Claude Code AI - Gitea MCP 598a7c326a refactor(skills): retrofit the corpus to the ADR-0020 context contract (#129)
Retrofits all 39 skills to ADR-0020's description/body context contract, then fixes what six rounds of independent review found in that retrofit — including four ways the hot gate itself failed open.

Closes #99, #107, #108, #110, #111, #114, #115, #120.

## The retrofit (waves 1-5)

| | Start | Now |
|---|---|---|
| Description FAILs (>400 chars) | 26 | **0** |
| Body FAILs (>900 words, body-only) | 9 | **0** |
| Dangling routing targets | 2 | **0** |
| `Kyberforge.CompositionNote` | 10 | **0** |
| Preload tax | 21,005 chars | **~10,500** |

Under the 12,000-char success criterion. Per-wave detail is on #99.

## The review fixes

**The gate failed open four ways, three of them found after the retrofit shipped.** An unrecognised follower token made a dangling target vanish. A skill directory with no `SKILL.md` resolved as a valid target, so a commit could be green locally and red in a fresh clone — three existing fixtures were relying on that, one of which made the install-leak A/B pass vacuously. Then the free-standing `/name` sweep turned out to be gated on the sentence carrying a boundary marker, so route notation in any other sentence was invisible — not an ERROR, not a SUGGESTION, not an INFO — which left the documented "`/name` always blocks" promise false from a second direction. All four fixed and pinned.

**Two checks were silently not running.** `validate-provenance.sh` checks 7-8 were dead across nine skills. Waking them exposed a deeper problem: they assume `Research doc:` names a source index, but 30 of 121 entries point at topic content documents, so every new check-7 INFO was a false positive and check 8 was saved from a false-FAIL flood only by an *unannounced* skip. Checks 7/8 are now scoped to source indexes and every skip announces itself (#121).

**The retrofit's own anti-goal, four times.** ADR-0020 warns that a blunt gate gets satisfied by deleting content rather than relocating it. `diagnose` and `skill-audit` relocated prose and then read it unconditionally; `prototype` and `vale-config` deleted rules outright that survived nowhere. All four addressed.

## Verification

- `bash tests/run-tests.sh --strict` — 24 suites, 0 skipped, 0 failed
- `bash tests/run-bats.sh` — 325 tests, 0 failures
- `pre-commit run --all-files` — 17/17
- `pre-commit run --hook-stage pre-push --all-files` — 16/16, with `apm marketplace check` and `apm pack --check-clean` run against the remote, not skipped
- `scripts/skill-size-check.sh` over all 39 skills — rc 0, 0 ERROR/FAIL, SUGGESTION-only
- Preload tax measured at **10,498 chars**, max description 390 — both inside budget
- Every new test proven non-vacuous by a deliberate mutation of the behaviour it covers

**Per-commit sync, stated accurately:** the ten commits from the latest review round each pass `check-plugin-content-sync` in isolation, verified by checking each out in a detached worktree with a clean between. The earlier gitea window (`dfacf05..bedbd1d`, nine commits) does **not** — its mirror was regenerated in one batch at `bbc7300`. An earlier revision of this description claimed the property held for every commit; it does not, and a bisect through that window lands on a red commit. **Squash-merge** to collapse it, or accept that this range is not bisectable.

## Version bump

Six plugins and the catalog take a **patch**, not a minor. The branch is **89 commits — 40 `fix` / 30 `refactor` / 12 `docs` / 5 `chore` / 2 `test` — zero `feat`, zero `!`, zero `BREAKING CHANGE`** — and adds no skill, agent, command or hook. (Two earlier revisions of this section cited a stale histogram, most recently 78 commits; the figures above are measured at HEAD.) Both rules this repo ships (`forge/references/version-bump.md`, landing in this PR, and `git-commits/references/conventional-commits-spec.md`) make that a patch, and the catalog set is unchanged at 7 entries.

Not settled by that: four published files were removed from the installed tree, three moved, and `caveman` gained `disable-model-invocation`, retiring its old triggers. Under a strict reading those are major-class and currently ship under `refactor:` with no marker. Whether the deployed skill surface is a public contract is written down nowhere — worth deciding, but it outlives this PR.

## Deliberately not in scope

#112 (cherry-pick ownership, now resolved in favour of `git-commits`), #113 (`rtk git` normalisation), #116 (research fan-out), #101 (audit-skill merge), #122 (non-spec skill-root files), #123 (no PRD producer) stay open. #117 is the one worth reading: the contract's remedy is to move prose into `references/`, which is exactly where neither the size gate nor Vale looks — and the blind spot is wider than #117 currently records, since there is no root `.vale.ini` at all, so every ADR, `CONTEXT.md` and `README.md` is unlinted too.

That blind spot let this branch carry two `level: error` `Kyberforge.SentenceOpenerThereIs` violations into `references/` files it created — `provider-adapter-author/references/provider-matrix.md:31` and `agent-audit/references/finding-criteria.md:95`. Both are reworded in `afadaae`, confirmed by routing each file through the audit's own `vale-wrap.sh` (1 error each before, 0 after). Five further occurrences sit in `references/` files already on `main`; those are the pre-existing corpus and stay with #117, which is the real fix.

Also unfixed and not this PR's: `apm install` appends a duplicate `SessionStart` entry to `.claude/settings.json`, so a fresh clone cannot get pre-push green without an edit AGENTS.md warns against. Reproduces identically on `main`.

Co-authored-by: Defame1297 <gitea@rkdr.net>
Reviewed-on: https://git.dev.rkdr.net/Defame1297/holocron/pulls/129
Co-authored-by: Claude Code AI - Gitea MCP <claude@noreply.git.dev.rkdr.net>
Co-committed-by: Claude Code AI - Gitea MCP <claude@noreply.git.dev.rkdr.net>
2026-09-01 13:47:46 +00:00

holocron

The global AI development configuration repository — the authoritative source for agent definitions, skills, workflows, and prompts across all projects. Built as a homelab tool intended to scale to professional environments.

Content ships as six installable plugins, each an apm (Agent Package Manager) package. This repo consumes its own plugins through apm, so the working copy runs the same released content every other consumer gets.

Repo layout

Path What it holds
plugins/ Six apm packages — bin, core, git, gitea, kyberforge, lint — each carrying skills, and where relevant agents, hooks, MCP servers, and bundled assets
providers/claude-code/ Claude Code adapter, deployed to ~/.claude/ via scripts/install.sh
core/ Provider-agnostic always-on content — core/AGENTS.md and core/instructions/
docs/ Specs (docs/spec/), architectural decisions (docs/adr/), governance, research, and notes
scripts/ Install, sync, and check scripts used by the git hooks
tests/ run-tests.sh, run-bats.sh, the test-*.sh suites, and the bats submodules

The six plugins:

  • kyberforge — skills and agents for creating, maintaining, and managing a Claude Code / Copilot CLI plugin marketplace
  • git — conventional commits, branches, history, submodules, worktrees, remotes, pre-commit hook authoring and running (pc-author / pc-run), and an interactive router (git-workflow)
  • gitea — issues, pull requests, labels, milestones, releases, branches, files, and an interactive router (gitea-workflow)
  • core — authoring and auditing a repo's AGENTS.md and the provider adapter files that defer to it
  • lint — configuring and running linters
  • bin — cross-cutting workflow skills not yet split into a focused plugin: research, documentation, TDD, prototyping, triage, diagnosis, architecture review, requirement grilling, compressed output (caveman), and re-orienting mid-task (zoom-out)

Prerequisites

Install all of these before setting up. Each one is a hard dependency of a git hook or a script — several fail with an unhelpful "command not found" if missing.

Tool Why Install
apm CLI Four pre-push hooks shell out to it (apm-marketplace-check, apm-audit-ci, apm-pack-check-clean, and check-plugin-content-sync via scripts/sync-plugin-content.sh) The apm-install skill, or curl -sSL https://aka.ms/apm-unix | sh. Verify with apm --version
jq Required by scripts/check-manifests.sh and scripts/sync-plugin-content.sh, both pre-push Your package manager
python3 + PyYAML Required by scripts/skill-size-check.sh (the skill-size-check pre-commit hook), which reads folded YAML frontmatter python3 is usually present — pre-commit is itself a Python application. pip install pyyaml if the hook reports PyYAML missing
vale Required by the vale-audit-prefilter-skill / -agent pre-commit hooks and the check-vale-style-sync pre-push hook brew install vale (macOS), snap install vale (Linux), choco install vale (Windows), or https://vale.sh/docs/vale-cli/installation/
claude CLI Required by the validate-plugins and validate-marketplace pre-push hooks Claude Code

Two notes worth reading before you skip one:

  • PyYAML is a hard requirement, not an optional accelerator. The hand-rolled fallback frontmatter reader was removed deliberately: a reader that mis-parses an unfamiliar scalar shape reports a clean pass on a file it never measured.
  • No vale sync is needed. The Kyberforge styles are committed under plugins/kyberforge/.apm/skills/{skill-audit,agent-audit}/assets/vale/styles/, not downloaded packages (ADR-0014).

Setup

Run these in order, from the repo root.

# 1. Deploy this repo's own skills and agents
apm install

# 2. Install the git hooks — all three stages
pre-commit install -t pre-commit -t commit-msg -t pre-push

apm install deploys the six plugins into .claude/skills/ and .claude/agents/. Both are gitignored install output, not authoring source — plugins/<name>/.apm/ remains the only place to edit. It needs the network, materializes apm_modules/ (which stays gitignored), and also configures the obsidian MCP server into the repo's .mcp.json.

Git hooks must be wired for all three stages. This repo's .pre-commit-config.yaml has no default_install_hook_types, so a plain pre-commit install silently skips commit-msg (Conventional Commits) and pre-push (the full gate) — the -t flags above are not optional. The pc-run skill handles this and the troubleshooting around it, if you would rather not remember the flags.

Keeping the install current

The six dependencies in root apm.yml are unpinned against the default branch, so deployed skills go stale whenever anyone merges. kyberforge ships a SessionStart hook that runs apm outdated at startup (~0.7s) and, when something is behind, runs apm update --yes and asks the host to re-scan skills (~10.4s).

That rewrites apm.lock.yaml — an unexplained modification to it after opening a session is expected, not a bug. Commit or discard it deliberately.

Note the difference between the two commands:

  • apm install deploys from apm.lock.yaml. It does not pick up remote changes.
  • apm update re-resolves refs. This is the command that pulls in a merged .apm/ edit.

Running tests

bash tests/run-tests.sh              # every test-*.sh script plus the bats suite
bash tests/run-tests.sh --bats-only  # just bats

The first run auto-initializes the bats submodules; no manual git submodule update needed.

A suite that exits 77 because a dependency is missing is reported as SKIPPED and does not fail an ad-hoc run. It does fail under --strict (equivalently RUN_TESTS_STRICT=1), which is how the pre-push hook invokes it — at pre-push, a skip means one of the prerequisites above is absent on this machine, and the gate would otherwise report success having run fewer suites than it appears to. The strict failure names each skipped suite and what to install.

Before pushing

Run the pre-push gate locally in one command:

pre-commit run --hook-stage pre-push --all-files

One caveat: check-release-needed is a silent no-op under this invocation. It exits 0 unless PRE_COMMIT_REMOTE_BRANCH is refs/heads/main, and pre-commit exports that only from the real pre-push git hook during an actual git push — so the hook reports Passed having checked nothing. Every other pre-push hook does run.

See docs/spec/gates.md for what each hook enforces and why.

Offline? Exactly two pre-push hooks need the network, because root apm.yml's marketplace contains one remote package entry that must be resolved with git ls-remote:

SKIP=apm-marketplace-check,apm-pack-check-clean git push

Skip only those two. The remaining pre-push hooks are real local checks and pass offline; adding one of them to SKIP disarms it silently.

Editing plugin content

plugins/<name>/.apm/ is the only hand-edited source for plugin content — skills, agents, commands, instructions, extensions, and hooks. The flat plugins/<name>/{skills,agents,commands,instructions,extensions}/ directories, the merged hooks/hooks.json, and every plugin.json / marketplace.json manifest are generated. Nothing labels a generated file as generated, so check the path before you edit; an edit to the mirror is discarded by the next sync and reported as drift by the check-plugin-content-sync pre-push hook.

Hand-authored material that is not an .apm/ primitive — README.md, docs/, bin/, sources.md, .mcp.json — lives at the plugin root and is untouched. Never place such a file inside a mirrored directory: the sync removes the destination before every copy, so it is deleted with no drift report.

Full detail in docs/spec/architecture.md.

For external consumers

Install a plugin natively from the marketplace manifests:

claude plugin install <name>@holocron

Or consume the packages through apm, the way this repo does — declare them as dependencies.apm git+path entries against the holocron remote and run apm install.

Where to go next

Description
AI development skills for Claude Code and GitHub Copilot CLI — factory, design, implement, review, and cross-cutting workflows.
Readme 14 MiB
Languages
Shell 89.7%
Python 6.3%
HTML 3.7%
JavaScript 0.3%