gitleaks false positive (U1, Gitea issue #2):
- 'Token routing: Haiku/Sonnet/Opus' in ai-coding-factory-session.md:90
triggers generic-api-key on entropy match of "Token". Not a credential.
- ROADMAP.md now documents this pattern and triggers the same rule.
- Both .gitleaks.toml (deployed, read by hook) and scripts/gitleaks.toml
(source for setup-gitleaks.sh deploys) updated and aligned. Previously
out of sync — deployed file had docs/research/.* already; source did not.
ROADMAP.md: governance workstream Phase 2 expanded with 7 immediately-
actionable test suite gaps and 5 Chunk 6 CI gaps, all mapped to
CONTROLS.md requirements. Housekeeping updated with audit entry.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Gv5iNACZxumtF2k6TsK18q
Per repo convention, .gitkeep files are removed when the directory is
first populated with real content. Both directories are awaiting their
first ARD and Bug Brief respectively (Chunk 3+ work).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Gv5iNACZxumtF2k6TsK18q
claude plugin validate scans all .md files in agents/ as agent
definitions and warns on missing YAML frontmatter. The file was a
contributor guide, not an agent. Kyberforge ships no agents, so the
agents/ directory is now correctly empty.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Gv5iNACZxumtF2k6TsK18q
Two related fixes exposed when install.sh was first staged post-audit:
1. shellcheck invocation in setup-hooks.sh lacked -x, causing SC1091
(info) to fire for any .sh file that sources another, blocking the
pre-commit hook on legitimate scripts.
2. The shellcheck source= directive in install.sh pointed to
'deploy-manifest.sh' (bare filename). With -x, shellcheck resolves
this from CWD (repo root), where the file doesn't exist. Updated to
'scripts/deploy-manifest.sh' — the correct repo-root-relative path.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Gv5iNACZxumtF2k6TsK18q
- neuledge-context v1.2: document that --libs identifiers must include
version suffix verbatim from `context list` (e.g. name@latest);
add rebuild workflow for packages with bad crawl/low section count;
add failure cases for get_docs returning Package not found and
/reload-plugins not restarting stdio MCP processes
- .mcp.json: fix all --libs identifiers to include @latest suffix;
update claude-code-docs to @2.1.98 (rebuilt from GitHub, 636 sections
vs 9 from the previous bad web crawl)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TP4EGbBg3XMcyF28Lx78XJ
- Fix claude mcp add scope flag: -s user for global, -s project for
per-project --libs (--project flag does not exist)
- Project scope writes to .mcp.json (committed); not settings.local.json
- Document dual-scope pattern and expected conflict warning
- Document MCP tools not available mid-session after claude mcp add;
require /reload-plugins or new session
- Expand context add step with llms.txt-first workflow for registry gaps
(Anthropic, Claude Code, MCP docs not in public registry)
- Fix self-check: explicit scope flag required, context list for identifiers
- Add .mcp.json with project-scoped context serve --libs for this repo
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TP4EGbBg3XMcyF28Lx78XJ
Adds a complete cross-cutting skill to install, configure, and manage
@neuledge/context — a local-first MCP server that delivers version-specific
library docs to AI agents via SQLite FTS5.
Includes:
- SKILL.md with 9-step process: install, global MCP registration, per-project
--libs scoping, package management, auth, custom registry, upgrade, uninstall
- setup-neuledge-context.sh: pinned version install, idempotent version check
- secure-context-config.sh: chmod 600 on ~/.context/config.json after auth
- 13-case test suite covering both scripts (all pass)
- eval.yaml with 6 trigger tests and 4 output tests
- references/: context-cli-reference.md, http-mode.md, install-notes.md
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TP4EGbBg3XMcyF28Lx78XJ
trap '...' RETURN inside a function is NOT local to that function in bash
— it persists in the calling scope and fires on every subsequent function
return. After install_shellcheck set the trap, it fired again when
ensure_tool returned with $tmp_dir unbound, causing nounset abort.
Fix: change install functions from {} to () (subshell bodies) and use
trap EXIT instead of RETURN. The trap is now scoped to the subshell and
cannot leak to callers.
Also fixes double _os() call in install_jq and removes redundant local
declarations (subshells don't need them).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TP4EGbBg3XMcyF28Lx78XJ
setup-hooks.sh now installs shellcheck, jq, and yq if absent rather
than warning and continuing. Follows the same install pattern as
setup-gitleaks.sh (curl + install to TOOL_INSTALL_DIR=/usr/local/bin,
OS/arch detection, pinned versions).
Pinned versions: shellcheck 0.10.0, jq 1.7.1, yq 4.44.3.
The deployed pre-commit hook retains its runtime fallbacks as a safety
net for environments where tools are removed after setup.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TP4EGbBg3XMcyF28Lx78XJ
Two bugs in setup-hooks.sh:
1. awk+mv to replace a marker block created a 644 temp file, losing the
exec bit. chmod +x after every write_block call fixes this. Regression
test added to idempotency block.
2. set -euo pipefail in the deployed pre-commit hook caused grep to exit 1
when no files of a given type were staged, aborting the hook. Changed
all filter pipes to process substitution with || true so no-match is
handled gracefully.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TP4EGbBg3XMcyF28Lx78XJ
Adds setup-hooks.sh and check-manifests.sh as the deterministic
enforcement layer described in docs/research/governance_principles/CONTROLS.md.
- commit-msg: conventional commits pattern check (hard block)
- pre-commit: shellcheck on .sh, jq on .json, yq on .yaml/.yml,
SKILL.md frontmatter validation; optional tools degrade gracefully
- pre-push: full test suite + manifest cross-reference check
- check-manifests.sh: validates marketplace.json plugin sources,
plugin.json skill/hooks/mcpServers path references
- Marker-based blocks (idempotent, composable with gitleaks)
- 33 integration tests across two test scripts
Run scripts/setup-hooks.sh to install into any repo's .git/hooks/.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TP4EGbBg3XMcyF28Lx78XJ
No longer needed — kyberforge plugin-create provides a bundled template that
serves as the canonical scaffold reference. Remove hello-world from marketplace
manifests and update docs accordingly.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Move all evals into each skill's own evals/ directory and test_scripts.sh into
marketplace-architect/scripts/ so test artefacts live alongside the code they test.
Also fix: hooks.json array→object, displayName title-case, marketplace.json owner
placeholders, and .github/plugin/marketplace.json metadata-wrapper schema divergence.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds plugins/, .agents/evals/, and .claude-plugin/ to the structure
section. Clarifies that .agents/skills/ contains directly-deployed skills
only; marketplace and factory skills now live in plugins/kyberforge/.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Renames plugins/kyberforge/skills/create-plugin/ to plugin-create/ to match
the directory-based skill name Claude Code uses for slash commands. Adds
.claude/settings.json with kyberforge plugin enabled. Gitignores
.claude/settings.local.json (machine-local MCP permissions).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Updates Skills glossary to document both direct and plugin-based deployment
paths. Updates META.md path to reflect write-skill move to kyberforge plugin.
Adds Plugin and Plugin marketplace glossary terms.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds plugin marketplace workstream section documenting Phase 1 completion.
Updates skills pipeline note and pre-0019 cleanup paths to reflect skills
and evals now living in plugins/kyberforge/.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Updates overview.md and architecture.md to document the kyberforge plugin,
the moved skills and evals, the removal of templates/, and the new plugins/
directory in the repo structure.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Moves create-plugin, marketplace-architect, write-skill, and write-eval
from canonical .agents/skills/ into plugins/kyberforge/skills/, along
with all bundled sub-files, evals, and the plugin-marketplace-architecture
research doc. Bundles templates/plugin/ into create-plugin/assets/plugin-template/
so the skill is self-contained after install-time caching. Removes
templates/plugin/ and docs/research/plugin-marketplace-architecture.md
from the repo root as they are now exclusively in the plugin.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Scaffolds the kyberforge marketplace management plugin (create-plugin and
marketplace-architect skills will live here). Renames the plugin-create
skill directory to create-plugin to match the canonical kebab-order convention.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds the plugin-create skill (.agents/skills/plugin-create/) that scaffolds
a new plugin from templates/plugin/, substitutes PLUGIN_NAME/AUTHOR_* markers,
registers the plugin in marketplace.json, runs claude plugin validate ., and
hands off to /marketplace-architect. Includes evals and the generic template
with all components (agents, skills, hooks, MCP, bin, docs) with per-directory
READMEs explaining what goes where and which tool reads each directory.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
23 tests covering the full JSON-RPC 2.0 protocol surface:
initialize handshake, silent notifications/initialized, tools/list
schema, tools/call with and without args, unknown tool error,
unknown method error, and invalid JSON resilience.
Fixed assert helpers to use grep -qF -- to prevent leading-dash
patterns (like -32601) from being parsed as grep flags.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Minimal dependency-free Node.js MCP server (JSON-RPC 2.0 over stdio).
Exposes one tool: say_hello. Handles initialize, tools/list, tools/call,
and SIGTERM cleanly. No npm packages required — uses only readline.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Applies the same shared-field sync logic to the two marketplace.json
files that we already applied to plugin.json: name, owner.name,
description, version, and the full plugin catalog (name, source,
description per entry) must match across .claude-plugin/ and
.github/plugin/ manifests.
Fixes .github/plugin/marketplace.json to use the canonical Copilot
schema (description and version nested under metadata) rather than
a copy of Claude's top-level format. Adds owner field to both files.
Validate.sh handles the structural divergence by extracting values
from either location before comparing.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds every cross-compatible component between Claude Code and Copilot CLI:
skills (shared), agents (per-tool .md vs .agent.md), hooks (per-tool
paths), and .mcp.json (shared). Both plugin.json manifests now carry all
shared identity fields (name, description, author, license, keywords)
with Copilot-specific component paths only in the root manifest.
Updates validate.sh sync check to verify shared identity fields rather
than demanding content equality, since component path declarations
legitimately diverge between tools.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds marketplace scaffolding (.claude-plugin/marketplace.json,
.github/plugin/marketplace.json) and a hello-world proof-of-concept
plugin to validate the format before migrating real skills.
Also fixes inventory.sh to include .agents/ in the hidden-dir exception
list so audits correctly surface the 16 existing skills.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds a new skill for creating, managing, and adopting plugins across
Claude Code and GitHub Copilot CLI marketplaces. Includes three Bash
scripts (inventory, gen_manifests, validate), three reference docs
(cross-compat, claude-code, copilot-cli), a test harness with 18
passing tests, and an eval.yaml. Also adds the `marketplace` category
to CATEGORIES.md and commits the plugin marketplace architecture
research doc that informed the skill design.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Behavioral tests for write-eval, write-skill, and write-docs run via
fresh-context subagents (HOTL). All process steps verified correct.
Caveman defects surfaced during testing logged in 0028 for upgrade-skill.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Insert explicit self-check step (step 9) before HITL (step 10);
self-check runs after write-eval so all items are verifiable
- Remove HITL from self-check checklist — HITL may occur across a
PR boundary after the session ends
- Fix frontmatter constraint and self-check item to acknowledge
optional `model:` field alongside `allowed-tools`
- Conflict-check sub-agent now also reads factory-integration-decisions.md
with explicit precedence rule: integration decisions override factory
principles — prevents false positives from deliberately overridden decisions
- Bump to v1.5
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- AGENTS.md: add factory principles and factory-integration-decisions to
on-demand content index so they are discoverable for skill design work
- write-skill: insert conflict-check step (step 3) — sub-agent reads
constitution and factory principles after grill, before any writing;
hard gate with explicit self-check item; renumber steps 3–8 → 4–9
- META.md: bump to v1.4
Closes the gap identified in PRD chunk-3-skills-library §sub-agent-usage:
conflict checking against constitution and factory principles was specified
but never wired into the write-skill process.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add sub-file constraint: content-type split rule (explains vs. directs),
three spec-defined optional directories (scripts/, references/, assets/),
one-level-deep rule, and wiring syntax requirement
- Update output format section to list optional sub-files as a third output
- Add self-check item for sub-file placement and wiring
- Update SKILL-TEMPLATE.md constraints and output format examples to match
- Bump META.md to v1.3
- Add two LESSONS.md entries: research agents presenting synthesis as spec
fact; META-TEMPLATE fix deferred with explicit do-not-apply note
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add model: sonnet to SKILL.md frontmatter (Claude Code extension; correct
location per research — runtime config belongs in frontmatter, not META.md)
- Document model field in SKILL-TEMPLATE.md with factory §9 routing guidance
- Wire grill output explicitly to trigger description step (step 3 now references
agreed name/category/purpose from grill rather than drafting independently)
- Strengthen eval self-check: presence check → coverage check (trigger cases +
at least one output case required)
- Bump META.md to v1.2 (2026-05-26)
- Add three LESSONS.md entries: META-TEMPLATE comment retention, overlap check
scope (deployed dir not just repo), model field placement boundary
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Complete 2026-05-18 workstream for write-skill refactor (issue 0018 phase 1).
Grill output (handoff in docs/issues/0018-factory-write-skill.md):
- 6-section standard replaces 8: Role and When/When not dropped (not in
agentskills.io spec; description carries trigger scope and negatives)
- Frontmatter reduced to 3 fields; provenance moves to META.md
(progressive disclosure — not loaded at every skill scan)
- SKILL-TEMPLATE.md and META-TEMPLATE.md as authoritative copy-fill artifacts
- CATEGORIES.md as self-contained category reference in skill directory
- Copy and fill explicitly split into separate process steps for determinism
New files in .agents/skills/write-skill/:
- SKILL-TEMPLATE.md — 6-section template with XML blocks and inline examples per section
- META-TEMPLATE.md — provenance schema with inline-commented YAML; source vs references explicit
- CATEGORIES.md — self-contained category table (no runtime dependency on factory docs)
- META.md — write-skill's own provenance (v1.1, self-authored)
SKILL.md rewritten: 8-step process, XML blocks (<requirements>, <steps>, <checks>),
3-field frontmatter, copy-then-fill steps explicit.
Supporting docs updated:
- skill-implementation-workflow.md: SKILL-TEMPLATE.md as authoritative template;
source:/references: now reference META.md; when: marked resolved
- factory-integration-decisions.md: frontmatter spec corrected
- ROADMAP.md: authoring standard description updated
- CONTEXT.md: Source field entry corrected; META.md added to glossary
- docs/spec/overview.md: 2026-05-18 refactor entry added
- docs/issues/0018: handoff status updated; acceptance criteria marked complete
LESSONS.md: 3 entries added in grill session (cargo-culted body sections,
provenance fields in frontmatter, copy-fill determinism) + 1 from implementation
(planning meta-commentary does not belong in deployed artifacts).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Remove Fleet, Symbolic oversight, and Data classification tiers from
CONTEXT.md glossary: Fleet is Phase 2 only; the other two duplicate
always-on governance.md content
- Drop now-stale governance test assertions for the removed terms
- write-skill eval: add section-ordering assertion; fix duplicate prompt
across two deterministic tests
- write-eval eval: tighten plan-shown assertion to require per-case
detail (query + type), not just "a list of test cases"
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Adds write-eval, the first factory meta-skill. Produces eval.yaml test
files for skills following the two-section schema (trigger_tests +
output_tests) with provider-agnostic string assertions and show-plan-
then-merge-on-rerun behaviour. Hand-written bootstrap — subsequent
skills will use write-eval to produce their own evals.
Also tightens skill-implementation-workflow.md step 5b: per-section
options walk-through is now a named gate before writing, separate from
the synthesis grill. LESSONS.md entry added.
HITL behavioral test pending.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Create AGENTS.md at repo root and core/AGENTS.md as provider-agnostic
sources of always-on rules. Slim both CLAUDE.md files to thin adapters.
Deploy core/AGENTS.md → ~/.agents/AGENTS.md via deploy-manifest.sh.
Update three test suites to check correct locations post-refactor.
All automated tests pass (57 instructions, 106 install, 25 governance).
HITL behavioral test plan in test-instructions-and-docs.sh scenarios 9–12.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
14 issues created covering AGENTS.md refactor prerequisite, skill
implementation workflow grill, bootstrap skills (write-eval, write-skill),
remaining factory skills, and one issue per skill category group through
to chunk closure. All HITL; acceptance criteria for 0017-0028 to be
refined after 0016 grill session.
Doc updates: CONTEXT.md PRD/issue scope clarified (HOW distribution
across architecture-review and issue design notes); ROADMAP.md housekeeping
updated with bootstrap order and issue range; spec/overview.md recent
changes entry added; PRD updated (skills-index: delete → update).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Skills-index is now explicitly the canonical build reference for trigger
descriptions, constraints, and categories. Roadmap entry updated with
category breakdown, flat-path naming reconciliation (ADR-0009), authoring
standard reference, and delete-when-done instruction. Spec overview updated
to match.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
13 manual scenarios run across instructions and governance layers (two
rounds for failures). Fixed four rules that lost to RLHF defaults:
- Exploratory question format: tightened with boundary framing; added
@import CONTEXT.md to repo CLAUDE.md and a standing rule to check
docs/adr/ and ROADMAP resolved entries before answering design questions
(3-round iteration to resolve)
- File-edit intent: added counter-example to stop clarification-seeking
- Push confirmation: reframed as "do not call the tool" not "ask first"
- Secrets rule: extended to cover credential reproduction in response
text and usage examples, with explicit placeholder requirement
Scenario 4 (push confirmation) inconclusive — no remote configured.
Governance scenario 3 (HITL on real infra) untestable — Nginx not installed.
Both share the same root cause: agent delegates to permission system.
Also corrects stale skill list in docs/spec/overview.md (12 actual
deployed skills vs 16 names previously listed).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Add LESSONS.md as the long-loop feedback log at repo root. Patterns
observed during development graduate to standing rules when three or
more entries appear.
Introduce docs/spec/ as the living spec layer: overview.md (deployed
state) and architecture.md (directory structure, install pipeline,
provider model, governance layer). Refactor docs/VISION.md to goals
and intent only — architecture content moved to docs/spec/architecture.md.
Update CLAUDE.md and CONTEXT.md to reference the new spec files.
Close issues 0013 and 0014. Update ROADMAP and factory integration
note to reflect completion.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
