From caebc42bad47357a3ddfcd28d8137b88be4786b1 Mon Sep 17 00:00:00 2001 From: Defame1297 Date: Sun, 5 Jul 2026 12:31:45 +0000 Subject: [PATCH 1/8] fix(kyberforge): require commit-hash verification and forbid self-spawned rechecks in skill-author Prior sessions had authoring subagents report completion after only staging changes (git diff --stat showing output, but no git commit), and one run self-spawned its own audit/recheck subagent instead of leaving that to forge's outer loop, losing an uncommitted draft when the stray subagent's worktree was torn down. Refs #69, #71 --- plugins/kyberforge/skills/skill-author/SKILL.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/plugins/kyberforge/skills/skill-author/SKILL.md b/plugins/kyberforge/skills/skill-author/SKILL.md index cd41916..0a38fb0 100644 --- a/plugins/kyberforge/skills/skill-author/SKILL.md +++ b/plugins/kyberforge/skills/skill-author/SKILL.md @@ -26,6 +26,7 @@ metadata: - Patching per symptom is the default failure mode. Three eval failures may all trace to one missing instruction — always identify the root cause before editing. - Do not create new scripts unless a signal explicitly calls for it. Writing scripts from scratch requires transcript analysis that is out of scope here; flag the opportunity as a suggestion instead. +- Never spawn a subagent to audit or recheck your own work during an authoring pass. Run `/skill-audit` yourself, inline, in the same context as the edits you just made. A *separate* independent recheck via a clean-context subagent is forge's outer-loop responsibility exclusively — delegating it inward here duplicates that layer and introduces a race: a stray self-spawned subagent can have its worktree torn down by concurrent cleanup, destroying an uncommitted draft before it was ever safe. ## Route @@ -222,6 +223,8 @@ All FAIL findings must be resolved before the skill is considered done. If the skill is versioned (`metadata.version`), set it to the next **minor** version (e.g. `0.2.0` → `0.3.0`). New skills without a prior version start at `0.1.0`. +**Commit verification.** Capture `git log --oneline -1` before Step 1 and keep it. Once the audit is clean, run `git add` and `git commit` for the new skill files — do not stop at staging. Then run `git log --oneline -1` again and confirm the hash changed from the one you captured at the start. A non-empty `git diff --stat` is not sufficient proof of completion: staged-but-uncommitted work isn't part of any commit and can be silently lost if the working tree is cleaned up before a commit lands. Only report the skill as done once the hash has actually changed. + ## Improving an existing skill ### Step 1 — Verify inputs @@ -284,3 +287,5 @@ Before running the audit, confirm: Run `/skill-audit` on the skill directory. Resolve any FAIL findings before considering the improvement complete. If the skill is versioned (`metadata.version`), bump the **patch** version (e.g. `0.1.0` → `0.1.1`). + +**Commit verification.** Capture `git log --oneline -1` before Step 1 and keep it. Once the audit is clean, run `git add` and `git commit` for the changed files — do not stop at staging. Then run `git log --oneline -1` again and confirm the hash changed from the one you captured at the start. A non-empty `git diff --stat` is not sufficient proof of completion: staged-but-uncommitted work isn't part of any commit and can be silently lost if the working tree is cleaned up before a commit lands. Only report the improvement as done once the hash has actually changed. -- 2.43.0 From 8b92590dc9833374e86cace700d9155e43467748 Mon Sep 17 00:00:00 2001 From: Defame1297 Date: Sun, 5 Jul 2026 12:39:15 +0000 Subject: [PATCH 2/8] fix(kyberforge): surface commit-hash checklist earlier, drop redundant scripts line in skill-author Independent /skill-audit recheck flagged the git-log-capture instructions as discoverable only at close-out (Step 6/Step 5), long after the step where the hash should actually be snapshotted. Adds the capture checklist item to Prerequisites (create flow) and Step 1 (improve flow) instead of leaving it as a retrospective-only note. Also drops a sentence in the improve flow's Step 4 that duplicated the preceding one on editing scripts/reference files directly. Refs #69 --- plugins/kyberforge/skills/skill-author/SKILL.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/plugins/kyberforge/skills/skill-author/SKILL.md b/plugins/kyberforge/skills/skill-author/SKILL.md index 0a38fb0..c97f653 100644 --- a/plugins/kyberforge/skills/skill-author/SKILL.md +++ b/plugins/kyberforge/skills/skill-author/SKILL.md @@ -51,6 +51,7 @@ Design for one coherent user intent — skills too narrow force multiple loads p - [ ] A clear purpose — what specific task will this skill handle? - [ ] Trigger scenarios — when should an agent activate it, including indirect cases? - [ ] Skill name (kebab-case) and destination path +- [ ] Capture `git log --oneline -1` now, before touching the filesystem — Step 6 needs it to verify a real commit landed If any are missing, stop and ask the user before proceeding. @@ -233,6 +234,8 @@ Confirm the skill directory path exists and that at least one improvement signal If the skill dir is missing, ask for it. If no signals are present, stop: "This skill applies existing signals to a skill. For a blind review without signals, use `/skill-audit` instead." +- [ ] Capture `git log --oneline -1` now, before making any edits — Step 5 needs it to verify a real commit landed + Signals can come from anywhere in the conversation or referenced files: - Grill session output (most common predecessor in the factory sequence) - `/skill-audit` findings (PASS/FAIL/SUGGESTION punch list) @@ -275,8 +278,6 @@ Edit any file in the skill directory that the signals point to: SKILL.md, script If a signal points to a script or reference file, edit that file directly rather than adding a workaround in SKILL.md. -**On scripts**: Fix and edit existing scripts freely when signals point to them. - ### Step 5 — Validate and close Before running the audit, confirm: -- 2.43.0 From fc79acfa05ae7ee39620a64eb4018548e1ce3787 Mon Sep 17 00:00:00 2001 From: Defame1297 Date: Sun, 5 Jul 2026 12:46:05 +0000 Subject: [PATCH 3/8] fix(kyberforge): tighten skill-author checklist/phrasing/reference style Address round-2 independent-audit suggestions: single-item checklist misuse in the improve flow, inaccurate "before Step 1" phrasing, and an unbackticked cross-skill reference to kyberforge:forge. Refs #69, #71 --- plugins/kyberforge/skills/skill-author/SKILL.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/plugins/kyberforge/skills/skill-author/SKILL.md b/plugins/kyberforge/skills/skill-author/SKILL.md index c97f653..bc2f771 100644 --- a/plugins/kyberforge/skills/skill-author/SKILL.md +++ b/plugins/kyberforge/skills/skill-author/SKILL.md @@ -26,7 +26,7 @@ metadata: - Patching per symptom is the default failure mode. Three eval failures may all trace to one missing instruction — always identify the root cause before editing. - Do not create new scripts unless a signal explicitly calls for it. Writing scripts from scratch requires transcript analysis that is out of scope here; flag the opportunity as a suggestion instead. -- Never spawn a subagent to audit or recheck your own work during an authoring pass. Run `/skill-audit` yourself, inline, in the same context as the edits you just made. A *separate* independent recheck via a clean-context subagent is forge's outer-loop responsibility exclusively — delegating it inward here duplicates that layer and introduces a race: a stray self-spawned subagent can have its worktree torn down by concurrent cleanup, destroying an uncommitted draft before it was ever safe. +- Never spawn a subagent to audit or recheck your own work during an authoring pass. Run `/skill-audit` yourself, inline, in the same context as the edits you just made. A *separate* independent recheck via a clean-context subagent is the `kyberforge:forge` skill's outer-loop responsibility exclusively — delegating it inward here duplicates that layer and introduces a race: a stray self-spawned subagent can have its worktree torn down by concurrent cleanup, destroying an uncommitted draft before it was ever safe. ## Route @@ -234,7 +234,7 @@ Confirm the skill directory path exists and that at least one improvement signal If the skill dir is missing, ask for it. If no signals are present, stop: "This skill applies existing signals to a skill. For a blind review without signals, use `/skill-audit` instead." -- [ ] Capture `git log --oneline -1` now, before making any edits — Step 5 needs it to verify a real commit landed +Capture `git log --oneline -1` now, before making any edits — Step 5 needs it to verify a real commit landed. Signals can come from anywhere in the conversation or referenced files: - Grill session output (most common predecessor in the factory sequence) @@ -289,4 +289,4 @@ Run `/skill-audit` on the skill directory. Resolve any FAIL findings before cons If the skill is versioned (`metadata.version`), bump the **patch** version (e.g. `0.1.0` → `0.1.1`). -**Commit verification.** Capture `git log --oneline -1` before Step 1 and keep it. Once the audit is clean, run `git add` and `git commit` for the changed files — do not stop at staging. Then run `git log --oneline -1` again and confirm the hash changed from the one you captured at the start. A non-empty `git diff --stat` is not sufficient proof of completion: staged-but-uncommitted work isn't part of any commit and can be silently lost if the working tree is cleaned up before a commit lands. Only report the improvement as done once the hash has actually changed. +**Commit verification.** Capture `git log --oneline -1` at the start of Step 1 and keep it. Once the audit is clean, run `git add` and `git commit` for the changed files — do not stop at staging. Then run `git log --oneline -1` again and confirm the hash changed from the one you captured at the start. A non-empty `git diff --stat` is not sufficient proof of completion: staged-but-uncommitted work isn't part of any commit and can be silently lost if the working tree is cleaned up before a commit lands. Only report the improvement as done once the hash has actually changed. -- 2.43.0 From 3eb216afa6a04e625a12ce275733218c9b88e742 Mon Sep 17 00:00:00 2001 From: Defame1297 Date: Sun, 5 Jul 2026 12:52:18 +0000 Subject: [PATCH 4/8] fix(kyberforge): use consistent slash-command form for forge reference Refs #69, #71 --- plugins/kyberforge/skills/skill-author/SKILL.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/plugins/kyberforge/skills/skill-author/SKILL.md b/plugins/kyberforge/skills/skill-author/SKILL.md index bc2f771..35911d0 100644 --- a/plugins/kyberforge/skills/skill-author/SKILL.md +++ b/plugins/kyberforge/skills/skill-author/SKILL.md @@ -26,7 +26,7 @@ metadata: - Patching per symptom is the default failure mode. Three eval failures may all trace to one missing instruction — always identify the root cause before editing. - Do not create new scripts unless a signal explicitly calls for it. Writing scripts from scratch requires transcript analysis that is out of scope here; flag the opportunity as a suggestion instead. -- Never spawn a subagent to audit or recheck your own work during an authoring pass. Run `/skill-audit` yourself, inline, in the same context as the edits you just made. A *separate* independent recheck via a clean-context subagent is the `kyberforge:forge` skill's outer-loop responsibility exclusively — delegating it inward here duplicates that layer and introduces a race: a stray self-spawned subagent can have its worktree torn down by concurrent cleanup, destroying an uncommitted draft before it was ever safe. +- Never spawn a subagent to audit or recheck your own work during an authoring pass. Run `/skill-audit` yourself, inline, in the same context as the edits you just made. A *separate* independent recheck via a clean-context subagent is the `/forge` skill's outer-loop responsibility exclusively — delegating it inward here duplicates that layer and introduces a race: a stray self-spawned subagent can have its worktree torn down by concurrent cleanup, destroying an uncommitted draft before it was ever safe. ## Route -- 2.43.0 From b0903f190a6471338ea9bc901b0dbff8015d17ed Mon Sep 17 00:00:00 2001 From: Defame1297 Date: Sun, 5 Jul 2026 12:58:35 +0000 Subject: [PATCH 5/8] fix(kyberforge): require commit-hash verification in agent-author Prior sessions had authoring subagents report completion after only staging changes (git diff --stat showing output, but no git commit). agent-author's create and improve flows now require capturing git log --oneline -1 before and after the authoring pass and asserting the hash actually changed via a real commit, matching the fix already applied to skill-author. Refs #69 --- plugins/kyberforge/skills/agent-author/SKILL.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/plugins/kyberforge/skills/agent-author/SKILL.md b/plugins/kyberforge/skills/agent-author/SKILL.md index bcddd9f..dd77b24 100644 --- a/plugins/kyberforge/skills/agent-author/SKILL.md +++ b/plugins/kyberforge/skills/agent-author/SKILL.md @@ -56,6 +56,7 @@ Before touching the filesystem, confirm you have: - [ ] Root directory (plugin root, project root, or `~` for user scope) - [ ] Agent purpose — one sentence describing the task this agent handles - [ ] Trigger condition — when should the runtime delegate to this agent? +- [ ] Capture `git log --oneline -1` now, before touching the filesystem — Step 5 needs it to verify a real commit landed If any are missing, stop and ask before proceeding. @@ -193,6 +194,8 @@ If the destination is inside a plugin directory, apply a **minor bump** to the ` Invoke the `kyberforge:agent-audit` skill directly on the created files to confirm the pair is valid before closing. +**Commit verification.** Capture `git log --oneline -1` before Step 1 and keep it. Once the audit is clean, run `git add` and `git commit` for the new agent files — do not stop at staging. Then run `git log --oneline -1` again and confirm the hash changed from the one you captured at the start. A non-empty `git diff --stat` is not sufficient proof of completion: staged-but-uncommitted work isn't part of any commit and can be silently lost if the working tree is cleaned up before a commit lands. Only report the agent as done once the hash has actually changed. + ## Improving an existing agent ### Step 1 — Verify inputs @@ -201,6 +204,8 @@ Confirm the agent files exist and at least one improvement signal is present in If no signals: "This skill applies existing signals to an agent. For a blind review, examine the files manually or run a grill session first." +Capture `git log --oneline -1` now, before making any edits — Step 5 needs it to verify a real commit landed. + **Partial state** — if one provider file exists but the other does not, scaffold the missing file first (run `bash scripts/new-agent.sh ` — the file-by-file no-op means only the missing file is created), then continue with the improve flow on both files. ### Step 2 — Gather and group signals @@ -231,3 +236,5 @@ Re-run the validation checklist from the create flow's Step 5 on any edited file If the agent lives inside a plugin directory, apply a **patch bump** to the `version` field in both `plugin.json` and `.claude-plugin/plugin.json` at the plugin root in the same edit pass (e.g. `1.0.4` → `1.0.5`). Invoke the `kyberforge:agent-audit` skill directly on the edited files to confirm no regressions before closing. + +**Commit verification.** Capture `git log --oneline -1` at the start of Step 1 and keep it. Once the audit is clean, run `git add` and `git commit` for the changed files — do not stop at staging. Then run `git log --oneline -1` again and confirm the hash changed from the one you captured at the start. A non-empty `git diff --stat` is not sufficient proof of completion: staged-but-uncommitted work isn't part of any commit and can be silently lost if the working tree is cleaned up before a commit lands. Only report the improvement as done once the hash has actually changed. -- 2.43.0 From fe24f7d9001465996d5410b893afccc54426e553 Mon Sep 17 00:00:00 2001 From: Defame1297 Date: Sun, 5 Jul 2026 13:06:39 +0000 Subject: [PATCH 6/8] fix(kyberforge): close agent-author frontmatter-comment and audit-availability gaps Independent skill-audit found that agent-author's closing checklists never verified template comments were stripped from frontmatter (produces invalid YAML if left in), the Copilot field-exclusion checklist omitted two fields present in the authoritative list, and the improve flow had no agent-audit availability check unlike the create flow. --- plugins/kyberforge/skills/agent-author/SKILL.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/plugins/kyberforge/skills/agent-author/SKILL.md b/plugins/kyberforge/skills/agent-author/SKILL.md index dd77b24..967bbc9 100644 --- a/plugins/kyberforge/skills/agent-author/SKILL.md +++ b/plugins/kyberforge/skills/agent-author/SKILL.md @@ -181,14 +181,16 @@ Run this checklist before invoking the audit: - [ ] If plugin scope: no `hooks`, `mcpServers`, or `permissionMode` (silently ignored at plugin scope) - [ ] System prompt body present and non-empty - [ ] No `FILL IN:` placeholders remain +- [ ] No `` template comments remain in frontmatter **Copilot CLI file (`.agent.md`):** - [ ] File extension is `.agent.md` (not `.md`) - [ ] `name` field matches the filename stem (e.g. `name: my-agent` in `my-agent.agent.md`) - [ ] `description` field present -- [ ] No Claude Code-only fields (`maxTurns`, `isolation`, `memory`, `permissionMode`, `effort`) +- [ ] No Claude Code-only fields (`maxTurns`, `isolation`, `memory`, `permissionMode`, `effort`, `hooks`, `mcpServers`) - [ ] System prompt body present and non-empty - [ ] Body does not exceed 30,000 characters +- [ ] No `` template comments remain in frontmatter If the destination is inside a plugin directory, apply a **minor bump** to the `version` field in both `plugin.json` and `.claude-plugin/plugin.json` at the plugin root in the same edit pass (e.g. `1.0.4` → `1.1.0`). @@ -204,6 +206,8 @@ Confirm the agent files exist and at least one improvement signal is present in If no signals: "This skill applies existing signals to an agent. For a blind review, examine the files manually or run a grill session first." +Verify `kyberforge:agent-audit` is available — it ships with the kyberforge plugin and is co-installed with this skill. If unavailable, stop and tell the user to install the kyberforge plugin before continuing. + Capture `git log --oneline -1` now, before making any edits — Step 5 needs it to verify a real commit landed. **Partial state** — if one provider file exists but the other does not, scaffold the missing file first (run `bash scripts/new-agent.sh ` — the file-by-file no-op means only the missing file is created), then continue with the improve flow on both files. -- 2.43.0 From f657123931a1b72eb22ee903aa46348b8eed3d96 Mon Sep 17 00:00:00 2001 From: Defame1297 Date: Sun, 5 Jul 2026 13:13:25 +0000 Subject: [PATCH 7/8] fix(kyberforge): fix checklist/action mixing and improve-flow source_keys gap in agent-author The Prerequisites checklist mixed items to confirm (preconditions) with an action to perform (capturing git log), so the following "stop and ask if missing" gate didn't logically apply to the git-log step. The improve flow also had no reminder to update source_keys/sources.md when an edit touches research-sourced content, unlike the create flow's explicit step for it. Refs #69 --- plugins/kyberforge/skills/agent-author/SKILL.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/plugins/kyberforge/skills/agent-author/SKILL.md b/plugins/kyberforge/skills/agent-author/SKILL.md index 967bbc9..936e6b7 100644 --- a/plugins/kyberforge/skills/agent-author/SKILL.md +++ b/plugins/kyberforge/skills/agent-author/SKILL.md @@ -56,9 +56,8 @@ Before touching the filesystem, confirm you have: - [ ] Root directory (plugin root, project root, or `~` for user scope) - [ ] Agent purpose — one sentence describing the task this agent handles - [ ] Trigger condition — when should the runtime delegate to this agent? -- [ ] Capture `git log --oneline -1` now, before touching the filesystem — Step 5 needs it to verify a real commit landed -If any are missing, stop and ask before proceeding. +If any are missing, stop and ask before proceeding. Then capture `git log --oneline -1` before touching the filesystem — Step 5 needs it to verify a real commit landed. Verify `kyberforge:agent-audit` is available — it ships with the kyberforge plugin and is co-installed with this skill. If unavailable, stop and tell the user to install the kyberforge plugin before continuing. @@ -233,6 +232,8 @@ Before editing, state which root causes were identified, what evidence supports Edit any file the signals point to. Generalize the fix — find the underlying gap, not the specific example that failed. For every sentence you add, ask: "Would the agent get this wrong without it?" A shorter, focused definition consistently outperforms an exhaustive one. For Copilot files, verify no Claude Code-only fields are introduced. +If the edit adds or removes research-sourced content, update `source_keys` in the edited file(s) and the corresponding entry in `sources.md` per Create flow's Step 4. + ### Step 5 — Validate and close Re-run the validation checklist from the create flow's Step 5 on any edited file. -- 2.43.0 From c60ec5f2f7e0d63c6c57132e3dbe212aeced7d65 Mon Sep 17 00:00:00 2001 From: Defame1297 Date: Sun, 5 Jul 2026 13:18:05 +0000 Subject: [PATCH 8/8] chore(kyberforge): bump plugin version to 1.2.3 skill-author and agent-author SKILL.md files received bug fixes (git-log commit-hash verification before reporting completion, skill-author now forbids self-spawning audit/recheck subagents during its authoring pass, and agent-author closed checklist/coverage gaps). Patch bump to reflect fixed behavior, not new capability. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01FNJWdVvdgvZCHi1hZGqgVQ --- plugins/kyberforge/.claude-plugin/plugin.json | 2 +- plugins/kyberforge/plugin.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/plugins/kyberforge/.claude-plugin/plugin.json b/plugins/kyberforge/.claude-plugin/plugin.json index 5894989..8a5badf 100644 --- a/plugins/kyberforge/.claude-plugin/plugin.json +++ b/plugins/kyberforge/.claude-plugin/plugin.json @@ -8,5 +8,5 @@ "keywords": [], "license": "MIT", "name": "kyberforge", - "version": "1.2.2" + "version": "1.2.3" } diff --git a/plugins/kyberforge/plugin.json b/plugins/kyberforge/plugin.json index 1225684..f540bc0 100644 --- a/plugins/kyberforge/plugin.json +++ b/plugins/kyberforge/plugin.json @@ -13,5 +13,5 @@ "skills": [ "skills/" ], - "version": "1.2.2" + "version": "1.2.3" } -- 2.43.0