could not
measure anything until the word was pinned.
Layer 1 prose stays fieldless - fields there would turn the experience
layer into a form. The obligation runs the other way: a specific defect
named in that prose has to be promoted to an entry rather than left as a
loose claim.
* Correct the 1.19.0 changelog entry to the shipped Step 0 trigger
* Add frontend-craft skill
* Fix self-review findings
* Fix adversarial review findings
* Enforce visible design read and full finding format after RED eval verdict
Pre-release evals showed with-skill sessions passing code expectations but
missing the skill's own process contract:
- review.md licensed a fieldless one-line P3 summary, contradicting its own
finding format and delivery checklist; P3 entries now carry full fields or
are cut, and layer separation requires explicitly headed sections
- the mode announcement and design read could satisfy the letter of the
contract from private reasoning; SKILL.md and direction.md now require both
in the visible reply before the first file is written
* Register frontend-craft in release metadata
* Rename frontend-craft to frontend-crafting
* Fix stale H1 title in frontend-crafting SKILL.md
The heading still read "Frontend Craft" from the pre-rename working name;
align it with the skill's actual name, frontend-crafting.
An explicit /commit-all is the approval: on a feature branch the skill shows the
file list and generated message as a progress update and commits in the same
turn. Pre-existing tracked changes and a missing session snapshot no longer
pause the run; the remaining stops are the default branch, suspicious untracked
files, and unsafe path arguments, with dry-run as the guaranteed stop.
- Phase 1 records the unit and command behind every size, and keeps
cross-repository symlinked instruction files on the map but outside edit scope.
- Constraints that must hold before a pointer target is opened stay inline next
to the pointer instead of behind it.
- Phase 3 reads file bodies before judging duplication and contradiction.
- Phase 4 reports wrong facts found outside the instruction files in their own
section, and may state the current structure is already the target.
- Phase 5 keeps the confirmation gate even when the invocation asks to skip it.
- Phase 6 re-checks edited lines and files against the limits the audit treated
as governing.
- Assessment criteria: redundant-command category, import-shim criterion, and
an optional "Findings outside the instruction files" report section.
Risk-based spot-checking with explicit verification statuses, coverage scope,
and residual uncertainty for large instruction surfaces (Phase 2); explicit
measurement units for every size or limit claim (Phase 3); verification
coverage and residual uncertainty in the report (Phase 4); the reformatting-
vs-compression trade-off separated into an approval step before applying only
the approved choice while preserving semantic content (Phase 5/6). Local
read-only shell inspection is now explicitly allowed during the audit phases,
while project and repository-controlled commands stay out of scope. Updates
the skill CHANGELOG, repository CHANGELOG (1.14.0), and README version/tag
columns, adds references/restructuring-verification.md, and hardens
test_contract.py.
Audit, restructure, and maintain a repository's agent instruction architecture
(AGENTS.md, CLAUDE.md variants, .claude/rules/, skills, linked agent docs) for
Claude Code and Codex. Synthesizes the writing theory of mattpocock
writing-for-agents with the operational shape of Anthropic claude-md-improver:
read-only discovery and verification, per-file-type assessment criteria, a
quality report before any edit, and diff proposals gated on user confirmation.
Registers the skill in README, repo CHANGELOG (1.13.0), skills.sh.json, and the
plugin marketplace under a new Agent Context group.
* Trim the five most expensive skill descriptions
* Finalize v1.12.1 release notes for the description-trims batch
Turn the repository CHANGELOG Unreleased section into the 1.12.1 entry
and mark the five trimmed skills with the v1.12.1 release tag in README.
* Answer the 2026-08-19 feedback for dashfix and negafix
dashfix 1.2.0: single-file pre-handoff check, candidate vs replace counts,
block-level language classification in mixed Markdown, and a named fix in
every replace row. negafix 1.2.0: single-file check with mandatory verdicts,
candidate framing for all pattern matches, and an exploratory Ukrainian
'ne A, a B' pattern with manual verdicts.
* Add the commit-all skill for user-invoked single-commit gathering
Answers docs/requests/create-commit-all-skill.md from skills-aiassist:
one commit on the current branch with a generated English message,
explicit /commit-all invocation only, dry-run support, and guard rails
against default-branch commits, mixed trees, hook bypass, and pushes.
* Release skills v1.12.0: commit-all skill and the 2026-08-19 dashfix/negafix feedback
Combines two feature branches into one repository release: the commit-all
1.0.0 skill for user-invoked single-commit gathering, and dashfix 1.2.0 /
negafix 1.2.0 answering their 2026-08-19 field feedback (single-file
pre-handoff checks, candidate framing, per-block language classification).
* Add the skills.sh badge and consolidate the install commands in README
* Make dashfix language-aware and give both writing-style skills an enforcement hook
Answers the first field feedback on dashfix 1.0.0.
- dashfix 1.1.0: "Language scope" binds the ban per file. English keeps the full
ban; in Ukrainian, Russian, Polish and German the em dash is orthography, so the
skill checks its form and a correct dash earns a fifth `justified` category.
- Both skills scan commit messages via `git log`, catalog them separately by hash
and keep them out of the score, since history needs a rewrite to change.
- Both ship `scripts/commit-msg`: dashfix rejects a banned dash, negafix warns
only, because its patterns overmatch by design. dashfix also documents a
`PreToolUse` snippet, and both state that write mode dies with a compaction.
- Both scores are normalized by project size (`100 - spread - depth`) so five
dirty files no longer force a 0 in a 2000-file repository.
- Scan exclusions become a rule, and dashfix drops the `grep -rnP` fallback that
BSD grep on macOS cannot run.
* Fix the review findings on the history scan, the hooks and the score edges
- `git log --grep` now does the matching in both skills, so every hit prints with
its hash even from a commit body, and merge commits stay in scope
- the dashfix hook skips a message written in Cyrillic instead of rejecting a
correct Ukrainian or Russian dash, and its header names German among the
languages that keep the hook uninstalled
- the `PreToolUse` snippet drops `jq`: without it the pipeline ended on a
successful perl and passed the commit through in silence
- negafix looks for `not a ... but a` in its inventory regex and its hook, which
its own pattern list had documented all along
- the score states what to report when no file is in scope, and the perl fallback
uses `git ls-files -z | xargs -0` so a filename with a space survives
* Make the history scan a per-match catalog and harden the perl fallback
- `git log --grep` now only selects the commits; an inner `rg` pass over
`git show -s --format=%B` prints one line per match as `<hash>:<line>:<snippet>`,
so the history table catalogs every match instead of one row per commit.
Verified on 09b2413, which carries five dashes in its body and produced five rows.
- the perl fallback passes `--` before the filenames, since perl otherwise reads a
path such as `-weird.md` as its own switches and dies
- the Cyrillic heuristic states both of its limits in SKILL.md and in the hook
header: an English message mentioning a Cyrillic name is skipped too, and
Latin-script Polish and German cannot be detected at all. The audit is what
catches what the hook misses.
* Count occurrences, not matching lines, in both audits
`rg -n` prints a line once however many matches it holds, so the line-oriented
inventory understates the total the catalog and the score depend on. On this
repository the gap is real: dashfix sees 80 lines against 89 occurrences, negafix
39 against 57.
- both skills add a `--count-matches` pass, and the reported total comes from it
- Step 2 says one row per matching line, a row states how many occurrences its
line carries, and a line whose occurrences disagree on the verdict splits into a
row each; both catalogs gain an example row
- Verification asks the catalog to account for every occurrence in that total
* Guard the shared negafix pattern and key split rows by occurrence
- negafix sets `PATTERN` once at the head of Step 1, and the working-tree,
history and counting blocks each open with `: "${PATTERN:?...}"`. Run alone, a
block previously handed `rg` an empty pattern, which matches every line and
reported a total unrelated to the project; it now aborts with the message.
- a line whose occurrences carry different verdicts splits into rows keyed
`<location>#<n>` in reading order, so no two catalog rows share a key. Both
skills document the form and show an example pair.
* Anchor the working-tree scans at . and align the perl fallback with rg
- both working-tree passes name `.`: given a piped stdin and no path, `rg` reads
the pipe instead of the tree and reports zero matches on a project that has 93
- the perl fallback repeats the scan exclusions as `:(exclude)` pathspecs, so it
no longer scores a wider file set than the primary command
- the same fallback closes `ARGV` at each `eof`. Without it `$.` ran on across the
whole file list, so every line number after the first file was wrong: the run on
this repository pointed at CHANGELOG.md:381 where rg reports :101. With the fix
both passes return byte-identical location lists (82 lines).
* Make the perl fallback scan the same file set as rg
On a fixture with a tracked, an untracked, a gitignored, a nested lock, a hidden
and a binary file, rg read two files and the fallback read one. Now both read the
same two.
- `--others --exclude-standard` picks up untracked files while still honoring
`.gitignore`; plain `git ls-files` saw only tracked ones
- the exclusion pathspecs gain `**/`, so a nested `package-lock.json` drops out
the way an rg glob without a slash already dropped it
- `':!:.*' ':!:**/.*'` skip hidden paths as rg does by default, with the text
naming `--hidden` as the way to audit them on both sides
- binary files stay the one difference, stated in the text rather than left to
surprise the reader
On this repository both passes now return byte-identical location lists.
* Exclude root lock files and binary files from the perl fallback
A git pathspec is not a gitignore pattern: `**/package-lock.json` reached the
nested copies and left the one in the root, so the fixture kept package-lock.json,
a.min.js and a.map that rg had dropped. Every exclusion is now listed twice, bare
and `**/`-anchored.
The fallback also skips a file holding a NUL byte, which is the rule rg uses to
call a file binary; the fixture's binary.dat no longer reaches the catalog. Perl's
own `-B` test was tried first and let that file through, since a few NUL bytes in
mostly ASCII stay under its 30% threshold.
Slurping with `-0777` and counting lines per file replaces `close ARGV if eof` and
keeps the numbering right.
Verified: on the fixture rg and the fallback agree except for a file with invalid
UTF-8 and no NUL, which the text now names as the best-effort limit; on this
repository both passes return byte-identical location lists.
* Name the force-added gitignored file as the second fallback limit
Reproduced on a fixture: a file that .gitignore covers but that `git add -f` put
in the index is skipped by rg, which goes by the ignore rules alone, and kept by
`--exclude-standard`, which sees it in the index.
Filtering those paths would need another `git check-ignore` stage in what is
already a long one-liner, so the text names the case instead, next to the invalid
UTF-8 one, and gives the command that lists them:
`git ls-files --cached --ignored --exclude-standard`. Rows from either kind get
dropped before scoring and the report says so.
* Skip symlinks in the perl fallback
rg follows a link only under --follow, so a fixture with real.md and a link.md
pointing at it gave rg one row and the fallback two, counting the same text twice.
`next if -l $ARGV` costs one token and closes the gap: both passes now return
real.md alone on that fixture, and byte-identical location lists on this
repository.
* Name the rg flag that pairs with dropping the symlink test
* Finalize v1.11.0 release details
marketplace.json was last touched in v1.3.1 and misses scope-triage, plan-crafting, dashfix, and negafix. Add the design-planning and writing-style plugin groups mirroring skills.sh.json, refresh the marketplace description, and bump its manifest version to 1.1.0. AGENTS.md now requires updating marketplace.json in the same PR that adds, renames, or removes a skill.
Record what actually cleared the audit finding on scope-triage: W007 fires on the
directive to repeat literal values from the request, and a carve-out placed after
it does not help. Also note that a clean local snyk-agent-scan run is a pre-flight
only, since it passed the version skills.sh failed.
The skills.sh Snyk audit still returned W007 (high) on scope-triage 1.0.1: Step 0
and Route A asked the model to repeat the literal values, names, and numbers from
the request, and the secrets carve-out sat in a following paragraph, so the audit
read the instruction as forcing the model to echo user-supplied secrets verbatim.
Both places now ask for the request's domain values, the prohibition on
reproducing a secret, token, key, password, connection string, or personal datum
leads its own paragraph, and credentials are referenced by placeholder name in
the done criterion, in every command, and in the Security Model. No workflow
change; scope-triage 1.0.1 -> 1.0.2, release 1.9.1.
Release six updated skills with audit and feedback fixes. Harden Vitest auto-selected script execution and its runtime trust boundary, add regression coverage, improve web-debug checkpoint safety, and strengthen CI validation.
scope-triage is a scope-gated fork of superpowers brainstorming: it classifies
request scope first, and only the full-design route writes a design doc to
docs/specs/ and hands it to plan-crafting.
plan-crafting is a fork of superpowers writing-plans that turns an approved
design into bite-sized TDD tasks and saves the plan to docs/plans/.
Both replace their upstream counterparts rather than complementing them.
Feedback-driven update from agilecharts audit session (2026-07-20) plus two
unclosed items from the 2026-07-13 TS7 migration feedbacks:
- already-healthy early exit and sampling heuristic in Audit & Hardening
- generic defineProps note in Framework Projects
- ERR_PACKAGE_PATH_NOT_EXPORTED './lib/tsc' in the error playbook
- Choosing the TS-7 target checklist + types:[] vs lib note in the migration ref
Ihor Orlovskyi