60 Commits

Include renames

Author	SHA1	Message	Date
Defame1297andClaude Sonnet 5	58a3f402a6	docs(adr): record the review outcomes for the Research registry grammar ... - ADR-0004: add the "Amended by ADR-0028" note, following the ADR-0025 convention. - ADR-0028: correct Q5 (parse_status is gone), the skill count (38, not 39), and the question order. Q7 records the anchored, format-only sha check. Q8 records the decision to commit real Vale fixtures. A new consequence covers path confinement and list rejection. - CONTEXT.md: the `_Avoid_` entry means the bare noun, not the field. - gates.md: correct the authored-hook counts after the corpus gate. - create.md: a `none` entry backed by a reproduction must name committed fixtures in `Basis:`; use the `(digest: <full path>)` form. - gitea-releases: use the `(digest: <full path>)` form. Co-Authored-By: Claude Sonnet 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01EGHFJextYtVQseaHPDDhxB	2026-09-21 19:40:43 +00:00
Defame1297andClaude Sonnet 5	b62513d30d	docs(adr): record that Research doc names one Research registry ... ADR-0028 records the grammar decided for #121 and the alternatives rejected at each step: what `Research doc:` refers to, how an entry with no registry declares that (`none` plus `Basis:`), the FAIL and INFO tiers, the corpus-wide sweep gate, parser parity, retiring check 8, the `(removed in <sha>)` escape for Basis paths, and removing the lint entry that had no verifiable basis. Add the Research registry term to CONTEXT.md, since "registry" had no definition and "research doc" was being used for both the registry and the topic docs it digests. Refs: #121 ADR: 0028 Co-Authored-By: Claude Sonnet 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01EGHFJextYtVQseaHPDDhxB	2026-09-21 17:29:31 +00:00
Defame1297andClaude Opus 5	c84f1f4145	docs: close the self-contradictions left by the branch's own cuts ... CONTEXT.md used two terms it no longer defines. This branch deleted the Preload tax and Skill context contract entries as audit finding 31, but the Hand-invoked skill definition and the example dialogue still used both, bolded, which is this file's convention for a defined term. The definitional file contradicted itself while AGENTS.md tells every session to read it as authoritative. Rephrased in place, the way e2e957e handled the one the audit's own note records. ADR-0024 said 10 .bats files deploy across 6 skills; ADR-0025 merged two of those directories the next day, on this branch, leaving 5. It was also the only ADR ADR-0025 invalidated without an amendment banner, as was ADR-0016, which still named agent-audit in the present tense as the live enforcer. Both get the banner the other nine carry, and the figure and names are corrected in place as well, since these sit in text asserting present fact rather than a superseded decision. ADR-0019's correction block from 1614bce was inserted mid-paragraph and swallowed the original's trailing sentence, leaving the quote malformed and the next line starting lowercase mid-sentence. gates.md took the same correction and is not affected. In the audit note: two of §12's five open follow-ups were already closed (e4ed343 repointed the a8cd5e8 citations at 598a7c3; #101 closed 2026-09-16, so Closes #101 is a no-op), the same stale hash sat at :330 with a wrong line number, the vale-wrap counts had drifted from 63/19 to 65/14 and are now pinned to a commit per §1's own convention, and the deleted-suite tally said eight where the diff shows nine. Co-Authored-By: Claude Opus 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01NwD8Egs5r4ndqeFLmhusX2	2026-09-20 12:34:28 +00:00
Defame1297andClaude Opus 5	620f20b0fd	refactor(kyberforge)!: merge skill-audit and agent-audit into factory-audit ... Why The two audit skills carried 1,724 lines of byte-identical duplication: the ADR-0020 boundary resolver (1,061), vale-wrap.sh (526), the Vale style rules (44) and the Contributing-files parser (93). Nothing shared them — they were held in sync by a 413-line pre-push gate and its 797-line test suite. Sync-by-gate had already failed once: at 484357a the two parser copies drifted into different spellings of the bullet loop while a docstring asserted they were identical. That drift was behaviour-neutral and was re-unified by hand at 598a7c3, so the copies were identical at merge time — but nothing had caught it, and the next drift need not be neutral. Implementation Notes Self-containment binds BETWEEN skills, not within one. The agentskills.io spec forbids reaching across skill directories, which is why two separate skills needed embedded copies; two files inside ONE skill may source a third. That is the whole reason the merge removes duplication rather than relocating it. The union of both bodies measured 1,532 words against BODY_MAX_WORDS=900, and only 211 of those words were shared, so SKILL.md is a dispatch body. Step 0 resolves the flow from the target path before any validation, and its table mirrors validate.sh's detection exactly: a directory holding SKILL.md or a SKILL.md file (skill); a *.agent.md, or a .md directly under an agents/ directory (agent); anything else stops without running a validator. Steps 1-3 live in references/skill-flow.md and references/agent-flow.md, and gotchas that apply to one flow live in that flow's file, since it is loaded on every invocation anyway. If validate.sh reports on the other artifact type, the body restarts at Step 0. Named factory-audit rather than forge-audit because forge is a live skill, and a family prefix that matches a live sibling reads as ownership rather than membership. The description carries one arrow per boundary target, because ADR-0020 resolves only the first target after an arrow. It drops the quoted "audit this skill"-style phrases, which restated "audited" in a second register (ADR-0020's duplicate-register rule). 241 characters, Gotchas 16% of the body: no size SUGGESTIONs. The boundary resolver stays embedded in two files rather than imported: a cache-installed plugin cannot read outside its own directory, and the repo-root hook resolves via .pre-commit-hooks.yaml where entry[0] is the only token pre-commit rewrites, so no single file is reachable by both. tests/test-adr0020-contract.sh hashes both copies for byte-identity, and asserts validate.sh sources the resolver and that no third copy exists. The entry scripts classify the target from its resolved parent directory, so a bare agent filename typed inside agents/ works; resolve SCRIPT_DIR CDPATH-safely; and exit 2 when a lib-*.sh is missing, rather than dying with exit 1, the tier the flows relay as real findings. The provenance run functions stash their findings code in KYBERFORGE_PROV_RC and return 0, so validate-provenance.sh calls them UNTESTED. Testing a function's status (`f || RC=$?`) disables errexit for its entire body, and no subshell or `set -e` inside can re-arm it once the call sits in a condition context (measured, both spellings). Their error paths use `exit`, which is unaffected either way; this keeps errexit armed for anything added later. Case 0's readability guard reads the file instead of asking `[[ -r ]]`. `-r` is access(2), which answers yes for uid 0 even on a mode-000 file, and this repo's dev environment is root -- so the guard could never fire where it exists to fire. A read attempt is also the stricter question, catching EIO. This is the reasoning scripts/check-vale-style-sync.sh carried before this commit deleted it; the hazard did not go with it. All three entry scripts are CDPATH-safe, vale-wrap.sh included: both of its cd sites are cleared, the --config resolution and the directory-mirror walk, where an exported CDPATH would otherwise print a decoy path into the -print0 stream and build the mirror from the decoy's files. The two remaining bare cd calls take absolute paths, which CDPATH is never consulted for. Impact BREAKING: skill-audit and agent-audit no longer exist as invocable skills. kyberforge goes to 2.0.0 (catalog 0.4.7). Check logic is unchanged: differential runs of the old and new validators across every skill and agent produced byte-identical stdout, stderr and exit codes, and the reconstructed Python payloads differ only in comments and the references/field-inventory.md -> agent-field-inventory.md rename. One doctrine governs the tiers: exit 0 is audited and clean, exit 1 is audited with findings OR a target present but unreadable, exit 2 is that nothing was audited at all. Edge paths DID change, deliberately (full table in ADR-0025): - a missing target exits 2 (never ran), not 1, under its own "does not exist" message; detection is by path shape, so a shape-matching path that is simply absent used to reach the validator and come back as a FAIL against a file that never existed; - an unshaped target exits 2 under the generic "matches neither" message, and a directory with no SKILL.md under a third, distinct one -- three exit-2 messages, not one; - a dangling symlink or a symlink loop stays exit 1: it is present but broken, which is a finding about the artifact rather than a usage error; - a SKILL.md file path is audited as its skill directory instead of refused; - a .md agent outside an agents/ directory is refused rather than audited; - a missing script library, a missing python3, a missing PyYAML, and no argument at all each exit 2. validate-provenance.sh already exited 2 for the last two; validate.sh now matches it. .pre-commit-hooks.yaml is a published contract consumed by external repos. Both hook IDs and both files: regexes are unchanged; only entry: and description: moved. scripts/check-vale-style-sync.sh (413), scripts/sync-vale-styles.sh (21), tests/test-check-vale-style-sync.sh (797) and agent-audit/scripts/README.md (47) are deleted. The checker made 17 assertions: 6 compared the two Vale copies and are moot; 10 are rehomed into tests/test-vale-wrap.sh (case 0, cases 28-31, and the suite's Vale-absent skip); and the cross-manifest files: agreement check, which selected hooks by entry: and so could not survive both hooks sharing one, is ported as case 33 pairing hooks by id:. Cases 28, 30 and 33 carry mutation self-tests; narrowing the local skill prefilter to 6 of 38 SKILL.md files now fails the suite. Skills go 39 to 38. Pre-push goes 9 repo-authored hooks to 8. ADR: 0025 BREAKING-CHANGE: the skill-audit and agent-audit skills are removed. Both flows are served by factory-audit, which auto-detects whether it was handed a skill directory or an agent file. Co-Authored-By: Claude Opus 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01YR2CjVumUbEGWcMikcoXBD	2026-09-16 09:13:57 +00:00
Defame1297andClaude Opus 5	061bb3d5b4	docs: correct the apm-only change after a five-agent review ... A five-agent review of 718c79a and d2480b8 found no skill, agent or hook regressions (39 skills before and after) and confirmed both hook removals are genuinely moot -- verified against the tree, not taken on the commit's word. It did find one functional regression (fixed separately) and this documentation drift. Counting errors, all from a git pathspec `*` crossing `/`: - 17 .bats files shipped to consumers is really 10; 17 counted tracked paths merely containing /tests/, one of them a template asset - "roughly 88s off every push" is ~92.4s; 88 omitted validate-plugins - "roughly 70% of each plugin remains live" holds only for kyberforge; the real spread is 44.3% (bin) to 70.6%, now a table - the pre-push enforcement row was half-corrected: 33 entries stood unstruck (now 27) and 14 -> 11 switched counting basis mid-sentence - the root .claude-plugin/plugin.json was described as "kept"; it has never been tracked gates.md said "Ten hooks" above a nine-row table (11 was decremented for one removal, not two), and "both need the claude CLI" for one remaining validator. Its pretty-format-json exclude rationale claimed six alternations expanding to sixteen files in a passage headed "Mind which number you are quoting" -- four alternations, two live files; the two dead ones are dropped from the pattern. check-useless-excludes could not catch this: it only flags an exclude matching nothing at all. ADR-0024 cited ADR-0006 for a patch-bump rule it does not contain and which ADR-0015 explicitly retired; stated apm's marketplace probe order backwards (.claude-plugin/ is the last candidate, not the first, so the earlier .github/plugin/ deletion only demoted resolution); undercounted apm's skill-deploying targets as seven when there are fifteen; and never recorded that validate-plugins was removed. The symlink hedge is resolved: apm_cli/security/gate.py's ignore_non_content() drops symlinks silently on deploy while apm_modules/ materialization dereferences them, so content survives that far and vanishes at install. Accepted with no replacement guard, per decision -- kyberforge/docs/hooks.md previously asserted a guard that had been deleted with its script. Four plugin READMEs still advertised `claude plugin install`; ADRs 0001, 0006, 0013, 0014, 0015 and 0019 described deleted machinery in the present tense, 0019 most consequentially as the live justification for the SessionStart hook's .apm/ path. CONTEXT.md's "apm package" entry forbade "plugin" while using it in its own body, and "Output profile" lost the antecedent for "one catalogue serves both". run-tests.sh gains the .claude/skills/ exclusion run-bats.sh already had. Latent today -- no test-*.sh lives under any .apm/skills/*/tests/ -- but apm now deploys those directories, so one would be discovered twice. Co-Authored-By: Claude Opus 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01YR2CjVumUbEGWcMikcoXBD	2026-09-14 18:09:03 +00:00
Defame1297andClaude Opus 5	718c79af70	chore: drop the flat content mirror and native install support (ADR-0024) ... apm becomes the only supported install path. The flat mirror at each plugin root existed solely so Claude Code's native `claude plugin install` could convention-scan plugin content (ADR-0017). With no native consumers, it cost ~20,000 tracked lines plus ~2,100 lines of sync tooling and ~88s of every push to guard content apm never reads — and its only automated gate, `claude plugin validate --strict`, passes on a plugin with zero content, so it could not detect the defect ADR-0017 was created to fix. Removes the mirror (213 files), the six per-plugin manifest pairs, sync-plugin-content.sh, its 1,289-line test, the orphaned marketplace-plugins.sh, and the check-plugin-content-sync and validate-plugins pre-push hooks. The root `marketplace:` block and .claude-plugin/ catalogue stay: apm's own marketplace consumers read that same file, so `<name>@holocron` short names keep working. tests/run-bats.sh now excludes .claude/skills/. apm installs from .apm/, which carries the tests/ dirs the mirror stripped, so deployed .bats files would otherwise be discovered and double-run. Co-Authored-By: Claude Opus 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01YR2CjVumUbEGWcMikcoXBD	2026-09-14 16:59:42 +00:00
Defame1297andClaude Sonnet 5	e2e957efdd	docs: record subagent outcomes for findings 2, 31, 38 ... Three findings from the simplification audit were independently re-verified before execution, corrected, then implemented by subagents: - Finding 2 (check-executables-allow-sync): the audit's "drop it" option was found unsafe (ADR-0019 calls this failure mode silent, not "visible and recoverable" as claimed); shrunk instead of deleted, 231 -> 222 lines. - Finding 31 (CONTEXT.md): "most terms unused by skills" was found overstated (13 of 28 are model-facing must-keeps); cut only the 9 confirmed true orphans, 28 -> 19 terms. Also de-referenced one dangling pointer to a deleted term in the Flagged-ambiguities section. - Finding 38 (pc-author/pc-run): line count was found overstated (598 actual vs. 689 claimed); trimmed the two generic reference files by 60 lines while preserving house-specific content. Co-Authored-By: Claude Sonnet 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01YR2CjVumUbEGWcMikcoXBD	2026-09-13 21:03:58 +00:00
Defame1297andClaude Sonnet 5	124ce6eaa9	docs(context): remove unreferenced glossary terms (finding 31) ... Corrected scope for audit finding 31: the audit's claim that most of CONTEXT.md's 28 terms are unused was overstated (13 are must-keep, referenced in model-facing skill references/*.md files). This cuts only the 9 confirmed true orphans, independently re-verified by grep across plugins/*/.apm/, docs/, scripts/, and tests/ with zero hits outside CONTEXT.md (two had a single incidental ADR mention that doesn't constitute a dependency): Content mirror, apm-consumed install, Vale audit prefilter, Vacuous green, Management Application, Sycophancy, HOTL, Preload tax, Skill context contract. Term count: 28 -> 19. Also removed two Relationships bullets that existed solely to relate now-deleted terms (Preload tax/Skill context contract, and HITL/HOTL/Sycophancy), leaving HITL's own entry to stand alone. The Preload tax entry's self-contradiction (quoting two dated character counts immediately after saying not to quote either) is moot since the whole entry is removed. Example dialogue and flagged ambiguities sections left untouched per scope, including one now-stale bold reference to "Preload tax" in flagged ambiguities. Co-Authored-By: Claude Sonnet 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01YR2CjVumUbEGWcMikcoXBD	2026-09-13 21:02:41 +00:00
Claude Code AI - Gitea MCPandDefame1297	598a7c326a	refactor(skills): retrofit the corpus to the ADR-0020 context contract (#129) ... Retrofits all 39 skills to ADR-0020's description/body context contract, then fixes what six rounds of independent review found in that retrofit — including four ways the hot gate itself failed open. Closes #99, #107, #108, #110, #111, #114, #115, #120. ## The retrofit (waves 1-5) | | Start | Now | |---|---|---| | Description FAILs (>400 chars) | 26 | **0** | | Body FAILs (>900 words, body-only) | 9 | **0** | | Dangling routing targets | 2 | **0** | | `Kyberforge.CompositionNote` | 10 | **0** | | Preload tax | 21,005 chars | **~10,500** | Under the 12,000-char success criterion. Per-wave detail is on #99. ## The review fixes **The gate failed open four ways, three of them found after the retrofit shipped.** An unrecognised follower token made a dangling target vanish. A skill directory with no `SKILL.md` resolved as a valid target, so a commit could be green locally and red in a fresh clone — three existing fixtures were relying on that, one of which made the install-leak A/B pass vacuously. Then the free-standing `/name` sweep turned out to be gated on the sentence carrying a boundary marker, so route notation in any other sentence was invisible — not an ERROR, not a SUGGESTION, not an INFO — which left the documented "`/name` always blocks" promise false from a second direction. All four fixed and pinned. **Two checks were silently not running.** `validate-provenance.sh` checks 7-8 were dead across nine skills. Waking them exposed a deeper problem: they assume `Research doc:` names a source index, but 30 of 121 entries point at topic content documents, so every new check-7 INFO was a false positive and check 8 was saved from a false-FAIL flood only by an *unannounced* skip. Checks 7/8 are now scoped to source indexes and every skip announces itself (#121). **The retrofit's own anti-goal, four times.** ADR-0020 warns that a blunt gate gets satisfied by deleting content rather than relocating it. `diagnose` and `skill-audit` relocated prose and then read it unconditionally; `prototype` and `vale-config` deleted rules outright that survived nowhere. All four addressed. ## Verification - `bash tests/run-tests.sh --strict` — 24 suites, 0 skipped, 0 failed - `bash tests/run-bats.sh` — 325 tests, 0 failures - `pre-commit run --all-files` — 17/17 - `pre-commit run --hook-stage pre-push --all-files` — 16/16, with `apm marketplace check` and `apm pack --check-clean` run against the remote, not skipped - `scripts/skill-size-check.sh` over all 39 skills — rc 0, 0 ERROR/FAIL, SUGGESTION-only - Preload tax measured at **10,498 chars**, max description 390 — both inside budget - Every new test proven non-vacuous by a deliberate mutation of the behaviour it covers **Per-commit sync, stated accurately:** the ten commits from the latest review round each pass `check-plugin-content-sync` in isolation, verified by checking each out in a detached worktree with a clean between. The earlier gitea window (`dfacf05..bedbd1d`, nine commits) does **not** — its mirror was regenerated in one batch at `bbc7300`. An earlier revision of this description claimed the property held for every commit; it does not, and a bisect through that window lands on a red commit. **Squash-merge** to collapse it, or accept that this range is not bisectable. ## Version bump Six plugins and the catalog take a **patch**, not a minor. The branch is **89 commits — 40 `fix` / 30 `refactor` / 12 `docs` / 5 `chore` / 2 `test` — zero `feat`, zero `!`, zero `BREAKING CHANGE`** — and adds no skill, agent, command or hook. (Two earlier revisions of this section cited a stale histogram, most recently 78 commits; the figures above are measured at HEAD.) Both rules this repo ships (`forge/references/version-bump.md`, landing in this PR, and `git-commits/references/conventional-commits-spec.md`) make that a patch, and the catalog set is unchanged at 7 entries. Not settled by that: four published files were removed from the installed tree, three moved, and `caveman` gained `disable-model-invocation`, retiring its old triggers. Under a strict reading those are major-class and currently ship under `refactor:` with no marker. Whether the deployed skill surface is a public contract is written down nowhere — worth deciding, but it outlives this PR. ## Deliberately not in scope #112 (cherry-pick ownership, now resolved in favour of `git-commits`), #113 (`rtk git` normalisation), #116 (research fan-out), #101 (audit-skill merge), #122 (non-spec skill-root files), #123 (no PRD producer) stay open. #117 is the one worth reading: the contract's remedy is to move prose into `references/`, which is exactly where neither the size gate nor Vale looks — and the blind spot is wider than #117 currently records, since there is no root `.vale.ini` at all, so every ADR, `CONTEXT.md` and `README.md` is unlinted too. That blind spot let this branch carry two `level: error` `Kyberforge.SentenceOpenerThereIs` violations into `references/` files it created — `provider-adapter-author/references/provider-matrix.md:31` and `agent-audit/references/finding-criteria.md:95`. Both are reworded in `afadaae`, confirmed by routing each file through the audit's own `vale-wrap.sh` (1 error each before, 0 after). Five further occurrences sit in `references/` files already on `main`; those are the pre-existing corpus and stay with #117, which is the real fix. Also unfixed and not this PR's: `apm install` appends a duplicate `SessionStart` entry to `.claude/settings.json`, so a fresh clone cannot get pre-push green without an edit AGENTS.md warns against. Reproduces identically on `main`. Co-authored-by: Defame1297 <[email protected]> Reviewed-on: https://git.dev.rkdr.net/Defame1297/holocron/pulls/129 Co-authored-by: Claude Code AI - Gitea MCP <[email protected]> Co-committed-by: Claude Code AI - Gitea MCP <[email protected]>	2026-09-01 13:47:46 +00:00
Defame1297andClaude Opus 5	d42f6368fe	fix(docs): correct claims the first fix round asserted without measuring ... Why: two blind verifiers re-ran the five preceding commits and found four defects of the same class this branch exists to close -- a confidently stated measured claim that does not survive re-measurement -- this time inside the fixes themselves. - AGENTS.md:41 still carried both phrasings c68e864 reports having corrected. `grep -rn repo-defined` returned exactly one hit repo-wide: that line, in the file every session preloads. 4d336bb edited the line directly above it. - ADR-0021 asserted twice, in the section justifying that no gate is added, that the ADR-0020 validators "never open an apm.yml". All three open and yaml.safe_load it (skill-size-check.sh:342, both validate.sh). The conclusion survives -- none reads the description: key, and their globs are SKILL.md and *.agent.md only -- but the stated mechanism is falsified by one grep. - architecture.md said the ADR directory holds 20 numbered ADRs; c7ba3d2 made it 21, and c68e864 audited that file for exactly this class of stale count. The number is dropped rather than corrected: `ls docs/adr/` is already the index, so a count in prose is a second thing to maintain. - gates.md's new three-verdict table said `-> name` promotes an unresolved target to ERROR. Reproduced with fixtures: NAME_HYPH (skill-size-check.sh:543) requires a hyphen, so `-> gitea-prs` is checked and `-> triage` is not extracted at all, and the unicode arrow is never recognised. The SUGGESTION text advises that spelling, so taking its advice can silence the finding. The gap is now documented as a defect; nothing covers it, since the one arrow case in test-adr0020-targets.sh happens to use a hyphenated target. Implementation notes: - AGENTS.md:48's coverage claim is shrunk rather than chased. Restoring six glossary entries did not make it true: 12 more sampled terms are undefined, three of them (trigger/capability/boundary clause) used inside CONTEXT.md itself. It now says CONTEXT.md is the glossary and is not exhaustive. - CONTEXT.md's output profile and near-miss entries are corrected against their sources. The first stated a false exclusion -- .github/plugin/plugin.json IS apm-generated; only the marketplace mirror has no profile. The second inverted its source's referent: description-quality.md defines a near-miss as a query, not a sibling skill. - The strict-mode message named jq, which no suite guards on (`command -v jq` appears nowhere in tests/), while omitting python3/PyYAML, which three do. - README's git and gitea bullets now name git-workflow and gitea-workflow. ADR-0021 leaves README the only inventory and architecture.md now points at it, so the two bullets that were short had to be completed. - ADR-0018's 2026-08-14 correction is marked superseded in place. It asserted machine state in the present tense that its own 2026-08-17 note retracts. - ADR-0021's remaining errors: six files -> four (measured from de84d1b), the wiki description's length 114 -> 96 chars, the codex self-contradiction, the cost argument overstating bumps already owed for any skill addition, and two claims about files this branch went on to edit. - The "15 of 17 suites" figure is restored where I had removed it: it is a dated record of one incident, not a live count, and four sites now describe it the same way. Impact: 16/16 pre-push hooks pass, suite 24 passed 0 skipped 0 failed. No behaviour change; every edit is prose or a comment. Refs: #105 Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01TmFqzpuExLJv3m114XVE9w	2026-08-17 13:18:55 +00:00
Defame1297andClaude Opus 5	4d336bbf35	docs: stop the preloaded instruction set asserting machine state ... Why: four defects in the files every session pays for, all introduced or left behind by the trim. AGENTS.md told agents the `<plugin>:` form still resolves "because user-scope native installs were left enabled on purpose", and that a working namespaced call "is not something to fix". That premise is false on this machine: installed_plugins.json is empty, no enabledPlugins key exists in ~/.claude.json, and ~/.apm/marketplaces.json is empty. ADR-0018 already reversed itself once on this exact claim (Correction 2026-08-14) using that same enablement as its evidence, so flipping the assertion again would be the third revision in three. Both files now assert nothing about install state at all, which removes the flip-flop surface instead of re-aiming it. The other three are guard-rails whose instruction survived the trim while the caveat that made it safe did not: - The run-tests.sh line omitted --strict, so it named the one invocation that reports SKIPPED rather than failed when a dependency is missing. gates.md records this gate going green having verified 15 of 17 suites on a vale-less PATH. .pre-commit-config.yaml:70 already uses --strict for that reason. - The .claude/settings.json prohibition lost its ADR-0019 exception, so an agent applying it literally would strip apm's own merged SessionStart entry and create the drift the rule exists to prevent. - LESSONS.md still routed graduated rules to CONTEXT.md's Principles section, which this branch deleted. Implementation notes: the six terms the trim dropped while AGENTS.md still claimed CONTEXT.md glosses everything -- authoring root, content mirror, apm package, output profile, near-miss, vacuous green -- are restored as one-line entries per CONTEXT-FORMAT.md, sourced from architecture.md, gates.md and skill-audit's description-quality.md rather than reworded. ADR-0018 gets a third dated note recording the observation and the fact that the state has now been described two ways, and its stale user-scope inventory is replaced by a pointer to it; the decision it records is untouched. LESSONS.md:3 carried the identical stale claim as :5 and is fixed with it. Impact: preloaded context is now free of assertions about machine state. Refs: #105 Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01TmFqzpuExLJv3m114XVE9w	2026-08-17 12:28:30 +00:00
Defame1297	b93af30750	docs: fix a wrong pointer and two stale claims in CONTEXT.md ... Why: CONTEXT.md is an instructed every-session read, so a wrong assertion in it is cited downstream without being checked. The b9c7762 rewrite introduced one broken pointer and carried over two claims that were already false. Implementation notes: - The Preload tax entry pointed at docs/spec/gates.md for the measurement method. gates.md has no such method — it uses the 23,427-char figure once, in passing, without deriving it. The method and the current figure both live in ADR-0020, which is where a dated measurement belongs: it is superseded there deliberately, and issue #99 tracks its drift. - Dropped the "~5,900 tokens across 39 skills" measurement rather than re-measuring it. It was already wrong three days after being written (~5,340 today) and it was the only live number in the file. Every sibling entry is one definitional sentence plus a pointer fragment; this one now matches, and CONTEXT-FORMAT.md:43 asks for exactly that. - Dropped "Written by the session-handoff skill or directly by the human" from the LESSONS.md entry. No session-handoff skill exists — LESSONS.md:7 records it as planned work. Who writes a file is not its definition. Impact: removes the only rot surface in the file and the only assertion in it that names an artifact the repo does not have. Refs: #99	2026-08-17 10:06:26 +00:00
Defame1297	b9c7762463	docs: trim CONTEXT.md to a glossary and demote VISION.md ... Why: CONTEXT.md is an instructed every-session read at 33,799 bytes (~8,450 tokens), and CONTEXT.md:17 layered docs/VISION.md on top. After the AGENTS.md trim, that left ~9,650 tokens of instructed reads sitting behind a file whose own format contract — grill-with-docs/CONTEXT-FORMAT.md:43, "Keep definitions tight. One sentence max." — it was not following. 22 glossary entries averaged 190 words; the top four were 55% of the file, and one ("Vale audit prefilter") was 1,444 words of pre-commit forensics filed as a definition. Implementation notes: - CONTEXT.md rewritten to CONTEXT-FORMAT.md's prescribed template: ## Language (five clusters, 22 terms with _Avoid_ aliases), ## Relationships, ## Example dialogue, ## Flagged ambiguities. 33,799 -> 9,762 bytes. - Vale prefilter forensics moved to docs/spec/gates.md under nine subsections: the two-copy style layout, vale-wrap.sh and the Vale 3.15.2 text.frontmatter.description limitation, the --config argv defect (E100), glob scoping, the rule inventory, and 0-files-means-NOT-RUN. - Instruction-file format and the bidirectional-reference principle moved to docs/spec/architecture.md, the latter flagged as aspirational: no instruction file carries a `when:` field, only 2 of 39 skills do, and the reference scanner script it names does not exist. - Added a per-plugin scope table to architecture.md so "which plugin owns this skill" survives the trim, and corrected its claim that the content index lives in providers/claude-code/CLAUDE.md — that file is now two import lines and the index sits in core/AGENTS.md. - "Repo and Gitea are the only source of truth" moved from CONTEXT.md's Principles into AGENTS.md session rules; it was operative guidance in a glossary. docs/VISION.md and LESSONS.md added to the on-demand list. - The apm-consumed install entry (432 words) was deleted outright: all four consequences are already carried by README.md, ADR-0018, gates.md and AGENTS.md. - ADR-0013, ADR-0015 and ADR-0017 each pointed at CONTEXT.md sections that moved; amended with dated supersession notes rather than left dangling. Impact: the every-session set drops from ~15,700 to ~4,140 tokens across both passes (-74%). The deleted "lint plugin" entry was also stale on a safety claim — it said lint-runner inherits Edit, but ADR-0016 restored `disallowedTools: Edit, Write, NotebookEdit` and CONTEXT.md was never updated. Refs: #99	2026-08-17 09:28:01 +00:00
Defame1297	64ffb9f35a	docs: make ADR-0020 match what actually shipped, and record what did not ... The ADR was written against base commit `f9b919d` and then not updated as the implementation moved, so several of its numbers were measuring one thing and being read as another — the exact conflation the ADR exists to stop, reproduced inside it. Corrections, all reproducible now that each figure states its method: - The preload tax is 23,427 chars / ~5,900 tokens, not 23,612 / ~6,200. - `MAX_WORDS=2770` is a density proxy for the agentskills.io ~5,000-token ceiling, not "2× p90". Neither percentile reaches it: 2× the body-only p90 is 2,698 and 2× the whole-file p90 is 3,052. Reading it as a percentile pairs a whole-file gate against a body-only distribution. - `apm-workflow` is a 421-word body; 554 is its whole-file count. `skill-author` and `agent-author` were 2,623 and 2,582 body words — 2,760 and 2,758 whole-file, which is where "within twelve words of the gate" comes from. Two numbers for one file is the point, and only one of them is what either gate measures. - Every `file:line` citation now says it resolves against `f9b919d`, since this change rewrites most of the cited files. Three things the ADR asserted that no validator implemented are now filed by tier in an exhaustive enforcement table — deterministic, prose-pattern, or auditor judgment — because a rule filed under "Enforcement" that nothing enforces is the failure mode this ADR is most exposed to. The Gotchas entry count moves to SUGGESTION to match the script; the paraphrase FAIL is marked as an auditor's, since semantic equivalence is not pattern-matchable. Two gaps recorded rather than quietly left: - The agent body-gate exemption lives in `agent-audit`'s validator and in the `skill-size-check` hook's `SKILL.md`-only `files:` pattern — *not* in `scripts/skill-size-check.sh`, which measures whatever path it is handed and today reports 900-word body FAILs on `git-orchestrate` (933), `gitea-orchestrate` (1,199) and `apm-orchestrate` (1,080). Agents escape by file pattern, not because the script knows the difference, so widening that pattern would silently enforce a gate this ADR declines to set. - The `skill-audit`/`agent-audit` merge is deferred to #101. This change made the split deeper, not shallower: the dispatch retrofit took them from 3 and 4 reference files to 7 and 8, and their two same-named `description-quality.md` files now differ on 100 of ~120 lines after normalising skill/agent. The merge reopens ADR-0008 and touches every call site in `skill-author`, `agent-author` and `forge`, so it is its own change. #100 carries the dangling-target fixes. AGENTS.md and CONTEXT.md take the same corrections plus the two live setup changes: PyYAML is now a hard requirement rather than an optional accelerator (a fallback that mis-parses an unfamiliar scalar shape reports a clean pass on a file it never measured), and `.claude/settings.json`'s `pretty-format-json` exclusion is documented as load-bearing rather than as a tidy-up candidate. LESSONS.md's autofix entry is corrected on its own provenance, which it got wrong in both directions. `git log --date=iso` puts the introducing commit at 18:47 and the fix at 21:54 — three hours, not "weeks" — and `git branch -a --contains` puts the introducing commit on this branch only, not on main. It was manufactured inside the same PR that diagnosed it. The added lesson is that "pre-existing" is a claim about history and history is queryable: a defect found while working on a branch feels inherited, and the feeling is not evidence. Refs: ADR-0020, #99, #100, #101	2026-08-16 16:41:45 +00:00
Defame1297	1c6eababb0	docs(adr): set a context contract for skill and agent authoring ... Every installed skill's name+description is preloaded every session - 23,612 chars (~6,200 tokens) across 39 skills. The authoring rules optimised for triggering reliability with no counter-pressure on size: skill-author:104 and description-quality.md:21 both mandate padding, while skill-author:102 (the rule that would deflate it) is judgment-only and absent from description-quality.md's FAIL conditions. ADR-0020 sets the description shape (trigger + one capability + boundary), two-tier size gates sitting below the unchanged agentskills.io ceilings, a mandatory dispatch pattern for multi-branch bodies, a Gotchas constraint, an agent-side delegation check, and invocation as a design axis. Gates ship blocking with no baseline. Adds five CONTEXT.md glossary entries: preload tax, skill context contract, dispatch body, hand-invoked skill, delegation discipline. Refs: ADR-0020	2026-08-14 19:39:14 +00:00
Defame1297andClaude Opus 5	c9fe2e8ab2	docs: correct the namespace claim and record the hook fixes ... AGENTS.md and CONTEXT.md asserted that the `<plugin>:<skill>` form "no longer resolves here". It does: ~/.claude.json still enables core, git, gitea, kyberforge and lint at user scope, which ADR-0018 left in place deliberately. Both names are live at once, so a working `gitea:gitea-prs` is the user-scope copy answering — not evidence that the apm install is broken and not something to "fix". ADR-0018 contradicted itself on this, claiming every namespaced reference went stale while its own "User scope is untouched" consequence said otherwise; recorded as a dated correction alongside the existing one. Bare names stay the documented default. Five stale pre-push hook counts updated for the new check-executables-allow-sync gate: 13 -> 14 repo-defined hooks, 15 -> 16 reported by pre-commit, eleven -> twelve passing offline. The gate reads two local manifests and makes no network call, so the SKIP pair for offline pushes stays exactly two. "Four pre-push hooks shell out to apm" is unchanged and still correct — the new hook parses YAML directly. ADR-0019 gains the timeout arithmetic, the singular/plural failure and why mocking every apm call hid it, and a consequence recording that the trust gate is keyed on version rather than content: an edit to a hook script landing on main deploys and executes unattended on the next session start, since the dependency is unpinned and the hook runs `apm update --yes`. That is accepted, not overlooked, but it is why the gate should not be read as a supply-chain control. Co-Authored-By: Claude Opus 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01X7GvKuJfy2WrdBmUttV4DT	2026-08-14 18:31:42 +00:00
Defame1297andClaude Opus 5	2e8732a8e5	build(apm): consume holocron plugins through apm instead of plugin install ... Why: The repo published apm packages but consumed them the old way — `claude plugin install <name>@holocron`, six plugins enabled per project. Dogfooding stopped one layer short of the install tooling kyberforge itself ships. Implementation notes: - Root apm.yml declares the six packages as dependencies.apm git+path objects against the holocron remote. Object form over `<name>@holocron` aliases on purpose: an alias first needs `apm marketplace add`, which writes to ~/.apm/marketplaces.json — user scope, absent on a fresh clone. Unpinned against the default branch, matching the autoUpdate the native install had. - apm.lock.yaml is committed; .claude/skills/, .claude/agents/ and apm_modules/ are gitignored regenerable install output. Committing the deployed skills would add a third mirror of content ADR-0017 already governs two copies of. - .mcp.json is generated by apm from plugins/bin/.mcp.json, so the obsidian MCP server survives the switch. - .claude/settings.json is reduced to {"hooks": {}}. apm replays the install into a scratch tree and diffs, so any repo-owned key there is permanent drift that fails apm-audit-ci. Nothing was lost: enabledPlugins was empty after the uninstall and the only hooks entry was PreToolUse: []. - tests/run-bats.sh and tests/run-tests.sh exclude apm_modules/. It holds a full copy of every plugin, and a copied .bats file resolves its helpers against the dependency root rather than this repo — 334 tests, 167 failures before the exclusion. Impact: Skills are now unnamespaced — `git-commits`, not `git:git-commits` — because apm deploys plain project skills with no plugin to prefix. AGENTS.md, CONTEXT.md and docs/spec/architecture.md are updated accordingly. Root apm.yml now declares dependencies, which arms apm-audit-ci's lockfile-exists check for the root manifest. External consumers are unaffected: the marketplace manifests are untouched and `apm pack --check-clean` stays clean. Project scope only. ADR: 0018 Co-Authored-By: Claude Opus 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01X7GvKuJfy2WrdBmUttV4DT	2026-08-14 17:15:17 +00:00
Defame1297andClaude Opus 5	013b913bd4	docs: correct claims the apm conversion left false ... Documentation asserted things the code no longer did, which is how several of this round's defects survived three review passes. - `docs/spec/architecture.md` still described the pre-APM model — "each plugin has a `plugin.json` manifest" — when no such file exists. AGENTS.md routes agents here for the current structure, so it was live drift, not archive. Also cited ADR-0012 where ADR-0003 is meant. - AGENTS.md never said `.apm/` is the sole hand-edited source, while the generated mirror is byte-identical with no marker — an agent reading only AGENTS.md would edit the mirror and find out at pre-push. It also omitted that `apm` and `jq` are now required to push, unlike the `vale` bullet that exists for exactly that reason, and understated the pre-push gate. `apm marketplace check` hard-fails offline and `--offline` does not help, so the `SKIP=` escape hatch is documented rather than new machinery built. - ADR-0017 carried hardcoded line numbers that drifted twice within one PR, and said `mcpServers` reinjection was real-syncs-only where the script's own header says both modes. Line numbers dropped rather than corrected. - ADR-0015 asserted issue #90 was closed. It is open. Reworded to defer to the issue's own state rather than depend on someone remembering to close it. - ADR-0014 said both audit skills pass `--config`; both SKILL.md files say pass none, and passing one fails with E100. The ADR was wrong. - ADR-0007 cross-referenced an archived ADR-0011 whose number was later reused. Disambiguated with a note — renumbering a published ADR rewrites an immutable record and breaks every existing citation. - CONTEXT.md claimed `lint-runner` is report-only via a missing `Edit` tool. Plugin-scope APM agents cannot express `tools:` (ADR-0016), so it is report-only by instruction now; ADR-0016 accepted that regression but CONTEXT.md was not updated. - Recorded two undocumented consequences of the conversion: `displayName` dropped from all six compiled manifests and `owner.email` from the marketplace, and `mattpocock-skills` silently version-pinned and manually maintained. - Wrote the version-bump policy issue #90 specified but never delivered. Its previous carrier, `marketplace-author`, was deleted in this PR, leaving the per-package rule documented nowhere. - README fixes: kyberforge listed skills belonging to the `git` plugin and a deleted hooks path, `bin` advertised an agents directory it never had, and the docs index listed files that do not exist. Refs: #90 Co-Authored-By: Claude Opus 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01X7GvKuJfy2WrdBmUttV4DT	2026-08-14 01:53:26 +00:00
Defame1297andClaude Sonnet 5	911daddbe2	docs(kyberforge): fix stale references in CONTEXT.md ... plugin-author was deleted by this PR (ADR-0015, apm-workflow is the successor) but still appeared as a live example in the skill-composition list. The Gitea-canonical-issue-tracker line also cited ADR-0017 (the unrelated plugin-content-mirror ADR added by this PR) instead of ADR-0007. Co-Authored-By: Claude Sonnet 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01X7GvKuJfy2WrdBmUttV4DT	2026-08-13 21:29:23 +00:00
Defame1297	7c3c867e00	docs(kyberforge): fix stale vale-prefilter regex in CONTEXT.md ... The Vale-audit-prefilter glossary entry still quoted the pre-.apm/- migration file-scoping regexes (^plugins/[^/]+/skills/..., ^plugins/[^/]+/agents/...). The actual pre-commit hooks require .apm/ in the path and .agent.md for agent files; updated the glossary to quote the live patterns from .pre-commit-config.yaml verbatim, including a third stale occurrence in the skill-size-check description that the PR #95 review missed. Refs: #95	2026-08-13 19:47:47 +00:00
Defame1297	a873e93050	fix(kyberforge): keep .github/plugin/marketplace.json synced ... apm.yml only declares claude and codex marketplace output profiles -- codex writes a differently-shaped file to .agents/plugins/marketplace.json, so nothing regenerates the legacy Copilot CLI path at .github/plugin/marketplace.json. It was hand-synced once during the #90 conversion and had drifted (missing the category field added when codex output was enabled) with no gate to catch it. scripts/sync-marketplace-mirror.sh keeps it byte-identical to the compiled .claude-plugin/marketplace.json, wired as a pre-push check so it can't go stale silently again. Refs: #90	2026-08-13 18:54:10 +00:00
Defame1297	38f1ba4e03	fix(kyberforge): bridge apm content to Claude Code's flat plugin discovery ... Claude Code's (and Copilot's) native plugin installer has zero awareness of .apm/ nesting -- it convention-scans only flat skills/, agents/, commands/, hooks.json at each plugin's root. Confirmed via strings on the installed claude binary and live installs of git@holocron/gitea@holocron/kyberforge@ holocron, all reporting Skills(0) Agents(0) Hooks(0) post ADR-0015's apm conversion. Root cause (apm_cli/core/plugin_manifest.py): apm's plugin.json compiler deliberately strips skills/agents/commands keys, assuming the host already auto-discovers those convention directories -- it has no model of .apm/ being host-visible at all. Separately, apm's own bundle exporter (apm_cli/bundle/plugin_exporter.py, behind `apm pack --format plugin`) implements the correct .apm/ -> flat mapping, but only ever targeted build/<name>-<version>/, a path nothing in marketplace.json's source: points at. scripts/sync-plugin-content.sh wraps that bundle exporter and copies its agents/, skills/, commands/, instructions/, extensions/, and merged hooks.json back into each plugin's own root as a second tracked compiled-output category -- same governance status as .claude-plugin/plugin.json: generated from .apm/, never hand-edited. tests/ subdirectories are excluded from the mirror (dev fixtures, not host-visible runtime content; several hardcode a relative repo-root walk-up sized for the .apm/-nested depth, which breaks when duplicated one level shallower). Applied for real across all 6 plugins and verified two ways: `claude plugin validate --strict` passes on every real plugin directory, and a live `claude --plugin-dir <path> -p "list skills/agents"` behavioral test confirms content is now actually discovered. Also, from the same issue #90 review round: - scripts/check-manifests.sh pointed at each plugin's root-level plugin.json (checking skills/hooks/mcpServers/agents pointer fields) -- that file was a stale near-duplicate of .claude-plugin/plugin.json nothing else read or wrote, now deleted across all 6 plugins. check-manifests.sh is rewritten to validate .claude-plugin/plugin.json instead, and drops the pointer-field checks entirely (nothing to check -- those fields are correctly absent by design). Content-presence drift is now check-plugin-content-sync's job, a new pre-push hook wired in .pre-commit-config.yaml. docs/adr/0017 records the root cause and decision in full, including two rejected alternatives (patching plugin.json's path fields directly -- apm's compiler strips them on every run; pointing marketplace.json at apm pack's build/ output -- a version-suffixed non-source directory nothing can install from without an extra build step). ADR-0015 and CONTEXT.md are updated to point at it. Refs: #90	2026-08-13 16:59:03 +00:00
Defame1297	7910b8b12c	docs(kyberforge): fix path drift and content gaps from apm conversion ... The apm conversion (5e23250) moved skills/agents to plugins/<name>/.apm/ and deleted plugin-author/marketplace-author, but a review against issue #90's Definition of Done found several stale pre-conversion references left behind by straight git-mv's, plus one real content gap: - ADR-0014 still documented the old flat vale-prefilter paths in 6 places, despite ADR-0015 claiming it had been updated. - ADR-0015 also overclaimed: it said ADR-0014 had both a skills/ and an agents/ path regex updated, but ADR-0014 never had an agents/ path regex to begin with (its one "agents" mention is a Vale glob-section identifier, not a filesystem path). Corrected the wording. - CONTEXT.md's Skill glossary entry, its Vale-prefilter section, and its plugin-author/marketplace-author forward-pointer all still described the pre-conversion layout or a "pending issue #90" state that has since landed. - LESSONS.md and two skill test READMEs pointed at skill-author/ skill-audit/agent-author paths without the .apm/ segment. - apm-workflow/references/marketplace.md cited plugin-author/SKILL.md's Gotchas for the Claude Code reserved plugin-name-prefix list, but that list was never actually carried into apm-workflow during the conversion despite ADR-0015 claiming it was. Recovered the list from git history and inlined it directly rather than leaving a dangling citation. - agent-author/references/deployment-modes.md had an example contradicting its own stated .apm/agents/ convention two lines above. Refs: #90	2026-08-13 07:50:56 +00:00
Defame1297andClaude Sonnet 5	5e232503c4	feat(kyberforge): execute plugin-to-apm marketplace conversion ... Why: ADR-0015 established that Microsoft APM (apm.yml + .apm/) should replace this repo's hand-authored plugin.json/marketplace.json model, with those files becoming compiled output of `apm pack` instead of files edited by hand via the (now-retired) plugin-author/marketplace-author skills. Issue #90 was the deferred execution of that decision, gated on #88 (apm tooling) and #89 (apm-native agent-author/skill-author routing). Implementation notes: - All six plugins (bin, core, git, gitea, kyberforge, lint) now carry apm.yml + .apm/{skills,agents,hooks} as their authoring source. Skills moved with a plain git mv (content-identical across targets). Agents were re-authored, not moved: per ADR-0016, .apm/agents/*.agent.md compiles verbatim to both Claude and Copilot, so plugin-scope agents now carry only name/description/model/source_keys -- no tools: field, no Claude-only knobs (isolation, maxTurns, effort, memory, permissionMode). - Root apm.yml registers all 7 marketplace packages (6 local plus mattpocock-skills as a remote entry) under versioning: per_package, matching this repo's existing independent-plugin-versioning practice. - .claude-plugin/marketplace.json and every plugin's plugin.json are now apm-pack-compiled output, verified against the prior hand-maintained content: same names/descriptions/versions/licenses/authors, only cosmetic serialization differences (JSON key order, owner email vs. url, Unicode escaping). - plugin-author and marketplace-author are retired now that apm-based authoring fully replaces their job; kyberforge bumped 1.3.1 -> 1.4.0 for that removal, and the root marketplace catalog bumped 0.3.1 -> 0.3.2 to match, per the version-bump convention now documented in apm-workflow's reference docs instead of a dedicated script (apm has no native version-bump automation). - Fixed hardcoded pre-.apm/ path assumptions across .pre-commit-config.yaml, .pre-commit-hooks.yaml, scripts/check-scope-walkup-sync.sh, scripts/sync-vale-styles.sh, scripts/check-vale-style-sync.sh, six plugins' root plugin.json (stale skills/hooks/agents pointer fields that check-manifests.sh validates), and several tests/*.bats and tests/*.sh fixtures -- including a bats REPO_ROOT relative-path depth bug (10 files, one extra .apm/ directory level to walk up) and a vale probe-path isolation regression introduced mid-fix. - Corrected empirically-wrong assumptions surfaced this session in apm-workflow/apm-install's own reference docs: `apm marketplace package add` does not accept local paths (only owner/repo remote shorthand -- local packages are registered by editing apm.yml's marketplace.packages[] directly); `apm compile` is a consumer-side AGENTS.md/CLAUDE.md generator, not the plugin.json producer, and hard-fails on skill/agent-only packages without --clean; `apm plugin init <name>` nests a stray subdirectory when run with a positional name arg from inside a same-named directory; no native Copilot marketplace output profile exists; .mcp.json is merged into the compiled plugin.json content-aware and target-scoped, with no dependencies.mcp entry needed for simple passthrough; pipx is the correct pip fallback on externally-managed Python environments. - Renamed agent-author's copilot.agent.md template asset to copilot.agent.md.template so apm compile's recursive *.agent.md glob stops misparsing the placeholder template as a real agent primitive. Impact: plugin.json and marketplace.json are compiled artifacts from here on -- editing them by hand is no longer the workflow; edit apm.yml/.apm/ and run apm pack. CONTEXT.md's Plugin/Plugin marketplace glossary entries reflect this. ADR-0001 is marked superseded, ADR-0006 moot, and ADR-0010 updated for the new .apm/agents/ path (project/user scope unaffected, per ADR-0016). Full local verification: claude plugin validate --strict on all 6 plugins, apm audit --ci, apm marketplace check, check-manifests.sh, and the full test suite (165/165 bats, 13/13 shell scripts) all pass clean. Fixes: #90 Refs: #88, #89 ADR: 0015 ADR: 0016 Co-Authored-By: Claude Sonnet 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01Ub96PyaSRD9BHPktotj1pC	2026-08-12 18:21:24 +00:00
Defame1297andClaude Sonnet 5	591b9cccb8	fix(kyberforge): resolve second round of PR #91 review findings ... Two review passes on PR #91 (correctness + simplification) found the prior fixup commit (d6fd9b6) left the deprecation notice it added half-applied, cited a nonexistent ADR, and introduced/compounded a few duplicate restatements of the same facts across apm-workflow's skill files and apm-orchestrate's Hard rules. - plugin-author/SKILL.md cited ADR-0016 (doesn't exist) instead of ADR-0006 for the version-parity invariant. - The deprecation banner on plugin-author/marketplace-author wasn't reflected in their routing `description:` frontmatter, forge's routing table, either kyberforge README skill table, or CONTEXT.md — now propagated consistently; routing behavior is unchanged since issue #90 (repo-wide apm conversion) hasn't landed yet. - apm-orchestrate's `configure` operation only covered scaffolding a new package, not editing an existing apm.yml (e.g. removing a marketplace.packages[] entry, which has no dedicated `apm` CLI verb and is just a manifest edit). Added `edit-config`, intentionally ungated — a local file edit isn't the same class of irreversible action as `apm publish`, and normal review already gates the commit. - Deduplicated facts restated 3-4x across SKILL.md/references/ADR boundaries (audit semantics, reserved name prefixes, marketplace-add direction, registries precondition), and trimmed configure.md's ~55-line apm.yml schema dump — copied near-verbatim from the research doc — down to a compact key list with a pointer, matching install.md's existing terse cross-referencing style. Deliberately left as-is: apm-orchestrate's parallel/sequential fan-out logic stays inline rather than extracted to a shared reference, since neither git-orchestrate nor gitea-orchestrate need it yet — premature extraction for a single caller. Co-Authored-By: Claude Sonnet 5 <[email protected]> Claude-Session: https://claude.ai/code/session_0186ERbyACLRuRxPRnqwpa4m	2026-08-11 15:20:46 +00:00
Defame1297andClaude Sonnet 5	e16c3dc95f	docs(kyberforge): fix PR #91 review findings in ADR-0015 and apm docs ... ADR-0015's Decision bullet stated ADR-0001 was superseded as present fact while Consequences framed it as conditional on issue #90 — reworded Decision to match, and added a Supersedes header (repo convention per ADR-0007/ADR-0010) so the pending change is visible from the title. Also fixed a forward-note that misattributed the pre-existing .agent.md convention (ADR-0005/0010) to the APM move, and reworded the rejected-plugins/apm/ rationale to acknowledge the shipped skills are actually generic rather than repo-specific. CONTEXT.md's Plugin/Plugin-marketplace glossary entries got a forward-pointer to ADR-0015 so a session-start read surfaces the pending manifest-authoring change. apm-orchestrate.md/.agent.md: removed a Hard Rule requiring ${VAR} secret indirection that can never fire (the orchestrator has no Edit/Write tool and never touches apm.yml — apm-workflow's SKILL.md already owns this rule where content is actually written); removed compile-manifest-check, an operation with no backing apm CLI command anywhere in the research docs; added explicit CLI mappings for add-package/add-marketplace so an executing agent can't invert them. marketplace.md's release steps shelled out to raw git add/commit/ tag/push — replaced with a pointer to the git-commits/git-remotes skills per AGENTS.md's "prefer plugin skills over raw shell" rule. compile.md now states audit runs after compile/pack (audit scans deployed output, not the source apm.yml) — answers a reviewer question that had no documented answer. Refs: #91 Co-Authored-By: Claude Sonnet 5 <[email protected]> Claude-Session: https://claude.ai/code/session_0186ERbyACLRuRxPRnqwpa4m	2026-08-10 21:23:07 +00:00
Defame1297	302f6d0c19	fix(lint): tighten the SKILL.md word ceiling to 2770 ... MAX_WORDS=2900 was calibrated to the corpus median density and carried no margin: at the densest observed 7.22 chars/word (~1.81 tokens/word) it permits ~5,240 tokens against the 5,000 it proxies for. 2770 holds the worst observed density under the ceiling. The largest SKILL.md is 2,489 words, so the change costs nothing today — 281 words of margin — and the header comment now argues the new calibration rather than swapping the digits. Both enforcement points move together, and a new test asserts they agree, since a SKILL.md passing its own audit while the commit hook blocks it is the disagreement this pair exists to prevent. CONTEXT.md is deliberately left ungated: it is 2,816 words, and gating it would block the build. Recorded here so the omission reads as a decision rather than an oversight. skill-audit's manual-fallback path listed only the line ceiling, so an agent taking that path passed an oversized SKILL.md the hook then rejected. The word ceiling is now named alongside it. agent-audit is deliberately unchanged: the size hook scopes to SKILL.md only and agent-audit's validate.sh has no word gate, so claiming it there would be false. The Vale research doc still showed the MDX {/* vale off */} form under a Markdown heading, contradicting CONTEXT.md and vale-run's troubleshooting reference — that form suppresses nothing in plain .md. Fixed in both places it appeared. tests/run-tests.sh used mapfile (bash 4.0+) with unguarded array expansion, though AGENTS.md tells contributors to run it and macOS ships bash 3.2. It now collects via a while-read loop over process substitution and guards every expansion. The newline-delimited find|sort pipeline is kept rather than -print0 with sort -z, whose BSD portability is the weaker link, and which matches mapfile -t's previous behaviour exactly. Refs: #85 ADR: 0013	2026-08-09 17:23:51 +00:00
Defame1297	57654c4b02	docs(lint): correct the Vale scalar, size-ceiling and release-gate claims ... Four claims in shipped agent-facing docs did not match verified behaviour. These are read as ground truth by agents in other repos, so each was reproduced against vale 3.15.2 before rewriting: - CONTEXT.md and `vale-config/SKILL.md` said both `>` and `|` block scalars break the description scope. `|` does not — it lints normally and fires every alert, while `>` yields zero. An agent following the old text would rewrite a working `|` description into a plain multi-line scalar, which genuinely does break, inverting the intended remediation. Both now name the forms that do break and state that `|` does not. - CONTEXT.md and ADR-0013 described the size hook as failing only above 500 lines, omitting the 2900-word gate it also enforces. Both now describe the pair and state that `validate.sh` checks the same two. - ADR-0014 recorded an accepted residual — a wholesale `assets/` deletion going unflagged — that commit 14c2c91 closed. Left as the point-in-time record and amended with an update describing the union-with-tag-manifest mechanism, following the amendment precedent in ADR-0005. - `vale-config/SKILL.md` asserted a fresh `.vale.ini` fails until `vale sync` runs, contradicting its own note that built-in styles need no download. The claim is now scoped to package styles; this repo's two configs declare no packages and lint clean with zero syncs. Also repoints AGENTS.md at the seven `gitea:*` skills — the `bin:gitea` route it named no longer exists. Refs: #85	2026-08-09 15:44:28 +00:00
Defame1297andClaude Opus 5	e9234f6d8a	docs(lint): correct the Vale exit-code and glob-scoping claims ... cli-reference.md said vale exits non-zero for any alert at or above MinAlertLevel. The exit code keys on error-level alerts alone; MinAlertLevel filters display only. LESSONS.md records this exact misconception as costing two review rounds, and this research doc is the cited provenance source for the skills that state it correctly. CONTEXT.md claimed a SKILL.md outside plugins/ matches no glob section. [**/SKILL.md] matches any path ending in SKILL.md — the sentence is a stale leftover from the path-scoped globs at cbc33d9, and contradicted its own paragraph two sentences earlier. The NOT-RUN 0-files guard it justifies is correct and is unchanged; only the rationale was wrong. CONTEXT.md also cited the local files: regex as the scoping mechanism, where the shipped manifest deliberately stays layout-agnostic. ADR-0014 records the entry[0]-only prefixing constraint as the reason the self-locating design is required, and that no entry may grow a repo-internal path argument. Co-Authored-By: Claude Opus 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01MCQ648fLSFXPHGZdQ8gn58	2026-08-09 13:06:52 +00:00
Defame1297	1164f3abad	fix(lint): make Vale prefilter portable via the plugin ... skill-audit/agent-audit's Step 1 resolved vale-wrap.sh/.vale.ini via `git rev-parse --show-toplevel`, which returns whichever repo the skill happens to run in. Inside ai-development that works; in any external repo that installs kyberforge@holocron as a plugin, it resolves to that repo's own root, which has no .vale.ini — the prefilter silently fell back to full LLM judgment. ADR-0013 named this as a deliberately deferred gap. Vale's config/styles/wrapper now ship inside the plugin itself: a canonical copy in agent-audit/assets/vale/ (Kyberforge + KyberforgeCopilot, the superset agent-audit needs) and a smaller duplicate in skill-audit/assets/vale/ (Kyberforge only) — per the no-cross-skill-path rule already established for plugin cache-installs. Both skills resolve these relative to their own directory, same as scripts/validate.sh already does. A new root .pre-commit-hooks.yaml exposes both copies plus skill-size-check so any external repo can enforce the same rules via `repo: <this-repo-url>, rev: <tag>` in its own pre-commit config, independent of Claude Code entirely — the same mechanism covers CI. This repo's own pre-commit hook now consumes the identical plugin-bundled copies via repo: local (not a third root copy, and not a pinned self-reference, which would lint working-tree edits against the last tagged release instead of the change being made). Split into vale-audit-prefilter-skill/-agent hooks after confirming, by diffing the full corpus against both old and new config before deleting the old files, that one combined hook pointed at only one copy silently 0-file- skips the other file type. scripts/check-vale-style-sync.sh guards the two copies against drift, wired at pre-push alongside check-manifests. ADR: 0014	2026-08-09 10:04:19 +00:00
Defame1297andClaude Opus 5	149d564f6a	fix(lint): make the Vale gate actually gate, drop VagueQualifier ... Round-3 review of PR #85 found the "enforcing" pre-commit hook enforced nothing. Vale's exit code keys on error-level alerts alone: five of the six rules were level: warning, so they exited 0, and pre-commit hides output from a passing hook — the alerts were invisible and blocked nothing. ADR-0013 rejected a report-only trial tier and then shipped one by accident. Flatten every rule to level: error. Vale's own exit code is then correct, so the hook entry drops to a bare vale-wrap.sh call and the graded error->FAIL / warning->SUGGESTION mapping disappears from both audit skills: every alert is a FAIL, in the gate and the audit alike. No ignorable tier, matching shellcheck, the test suite and conventional-pre-commit. Delete Kyberforge.VagueQualifier. Measured against the 41 skill/agent files as they stood before the rule ever ran: 2 hits. One marginal ("very different" -> "fundamentally different"), one an unfixable false positive — caveman/SKILL.md quotes "of course" as an example of filler, a mention not a use — which forced the only Vale suppression comments in the repo. Those four lines go with it; two of them were dead anyway, suppressing a frontmatter-scoped rule on a body line. Held-out prose (273 files) fired 15 times, 9 inside out-of-scope research examples and the rest one word in two idioms in a single doc. SentenceOpenerThereIs survives: 22 held-out hits, both in-corpus hits clean rewrites, zero suppressions. Widen .vale.ini's globs to [**/SKILL.md], [**/agents/*.md] and [**/*.agent.md]. The plugins/*/-prefixed globs scoped nothing — Vale's * crosses /, so they already matched docs/research/examples/**/agents/*.md and assets/templates/SKILL.md, the two paths CONTEXT.md claimed they excluded. Scoping is and was the hook's files: regex. The old globs also hid a silent false negative: a skill outside plugins/ matched no section, so Vale reported 0 files and exited 0, which both audits read as clean. They now treat a 0-file run as NOT RUN and fall back to full judgment. Also: - vale-wrap.sh resolves relative --config values and file arguments against the caller's cwd, as vale does, instead of the repo root, which hard-errored from a subdirectory and silently skipped flattening for file args that did not resolve from the root. Absolute paths inside the cwd are relativized so reports cite resolvable paths, not scratch ones. - vale-run's exit-code model was documented backwards ("exits non-zero whenever it finds an alert at or above MinAlertLevel") and would have led anyone following it to build a gate that passes everything. Its Markdown suppression syntax was MDX-only and does not suppress in .md; corrected in the skill and its troubleshooting reference, with backtick/fence exemption documented as the first resort. - skill-size-check.sh fails only above 500 lines, agreeing with skill-audit's validate.sh <= 500 pass. - ADR-0013 and CONTEXT.md amended to match, recording why graded severities cannot gate. Verified: 9 test scripts / 15 vale-wrap cases pass; vale-audit-prefilter, skill-size-check and shellcheck pass --all-files; check-manifests and claude plugin validate --strict clean. New tests fail against the old script (3 of them) and pass against the new one. Co-Authored-By: Claude Opus 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01MCQ648fLSFXPHGZdQ8gn58	2026-08-08 20:42:15 +00:00
Defame1297andClaude Sonnet 5	792d3e1852	fix(lint): resolve round-1 and round-2 review findings on the Vale prefilter ... Addresses PR #85's outstanding review items after grilling the open questions against ADR-0013/CONTEXT.md/ADR-0010: Blocking fixes: - vale-wrap.sh: replace json.dumps() escaping (which silently defeated Vale's frontmatter scope on any description containing a quote, backslash, or non-ASCII char — ~58% of the corpus) with a single-quoted YAML scalar, substituting a Unicode right single quote for embedded apostrophes rather than '' doubling (Vale's frontmatter scanner isn't a full YAML parser and silently truncates on '' too). - vale-wrap.sh: fix a blank-line-inside-a-folded-description truncation bug via indentation-based, blank-line-tolerant body capture; narrow flattening to `>`-style scalars only (`|` already works unflattened). - skill-audit/agent-audit Step 1: make the vale-wrap.sh invocation cwd-independent via git rev-parse --show-toplevel, fixing a bug where no single cwd satisfied all three Step 1 commands. - styles/Kyberforge/VagueQualifier.yml: prune 17 tokens verified false-positive-dominated on this repo's own voice via a real corpus sweep (obvious, clearly, usually, several, simple, easy, completely, simply, tiny, etc.), keep 13 with real or unattested noise. Revert the 28 prose "fixes" those tokens drove across 14 skill files back to their original, correct wording, including a functional regression to caveman/SKILL.md's own filler-word list (a mention, not a use) — now guarded with vale-off comments against recurrence. Gaps: - --minAlertLevel=warning on the pre-commit hook and Step 1 invocation so warning-level rules actually surface, without collapsing the FAIL/SUGGESTION severity mapping skill-audit/agent-audit rely on. - vale-wrap.sh: fix --config=<path> equals-form, absolute-path silent no-op, and a zero-file-argument stdin hang. - Route vale-run and lint-runner through a documented wrapper script when a target repo has one, instead of unconditionally recommending bare `vale`. - Wire Kyberforge.VagueQualifier/SentenceOpenerThereIs into skill-audit/ agent-audit's dimension-mapping prose (Body discipline). - Add plugins/lint/sources.md provenance for lint-runner (ADR-0010). - Sync both marketplace.json lint-entry descriptions with plugin.json. - Retune skill-size-check.sh's MAX_WORDS 5000->2900 (measured ~1.6-1.7 tokens/word on this repo's corpus, the old value gated at ~8,500 tokens against a stated 5,000 ceiling); fix the >/>= line-count boundary and wc -l undercount on files with no trailing newline. - Document the vale binary as a Setup prerequisite in AGENTS.md. - Fix SentenceOpenerThereIs's dead regex alternative and add a real sentence-start anchor/scope. - Fix a stale docs/research/docs/vale/ index pointer in kyberforge's docs README (moved to plugins/lint/ in e1a5403). - Rewrite ADR-0013's Consequences section past-tense to describe what actually landed, and record the styles-portability limitation (repo-root placement stays intentional; deferred to a separate session per this PR's review). Test coverage: 9 new vale-wrap.sh fixtures (quotes, backslash/unicode, blank-line paragraphs, --config= form, zero-arg/absolute-path handling, literal-block no-regression) and boundary-pair tests for skill-size-check.sh's line/word ceilings. bash tests/run-tests.sh: 9 scripts + 125 bats assertions, all passing. scripts/check-manifests.sh and claude plugin validate --strict: clean. Co-Authored-By: Claude Sonnet 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01MCQ648fLSFXPHGZdQ8gn58	2026-08-08 20:21:21 +00:00
Defame1297andClaude Sonnet 5	3324a73225	feat(lint): expand Vale audit prefilter into a broader plugin-content harness ... Deferred item from PR #85 review. Per ADR-0013: cherry-picks two low-noise rules from trialing write-good/alex against the real corpus (VagueQualifier, SentenceOpenerThereIs) into styles/Kyberforge rather than adopting either package wholesale (both are tuned for blog prose and were noisy on this repo's terse, imperative instruction files - see the ADR's rejected-rule list). Adds a new skill-size-check pre-commit hook enforcing agentskills.io's 500-line/5,000-token SKILL.md ceiling, currently unenforced. Fixes the 28 resulting violations across 20 existing SKILL.md/agent files so the enforcing pre-commit hook lands clean. governance.md/CONTROLS.md were evaluated and excluded as rule sources - they're org/CI-infrastructure controls, not prose patterns Vale can express. Co-Authored-By: Claude Sonnet 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01QUDczvw1H3eEeMD29Q9Lbi	2026-08-08 20:20:58 +00:00
Defame1297andClaude Sonnet 5	bbb0dcd21a	fix(lint): flatten multi-line frontmatter descriptions before Vale runs ... Vale's text.frontmatter.description scope silently stops matching once the description is a YAML block scalar spanning 2+ physical lines — the style used by most skills/agents in this repo. scripts/vale-wrap.sh flattens the description to one line in a scratch copy (preserving the repo-relative path and total line count) before invoking real vale, and both audit skills plus the pre-commit hook now call it instead of vale directly. Also tightens the pre-commit hook's file glob to single path segments so it can't cross into docs/research examples or asset templates the way the audit skills' scoped invocations already avoid. Addresses PR #85 review feedback. Co-Authored-By: Claude Sonnet 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01FxG5T8EJDgkABXxuneuFfn	2026-08-08 20:20:58 +00:00
Defame1297andClaude Sonnet 5	cbc33d952e	feat(kyberforge): wire Vale as deterministic prefilter for skill-audit/agent-audit ... Adds repo-root .vale.ini plus a custom Kyberforge style (description-opener, vague-wording, and generic reference-pointer padding rules) and a KyberforgeCopilot style scoped to .agent.md files (Use proactively check). skill-audit and agent-audit Step 1 now run vale against the specific file(s) being audited and defer the corresponding Description/Patterns/Body checks to its output instead of re-deriving them by LLM judgment, per the split proposed in issue #84. Closes #84 Co-Authored-By: Claude Sonnet 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01FxG5T8EJDgkABXxuneuFfn	2026-08-08 20:20:58 +00:00
Defame1297andClaude Sonnet 5	f326df4861	chore(lint): register lint plugin in marketplace and document scope ... Adds the lint plugin entry to both marketplace manifests and records the resolved scope/structure decisions from grilling in CONTEXT.md: standalone repo-agnostic plugin, split vale-config/vale-run skills, report-only lint-runner agent, audit-pipeline wiring deferred. Co-Authored-By: Claude Sonnet 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01FxG5T8EJDgkABXxuneuFfn	2026-08-08 20:20:58 +00:00
Defame1297	533364029a	docs(agents-md): shrink AGENTS.md and prefer plugin skills over shell ... AGENTS.md had grown to duplicate content owned elsewhere: behavioral rules already active globally via ~/.agents/AGENTS.md, a VISION.md read-on-demand entry CONTEXT.md already covers at session start, and setup/testing/commit instructions that explained hook mechanics the git plugin's pc-run/git-commits skills already own. It also gave no explicit steer toward using installed plugin skills over raw shell commands, so agents defaulted to shelling out to git directly. - Added a "Prefer plugin skills over raw shell" section mapping operations (commits, branches, hooks, issues/PRs, linting, AGENTS.md itself) to the skill that owns them. - Collapsed Setup/Testing/Commit-conventions into one section, keeping only the two genuinely non-obvious gotchas (missing default_install_hook_types, bats submodule auto-init). - Removed the "Subagent orchestration" section: its content was mostly universal Agent/Task/worktree-tool facts, not specific to working in this repo, so it moves to core/instructions/subagent-orchestration.md (deployed globally via install.sh, referenced from core/AGENTS.md's content index) rather than staying repo-local. - Removed agentsmd-author's "not this repo's own" scope exclusion in CONTEXT.md (ADR-0012 never mandated it) so this task could route through it, and folded the forge-routing rule it left behind into CONTEXT.md's existing Skill composition entry. AGENTS.md: 50 -> 40 lines. Full test suite and manifest check pass.	2026-07-24 21:19:17 +00:00
Defame1297	1fcee54c1e	docs(context): fix stale ADR-0012 references to correct ADR-0002/0003	2026-07-23 17:31:04 +00:00
Defame1297andClaude Sonnet 5	6c8ea8e8f0	feat(core): add agentsmd-audit skill files ... The previous commit only landed the research-folder rename — a multi-path git add silently failed and left CONTEXT.md, ADR-0012, and the actual skill files unstaged. This lands them: the agentsmd-audit skill itself (three deterministic validators for secrets, structure, and drift against a target repo's AGENTS.md), its bats test suite, provenance record, and the CONTEXT.md/ADR entries documenting why this lives in core rather than kyberforge. Co-Authored-By: Claude Sonnet 5 <[email protected]>	2026-07-23 17:08:19 +00:00
Defame1297andClaude Sonnet 5	7e3cb90359	feat(kyberforge): add forge routing skill for factory artifact classification ... Grills intent, classifies target artifact type (skill/agent/plugin/marketplace entry) against a fully descriptive table, then routes to the matching author skill via fork subagent (falling back to inline when fork is unavailable or the flow needs live interaction). Adds an independent clean-context audit recheck after each skill/agent route, looping author-then-audit until the recheck comes back clean, since the author skill's own inline audit shares context with the work it verifies. Updates CONTEXT.md's Skill composition entry to describe this recheck loop and adds forge's provenance chain (references/sources.md). Refs Defame1297/holocron#61 Co-Authored-By: Claude Sonnet 5 <[email protected]>	2026-07-04 16:45:50 +00:00
Defame1297	3b5b1b5199	docs(spec): remove overview.md, rewrite architecture.md for plugin model ... ## Why overview.md described the chunk-based delivery model, which is superseded by the marketplace/plugin pivot. architecture.md was equally stale: it described .agents/skills/ as the canonical skills source (directory does not exist), a provider-manifest.sh symlink mechanism (never built), and sync.sh / init-project.sh as existing scripts (Chunk 6, not yet built). ## Implementation Notes - overview.md deleted; all cross-references scrubbed from AGENTS.md, CONTEXT.md, and three notes/research files - architecture.md fully rewritten: content deployment model reflects actual install.sh behaviour (DEPLOY_FILES / DEPLOY_EXECUTABLES / DEPLOY_DIRS); plugin model section added listing all 5 plugins; directory structure section removed (was describing a layout that no longer exists) - "Chunk 6" phase label → "planned"; "chunk workflow" removed from AGENTS.md description - Fixed broken path docs/HUMANS.md → docs/wiki/HUMANS.md in governance layer and core/instructions/governance.md Refs: #15	2026-06-28 19:53:19 +00:00
Defame1297andClaude Sonnet 4.6	ee42e746f2	docs(context): remove duplicates and stale chunk references ... ## Why CONTEXT.md had grown stale and noisy after the plugin/Gitea pivot. Working context section duplicated AGENTS.md verbatim; Skills entry still described the defunct .agents/skills/ direct path; several glossary entries carried stale "Chunk 4" / "Chunk 6" framing from the superseded delivery model. ## Impact - Working context principle removed (live copy is in AGENTS.md) - Skills glossary is plugin-only (direct path confirmed absent from repo) - Skill composition, AGENTS.md glossary, and Bidirectional reference principle no longer reference chunk numbers Refs: #15 Co-authored-by: Claude Sonnet 4.6 <[email protected]>	2026-06-28 17:45:14 +00:00
Defame1297andClaude Sonnet 4.6	893f540645	docs(context): align CONTEXT.md with plugin/Gitea model ... ## Why Part of issue #15 (refactor: align repo with marketplace/plugin model). docs/issues/ and docs/prd/ are gone; Gitea is now the canonical tracker (ADR-0017). LESSONS.md glossary entry needed to survive the upcoming ROADMAP.md slim-down. ## Impact - Docs convention no longer lists docs/prd/ or docs/issues/ naming entries - NNNN explanation scoped to ADRs only - Provider-agnostic issue tracker entry drops file-based-phase language - LESSONS.md has a first-class glossary entry Refs: #15 ADR: docs/adr/0017-gitea-canonical-issue-tracker.md Co-authored-by: Claude Sonnet 4.6 <[email protected]>	2026-06-28 17:28:52 +00:00
Defame1297	4d061bd199	feat(kyberforge): add plugin-author and marketplace-author skills ... ## Why Plugin and marketplace management had no governed authoring path. Creating or updating a plugin required knowing the dual-manifest convention, version parity rules, and directory skeleton by memory — nothing enforced consistency or guided the process. `/plugin-author` closes that gap by owning the full plugin scaffold lifecycle: create, update, rename, and release. `/marketplace-author` handles the marketplace-facing side: register, deregister, and update plugin entries in `marketplace.json`. ADR-0016 codifies the version parity convention (identical `version` in both `plugin.json` and `.claude-plugin/plugin.json`) that `/plugin-author` now enforces. The two plugin.json files in this repo are backfilled to comply (keys also sorted to pass the pretty-format-json hook). CONTEXT.md gains glossary entries for "plugin scaffold" and "version parity" so future agents have shared vocabulary for these concepts. ## Implementation Notes `/plugin-author` ships a `scripts/new-plugin.sh` scaffold script that generates the directory skeleton and both manifests in one shot; the skill calls the script rather than generating files ad hoc so the scaffold is reviewable and repeatable. Version parity is an invariant, not a suggestion — the skill will fail loudly on create/update if the two versions would diverge. ADR: docs/adr/0016-plugin-version-parity.md	2026-06-28 10:45:03 +00:00
Defame1297andClaude Sonnet 4.6	8dc5241c1c	docs: add ADR-0014 and provenance chain glossary entries ... Record the decision to add INFO as a third skill-audit finding level (observational, non-actionable, does not affect pass/fail). Add Provenance chain and INFO (finding level) to CONTEXT.md glossary. Co-Authored-By: Claude Sonnet 4.6 <[email protected]>	2026-06-27 09:09:43 +00:00
Defame1297andClaude Sonnet 4.6	e50c98f722	chore: move skills and evals to plugins/bin, remove legacy root configs ... Skills and evals migrated from .agents/ to plugins/bin/ plugin directory. Remove .mcp.json, provider-manifest.sh, and skills-lock.json legacy artifacts. Co-Authored-By: Claude Sonnet 4.6 <[email protected]>	2026-06-25 19:18:41 +00:00
Defame1297andClaude Sonnet 4.6	7dfbc9897d	docs: update CONTEXT.md with plugin and marketplace glossary entries ... Updates Skills glossary to document both direct and plugin-based deployment paths. Updates META.md path to reflect write-skill move to kyberforge plugin. Adds Plugin and Plugin marketplace glossary terms. Co-Authored-By: Claude Sonnet 4.6 <[email protected]>	2026-06-20 18:13:38 +00:00
Defame1297andClaude Sonnet 4.6	76cdbdff7a	chore: roadmap housekeeping and orientation rule ... - Mark 0017, 0018 phase 1 and phase 2 HITL as complete in roadmap - Add pre-0019 cleanup block: 0018 phase 3, write-eval refactor, eval updates - Add orientation question rule to CONTEXT.md — read ROADMAP and open issue handoffs before answering "what's next?" questions - Note close-out workflow gap in 0018 phase 3 grill questions Co-Authored-By: Claude Sonnet 4.6 <[email protected]>	2026-05-26 19:30:53 +00:00
Defame1297andClaude Sonnet 4.6	e3cc0b65f4	refactor: write-skill phase 1 refactor — grill, implementation, lessons ... Complete 2026-05-18 workstream for write-skill refactor (issue 0018 phase 1). Grill output (handoff in docs/issues/0018-factory-write-skill.md): - 6-section standard replaces 8: Role and When/When not dropped (not in agentskills.io spec; description carries trigger scope and negatives) - Frontmatter reduced to 3 fields; provenance moves to META.md (progressive disclosure — not loaded at every skill scan) - SKILL-TEMPLATE.md and META-TEMPLATE.md as authoritative copy-fill artifacts - CATEGORIES.md as self-contained category reference in skill directory - Copy and fill explicitly split into separate process steps for determinism New files in .agents/skills/write-skill/: - SKILL-TEMPLATE.md — 6-section template with XML blocks and inline examples per section - META-TEMPLATE.md — provenance schema with inline-commented YAML; source vs references explicit - CATEGORIES.md — self-contained category table (no runtime dependency on factory docs) - META.md — write-skill's own provenance (v1.1, self-authored) SKILL.md rewritten: 8-step process, XML blocks (<requirements>, <steps>, <checks>), 3-field frontmatter, copy-then-fill steps explicit. Supporting docs updated: - skill-implementation-workflow.md: SKILL-TEMPLATE.md as authoritative template; source:/references: now reference META.md; when: marked resolved - factory-integration-decisions.md: frontmatter spec corrected - ROADMAP.md: authoring standard description updated - CONTEXT.md: Source field entry corrected; META.md added to glossary - docs/spec/overview.md: 2026-05-18 refactor entry added - docs/issues/0018: handoff status updated; acceptance criteria marked complete LESSONS.md: 3 entries added in grill session (cargo-culted body sections, provenance fields in frontmatter, copy-fill determinism) + 1 from implementation (planning meta-commentary does not belong in deployed artifacts). Co-Authored-By: Claude Sonnet 4.6 <[email protected]>	2026-05-18 06:48:46 +00:00
Defame1297andClaude Sonnet 4.6	2631142a0e	fix: architecture review corrections — CONTEXT.md trim and eval backtrack verification ... - Remove Fleet, Symbolic oversight, and Data classification tiers from CONTEXT.md glossary: Fleet is Phase 2 only; the other two duplicate always-on governance.md content - Drop now-stale governance test assertions for the removed terms - write-skill eval: add section-ordering assertion; fix duplicate prompt across two deterministic tests - write-eval eval: tighten plan-shown assertion to require per-case detail (query + type), not just "a list of test cases" Co-Authored-By: Claude Sonnet 4.6 <[email protected]>	2026-05-17 19:30:39 +00:00