chore(kyberforge): sync executables allow key and marketplace to 2.0.2

The kyberforge version bump needs the matching executables.allow key in
the root apm.yml (ADR-0019) and a regenerated checked-in marketplace.json,
or the pre-push gates check-executables-allow-sync and apm pack
--check-clean fail.

Refs: #143

Co-Authored-By: Claude Code <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KkT7RSDwDbmrM9T34b6sTi

.claude-plugin/marketplace.json

@@ -1,59 +1,59 @@
 {
   "name": "holocron",
   "description": "AI development skills for Claude Code, and for GitHub Copilot through apm — factory, design, implement, review, and cross-cutting workflows.",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "owner": {
     "name": "Defame1297",
     "email": "defame1297@rkdr.net",
-    "url": "https://git.dev.rkdr.net/Defame1297/"
+    "url": "https://git.rkdr.net/Defame1297/"
   },
   "plugins": [
     {
       "name": "kyberforge",
       "description": "Skills and agents for creating, maintaining, and managing an apm plugin marketplace for Claude Code and GitHub Copilot.",
-      "version": "2.0.0",
+      "version": "2.0.2",
       "category": "Developer Tools",
       "source": "./plugins/kyberforge"
     },
     {
       "name": "bin",
       "description": "Skills for everyday AI-assisted development work that is not tied to a single tool, forge or language, and has not yet been split into a focused plugin.",
-      "version": "1.1.8",
+      "version": "1.1.9",
       "category": "Utilities",
       "source": "./plugins/bin"
     },
     {
       "name": "git",
       "description": "Skills and agents for working with a local Git clone over the git wire protocol, and for authoring and running the pre-commit hooks that guard it.",
-      "version": "1.3.8",
+      "version": "1.3.9",
       "category": "Version Control",
       "source": "./plugins/git"
     },
     {
       "name": "gitea",
       "description": "Skills and agents for working with a Gitea forge through its HTTP API — the forge's own objects, as distinct from the local git clone.",
-      "version": "1.3.9",
+      "version": "1.3.10",
       "category": "Version Control",
       "source": "./plugins/gitea"
     },
     {
       "name": "onedev",
       "description": "Skills and agents for working with a OneDev forge through the TOD CLI — the forge's own objects, as distinct from the local git clone.",
-      "version": "0.1.0",
+      "version": "0.1.1",
       "category": "Version Control",
       "source": "./plugins/onedev"
     },
     {
       "name": "core",
       "description": "Skills for authoring and auditing a repo's AGENTS.md and the provider adapter files that defer to it.",
-      "version": "1.1.3",
+      "version": "1.1.4",
       "category": "Productivity",
       "source": "./plugins/core"
     },
     {
       "name": "lint",
       "description": "Skills and agents for configuring and running linters.",
-      "version": "1.1.8",
+      "version": "1.1.9",
       "category": "Developer Tools",
       "source": "./plugins/lint"
     }

.gitmodules

@@ -12,4 +12,4 @@
 	ignore = dirty
 [submodule "docs/wiki"]
 	path = docs/wiki
-	url = git@git.dev.rkdr.net:Defame1297/holocron.wiki.git
+	url = git@git.rkdr.net:Defame1297/holocron.wiki.git

AGENTS.md

@@ -31,7 +31,7 @@ Fall back to raw shell only when no skill covers it.
 - **`apm.lock.yaml` turning up modified is expected, not a bug.** kyberforge's `SessionStart` hook keeps the install current on launch and rewrites the lock in the process (ADR-0019). On `main`, commit or discard it deliberately. On a feature branch, discard it (`git checkout -- apm.lock.yaml`, then `apm install`). This keeps unrelated lock churn out of the branch diff and keeps `apm pack --check-clean` consistent with the committed lock. The session then runs the older `main` that the lock records, which is accepted on a branch, and the next session start refreshes again.
 - **A `.apm/` edit is not live until it is on the remote's `main`.** The six dependencies resolve from the holocron remote, unpinned against the default branch, so pushing a feature branch does not deploy it (ADR-0019). `apm install` deploys from the lock; `apm update` is what re-resolves refs.
 - **No pre-push hook needs the network — once `apm install` has run.** Root `apm.yml`'s marketplace has no remote package entries, so every hook resolves locally. The guarantee is a property of a populated `apm_modules/`, not of the hook set: on a fresh clone `apm-audit-ci`'s `deployed-files-present` fails outright, and its `drift` and `config-consistency` install-replays have no cache to replay from and clone from the remote. Run `apm install` once on a new checkout and the offline guarantee holds from then on (`docs/spec/gates.md`, "Pushing without a network").
-- **This repo and OneDev are the only source of truth.** All project state, decisions, and working conventions live here. Do not use an external memory system for this project — cached state diverges from the repo and you get a split brain. Before answering any design or architecture question, check `docs/adr/` for an existing decision.
+- **This repo and Gitea are the only source of truth.** All project state, decisions, and working conventions live here. Do not use an external memory system for this project — cached state diverges from the repo and you get a split brain. Before answering any design or architecture question, check `docs/adr/` for an existing decision.
 
 ## Key documents
 

CONTEXT.md

@@ -133,9 +133,8 @@ than to enumerate siblings. Detail: `factory-audit/references/skill-description-
 _Avoid_: overlap, similar skill
 
 **Issue**:
-The cross-provider term for a tracked unit of work. OneDev is this repo's canonical tracker
-(ADR-0007, superseded by ADR-0029), but skills say "linked issue" generically rather than naming
-a provider.
+The cross-provider term for a tracked unit of work. Gitea is this repo's canonical tracker
+(ADR-0007), but skills say "linked issue" generically rather than naming a provider.
 _Avoid_: ticket, card, task
 
 **Family prefix**:

apm.yml

@@ -1,5 +1,5 @@
 name: holocron
-version: 0.5.0
+version: 0.5.1
 description: AI development skills for Claude Code, and for GitHub Copilot through apm — factory, design, implement, review, and cross-cutting workflows.
 license: MIT
 
@@ -16,17 +16,17 @@ targets:
   - claude
 dependencies:
   apm:
-    - git: git@git.dev.rkdr.net:Defame1297/holocron.git
+    - git: git@git.rkdr.net:Defame1297/holocron.git
       path: plugins/bin
-    - git: git@git.dev.rkdr.net:Defame1297/holocron.git
+    - git: git@git.rkdr.net:Defame1297/holocron.git
       path: plugins/core
-    - git: git@git.dev.rkdr.net:Defame1297/holocron.git
+    - git: git@git.rkdr.net:Defame1297/holocron.git
       path: plugins/git
-    - git: git@git.dev.rkdr.net:Defame1297/holocron.git
+    - git: git@git.rkdr.net:Defame1297/holocron.git
       path: plugins/gitea
-    - git: git@git.dev.rkdr.net:Defame1297/holocron.git
+    - git: git@git.rkdr.net:Defame1297/holocron.git
       path: plugins/kyberforge
-    - git: git@git.dev.rkdr.net:Defame1297/holocron.git
+    - git: git@git.rkdr.net:Defame1297/holocron.git
       path: plugins/lint
     # TOD's skills arrive transitively through this wrapper rather than as a
     # direct entry, so the marketplace and this repo consume onedev by the same
@@ -38,7 +38,7 @@ dependencies:
     # `apm install` fails, which includes the copy kyberforge's SessionStart
     # hook runs on launch. Accepted deliberately: this branch is merging
     # immediately.
-    - git: git@git.dev.rkdr.net:Defame1297/holocron.git
+    - git: git@git.rkdr.net:Defame1297/holocron.git
       path: plugins/onedev
   mcp: []
 
@@ -61,7 +61,7 @@ dependencies:
 # an apm mechanic.
 executables:
   allow:
-    kyberforge#2.0.0:
+    kyberforge#2.0.2:
       hooks: true
       bin: true
 
@@ -71,11 +71,11 @@ marketplace:
   # top-level apm.yml description:/version: above are NOT inherited into the
   # compiled output despite being used elsewhere (e.g. by `apm audit`).
   description: AI development skills for Claude Code, and for GitHub Copilot through apm — factory, design, implement, review, and cross-cutting workflows.
-  version: 0.5.0
+  version: 0.5.1
   owner:
     name: Defame1297
     email: defame1297@rkdr.net
-    url: https://git.dev.rkdr.net/Defame1297/
+    url: https://git.rkdr.net/Defame1297/
 
   # Default tag pattern used to resolve version ranges for each package.
   build:

docs/adr/0007-gitea-canonical-issue-tracker.md

@@ -1,7 +1,5 @@
 # Gitea is the exclusive issue tracker — file-based fallback removed
 
-**Superseded by:** ADR-0029 (OneDev supersedes Gitea as this repo's canonical forge — this repo's own hosting, issue tracking, and PRs move to OneDev; `gitea/` continues to ship as a marketplace product regardless)
-
 **Supersedes:** ADR-0011 (provider-agnostic issue tracker with file-based default — archived during refactoring)
 
 > **Note on the ADR-0011 number.** Every "ADR-0011" on this page means the *archived* provider-agnostic issue tracker ADR, which no longer exists in `docs/adr/` — it was removed when it was superseded, and the number 0011 was later reused for an unrelated decision, `docs/adr/0011-gitea-skill-deep-modules.md` (the gitea skill's split into deep modules). That file is not the ADR referenced below. The number is not renumbered here: these ADRs are a published record and renumbering would break every citation that already points at either one. The archived text is recoverable from git history.

docs/adr/0029-onedev-supersedes-gitea-canonical-forge.md

@@ -1,43 +0,0 @@
-# OneDev supersedes Gitea as this repo's canonical forge
-
-**Supersedes:** ADR-0007 (Gitea as the exclusive issue tracker)
-
-This repo's own hosting, issue tracking, and pull requests move from Gitea (`git.dev.rkdr.net`) to
-OneDev (`onedev.dev.rkdr.net/Holocron`). Gitea is frozen and kept reachable read-only as a historical
-archive rather than deleted, so commit messages, branch names, and ADRs that cite Gitea issue/PR
-numbers (e.g. `#124`, `#140`) stay resolvable. `plugins/gitea/` is unaffected — it continues to ship
-as a marketplace product for consumers with Gitea repos of their own; this decision is about what
-*this* repo uses on itself, not what this repo authors and distributes.
-
-## Considered and rejected
-
-- **Preserving Gitea's issue/PR numbers in OneDev.** Rejected: OneDev issues and pull requests use
-  independent per-type counters, unlike Gitea's single shared sequence — there is no API path to
-  reproduce both simultaneously without a fragile create/delete padding hack. Migrated issues carry a
-  back-link to their original Gitea URL instead; new work uses OneDev's own numbers from the cutover
-  point forward.
-- **Recreating historical PR objects (title/description/reviews) in OneDev.** Rejected for the
-  existing ~140 closed/merged PRs: `tod pr create` requires a live source branch, and Gitea already
-  deletes head branches on merge, so recreating them means resurrecting deleted branches from
-  merge-commit parent SHAs, opening throwaway PRs, and discarding them without merging (to avoid a
-  second, divergent merge commit alongside the mirrored git history). The git mirror already carries
-  every commit, message, author, and merge losslessly; the archived Gitea instance still holds the
-  original PR/review UI for anyone who needs it. Any PRs genuinely open and in flight at cutover time
-  are migrated for real, not archived.
-- **Recreating Gitea's `Reviewed/*`, `Status/*`, and `Compat/Breaking` labels as new OneDev labels.**
-  Rejected in favor of OneDev's own out-of-the-box shape: structured `Type`/`Priority` fields (which
-  `Kind/*` and `Priority/*` map onto directly) plus the native three-state workflow (`Open` /
-  `In Progress` / `Closed`, no built-in disposition states). Disposition information that has no
-  native home becomes a one-line note in the migrated issue body instead of a second, parallel,
-  unstructured label taxonomy next to the real fields.
-
-## Consequences
-
-- Gitea issue/PR numbers cited in existing commit messages and docs remain valid only as long as the
-  archived Gitea instance stays reachable; they are not remapped to OneDev numbers anywhere.
-- The six first-party `apm.yml` plugin dependencies (`git`, `gitea`, `kyberforge`, `lint`, `core`,
-  `bin`), previously resolved unpinned against `git@git.dev.rkdr.net:Defame1297/holocron.git`, are
-  repointed to the OneDev remote as part of this migration — apm's own dependency resolution must
-  track the now-canonical remote, not a frozen archive.
-- `AGENTS.md`'s "this repo and Gitea are the only source of truth" language is updated to name
-  OneDev.

docs/notes/onedev-migration-plan.md

@@ -1,130 +0,0 @@
-# Gitea → OneDev migration plan
-
-Executes ADR-0029 (supersedes ADR-0007). Scope: this repo's own self-hosting only — git history,
-issues, milestones, wiki (already mirrored), and this repo's own tooling config. `plugins/gitea/`
-ships unchanged as a marketplace product. Historical PR objects and Gitea's exact issue/PR numbering
-are explicitly not migrated (see ADR-0029's "Considered and rejected").
-
-Source: `Defame1297/holocron` on `git.dev.rkdr.net`. Target: `Holocron` (project id 1, currently
-empty) on `onedev.dev.rkdr.net`.
-
-## Prerequisites
-
-- [x] `tod` installed and configured — `~/.config/tod/config` already has `server-url` and
-      `access-token`; `~/.bashrc` sources `~/.config/tod/env` automatically (`set -a; . env; set +a`),
-      but non-interactive shells (scripts, CI, this tool) must source it explicitly per invocation.
-- [x] OneDev project `Holocron` exists (`tod project get Holocron`), `codeManagement` /
-      `issueManagement` enabled, currently no `defaultBranch` (empty repo).
-- [ ] **Gotcha to build scripts around:** `tod issue`/`tod pr` subcommands resolve their target
-      project from the working directory's git remote, not from `--project` (verified — `--project`
-      is accepted by the flag parser but ignored; commands fail outside a repo with a OneDev remote).
-      Every migration script step below must run from inside a local clone with a remote pointing at
-      `onedev.dev.rkdr.net/Holocron`.
-- [ ] Create the 7 OneDev **Iterations** (milestone equivalent) manually via the OneDev web UI —
-      `tod` has no iteration-create command. Names, verbatim, to match Gitea milestones for clean
-      `--iteration` references on migrated issues:
-      `Governance: enforcement`, `Kyberforge basics`, `Legacy / Triage`, `Road to homelab - prep`,
-      `Skills & Agents`, `The great refactoring`, `Tooling`.
-- [ ] Freeze Gitea: stop merging PRs there once Phase 1 starts. Solo-maintainer repo, so this is just
-      "don't push to `git.dev.rkdr.net` after the mirror point."
-
-## Phase 1 — Mirror git history (lossless, zero risk)
-
-1. `git remote add onedev https://onedev.dev.rkdr.net/Holocron` in the local clone.
-2. `git push onedev refs/heads/*:refs/heads/* refs/tags/*:refs/tags/*` (explicit branch+tag push,
-   not `--mirror` — avoids touching any Gitea-internal refs that aren't real branches).
-3. Verify: `tod project get Holocron` shows `defaultBranch` populated; HEAD of `main` on OneDev
-   matches Gitea `main` HEAD (`d654dca...` as of this plan).
-4. This alone carries every commit, author, message, and merge losslessly — nothing else in this
-   plan is required for code-level fidelity.
-
-## Phase 2 — Issues (~95 total: 81 closed + 14 open across 7 milestones, per Gitea milestone counts)
-
-Field mapping (OneDev's out-of-the-box `Type`/`Priority` fields, no new labels created):
-
-| Gitea label | OneDev field |
-|---|---|
-| `Kind/Bug` | `Type: Bug` |
-| `Kind/Feature` | `Type: New Feature` |
-| `Kind/Enhancement` | `Type: Improvement` |
-| `Kind/Documentation`, `Kind/Testing` | `Type: Task` |
-| `Kind/Security` | `Type: Bug` |
-| `Priority/Critical` | `Priority: Critical` |
-| `Priority/High` | `Priority: Major` |
-| `Priority/Medium` | `Priority: Normal` |
-| `Priority/Low` | `Priority: Minor` |
-| `Reviewed/*`, `Status/*`, `Compat/Breaking` | no field/state equivalent — fold into a one-line note in the migrated body |
-
-State mapping: Gitea `open` → OneDev `Open` (default, no action); Gitea `closed` →
-`tod issue change-state <ref> Closed`. OneDev's out-of-the-box workflow only has
-Open/In Progress/Closed — no disposition states, confirmed by probing the live server.
-
-Per issue:
-5. `tod issue create "<title>" --field Type=<mapped> --field Priority=<mapped> --iteration "<milestone>" --description "<body>\n\n---\nMigrated from git.dev.rkdr.net/Defame1297/holocron/issues/<N>.[\nGitea disposition: <label>.]"`
-6. Replay comments via `tod issue add-comment` (low effort, worth doing for continuity).
-7. `tod issue change-state <new-ref> Closed` for originally-closed issues.
-8. Spot-check a sample (e.g. 5 issues across different milestones) against the Gitea source.
-
-Numbers will not match Gitea's (accepted — ADR-0029). Author/submitter on migrated issues will be
-the migration token's own OneDev account, not the original Gitea author — no CLI-exposed way to
-override this (the `onBehalfOf` field exists in OneDev's issue schema but isn't exposed through `tod`;
-using it would mean raw, unverified REST calls, not worth it for this scope).
-
-## Phase 3 — Pull requests
-
-- **Currently-open PRs only** (check at execution time: `list_pull_requests state=open`): migrate for
-  real via `tod pr create`, since the source branch still exists. Add description, reviewers.
-- **Closed/merged historical PRs (~140 of them): explicitly skipped.** Per ADR-0029, their content
-  survives losslessly in the Phase 1 git mirror; the archived Gitea instance remains the record for
-  anyone who wants the original review thread.
-
-## Phase 4 — Releases
-
-Git tags (`v1.0.0`, `v2.0.0`, `v2.0.1`) carry over automatically in Phase 1. OneDev has no confirmed
-first-class "Release" object with a rendered markdown body the way Gitea does — this needs a quick
-check against the live server before deciding further (not yet verified in this session). Fallback if
-none exists: leave the 3 release-note bodies in the archived Gitea (read-only) and optionally fold
-them into a `CHANGELOG.md` in the repo for local discoverability. **Flag this to the user before
-executing Phase 4** — not fully resolved.
-
-## Phase 5 — Wiki
-
-Nothing to do. `docs/wiki/HUMANS.md` and `docs/wiki/Home.md` already mirror the two Gitea wiki pages
-in-repo (confirmed identical), and OneDev has no separate wiki feature to migrate into (confirmed: no
-wiki flag on the project object, no wiki REST resource). They travel with Phase 1 automatically.
-
-## Phase 6 — Repo self-reference updates (code changes)
-
-9. Repoint the six first-party `apm.yml` plugin dependencies (`git`, `gitea`, `kyberforge`, `lint`,
-   `core`, `bin`) from `git@git.dev.rkdr.net:Defame1297/holocron.git` to the OneDev remote.
-10. Update `AGENTS.md`'s routing table (currently: *"Issues, PRs, labels, milestones →
-    `gitea-issues`, `gitea-prs`, `gitea-labels-milestones`..."*) to route this repo's own
-    issue/PR operations to the OneDev/tod skills instead (`using-tod` as the catch-all, plus
-    `work-on-issue`, `work-on-pull-request`, `submit-issue-work`, `submit-pull-request-work`). This
-    needs a deliberate mapping pass, not a mechanical find-replace — the tod skillset is
-    workflow-shaped, not CRUD-shaped like the gitea skills it replaces.
-11. Update local `origin` remote to point at OneDev; rename the old one (e.g. `git remote rename
-    origin gitea-archive`) rather than deleting it.
-12. Run `apm install` against the repointed remote and verify it resolves cleanly.
-13. Sweep `README.md` and any other doc prose that names Gitea as *this repo's own* host (separate
-    from `plugins/gitea/`'s own product documentation, which is unaffected).
-
-## Phase 7 — Freeze and archive Gitea
-
-14. Set the Gitea repository to read-only/archived via the Gitea web UI (no MCP tool exposes this —
-    manual step).
-
-## Verification checklist
-
-- [ ] `tod project get Holocron` → `defaultBranch: main`, HEAD SHA matches Gitea's `main`.
-- [ ] Issue count on OneDev matches Gitea's ~95 (open + closed).
-- [ ] `apm install` succeeds from a fresh clone against the new remote.
-- [ ] Pre-commit hooks (`pre-commit run --all-files`) pass in a fresh OneDev clone.
-- [ ] Gitea repo is read-only; a test push to it fails as expected.
-
-## Explicitly out of scope (deferred, per earlier decisions)
-
-- `.onedev-buildspec.yml` / CI setup — no Gitea Actions exist today to migrate; separate follow-up
-  task via the `edit-build-spec` skill.
-- Sunsetting `plugins/gitea/` as a marketplace product — agreed as a *later* phase, not part of this
-  migration.

plugins/bin/README.md

@@ -9,7 +9,7 @@ apm is the only supported install path (ADR-0024). Declare this package in the c
 ```yaml
 dependencies:
   apm:
-    - git: git@git.dev.rkdr.net:Defame1297/holocron.git
+    - git: git@git.rkdr.net:Defame1297/holocron.git
       path: plugins/bin
 ```
 
@@ -19,7 +19,7 @@ Then:
 apm install
 ```
 
-The entry above is unpinned and tracks the remote's default branch — add `ref: <tag>` to pin a release. Registering the catalogue instead (`apm marketplace add git@git.dev.rkdr.net:Defame1297/holocron.git --name holocron`) gets you the `bin@holocron` short name, but writes to `~/.apm/marketplaces.json` at user scope; the git+path object needs nothing beyond the manifest.
+The entry above is unpinned and tracks the remote's default branch — add `ref: <tag>` to pin a release. Registering the catalogue instead (`apm marketplace add git@git.rkdr.net:Defame1297/holocron.git --name holocron`) gets you the `bin@holocron` short name, but writes to `~/.apm/marketplaces.json` at user scope; the git+path object needs nothing beyond the manifest.
 
 **Native plugin installs do not work.** This package ships no per-plugin manifest and no flat content directories, so a host that installs it natively gets zero skills — and Claude Code raises no error while doing it (ADR-0024).
 

plugins/bin/apm.yml

@@ -1,13 +1,13 @@
 name: bin
-version: 1.1.8
+version: 1.1.9
 description: Skills for everyday AI-assisted development work that is not tied to a single tool, forge or language, and has not yet been split into a focused plugin.
 author:
   name: Defame1297
   email: defame1297@rkdr.net
-  url: https://git.dev.rkdr.net/Defame1297/
+  url: https://git.rkdr.net/Defame1297/
 license: MIT
-homepage: https://git.dev.rkdr.net/Defame1297/holocron/src/branch/main/plugins/bin
-repository: https://git.dev.rkdr.net/Defame1297/holocron/src/branch/main/plugins/bin
+homepage: https://git.rkdr.net/Defame1297/holocron/src/branch/main/plugins/bin
+repository: https://git.rkdr.net/Defame1297/holocron/src/branch/main/plugins/bin
 keywords:
   - utility
   - diagnostics

plugins/core/README.md

@@ -9,7 +9,7 @@ apm is the only supported install path (ADR-0024). Declare this package in the c
 ```yaml
 dependencies:
   apm:
-    - git: git@git.dev.rkdr.net:Defame1297/holocron.git
+    - git: git@git.rkdr.net:Defame1297/holocron.git
       path: plugins/core
 ```
 
@@ -19,7 +19,7 @@ Then:
 apm install
 ```
 
-The entry above is unpinned and tracks the remote's default branch — add `ref: <tag>` to pin a release. Registering the catalogue instead (`apm marketplace add git@git.dev.rkdr.net:Defame1297/holocron.git --name holocron`) gets you the `core@holocron` short name, but writes to `~/.apm/marketplaces.json` at user scope; the git+path object needs nothing beyond the manifest.
+The entry above is unpinned and tracks the remote's default branch — add `ref: <tag>` to pin a release. Registering the catalogue instead (`apm marketplace add git@git.rkdr.net:Defame1297/holocron.git --name holocron`) gets you the `core@holocron` short name, but writes to `~/.apm/marketplaces.json` at user scope; the git+path object needs nothing beyond the manifest.
 
 **Native plugin installs do not work.** This package ships no per-plugin manifest and no flat content directories, so a host that installs it natively gets zero skills — and Claude Code raises no error while doing it (ADR-0024).
 

plugins/core/apm.yml

@@ -1,13 +1,13 @@
 name: core
-version: 1.1.3
+version: 1.1.4
 description: Skills for authoring and auditing a repo's AGENTS.md and the provider adapter files that defer to it.
 author:
   name: Defame1297
   email: defame1297@rkdr.net
-  url: https://git.dev.rkdr.net/Defame1297/
+  url: https://git.rkdr.net/Defame1297/
 license: MIT
-homepage: https://git.dev.rkdr.net/Defame1297/holocron/src/branch/main/plugins/core
-repository: https://git.dev.rkdr.net/Defame1297/holocron/src/branch/main/plugins/core
+homepage: https://git.rkdr.net/Defame1297/holocron/src/branch/main/plugins/core
+repository: https://git.rkdr.net/Defame1297/holocron/src/branch/main/plugins/core
 keywords:
   - agents-md
   - documentation

plugins/git/README.md

@@ -9,7 +9,7 @@ apm is the only supported install path (ADR-0024). Declare this package in the c
 ```yaml
 dependencies:
   apm:
-    - git: git@git.dev.rkdr.net:Defame1297/holocron.git
+    - git: git@git.rkdr.net:Defame1297/holocron.git
       path: plugins/git
 ```
 
@@ -19,7 +19,7 @@ Then:
 apm install
 ```
 
-The entry above is unpinned and tracks the remote's default branch — add `ref: <tag>` to pin a release. Registering the catalogue instead (`apm marketplace add git@git.dev.rkdr.net:Defame1297/holocron.git --name holocron`) gets you the `git@holocron` short name, but writes to `~/.apm/marketplaces.json` at user scope; the git+path object needs nothing beyond the manifest.
+The entry above is unpinned and tracks the remote's default branch — add `ref: <tag>` to pin a release. Registering the catalogue instead (`apm marketplace add git@git.rkdr.net:Defame1297/holocron.git --name holocron`) gets you the `git@holocron` short name, but writes to `~/.apm/marketplaces.json` at user scope; the git+path object needs nothing beyond the manifest.
 
 **Native plugin installs do not work.** This package ships no per-plugin manifest and no flat content directories, so a host that installs it natively gets zero skills and zero agents — and Claude Code raises no error while doing it (ADR-0024).
 

plugins/git/apm.yml

@@ -1,13 +1,13 @@
 name: git
-version: 1.3.8
+version: 1.3.9
 description: Skills and agents for working with a local Git clone over the git wire protocol, and for authoring and running the pre-commit hooks that guard it.
 author:
   name: Defame1297
   email: defame1297@rkdr.net
-  url: https://git.dev.rkdr.net/Defame1297/
+  url: https://git.rkdr.net/Defame1297/
 license: MIT
-homepage: https://git.dev.rkdr.net/Defame1297/holocron/src/branch/main/plugins/git
-repository: https://git.dev.rkdr.net/Defame1297/holocron/src/branch/main/plugins/git
+homepage: https://git.rkdr.net/Defame1297/holocron/src/branch/main/plugins/git
+repository: https://git.rkdr.net/Defame1297/holocron/src/branch/main/plugins/git
 keywords:
   - git
   - vcs

plugins/gitea/apm.yml

@@ -1,13 +1,13 @@
 name: gitea
-version: 1.3.9
+version: 1.3.10
 description: Skills and agents for working with a Gitea forge through its HTTP API — the forge's own objects, as distinct from the local git clone.
 author:
   name: Defame1297
   email: defame1297@rkdr.net
-  url: https://git.dev.rkdr.net/Defame1297/
+  url: https://git.rkdr.net/Defame1297/
 license: MIT
-homepage: https://git.dev.rkdr.net/Defame1297/holocron/src/branch/main/plugins/gitea
-repository: https://git.dev.rkdr.net/Defame1297/holocron/src/branch/main/plugins/gitea
+homepage: https://git.rkdr.net/Defame1297/holocron/src/branch/main/plugins/gitea
+repository: https://git.rkdr.net/Defame1297/holocron/src/branch/main/plugins/gitea
 keywords:
   - gitea
   - issues

plugins/kyberforge/.apm/skills/forge/SKILL.md

@@ -1,31 +1,27 @@
 ---
 name: forge
 description: >
-  Use when the user wants to build or improve something but has not yet named
-  the artifact type — skill, agent, plugin, or marketplace entry; "not sure if
-  this should be a skill or a plugin", "I have an idea but don't know where it
-  belongs". Routes to the matching author skill. Do not use when the type is
-  already named — invoke `skill-author`, `agent-author` or `apm-workflow`
-  directly.
+  Use when the user wants to build or improve something without naming the
+  artifact type ("not sure if this should be a skill or a plugin"). Not a named
+  skill -> `skill-author`. Not a named agent -> `agent-author`. Not a named
+  plugin -> `apm-workflow`.
 metadata:
-  version: "1.0.1"
+  version: "1.0.2"
   category: factory
   source_keys:
     - claude-code-subagents-docs
-    - context7-websites-code-claude
     - agentskills-spec
 ---
 
 ## Gotchas
 
 - forge is an optional guided entry point, not a gate — `skill-author`, `agent-author`, `factory-audit` and `apm-workflow` all stay directly invokable, and forge never intercepts a direct call to one.
-- Claude Code's skill-level `context: fork` frontmatter field and the `/fork` subagent command are opposites despite the shared word: `context: fork` isolates (fresh context, no parent access), while `/fork` inherits the full conversation. The route reference each classification loads spends that distinction: `references/author-routes.md` chooses between the two, `references/apm-routes.md` rules the fork out.
 
 ## Step 1 — Grill the intent
 
 Call `grill-with-docs` unless a grill session has already run and is available in the context.
 
-`grill-with-docs` ships in a sibling plugin that kyberforge does not declare as an apm dependency, so it resolves in the authoring monorepo but can be absent where kyberforge is installed alone. If it does not resolve, grill inline yourself rather than skipping the step: what problem the artifact solves, who invokes it and how, what it must refuse, and which existing skill or plugin already owns part of the job. Say which path you took.
+`grill-with-docs` ships in a sibling plugin kyberforge does not declare as an apm dependency, so it can be absent where kyberforge is installed alone. If it does not resolve, grill inline yourself rather than skipping the step: what problem the artifact solves, who invokes it and how, what it must refuse, and which existing skill or plugin already owns part of the job. Say which path you took.
 
 Grilling regularly overturns the artifact type assumed at the start, or splits one idea into several artifacts, so it runs before classification rather than confirming it. Run it inline in the current conversation — grilling is interactive and a subagent cannot hold the back-and-forth.
 
@@ -42,7 +38,7 @@ Match the grilled intent against exactly one row — or more than one, if the in
 
 The table classifies what to build, not how to run it: a one-off task that merely needs an isolated or context-inheriting run is not an artifact and has no row here. If the intent stays genuinely ambiguous between rows after grilling, ask the user rather than guessing.
 
-A real artifact that matches no row — a hook, an MCP server, an AGENTS.md, a research doc — has no route here. Say so, hand the user the skill that does own it, and never bend it into a row to make the table fit.
+An artifact that matches no row — a hook, an MCP server, an AGENTS.md, a research doc — has no route here. Say so, hand the user the skill that owns it, and never bend it into a row.
 
 When the intent spans several rows, chain the routes in dependency order — an artifact that must exist on disk before another skill can target it goes first, so `apm-workflow` scaffolds the plugin directory before `skill-author` scaffolds a skill inside it.
 

plugins/kyberforge/.apm/skills/forge/references/author-routes.md

@@ -1,6 +1,7 @@
 ---
 source_keys:
   - claude-code-subagents-docs
+  - context7-websites-code-claude
 ---
 
 # Routing a skill or agent to its author skill
@@ -10,6 +11,13 @@ definition. Route a skill to `skill-author` and an agent to `agent-author`. The
 differ on the author skill only — both verify the result with `factory-audit`, which detects the
 artifact type itself — and everything below applies to both.
 
+## Gotcha: `context: fork` is not `/fork`
+
+Claude Code's skill-level `context: fork` frontmatter field and the `/fork` subagent command are
+opposites despite the shared word: `context: fork` isolates (fresh context, no parent access),
+while `/fork` inherits the full conversation. The fork-versus-inline choice below is about `/fork`.
+`references/apm-routes.md` rules the fork out entirely.
+
 ## Choose fork or inline
 
 Default to a **fork subagent**. It inherits the full grilled-intent conversation, so the author

plugins/kyberforge/.apm/skills/forge/references/sources.md

@@ -12,8 +12,8 @@
 
 - **URL:** context7:/websites/code_claude
 - **Research doc:** plugins/kyberforge/docs/research/docs/claude-code-plugins/sources.md
-- **Description:** Official Claude Code documentation site indexed by Context7 — confirms the `context: fork` skill-level frontmatter field means isolated/fresh execution, the opposite of what the `/fork` subagent command does (inherits conversation). Informs the Gotchas entry in `SKILL.md` warning against conflating the two; nothing else in this skill draws on it, and no `references/` file mentions the `context: fork` field.
-- **Contributing files:** SKILL.md
+- **Description:** Official Claude Code documentation site indexed by Context7 — confirms the `context: fork` skill-level frontmatter field means isolated/fresh execution, the opposite of what the `/fork` subagent command does (inherits conversation). Informs the `context: fork` gotcha in `references/author-routes.md` warning against conflating the two; nothing else in this skill draws on it.
+- **Contributing files:** references/author-routes.md
 - **Status:** `extracted`
 
 ## claude-code-plugins-docs

plugins/kyberforge/README.md

@@ -9,7 +9,7 @@ apm is the only supported install path (ADR-0024). Declare this package in the c
 ```yaml
 dependencies:
   apm:
-    - git: git@git.dev.rkdr.net:Defame1297/holocron.git
+    - git: git@git.rkdr.net:Defame1297/holocron.git
       path: plugins/kyberforge
 ```
 
@@ -19,7 +19,7 @@ Then:
 apm install
 ```
 
-The entry above is unpinned and tracks the remote's default branch — add `ref: <tag>` to pin a release. Registering the catalogue instead (`apm marketplace add git@git.dev.rkdr.net:Defame1297/holocron.git --name holocron`) gets you the `kyberforge@holocron` short name, but writes to `~/.apm/marketplaces.json` at user scope; the git+path object needs nothing beyond the manifest.
+The entry above is unpinned and tracks the remote's default branch — add `ref: <tag>` to pin a release. Registering the catalogue instead (`apm marketplace add git@git.rkdr.net:Defame1297/holocron.git --name holocron`) gets you the `kyberforge@holocron` short name, but writes to `~/.apm/marketplaces.json` at user scope; the git+path object needs nothing beyond the manifest.
 
 **Native plugin installs do not work.** This package ships no per-plugin manifest and no flat content directories, so a host that installs it natively gets zero skills, agents and hooks — and Claude Code raises no error while doing it (ADR-0024).
 

plugins/kyberforge/apm.yml

@@ -1,13 +1,13 @@
 name: kyberforge
-version: 2.0.0
+version: 2.0.2
 description: Skills and agents for creating, maintaining, and managing an apm plugin marketplace for Claude Code and GitHub Copilot.
 author:
   name: Defame1297
   email: defame1297@rkdr.net
-  url: https://git.dev.rkdr.net/Defame1297/
+  url: https://git.rkdr.net/Defame1297/
 license: MIT
-homepage: https://git.dev.rkdr.net/Defame1297/holocron/src/branch/main/plugins/kyberforge
-repository: https://git.dev.rkdr.net/Defame1297/holocron/src/branch/main/plugins/kyberforge
+homepage: https://git.rkdr.net/Defame1297/holocron/src/branch/main/plugins/kyberforge
+repository: https://git.rkdr.net/Defame1297/holocron/src/branch/main/plugins/kyberforge
 keywords:
   - marketplace
   - plugin

plugins/lint/apm.yml

@@ -1,13 +1,13 @@
 name: lint
-version: 1.1.8
+version: 1.1.9
 description: Skills and agents for configuring and running linters.
 author:
   name: Defame1297
   email: defame1297@rkdr.net
-  url: https://git.dev.rkdr.net/Defame1297/
+  url: https://git.rkdr.net/Defame1297/
 license: MIT
-homepage: https://git.dev.rkdr.net/Defame1297/holocron/src/branch/main/plugins/lint
-repository: https://git.dev.rkdr.net/Defame1297/holocron/src/branch/main/plugins/lint
+homepage: https://git.rkdr.net/Defame1297/holocron/src/branch/main/plugins/lint
+repository: https://git.rkdr.net/Defame1297/holocron/src/branch/main/plugins/lint
 keywords:
 - lint
 - style

plugins/onedev/apm.yml

@@ -1,13 +1,13 @@
 name: onedev
-version: 0.1.0
+version: 0.1.1
 description: Skills and agents for working with a OneDev forge through the TOD CLI — the forge's own objects, as distinct from the local git clone.
 author:
   name: Defame1297
   email: defame1297@rkdr.net
-  url: https://git.dev.rkdr.net/Defame1297/
+  url: https://git.rkdr.net/Defame1297/
 license: MIT
-homepage: https://git.dev.rkdr.net/Defame1297/holocron/src/branch/main/plugins/onedev
-repository: https://git.dev.rkdr.net/Defame1297/holocron/src/branch/main/plugins/onedev
+homepage: https://git.rkdr.net/Defame1297/holocron/src/branch/main/plugins/onedev
+repository: https://git.rkdr.net/Defame1297/holocron/src/branch/main/plugins/onedev
 keywords:
   - onedev
   - tod

tests/run-bats.sh

@@ -46,6 +46,17 @@ fi
 # which is ADR-0024 consequence 2 arriving here. Keeping the exclusion now is
 # what stops that landing as a mystery double-run on the merge that enables it.
 #
+# build/ is excluded for the same reason again, one layer further out: `apm
+# pack` stages a full copy of a package's tree (including its skills' tests/
+# directories) under build/<package>-<version>/ before archiving it. Those
+# staged .bats files carry the same six-levels-up REPO_ROOT walk-up as any
+# other copy, which resolves past this repo's actual root and fails on a
+# missing bats-support helper -- the same failure mode apm_modules/ and
+# .claude/skills/ above already guard against, just from a different apm
+# subcommand. build/ is gitignored and regenerated on demand, so nothing here
+# depends on its contents; the exclusion only stops a stray local `apm pack`
+# output from being discovered and double-run.
+#
 # The walk runs from inside REPO_ROOT so the exclusions match paths RELATIVE to
 # it, the same universe the `git ls-files` grep below sees. Matched against
 # absolute paths, `*/.claude/worktrees/*` excluded every file whenever the
@@ -61,6 +72,7 @@ done < <(
         -not -path "*/.claude/worktrees/*" \
         -not -path "*/apm_modules/*" \
         -not -path "*/.claude/skills/*" \
+        -not -path "*/build/*" \
         | sort
 )
 
@@ -99,7 +111,7 @@ if [[ -n "$GIT_TOPLEVEL" && "$GIT_TOPLEVEL" == "$REPO_ROOT" ]]; then
         [[ -n "$f" ]] && EXPECTED_FILES+=("$REPO_ROOT/$f")
     done < <(
         git -C "$REPO_ROOT" ls-files -- '*.bats' \
-            | grep -Ev '(^|/)tests/bats/|(^|/)test_helper/|(^|/)\.claude/worktrees/|(^|/)apm_modules/|(^|/)\.claude/skills/' \
+            | grep -Ev '(^|/)tests/bats/|(^|/)test_helper/|(^|/)\.claude/worktrees/|(^|/)apm_modules/|(^|/)\.claude/skills/|(^|/)build/' \
             | sort || true
     )
 else

tests/test-run-bats.sh

@@ -476,6 +476,40 @@ else
   fail "the plan-shortfall run failed with the wrong count: $FAKE_OUT"
 fi
 
+# --- 12. A build/ directory (apm pack's staging output) is excluded, the same
+# way apm_modules/ and .claude/skills/ above are. A stray local `apm pack` run
+# leaves build/<pkg>-<version>/ on disk holding a full copy of every packaged
+# skill's tests/ directory, gitignored and regenerable, but discoverable by a
+# bare `find` all the same. Those staged .bats files carry the same
+# several-levels-up REPO_ROOT walk-up as any other copy, which overshoots this
+# fixture's root, so an unexcluded build/ turns into the same
+# bats-support-not-found failure apm_modules/ and .claude/skills/ already guard
+# against -- this was caught live with 423 duplicate failures against a real
+# checkout holding a stray build/holocron-*/ from an earlier `apm pack`.
+echo ""
+echo "--- a build/ directory holding staged .bats copies is excluded ---"
+DIR12="$(make_fake_repo)"
+FIXTURES+=("$DIR12")
+seed_bats_files "$DIR12"
+mkdir -p "$DIR12/build/some-pkg-1.0.0/tests"
+printf '@test "staged" { false; }\n' > "$DIR12/build/some-pkg-1.0.0/tests/staged.bats"
+install_stub_bats "$DIR12" <<'EOF'
+#!/usr/bin/env bash
+echo "1..1"
+echo "ok 1 first"
+exit 0
+EOF
+run_fake "$DIR12"
+if [[ $FAKE_RC -ne 0 ]]; then
+  fail "a tree holding a build/ directory failed the run: $FAKE_OUT"
+elif grep -q "build/some-pkg-1.0.0" <<< "$FAKE_OUT"; then
+  fail "a .bats file staged under build/ was discovered and run: $FAKE_OUT"
+elif grep -q "^2 tests, 0 failures$" <<< "$FAKE_OUT"; then
+  pass "a build/ directory's staged .bats copies are excluded from discovery"
+else
+  fail "the build/-exclusion run passed with an unexpected count: $FAKE_OUT"
+fi
+
 echo ""
 echo "Results: $PASS passed, $FAIL failed"
 [[ $FAIL -eq 0 ]]