* feat: port Lauren Tan pstack skills and recut tdd/de-slop
Add pstack as a model-agnostic playbook orchestrator plus the high-value
workflow skills that this catalog did not already cover. Rewrite tdd and
de-slop in place with pstack rigor. Keep existing skill ids. Attribute
MIT to Lauren Tan / cursor/plugins.
Co-authored-by: Vincent <vincent@shipshit.dev>
* fix: regenerate marketplace snapshots after pstack port
CI regenerates bundles and marketplace.json, then fails if they drift.
The port updated catalog sources but left those generated snapshots stale.
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
- validate-skill-sync.sh: hard-error when plugin.json version != SKILL.md
metadata.version, or plugin.json description is a YAML block marker
- new scripts/check-skill-version-bumps.sh (bun run version:check): CI fails
when a skill's content changes without a metadata.version bump vs base
- CI: fetch-depth 0 + version:check step after validate
- sync 12 drifted plugin.json versions to SKILL.md; fix turborepo/html-style
junk descriptions
- bundle plugin.json + marketplace.json versions now come from
package.json / skill plugin.json instead of hardcoded 1.0.0
- fixtures + regression tests for both validator gates
A duplicate-detection audit flagged skills/analyze-codebase/ and
skills/codebase-advisor/ as near-identical in intent. codebase-advisor
wins on every axis: Hard Rules, a Contract block, the user-invoked
invocation split, scoped allowed-tools, effort levels, and a references/
tree. analyze-codebase was a thin five-step outline with none of it.
Fold in the one capability analyze-codebase had that the advisor lacked:
producing a written architecture and health document for a human, rather
than plan files for an executor. It lands as the `report` variant, with
the discovery pass and section structure in references/analysis-report.md
so SKILL.md only carries what every branch needs.
- Absorb its triggers into description/when_to_use (analyze codebase,
architecture review, project health check, onboarding).
- Widen Hard Rule 1 and the Contract to cover the report artifact, and
add the tools it needs (tree, .agents/memory writes).
- Bump codebase-advisor 1.0.1 -> 1.1.0 in SKILL.md and plugin.json.
- Delete skills/analyze-codebase/, drop it from the README Dev Workflow
list (43 -> 42) and the dev-workflow bundle, and regenerate.
scripts/classify-provenance.workflow.js keeps its mention: that array is
a frozen one-shot snapshot that still names skills retired in bacfbda.
Closes#97
* feat: add grok second-opinion review lane, fix catalog drift
- New grok-review skill: /review grok [target] runs one headless Grok CLI
pass on the exact diff (CLI default model/effort, no execution flags),
then verifies every finding in-session before reporting. Report-only.
- review-dispatch 1.4.0: parse the grok engine token, route gathered
diffs to grok-review; retro stays native; engine and depth flags are
mutually exclusive.
- README sync: remove ghost deslop-ui entry, list nestjs-testing-expert
(also added to the backend bundle), category counts corrected.
- skill-auditor 1.2.0: README-sync recipe now reads the categorized
backtick lists (the skills.sh link table no longer exists); orphaned
example table row restored to its table.
- Regenerated catalog facts (169 skills / 182 plugins).
* chore: regenerate marketplace bundles for grok-review lane
* feat: adopt Pocock skill craft and missing primitives
Fold grilling, domain-modeling, wait-what, wizard, prototype, and
codebase-design into the catalog, plus a user-invoked Dev Loop
router, without copying his 25-skill toolkit.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: include docs/ in generated catalog layout
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
* feat: retire session-documenter, session-start, and session-end skills
Session history lives in GitHub Issues and repo .agents/memory/ — the
session-doc ritual is no longer part of the workflow. Removes the three
skills from skills/, the session bundle, marketplace.json,
plugin-categories.json, and every cross-reference; regenerates catalog
artifacts via bun run marketplace:generate.
* fix(deps): override brace-expansion, js-yaml, linkify-it to patched versions
bun audit flagged 4 high advisories in markdownlint-cli transitive deps;
compatible-range update cannot reach the fixed versions, so pin via
overrides (same pattern as the existing picomatch override).
- skill-standards.md: model-reference check is a hard error since 400068d, not a warning
- provenance-manifest.json + upstream-tracking.md: tool-design no longer retains a pinned model name; its code example uses the YOUR_MODEL placeholder
The generator sliced every skill description to 100 chars, which cut the
'Use when …' trigger clauses (added in this PR) off mid-word in the catalog
— e.g. 'Use when ad', 'build configuration. Us', 'profiling or improvi'.
115+ of 155 descriptions were affected.
Emit the full SKILL.md description instead (the source frontmatter is already
length-capped at 1024/1536). Collapse whitespace so literal (`|`) block
scalars like turborepo render as a single-line blurb rather than leaking
embedded newlines. Regenerated marketplace.json: 155 descriptions expanded,
0 structural changes, valid JSON.
Implements three independent enhancements (#39, #26, #27):
#39 codex-image-gen skill (ai-agents bundle)
- New skill that drives the Codex CLI image tool and extracts the finished
PNG from the session rollout JSONL (the headless `codex exec` path never
writes the image to disk). Ships SKILL.md, plugin.json, and a Python
extractor helper, plus an AppIcon.appiconset worked example and the
alias/sandbox, size/alpha, and fragility caveats.
#26 dispatch:plan planning gate
- New plan-dispatch.yml: a human applies `dispatch:plan` to a Backlog issue;
the Claude lane runs the writing-plans contract, posts/updates a trusted
`## Implementation Plan` comment, moves the board to Human Review, assigns
the gate-applier, and applies NO execution gate. Planning and execution stay
separated by human validation.
- setup-dev-loop.sh seeds the dispatch:plan label and installs the workflow.
- Documented in triage-labels.md, setup-agent-routing, loop.md, ai-dev-loop.md
(incl. HITL issues never receiving any gate, dispatch:plan included).
#27 local /codex-loop command
- Codex twin of /loop: claims one dispatch:codex Backlog issue, runs the
executing-plans contract through `codex exec`, opens a PR, hands off to
Human Review. Same 30-min claim lock, reads the `## Implementation Plan`
comment, one issue per invocation. loop.md no longer calls the Codex lane
push-only and cross-references /codex-loop.
Bundles + marketplace.json regenerated; README counts updated (147 skills,
21 commands). All gates green: bun run validate, bun run lint (markdownlint +
biome + shellcheck), actionlint.
Mirrors the /review and /release dispatcher pattern — one front door per domain
instead of scattered single-skill commands. No behavior removed; routers delegate
to the existing skills behind their own gates.
New dispatchers (skill + front-door command):
/skill create|capture|comply|scout → skill-* skills
/design audit|clarify|critique|layout|polish|quieter|shape|consistency
/test run|qa|tdd|e2e|coverage|init|regression
/agent audit|config|init|route
/prd new|spec|gate|write|intake|interview
/deploy app|compose|ec2|monitor|devcontainer
Extended /pr with PR-scoped actions: address (gh-address-comments),
fix-ci (gh-fix-ci), suggest (gh-review-suggestions). gh-inbox and
gh-project-board left standalone (cross-PR scope, not single-PR).
Registered in plugin-categories.json; marketplace.json + bundles regenerated.
Skill count 146 → 152 (README, AGENTS.md, package.json).
One front door for the release lifecycle, mirroring the /review → review-dispatch
pattern. Subcommands route to the existing engines (no behavior removed):
/release status: trunk, latest tag, commits since, CI state + usage
/release gates → release-pr-gates (verify CI green, cut tag/release or release PR)
/release cut|notes|patch|minor|major|vX.Y.Z → release (semver + patch notes)
/release cleanup → release-cleanup (prune merged branches + stale worktrees)
- New skills/release-dispatch (explicit-invoke only; read-only until the
delegated skill's own confirmation gate).
- commands/release.md rewritten as the front door.
- Registered in plugin-categories.json; marketplace.json + bundles regenerated.
- Skill count 146 → 147 (README, AGENTS.md, package.json).
Close gaps found by comparing the Cursor cursor-team-kit skills against our
library. Adds four skills + four commands and extends four existing skills.
New skills:
- standup: author-scoped git recap (collapses Cursor weekly-review +
what-did-i-get-done)
- test-runner: scoped/changed/full/e2e/types test execution with a
read-trace, fix, rerun-until-green loop (subsumes run-smoke-tests +
check-compiler-errors)
- pr-comments: read-only, severity-tagged, priority-ordered PR comment digest
(get-pr-comments)
- fix-merge-conflicts: correctness-first conflict resolution, lockfile regen,
rebuild-before-continue; model-invokable so it auto-triggers on conflicts
New commands: /standup, /tests, /pr (dispatcher), /deslop
Extended skills:
- de-slop: --changed diff-only scoping, two new slop patterns (defensive
try-catch, over-nesting -> early returns), explicit Modes section
- gh-pr-publish: Reviewability Pass (/pr tidy) - rewrites the PR description
for reviewers; description only, no commit reorg (squash-merge repo)
- gh-fix-ci: autonomous loop-until-green mode, gh pr checks --json as truth
source, external-check link inspection (loop-on-ci parity)
- merge-open-prs: delegates conflicted PRs to fix-merge-conflicts
Registered the new skills in plugin-categories.json and regenerated bundles
and marketplace.json. Avoids files owned by the open /review PR to stay
conflict-free. Validate + lint clean; bundles regenerate deterministically.
Add a single front door for code review instead of remembering which of
six review skills fits which scope.
- commands/review.md: /review command with target modes — working tree,
single PR, all open PRs (summary table), last N commits, and time
windows (24h/7d/2w) — plus a --deep flag for the orchestrated pass.
- skills/review-dispatch: the router behind /review. Parses the arg into
(mode, depth), resolves the target to diffs with read-only git/gh, and
delegates to code-review (quick gate) or full-code-review (deep). Holds
no rubrics of its own. Read-only throughout.
- structural-review: add Design Purity (same behavior, less structure —
code-judo) and Directness vs Magic (speculative generality, hidden
assumptions) axes to close the gaps vs Cursor's thermo-nuclear rubric;
mirror both into full-code-review's inline structural reviewer prompt.
- merge.md: point the per-PR review step at the same engine as
/review prs so the two share one mental model.
- full-code-review.js: document why reviewer rubrics are inlined (Workflow
sandbox has no filesystem access) and name the canonical source skills.
Regenerated marketplace.json + dev-workflow bundle (review-dispatch added
to plugin-categories.json). All 142 skills pass validate-skill-sync;
markdownlint clean.
* feat(dev-loop): add ready-for-agent dispatch + setup-agent-routing skill
Human-gated autonomous execution for the AI dev loop, in two phases that share
one dispatch contract: an issue runs only when a human applies `ready-for-agent`
(opt-in) and it sits in `status:todo`.
- setup-agent-routing: new skill that writes an `## Agent skills` routing block
+ docs/agents/ so the dev-loop skills (executing-plans, feature-intake,
writing-prds, qa-reviewer) know a consumer repo's tracker, label vocabulary,
and domain layout. Adapted port of setup-matt-pocock-skills.
- commands/loop.md: Phase 1 local pull loop (/loop, --status, --list) wrapping
executing-plans. One invocation = one task, never a daemon.
- .github/workflows/agent-dispatch.yml: Phase 2 push dispatch on the
`ready-for-agent` label. OAuth-token-only auth (never ANTHROPIC_API_KEY),
per-issue concurrency, least-privilege permissions, untrusted issue body.
- executing-plans: candidate query now requires ready-for-agent + status:todo;
completion strips the gate; QA reject re-arms it (status:todo + ready-for-agent).
- .github/actionlint.yaml: register the Blacksmith runner label (also clears the
pre-existing false positive on generate-bundles.yml).
- Regenerate bundles + marketplace.json (session bundle 6 -> 7 skills).
* feat(dev-loop): add Codex/GPT lane + model-as-variable + setup script
Extend the ready-for-agent loop into a two-engine design:
- New codex-dispatch.yml: ready-for-codex gate routes to openai/codex-action@v1
(sandbox: workspace-write, safety-strategy: drop-sudo). The executing-plans
contract is inlined into the prompt since codex-action has no plugin-loading
equivalent; Codex auto-reads AGENTS.md/.codex. At most one gate per issue.
- Model selection is now a repo VARIABLE, not hardcoded or secret. Claude lane:
claude_args --model vars.AGENT_MODEL (fallback sonnet-4-6). Codex lane:
vars.CODEX_MODEL / vars.CODEX_EFFORT. Only auth tokens stay secret.
- scripts/setup-dev-loop.sh: one-shot per-repo provisioning — seeds labels
(incl. ready-for-codex), installs both workflows, arms CLAUDE_CODE_OAUTH_TOKEN
+ OPENAI_API_KEY, prints the gh variable set commands. --dry-run/--skip flags.
- Docs: AI-DEV-LOOP.md two-lane rewrite + planner/executor/QA role table;
setup-agent-routing SKILL + triage-labels seed gain the ready-for-codex gate;
commands/loop.md notes /loop is the Claude lane (Codex is push-only).
Verified: validate, shellcheck, markdownlint, actionlint all green.
* feat(skills): store implementation plans as issue comments, not local docs/plans files
writing-plans (ported from obra/superpowers) was saving the plan to a local
docs/plans/YYYY-MM-DD-<feature>.md file. That file desyncs from the project the
moment work starts and never crosses to CI, so the cross-engine "Claude plans ->
Codex executes" handoff silently failed on the plan path.
Now the plan is posted as a `## Implementation Plan` comment on the work/PRD
issue, mirroring how writing-prds stores the PRD in the issue body. A comment
co-locates plan + PRD on one issue while keeping the PRD body clean (feature-intake
forbids plans in the body). The executor and both dispatch lanes already read the
issue body, linked PRD, and ALL comments, so the plan reaches CI for either engine
with no executor/workflow/label change — the handoff gap closes for free.
- writing-plans: "Saving the Plan" -> "Storing the Plan" (gh issue comment
--body-file -); killed the docs/plans default; confirm-before-post; no-tracker
fallback; >65k-char split note; label-driven Execution Handoff; version 1.0.0 -> 1.1.0
- writing-plans/README: recorded the storage divergence so future upstream syncs preserve it
- executing-plans: the `## Implementation Plan` comment is the authoritative plan
- AI-DEV-LOOP: both planning artifacts live on the issue (PRD=body, plan=comment)
- writing-prds: "plan the X PRD" flow points at the plan comment
- regenerated planning + session bundles
skills/bug + /bug command. Turns a description into a structured bug
report (summary, steps to reproduce, expected vs actual, environment),
previews it, then on confirmation files a GitHub issue typed `Bug` via
`gh issue create --type Bug` — falling back to a `bug` label when the
repo has no issue types. Confirmation-gated; never fabricates repro
steps or environment (gaps are marked).
Registered in the github bundle; marketplace regenerated (181 skills);
README command table -> 12.
develop → staging → master promotion is deprecated. The repo's default
branch is the single trunk; releases are tags cut from it; staging and
production are deployment environments, not branches.
- skills/release: new orchestrator + /release command. Detects the trunk,
derives the next semver from commits since the last tag, generates
plain-English patch notes, then on confirmation tags the trunk and
publishes a GitHub release. Modes: notes / patch|minor|major | vX.Y.Z.
- Convert 9 skills off the develop→staging→master chain to trunk-based:
merge-open-prs (PRs target the default branch), release-pr-gates
(gate + cut on the trunk), release-cleanup (verify merged-to-trunk via
the squash-aware oracle), deploy, deployment-composer, worktree (base
off the trunk), plus gh-pr-publish / turborepo / open-source-checker
reference fixes.
- Register release in the github + dev-workflow bundles; regenerate the
marketplace (180 skills); README command table → 11, trunk wording.
staging/production as deployment environments and the verb "develop"
were intentionally left intact.
* feat(skills): port 6 muratcankoylan context skills v1.0.0 → upstream HEAD (25e1fa79a33f)
Bring context-degradation, memory-systems, multi-agent-patterns, tool-design,
evaluation, and advanced-evaluation forward from their v1.0.0 import to upstream
muratcankoylan/Agent-Skills-for-Context-Engineering HEAD (commit 25e1fa79a33f).
Carried-home upstream additions: Gotchas sections, claim-* evidence IDs,
"Do not activate" routing guards, expanded tables/examples, numpy→stdlib
detector rewrite (context-degradation), citation-detection regex fix
(evaluation), Tool Audit Checklist + "Build for Future Models" (tool-design),
production-framework/benchmark tables + Error Recovery (memory-systems),
Metric Selection table + prompt templates + Scaling (advanced-evaluation).
Marketplace adaptations:
- Stripped cross-references to upstream siblings not vendored here
(context-compression, filesystem-context, project-development, latent-briefing,
hosted-agents, bdi-mental-states, harness-engineering); retained cross-links to
vendored siblings (tool-design, evaluation, context-fundamentals,
context-optimization).
- Restored advanced-evaluation's 3 tool-design cross-links (tool-design IS
vendored; harness-engineering stays stripped).
- Renamed advanced-evaluation references/full-guide.md → evaluation-pipeline.md
to match upstream.
- Preserved local divergences: multi-agent-patterns "Dispatching Parallel Agents"
(no upstream equivalent); tool-design Vercel-specific references genericized.
- Normalized the "## Skill Metadata" footer across all 6 (matches merged
context-fundamentals/context-optimization precedent).
Provenance: bumped upstream_commit → 25e1fa79a33f, last_synced → 2026-06-13 in
SKILL.md metadata + README ## Upstream tables (via provenance-manifest.json +
apply-provenance.py). Updated .agents/SYSTEM/UPSTREAM-TRACKING.md (all 8 now
ported; license-request issues filed for changelog-generator + humanizer).
Regenerated ai-agents bundle + marketplace.json. validate + lint:md clean.
* fix(skills): harden 5 ported skills per CodeRabbit review on PR #21
Applied 11 verified CodeRabbit findings (1 critical, 8 major, 2 minor) to the
canonical sources; bundles regenerated. Each fix is a local divergence from
upstream 25e1fa79a33f, recorded in provenance-manifest.json (candidates to push
back to muratcankoylan).
- tool-design/scripts/description_generator.py [CRITICAL]: ErrorMessageGenerator
stored templates as json.dumps strings, so generate() called str.format on
literal JSON braces and crashed with KeyError on every call. Store templates as
dicts, interpolate values, then json.dumps.
- context-degradation/scripts/degradation_detector.py: detect_lost_in_middle
counted negative/out-of-range critical indices in the score denominator (and
negative indices silently wrapped) — now guarded with 0 <= pos < len and a
valid-only denominator. analyze_context_structure measured middle-band content
by section-start only — now uses true line-span overlap.
- memory-systems/scripts/memory_store.py + references/implementation.md: _embed
seeded the RNG with Python's per-process-salted hash(), making "deterministic"
embeddings non-reproducible across runs — now a stable SHA-256 seed with a local
RNG (no global np.random.seed mutation). retrieve_memories accepted time_filter
but never applied it — now merged into the search filters.
- multi-agent-patterns/scripts/coordination.py: receive() drains+clears the inbox;
three call sites kept one message type and silently dropped the rest — now
re-queue non-target messages. submit_vote silently no-oped unknown agents and
accepted invalid selections/confidence — now validates agent identity, selection
against the topic options, and confidence in [0,1].
- evaluation/scripts/evaluator.py: evaluation_history and samples were unbounded
lists — now bounded deques (10k/50k). Removed two no-op f-string prefixes (F541).
Skipped 3 findings (platform-neutral wording on memory-systems, multi-agent-patterns,
tool-design SKILL.md): the repo rule (AGENTS.md:18) bans INSTRUCTIONAL tool
references, not vendor names in examples/tables — consistent with merged
context-fundamentals, which ships "OpenAI"/"Anthropic" in examples.
All fixes smoke-tested (crash gone, validation raises, embeddings deterministic
across processes, denominators bounded). validate 178/0/0, lint:md clean.
* feat(skills): add merge-open-prs skill + /merge command
Orchestrator that reviews every open PR targeting develop, merges the
approved ones, then delegates branch/worktree pruning to release-cleanup.
- skills/merge-open-prs: discover open PRs into develop, classify
(draft/conflict/CI/candidate), review each candidate via code-review,
print a consolidated plan behind a confirm gate, merge oldest-first
with the repo's preferred method (squash > merge > rebase), then hand
off pruning to release-cleanup. Modes: review / merge / full.
- commands/merge: thin /merge entrypoint over the skill.
- Register in github + dev-workflow bundles; regenerate marketplace.
Safety: base is develop (stop if absent), drafts/conflicts/red-CI
auto-excluded, review is a gate, two confirmation points, no force or
admin override past branch protection, no deletion beyond merged head
branches (the rest is release-cleanup's gated job).
* refactor(merge): drop confusing `merge`/`full` mode words
`/merge merge` read as nonsense. Replace the positional mode words with a
clear surface: `review` (plan only), `--no-prune` flag (merge, skip prune),
and a bare base-branch arg — all combinable. Default `/merge` stays the full
review→merge→prune sweep.
* chore(skills): port context-fundamentals + context-optimization to upstream v2.x
Brings the vendored bodies, references, and scripts up to the upstream
muratcankoylan/Agent-Skills-for-Context-Engineering v2.x corpus (commit
cbc2c978133d, 2026-05-15) so they match the provenance pin instead of
lagging at the v1.0.0 content that was previously shipped under a v2 marker.
- context-fundamentals -> v2.2.0 (adds the routing framework + gotchas;
description now routes operational work to context-degradation /
context-optimization)
- context-optimization -> v2.1.0
Cross-references to upstream sibling skills that are not vendored in this
marketplace (context-compression, filesystem-context, project-development,
latent-briefing) were stripped so routing only names skills present here.
Updates provenance manifest "modifications" notes, regenerates the two
READMEs via apply-provenance.py, refreshes the muratcankoylan section of
UPSTREAM-TRACKING.md, and regenerates the ai-agents bundle + marketplace.json.
Verified: validate-skill-sync 0 issues / 0 warnings; markdownlint clean;
bodies/refs/scripts byte-faithful to upstream v2 modulo lint blank-lines;
zero dangling references to non-vendored siblings.
* chore(provenance): track 6 muratcankoylan v1.0.0 imports honestly
context-degradation, memory-systems, multi-agent-patterns, tool-design,
evaluation, and advanced-evaluation derive from muratcankoylan/Agent-Skills-
for-Context-Engineering (MIT, verified via the GitHub license API and by
fetching each live upstream file). They were imported at v1.0.0 on 2026-01-20
(commit ef42a98) and have NOT been ported forward to upstream's current v2.x
corpus.
Record rolling provenance pinned to each skill's earliest upstream commit at
its path — a verified content ancestor of the vendored body — rather than to
current upstream HEAD. Pinning HEAD would falsely claim the local body matches
v2.x; pinning the v1.0.0-era creation commit keeps "synced at" honest and makes
diff-since-pinned surface the full set of un-ported upstream changes.
- provenance-manifest.json: 6 new rolling entries, last_synced 2026-01-20,
each modifications field naming the upstream version drift + port recipe
- SKILL.md metadata blocks: source/upstream_repo/upstream_commit/last_synced/
license inserted after version (bodies untouched, still v1.0.0)
- README.md: canonical provenance docs regenerated (tool-design's hand-written
README replaced per marketplace convention)
- UPSTREAM-TRACKING.md: split the muratcankoylan section into "ported to v2.x"
(2 skills) and "tracked at v1.0.0 — port pending" (these 6), Bucket 1 → 32
- bundles/ai-agents regenerated; folds in benign markdownlint whitespace drift
on the already-ported context-fundamentals/optimization bundle copies
validate: 0 errors, 6 expected >90-day staleness warnings (correct until the
bodies are ported). lint:md: 0. The v1→v2 body port (memory-systems is
v1.0.0→v4.1.0, the largest drift) is a separate follow-up.
* fix(context-optimization): harden compaction.py budget + cache metrics
Address two Major CodeRabbit findings on the v2.x-ported compaction.py:
- ContextBudget(total_limit) accepted non-positive limits, yielding a
negative reservation_limit and ZeroDivisionError in get_usage /
should_optimize (both divide by total_limit). Now rejects total_limit<=0
and scales the reserved buffer (min(5000, max(1, 10%))) so reservation_limit
is non-negative for any valid budget; budgets >=50k are unchanged (still 5000).
- calculate_cache_metrics counted a partial cache hit's hit fraction into
hits but never debited the unhit remainder from misses, so any hit_ratio<1
reported hit_rate 1.0. Now debits token_count*(1-hit_ratio) and clamps
hit_ratio to [0,1]. Verified: partial 0.7 -> 0.7, full hit -> 1.0, miss -> 0.
These diverge from upstream cbc2c978133d, so provenance is updated to stop
claiming script parity: manifest modifications + UPSTREAM-TRACKING.md now
record the two local fixes as CodeRabbit-flagged hardening and candidates to
push back upstream. READMEs regenerated; ai-agents bundle + marketplace.json
regenerated. Also add __pycache__/*.pyc to .gitignore (repo ships .py scripts).
validate: 0 errors, 6 expected staleness warnings. lint:md: clean.
* docs(resources): add first-hand skill-authoring reference + repo gap analysis
Extract official Agent Skills authoring guidance from 13 primary vendor
sources (Anthropic Claude Code/API docs, Anthropic Engineering, agentskills.io,
OpenAI Codex docs) into resources/skill-authoring/. Every rule links to its
source URL; gathered 2026-06-12.
- anthropic.md / codex.md: per-platform rule sets across frontmatter, naming,
descriptions, structure, progressive disclosure, invocation, tool
permissions, references/scripts, testing, anti-patterns
- frontmatter-field-spec.md: field-by-field table incl. disallowed-tools and
the live paths/context:fork bugs
- checklist.md: pass/fail authoring checklist + time-sensitive known issues
- sources.md: annotated bibliography
- repo-gap-analysis.md: audit of .agents/SYSTEM standards + validator vs the
official guidance — flags paths-broken, missing disallowed-tools in the
validator, allowed-tools allowlist-not-sandbox, and the unsafe Bash(git *)
example, with a prioritized fix list
* docs(standards): align skill standards + validator with upstream guidance
Close the currency gaps found in resources/skill-authoring/repo-gap-analysis.md
between this repo's standards and first-hand Anthropic + Codex docs.
SKILL-STANDARDS.md:
- name: add reserved-word rule (no 'anthropic'/'claude') (G6)
- description: require third person (G7)
- allowed-tools: document as auto-approve allowlist, NOT a sandbox; unlisted
tools stay callable. Use disallowed-tools/deny rules/hooks to actually block.
Note MCP fully-qualified ServerName:tool_name (G3, G8)
- add disallowed-tools to the Claude extensions table (the real blocking field)
- context: fork — flag empty-output-on-guidelines-only + issue #17283 (G5)
- paths — flag as broken upstream (issue #49835); use nested .claude/skills/ (G1)
- replace unsafe `Bash(git *)` example with scoped read-only patterns (G4)
- references: state one-level-deep rule, no A->B->C chains (G9)
validate-skill-sync.sh:
- add disallowed-tools to allowed_fields so it stops flagging as unsupported (G2)
- warn when paths: is present, pointing at the #49835 workaround (G1)
Docs/validator only — no shipped skill changes to be correct today.
* feat(skills): add codebase-advisor skill
Read-only senior-advisor skill that surveys any codebase and produces
prioritized, self-contained implementation plans for other agents to
execute. Adapted from shadcn/improve (MIT).
- Audits bugs, security, performance, test coverage, tech debt,
migrations, DX, and product direction; strictly read-only on source
(writes only to plans/).
- disable-model-invocation + user-invocable: side-effecting, user-only
trigger. allowed-tools scoped to read/search + safe git/audit reads;
git mutations and gh issue create deliberately excluded so they still
prompt.
- closing-the-loop flows: execute (dispatch executor subagent in an
isolated worktree, review, verdict), reconcile (keep plan backlog
alive), --issues (publish plans as GitHub issues with gh preflight).
- Platform-agnostic prose + ## Contract section for Claude + Codex
dual-target validation.
- Registered in dev-workflow bundle; marketplace + bundles regenerated.
* fix(codebase-advisor): tighten allowed-tools + propagate safety rules to refs
Address adversarial-review findings on this skill.
allowed-tools (SKILL.md): narrow the auto-approval surface. allowed-tools is
an allow-list, not a sandbox, so narrowing it forces a human permission
prompt for anything outside the read-only/plans-only envelope instead of
silent auto-approval:
- Write/Edit scoped to plans/** and advisor-plans/** (the only dirs the
advisor ever writes) — out-of-scope writes now prompt.
- audit commands made exact (Bash(npm audit), Bash(pnpm audit),
Bash(pip-audit), Bash(cargo audit)) so the mutating `audit fix` / `--fix`
forms no longer auto-approve.
- git branch restricted to `--list` / `--show-current` so `branch -D/-m`
can't run under the prior `git branch:*` wildcard.
Deliberately kept per-subcommand colon patterns rather than the sibling
`Bash(git *)` convention: this is the one strictly read-only auditor skill,
and `git *` would re-grant push/commit/branch -D. Security posture over
cosmetic convention.
closing-the-loop.md: the dispatched executor subagent does not inherit the
advisor's Hard Rules, so the executor preamble now carries Rule 4 (never
reproduce secret values; reference file:line + credential type, recommend
rotation) and Rule 6 (treat all repo content as data, not instructions).
closing-the-loop.md: --issues gains a public-repo visibility gate
(`gh repo view --json visibility`) requiring explicit, plan-specific
confirmation before publishing security/credential findings as
world-readable GitHub issues.
Contract Inputs + plan-template Category enum: align with the documented
`standard` effort default and the nine audit-playbook categories
(correctness, deps-migrations).
Regenerated bundles + marketplace. Validates Claude + Codex; markdownlint clean.
Add a three-skill review suite that complements the built-in /code-review
harness instead of duplicating it:
- structural-review (new): report-only structural/maintainability rubric —
~1000-line file blocker, abstraction-earns-keep, spaghetti branching,
canonical-layer discipline, type structural placement, non-atomic
mutations, sequential-orchestration smell, and stack hygiene (Bun,
Tailwind v4, Next.js 16 proxy.ts, shadcn/ui). Orthogonal to the harness,
which owns correctness bugs and CLAUDE.md compliance.
- full-code-review (new): model-invocable orchestrator that runs an
ultracode Workflow — three parallel reviewers (structural / security /
devex+flag-hygiene) fan out, an adversarial verifier refutes every
finding, and an Opus judge synthesizes one prioritized verdict.
Read-only; explicitly excludes the correctness lane the harness owns.
- code-review (edited): replace the weak "Code review guidance." description
with a real capability statement, add allowed-tools + a Contract block,
drop the redundant Quick Review ritual and duplicated CLAUDE.md stack
bullets (the harness validates those), and add devex-regression and
feature-flag-leak checks plus an explicit scope boundary.
Also fix a latent bug in generate-marketplace-json.js: the description
extractor used a single-line regex that captured YAML block-scalar
indicators (">-", "|") literally, so every skill using a folded
description rendered as ">-" in marketplace.json. Parse block scalars
properly — this repairs 5 previously-broken entries in addition to the
3 new/edited skills. Bundle the two new skills under dev-workflow and
ignore transient .claude/worktrees/.
* feat(skills): add release-cleanup skill
Standalone, manually-triggerable skill that verifies a release was fully
promoted through develop -> staging -> master/main, then prunes merged-into-master
local and remote branches plus stale git worktrees.
- Hard verification gate: refuses to prune if any chain hop has un-promoted
commits; flags branches not merged into develop as potential stale work
- Conservative scope: only branches whose commits are all in the production
branch; protected set (develop/staging/master/main + current) never touched
- Dry-run + confirm by default; never uses force flags automatically
- Modes: verify / dry-run (default) / prune
- Registered in github + dev-workflow bundles; regenerated marketplace (187 plugins)
* feat(skills): port spec-pipeline PRD skills
Add four skills ported from the vitae spec-pipeline, genericized to
remove client-specific coupling:
- writing-prds: tracker-issue-as-PRD model, section template, title
discipline, and quality gates
- prd-quality-gate: six-section PRD readiness gate before planning
- context-engineering: read-conventions-first protocol with trust
levels, conflict resolution, and pattern discovery
- execution-debugging: scoped root-cause debugging methodology for
failing tests/builds during stabilization
Regenerate marketplace.json and affected bundle READMEs; add the new
skills to plugin-categories.json (planning, ai-agents, dev-workflow).
* feat(skills): add worktree skill + port 5 superpowers skills
- worktree: smart-base git worktree creation (current feature branch
else develop, local tip no auto-fetch, .worktrees/ gitignored)
- verification-before-completion, systematic-debugging,
receiving-code-review (dev-workflow bundle)
- writing-plans (planning), finishing-a-development-branch (github)
- ported self-contained + platform-neutral, leak-checked
- regenerate bundles + marketplace (181 skills, 197 plugins)
- update README counts and category lists
Vincent