Close four small ADR-0020-retrofit follow-ups (#125, #127, #113, #118) #130

Claude · 2026-09-07T20:49:43Z

Claude commented

2026-09-07 20:49:43 +00:00

Picks up four of the small, well-scoped issues that surfaced during the #99 ADR-0020 retrofit, prioritizing quick closes before the larger epics. #112 (cherry-pick/revert ownership) was investigated too but turned out already resolved on main — closed directly with an explanatory comment, no code change needed.

What's in this PR

ffaa3af — fix(agent-audit): remove user-invocable as a hand-invoked marker (#125)
disable-model-invocation and user-invocable are independent Copilot fields; only the first affects whether a description is a routing string. The old bullet conflated them.

60be7b3 — refactor(skills): mandate metadata.version on every skill's frontmatter (#127, part 1)
Adoption of metadata.version tracked which plugin a skill lived in, not any stated rule (12/39 skills had it, split cleanly by plugin with two outliers). Now mandatory everywhere — 19 non-git skills seeded at 1.0.0, skill-frontmatter's pre-commit hook now enforces presence. Full rationale in the new docs/adr/0022-skill-metadata-version-is-mandatory.md.

2c6ce43 — refactor(git): normalize rtk-prefix usage, add metadata.version (#113, #127 part 2)
Bundled since both touch the same nine git-plugin skills. #113: executable instructed commands now consistently use rtk git, illustrative mentions stay bare git — empirically validated against the corpus before the sweep, documented in the new plugins/git/README.md. Plus the remaining 8 skills' metadata.version.

09eea5e — fix(skill-audit): flag a changed provenance claim, not just its shape (#118)
validate-provenance.sh checked structural consistency but never whether a sources.md claim was true. A literal-filename cross-check was tried and rejected (tested against the real corpus: 3/95 false positives, and it wouldn't have caught the actual bug). New check 9 instead flags any changed Description/Contributing files text against a base ref as an INFO — a pointer for the auditor to go verify by reading, since no script can verify semantic truth. Plus a matching authoring-time guardrail in skill-author's retrofit checklist. 8 new bats tests (73 total, 0 failures).

af8b46c — chore(plugins): sync generated content mirrors
Regenerates plugins/*/skills/ from .apm/ per ADR-0017.

4f4b55b — chore: refresh apm.lock.yaml to match the deployed install state
Pre-existing drift from before this branch (lockfile behind 598a7c3); apm install restored it, apm audit --ci now passes 10/10.

Test plan

pre-commit run --all-files — passed on every commit
pre-commit run --hook-stage pre-push --all-files (network-dependent marketplace/pack-check hooks skipped) — 16/16 on final push
bash tests/bats/bin/bats plugins/kyberforge/.apm/skills/skill-audit/tests/validate-provenance.bats — 73/73
Manual review of the rtk-normalization diffs and the check-9 implementation before committing

Implementation notes with the reasoning behind each decision (including the two rejected approaches for #118 and #113's gate question) are posted as comments on the respective issues.

🤖 Generated with Claude Code

https://claude.ai/code/session_01EeH8SCbcrCAQrtymkNuhKP

Picks up four of the small, well-scoped issues that surfaced during the #99 ADR-0020 retrofit, prioritizing quick closes before the larger epics. #112 (cherry-pick/revert ownership) was investigated too but turned out already resolved on `main` — closed directly with an explanatory comment, no code change needed. ## What's in this PR **`ffaa3af` — fix(agent-audit): remove user-invocable as a hand-invoked marker** (#125) `disable-model-invocation` and `user-invocable` are independent Copilot fields; only the first affects whether a description is a routing string. The old bullet conflated them. **`60be7b3` — refactor(skills): mandate metadata.version on every skill's frontmatter** (#127, part 1) Adoption of `metadata.version` tracked which plugin a skill lived in, not any stated rule (12/39 skills had it, split cleanly by plugin with two outliers). Now mandatory everywhere — 19 non-git skills seeded at `1.0.0`, `skill-frontmatter`'s pre-commit hook now enforces presence. Full rationale in the new `docs/adr/0022-skill-metadata-version-is-mandatory.md`. **`2c6ce43` — refactor(git): normalize rtk-prefix usage, add metadata.version** (#113, #127 part 2) Bundled since both touch the same nine git-plugin skills. #113: executable instructed commands now consistently use `rtk git`, illustrative mentions stay bare `git` — empirically validated against the corpus before the sweep, documented in the new `plugins/git/README.md`. Plus the remaining 8 skills' `metadata.version`. **`09eea5e` — fix(skill-audit): flag a changed provenance claim, not just its shape** (#118) `validate-provenance.sh` checked structural consistency but never whether a `sources.md` claim was *true*. A literal-filename cross-check was tried and rejected (tested against the real corpus: 3/95 false positives, and it wouldn't have caught the actual bug). New check 9 instead flags any changed `Description`/`Contributing files` text against a base ref as an INFO — a pointer for the auditor to go verify by reading, since no script can verify semantic truth. Plus a matching authoring-time guardrail in `skill-author`'s retrofit checklist. 8 new bats tests (73 total, 0 failures). **`af8b46c` — chore(plugins): sync generated content mirrors** Regenerates `plugins/*/skills/` from `.apm/` per ADR-0017. **`4f4b55b` — chore: refresh apm.lock.yaml to match the deployed install state** Pre-existing drift from before this branch (lockfile behind `598a7c3`); `apm install` restored it, `apm audit --ci` now passes 10/10. ## Test plan - [x] `pre-commit run --all-files` — passed on every commit - [x] `pre-commit run --hook-stage pre-push --all-files` (network-dependent marketplace/pack-check hooks skipped) — 16/16 on final push - [x] `bash tests/bats/bin/bats plugins/kyberforge/.apm/skills/skill-audit/tests/validate-provenance.bats` — 73/73 - [x] Manual review of the rtk-normalization diffs and the check-9 implementation before committing Implementation notes with the reasoning behind each decision (including the two rejected approaches for #118 and #113's gate question) are posted as comments on the respective issues. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01EeH8SCbcrCAQrtymkNuhKP

Claude added 6 commits 2026-09-07 20:49:44 +00:00

refactor(skills): mandate metadata.version on every skill's frontmatter 60be7b3232

Only 12 of 39 skills carried metadata.version, and adoption tracked
which plugin a skill lived in rather than any stated rule: core,
gitea and lint were consistent adopters, bin and kyberforge were
consistent non-adopters, git was split with one outlier. There was
no documented convention, and skill-author's own bump logic was
already written as if presence were conditional.

metadata.version is now required on every skill. The 19 skills here
that never carried one (bin, kyberforge, gitea-files) are seeded at
1.0.0, not 0.1.0 -- that value stays reserved for a skill's actual
creation point under skill-author's existing convention. The
skill-frontmatter pre-commit hook now fails a SKILL.md missing the
field, the same class of failure as a missing name/description.

Full rationale in the new ADR. The git-plugin skills that also need
this field follow in the next commit, bundled with issue #113's rtk
normalization since both touch the same files.

Refs: #127
ADR: 0022
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EeH8SCbcrCAQrtymkNuhKP

fix(agent-audit): remove user-invocable as a hand-invoked marker ffaa3afb41

disable-model-invocation and user-invocable are independent Copilot
fields: the first gates whether the runtime auto-selects an agent (i.e.
whether its description is a routing string), the second only gates
manual invocation. An agent can be disable-model-invocation: false plus
user-invocable: false and still be model-routed, so the old bullet
conflated two unrelated contracts under one trigger.

Fixes: #125
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EeH8SCbcrCAQrtymkNuhKP

refactor(git): normalize rtk-prefix usage, add metadata.version 2c6ce438b6

Two bundled fixes across the same nine skills, since both touch the
same files.

Issue #113: skill prose used rtk git and bare git inconsistently for
the same operations, with no stated rule for which applied where.
Executable instructed commands (a dispatch-table "Run" cell, a fenced
code-block procedure, an imperative step) now consistently use rtk
git; illustrative or referential mentions -- naming a flag's behavior,
quoting a doc heading, warning against an anti-pattern -- stay bare
git. Documented in the new plugins/git/README.md, scoped to this
plugin only: gitea-* skills talk to the server over MCP tools and
carry no git/rtk mentions at all.

Also the git-plugin slice of #127: metadata.version added to the
eight skills that lacked it. git-commits already had one and is
untouched.

Fixes: #113
Fixes: #127
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EeH8SCbcrCAQrtymkNuhKP

fix(skill-audit): flag a changed provenance claim, not just its shape 09eea5e7ab

validate-provenance.sh checked that a sources.md entry was internally
consistent -- slugs resolve, Contributing files exist, back-references
match -- but never whether the asserted contribution was true. A
retrofit once turned an honest hedge into a false confident claim and
every existing check passed it silently.

A literal-filename cross-check (flag a description naming a .md file
absent from Contributing files) was tried and rejected: 3/95 flagged
against the real corpus, all three false positives, and it would not
have caught the actual bug -- the bad description never named a
literal filename. No bash script can verify semantic truth, so the fix
uses what git can reliably detect -- a changed field -- purely as a
trigger for what can verify semantics: the auditor reading the files.

New check 9 flags (INFO only, never FAIL) any Description or
Contributing-files text change against a base ref (default: merge-base
with origin/main, overridable via --base-ref). A slug absent at the
base ref is a creation, not a change, and is not flagged. skill-audit's
rubric now tells the auditor a check-9 INFO means open the named files
and verify by reading, not just relay it. skill-author's retrofit
checklist gained a matching authoring-time guardrail: don't upgrade a
hedge into a confident claim without re-reading the source first.

8 new bats tests (73 total, 0 failures).

Fixes: #118
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EeH8SCbcrCAQrtymkNuhKP

chore(plugins): sync generated content mirrors af8b46cd57

Regenerate plugins/*/skills/ from plugins/*/.apm/ after the previous
four commits, via scripts/sync-plugin-content.sh --all. The mirror is
generated output (ADR-0017) that check-plugin-content-sync's pre-push
hook diffs against .apm/; nothing here is hand-edited.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EeH8SCbcrCAQrtymkNuhKP

chore: refresh apm.lock.yaml to match the deployed install state 4f4b55b0be

kyberforge's SessionStart hook updates this lockfile automatically
when apm reports the local install behind; it had drifted since
before this branch existed (generated_at predates 598a7c3). Re-ran
apm install to bring the local .claude/ deployment in line with what
the lockfile now expects -- apm audit --ci passes 10/10 clean.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EeH8SCbcrCAQrtymkNuhKP

Defame1297 referenced this issue from a commit

2026-09-09 05:35:38 +00:00

fix(skill-audit): make check 9 reachable, wrap-safe and never silently skipped

Defame1297 added 6 commits 2026-09-09 05:35:38 +00:00

fix(skill-frontmatter): check every file, scope checks to frontmatter a6eedacfd8

The hook is `entry: bash` with `args: ['-c', <script>]`. pre-commit appends filenames after the
script string, so the first becomes `$0` and never enters `"$@"` — on a single-file commit, the
common case, the loop body never ran and the hook reported Passed having measured nothing.
ADR-0022 leans on this hook as the enforcement for a mandatory `metadata.version`, so the vacuous
green was the whole gate.

Implementation notes:
- An arg0 placeholder absorbs `$0` so every filename lands in `"$@"`.
- Checks now run against the YAML frontmatter block only, extracted with awk. The old
`grep -A10 "^metadata:"` matched a `metadata:` inside a body code fence, spanned past the block
into a following `source:` entry's `version:`, accepted any indentation, and missed a `version:`
more than ten lines in. An unreadable frontmatter block is now an error, never a pass.
- The value is asserted against three-part semver. `write-docs` carried "1.0" through the entire
ADR-0022 retrofit undetected, which a presence-only check cannot catch.

Impact: `tests/test-skill-frontmatter.sh` is the first test this hook has ever had. It drives the
real `entry`/`args` composition read out of the config rather than a copy of the script, which is
the only shape that catches the arg0 bug; against the pre-fix hook it scores 7/20.

gates.md described the hook wrongly in both directions and is rewritten, with a carve-out
explaining why this one stays a shell parser next to the "python3 and PyYAML are hard
requirements" reasoning that argues otherwise.

Refs: #127
ADR: 0022
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EeH8SCbcrCAQrtymkNuhKP

fix(git): stop prefixing rtk where it rewrites the output skills parse ed8c99efbd

The #113 sweep rested on CLAUDE.md's premise that rtk either filters or passes through unchanged,
so prefixing is always safe. Measured against rtk 0.42.4, that premise is false for several of the
commands the sweep prefixed, and two skills were left giving wrong answers silently.

Why:
- `rtk git worktree list --porcelain -z` discards both flags and renders its own format. The
`locked`/`lock_reason` fields git-worktrees Step 2 must emit are absent entirely, and paths under
$HOME are abbreviated to `~/`.
- `rtk git branch --list <name>` prints a phantom `* ` line even when nothing matches, so
git-branches' stated ambiguity test — "output from both means the name is ambiguous" — reported
every name as ambiguous. `tag --list` is a clean passthrough, so only one half broke.
- `rtk git diff --name-only`/`--name-status` append a `Changes:` trailer to output documented as
"one per line"; `--word-diff` emits none of the `[-removed-] {+added+}` markers its table
describes; `rtk git log -L` truncates each line at ~72 chars, on the one command whose purpose is
showing line content.
- `rtk git stash pop` prints only `FAILED: git stash pop`, swallowing the conflict diagnostic and
retained-entry message the surrounding prose tells the agent to rely on.

Implementation notes:
- Eleven sites reverted to bare `git`, each carrying its reason inline so the next sweep does not
undo it. `mergetool` and `rebase -i` are reverted on clause 3's interactive limb only: the TTY
defect does not reproduce — rtk filters exactly twelve subcommands and execs the rest — and
ADR-0023 records that measurement rather than a convenient one.
- ADR-0023 states the rule repo-wide with a third clause: a command whose output the skill parses,
or which is interactive, stays bare. `plugins/git/README.md` is reduced to a pointer; its claim
that gitea skills "contain no git/rtk mentions at all" was false, and its citation of
`hard-rules.md` pointed at a file containing no occurrence of "rtk".
- Eight gitea sites swept, all verified byte-identical passthroughs first.
- `scripts/check-rtk-prefix.sh` gates clause 1. Run against main's pre-sweep corpus it reports 99
findings including every gitea site, so it would have caught the drift #113 was filed about.

Impact: the gate covers clause 1 only, in shell-tagged fences and the opening span of Run cells.
Clause 2 is not gateable — "Run `git switch`" and "`git switch` refuses" are the same tokens — and
prose bullets are invisible to it. Both limits are recorded in gates.md rather than left implied.

Refs: #113
ADR: 0023
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EeH8SCbcrCAQrtymkNuhKP

fix(skill-audit): make check 9 reachable, wrap-safe and never silently skipped 175ea89c0a

Check 9 shipped in #130 to close #118, but three defects meant it could not do the job it was
added for.

Why:
- It is INFO-only, so it always exits 0 — and SKILL.md graded exit 0 "a genuine pass" and said the
  script "prints nothing on success". Every check-9 INFO was discarded before it reached a report,
  behind three further doors that only opened on a non-zero exit.
- `parse_field_raw()` matched `(.+)`, which does not span newlines, so only the first physical line
  of a wrapped value was compared. Rewriting only the continuation line of a wrapped Description
  from a hedge to a confident claim produced no finding at all — verbatim the regression #118 was
  filed about. The bullet branch had the same shape: a wrapped bullet broke the loop and dropped
  every later entry.
- A `git show` failure at the base ref was treated as "creation, nothing to flag" and skipped the
  whole skill with no output, collapsing "absent at that ref" with "not tracked under that name".
  A gitignored `.claude/skills/` copy reported clean while the authoring path reported four changed
  claims. The script's own usage text promises this is "never a silent skip".

Implementation notes:
- Exit-code guidance re-keyed on output as well as code: 0-and-silent passes, 0-with-output is
  INFO-only findings, 1 is FAILs, 2 never ran.
- `parse_field_raw()` is line-based and joins continuation lines; `normalize_field_text()`'s
  docstring is now true rather than aspirational. A reorder deliberately fires: the two fields share
  one parser, and order-insensitivity would mean splitting a prose Description on commas.
- The discarded `show_err` is now surfaced as one whole-check INFO naming both readings.
- `--base-ref=` given empty now beats the env var, as the usage text always claimed.

`validate.sh` gains an ADR-0022 `metadata.version` check at FAIL tier, because any lower tier lets
skill-author Step 4 report done on a file the commit gate then refuses. Its `read` heuristic now
skips here-doc bodies — reflowing the one offending line would have cleared the finding and left
the cause, since every usage() heredoc is one wrap from putting the English verb in column 0.

Impact: provenance tests 73 -> 82, validate tests 64 -> 72. Test 72 previously deleted origin/main
before asserting the override, so it proved the flag works with no default rather than that it beats
one; it now moves origin/main forward first.

Refs: #118
ADR: 0022
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EeH8SCbcrCAQrtymkNuhKP

fix(kyberforge): unblock the scaffold and finish the #125 and ADR-0022 edits 3811f5481b

Three related half-applied changes from #130, each leaving the corpus in a state its own
documentation contradicts.

Why:
- `assets/templates/SKILL.md` shipped `metadata:` fully commented out, and `new-skill.sh` only
substitutes SKILL_NAME. Every scaffolded skill therefore lacked the `metadata.version` ADR-0022
made mandatory and was blocked at first commit by the very hook this PR added. The commented
example also read `"1.0"` — neither the `0.1.0` new-skill seed nor valid semver.
- `agent-audit/references/scope-project-user.md` still joined `disable-model-invocation` and
`user-invocable` with a slash — #125's defect verbatim — while pointing the reader at the file
this PR had just corrected to say the opposite.
- ADR-0022 required the "when present" bump conditional dropped and `metadata.version` moved into
create.md's required list. It was dropped from SKILL.md but left in README.md, and the field was
edited in place under a heading that still authorises removing it entirely.

Implementation notes:
- The template emits `metadata: version: "0.1.0"` live, captioned as required, with the optional
keys left commented. `new-skill.bats` gains a case asserting a live key and three-part semver, so
this cannot regress.
- `description-quality.md` now asserts only what the vendored Copilot research supports: two fields
with opposite defaults, and the retired `infer` replaced by the pair rather than by either alone.
The unsupported negative it previously stated as fact is gone.
- The `1.0.0` retrofit seed is stated in improve.md and retrofit.md, which the retrofit flow
actually reads — create.md, where it lived, is unreachable from that path. The compression item
moved out of the file-churn checklist, whose preamble excluded the wording-only change it covers.
- Executable git commands in these three skills now carry the ADR-0023 rtk prefix.

Refs: #125, #127
ADR: 0022, 0023
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EeH8SCbcrCAQrtymkNuhKP

docs: retire the META.md guidance ADR-0022 overruled, bump touched plugins a3e721e937

Why: ADR-0022 made `metadata.version` mandatory in SKILL.md frontmatter, but three documents still
instructed the opposite — that `version:`, `source:`, `references:` and `when:` belong in a separate
META.md. That recommendation was never implemented: META.md exists exactly once in this repo, inside
a vendored third-party research example, and all 39 skills now contradict it. A stale instruction
that outranks nothing is worse than no instruction, because an author following it undoes the ADR.

Implementation notes:
- Two LESSONS.md entries deleted outright — their entire payload was the rejected fix. Two kept and
rewritten: the copy-fill entry loses only its META-TEMPLATE clause, and the `model:` entry keeps
the provider-extension fact and the invocation-time boundary rule, which stand on their own.
- One factual error corrected in passing: the `extracted` slug entry claimed provenance is recorded
in META.md. It lives in `references/sources.md` keyed by `source_keys:`, verified against
validate-provenance.sh.
- Both docs/notes files gain `metadata.version` in their required-field lists. Deleting the stale
paragraph while leaving those lists silent would have re-created the gap.
- `bin/write-docs` carried `metadata.version: "1.0"` — the only non-semver value in the corpus, and
the result of relocating its old top-level `version:` without normalising it. Now `1.0.0`.
ADR-0022 records the relocation it previously omitted, which issue #127 had asked it to decide.

Impact: patch bumps for the four plugins whose `.apm/` content changed — bin, git, gitea,
kyberforge. core and lint are untouched and stay put. Root apm.yml's `executables.allow` key and
marketplace package versions move in lockstep; the marketplace release version is unchanged.

Refs: #127
ADR: 0022
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EeH8SCbcrCAQrtymkNuhKP

chore(plugins): sync generated content mirrors 0f2bb242ad

Regenerates `plugins/*/skills`, `plugins/*/agents`, both per-plugin `plugin.json` manifests and the
two marketplace mirrors from `.apm/` per ADR-0017, via `scripts/sync-plugin-content.sh --all`.

The manifests matter beyond tidiness here: `plugin.json` carries the plugin version and wins over
the marketplace entry at install time (calculatePluginVersion precedence). Until this ran, the patch
bumps in the preceding commit were inert for anyone installing these plugins.

ADR: 0017
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EeH8SCbcrCAQrtymkNuhKP

Defame1297 referenced this issue from a commit

2026-09-09 05:35:38 +00:00

fix(kyberforge): unblock the scaffold and finish the #125 and ADR-0022 edits

Claude commented

2026-09-09 05:36:00 +00:00

Full review done, findings fixed and pushed (4f4b55b..0f2bb24). Six commits, split by concern.

Five blockers, all of the same shape — a gate or check that reported success without measuring anything:

skill-frontmatter used entry: bash with args: ['-c', <script>], so pre-commit's first filename became $0 and never entered "$@". On a single-file commit — the common case — it reported Passed having read nothing, which was the entire enforcement ADR-0022 relies on. Fixed, plus the checks are now frontmatter-scoped and assert semver; tests/test-skill-frontmatter.sh is the hook's first test and scores 7/20 against the pre-fix version.
The rtk sweep prefixed commands whose output skills parse. rtk git worktree list --porcelain -z discards both flags and drops the locked/lock_reason fields Step 2 must emit; rtk git branch --list prints a phantom * line, so git-branches' ambiguity test reported every name ambiguous. Eleven sites reverted with inline reasons, ADR-0023 adds a third clause, and check-rtk-prefix.sh reports 99 findings against main's pre-sweep corpus — it would have caught #113.
Check 9 could not do its job three ways: SKILL.md graded its INFO-only exit 0 as "a genuine pass"; parse_field_raw didn't span newlines, so rewriting the continuation line of a wrapped Description from a hedge to a confident claim produced nothing — verbatim the #118 regression; and a git show failure silently disabled it for the whole skill.
new-skill.sh scaffolded skills that failed this PR's own new gate on first commit.
scope-project-user.md still carried the disable-model-invocation / user-invocable conflation #125 removed, pointing at the file that now refutes it.

Also: four plugin versions bumped (they were inert until the manifests regenerated — plugin.json wins at install time); stale META.md guidance removed from LESSONS.md and two docs/notes files, which contradicted ADR-0022; write-docs's non-semver "1.0" corrected; gates.md updated for both new gates.

One correction to the review itself: the TTY defect reported for mergetool and rebase -i does not exist — rtk filters exactly twelve subcommands and execs the rest. Both were reverted on the interactive rule alone, and ADR-0023 records the measurement rather than the convenient claim.

Honest limits: the rtk gate covers clause 1 only, in shell-tagged fences and Run cells. Clause 2 isn't gateable and prose bullets are invisible to it — both written into gates.md. One flake observed: test-check-release-needed.sh failed once in an aggregated run and passed 7/7 afterwards.

Green on a clean tree: run-tests.sh --strict 26/26 (0 skipped), pre-commit 18/18, pre-push 16/16, apm audit --ci 10/10.

🤖 Generated with Claude Code

https://claude.ai/code/session_01EeH8SCbcrCAQrtymkNuhKP

Full review done, findings fixed and pushed (`4f4b55b..0f2bb24`). Six commits, split by concern. **Five blockers, all of the same shape — a gate or check that reported success without measuring anything:** - `skill-frontmatter` used `entry: bash` with `args: ['-c', <script>]`, so pre-commit's first filename became `$0` and never entered `"$@"`. On a single-file commit — the common case — it reported Passed having read nothing, which was the entire enforcement ADR-0022 relies on. Fixed, plus the checks are now frontmatter-scoped and assert semver; `tests/test-skill-frontmatter.sh` is the hook's first test and scores 7/20 against the pre-fix version. - The rtk sweep prefixed commands whose output skills parse. `rtk git worktree list --porcelain -z` discards both flags and drops the `locked`/`lock_reason` fields Step 2 must emit; `rtk git branch --list` prints a phantom `* ` line, so git-branches' ambiguity test reported *every* name ambiguous. Eleven sites reverted with inline reasons, ADR-0023 adds a third clause, and `check-rtk-prefix.sh` reports 99 findings against main's pre-sweep corpus — it would have caught #113. - Check 9 could not do its job three ways: SKILL.md graded its INFO-only exit 0 as "a genuine pass"; `parse_field_raw` didn't span newlines, so rewriting the continuation line of a wrapped Description from a hedge to a confident claim produced nothing — verbatim the #118 regression; and a `git show` failure silently disabled it for the whole skill. - `new-skill.sh` scaffolded skills that failed this PR's own new gate on first commit. - `scope-project-user.md` still carried the `disable-model-invocation` / `user-invocable` conflation #125 removed, pointing at the file that now refutes it. **Also:** four plugin versions bumped (they were inert until the manifests regenerated — `plugin.json` wins at install time); stale META.md guidance removed from LESSONS.md and two docs/notes files, which contradicted ADR-0022; `write-docs`'s non-semver `"1.0"` corrected; `gates.md` updated for both new gates. **One correction to the review itself:** the TTY defect reported for `mergetool` and `rebase -i` does not exist — rtk filters exactly twelve subcommands and execs the rest. Both were reverted on the interactive rule alone, and ADR-0023 records the measurement rather than the convenient claim. **Honest limits:** the rtk gate covers clause 1 only, in shell-tagged fences and Run cells. Clause 2 isn't gateable and prose bullets are invisible to it — both written into `gates.md`. One flake observed: `test-check-release-needed.sh` failed once in an aggregated run and passed 7/7 afterwards. Green on a clean tree: `run-tests.sh --strict` 26/26 (0 skipped), pre-commit 18/18, pre-push 16/16, `apm audit --ci` 10/10. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01EeH8SCbcrCAQrtymkNuhKP

Defame1297 approved these changes 2026-09-09 18:22:57 +00:00

Defame1297 merged commit b7bec71b8f into main

2026-09-09 18:23:00 +00:00

Defame1297 deleted branch fix/adr0020-followups

2026-09-09 18:23:00 +00:00

Defame1297 referenced this issue from a commit

2026-09-09 18:23:02 +00:00

Merge pull request 'Close four small ADR-0020-retrofit follow-ups (#125, #127, #113, #118)' (#130) from fix/adr0020-followups into main

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Defame1297/holocron#130