Files
holocron/apm.yml
Defame1297 70210d6a7e feat(factory-audit): audit hooks, instructions and prompts
factory-audit gains three Step 0 rows and flows for the apm primitives
that have no container of their own: a .json file under hooks/, a
*.instructions.md and a *.prompt.md. apm validates almost none of them
(invalid hook JSON is skipped silently, instruction validate() only
warns, input: names are never checked against ${input:x}), so the
deterministic checks live in a new scripts/lib-checks-primitive.sh,
wired into validate.sh's path-shape detection. Each check and tier
traces to the Authoring checklists in the microsoft-apm research docs.

- Hook: JSON/shape/event-list checks mirroring the Copilot payload
  validator, never-firing event casing, missing/escaping/non-executable
  scripts (FAIL); deprecated filename routing and ${CLAUDE_PLUGIN_ROOT}
  (SUGGESTION).
- Instruction: location, frontmatter, description, body, stem clash
  (FAIL); missing or list applyTo and unread keys (SUGGESTION).
- Prompt: location/name, frontmatter, description, input names, the
  upstream `- name: x` docs bug, declared-vs-used ${input:x} (FAIL);
  ADR-0029 description length and trigger clause, dropped keys,
  camelCase aliases, argument-hint with input (SUGGESTION). Whether a
  prompt carries procedure is judgment in prompt-flow.md, not a script
  heuristic.

Vale now lints *.instructions.md and *.prompt.md with the Kyberforge
style; test-vale-wrap.sh gains their probe rows. New
tests/validate-primitive.bats (31 cases). kyberforge 2.0.1 -> 2.1.0 with
the executables.allow key, catalog 0.5.1 -> 0.5.2, marketplace.json
regenerated.

Refs #94

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KkT7RSDwDbmrM9T34b6sTi
2026-09-28 17:02:04 +00:00

123 lines
4.7 KiB
YAML

name: holocron
version: 0.5.2
description: AI development skills for Claude Code, and for GitHub Copilot through apm — factory, design, implement, review, and cross-cutting workflows.
license: MIT
# Consumer side: this repo installs its own published plugins from the holocron
# remote, so the working copy runs the same released content every other
# consumer gets. Addressed as git+path objects rather than <name>@holocron
# marketplace aliases — an alias needs a `apm marketplace add` registration in
# ~/.apm/marketplaces.json (user scope, outside this repo), the object form
# needs nothing beyond this manifest.
# Unpinned (default branch) on purpose: parity with the Claude Code plugin
# install this replaced, which ran autoUpdate against main. Add `ref: <tag>`
# per entry to pin.
targets:
- claude
dependencies:
apm:
- git: git@git.rkdr.net:Defame1297/holocron.git
path: plugins/bin
- git: git@git.rkdr.net:Defame1297/holocron.git
path: plugins/core
- git: git@git.rkdr.net:Defame1297/holocron.git
path: plugins/git
- git: git@git.rkdr.net:Defame1297/holocron.git
path: plugins/gitea
- git: git@git.rkdr.net:Defame1297/holocron.git
path: plugins/kyberforge
- git: git@git.rkdr.net:Defame1297/holocron.git
path: plugins/lint
# TOD's skills arrive transitively through this wrapper rather than as a
# direct entry, so the marketplace and this repo consume onedev by the same
# path. The pin lives in plugins/onedev/apm.yml: third-party content is
# pinned, unlike the six first-party entries above, which stay unpinned for
# default-branch parity.
#
# Resolves only once plugins/onedev is on the remote's main — until then
# `apm install` fails, which includes the copy kyberforge's SessionStart
# hook runs on launch. Accepted deliberately: this branch is merging
# immediately.
- git: git@git.rkdr.net:Defame1297/holocron.git
path: plugins/onedev
mcp: []
# Turns apm's executable-trust gate ON. Without this block the gate is disabled
# and every hook, bin and MCP primitive a dependency ships deploys silently —
# verified: `apm approve --list` reports "Executable-trust gate disabled -- all
# executables deploy" until an `executables:` block exists.
#
# kyberforge ships the SessionStart hook that keeps this install level with the
# remote (ADR-0019). The `#2.0.0` suffix below is cosmetic as far as apm is
# concerned: grants are version-BLIND in apm 0.28.0. `_map_grants`
# (apm_cli/security/executables.py) matches the exact key, the version-blind
# name, or any stored key sharing that name, and `materialize_exec_map` also
# stores the version-blind name — so approving `kyberforge` covers
# `kyberforge#2.0.0` and vice-versa, and a kyberforge version bump does NOT
# make this entry stop matching or stop the hook deploying. Do not delete the
# suffix anyway: `scripts/check-executables-allow-sync.sh` is a repo-authored
# pre-push hook that asserts this key carries the version in
# plugins/kyberforge/apm.yml, so a bump here is a repo convention to keep, not
# an apm mechanic.
executables:
allow:
kyberforge#2.1.0:
hooks: true
bin: true
marketplace:
# apm's Claude marketplace mapper only emits description:/version: into the
# compiled marketplace.json when set explicitly here (an override) — the
# top-level apm.yml description:/version: above are NOT inherited into the
# compiled output despite being used elsewhere (e.g. by `apm audit`).
description: AI development skills for Claude Code, and for GitHub Copilot through apm — factory, design, implement, review, and cross-cutting workflows.
version: 0.5.2
owner:
name: Defame1297
email: defame1297@rkdr.net
url: https://git.rkdr.net/Defame1297/
# Default tag pattern used to resolve version ranges for each package.
build:
tagPattern: "v{version}"
# Output targets (map form). Each output writes to its profile default
# path; add 'path:' under a key to override.
outputs:
claude: {}
# CI tip: build a machine-readable manifest:
# apm pack --marketplace=claude --json | jq -r '.marketplace.outputs[].path'
versioning:
strategy: per_package
packages:
- name: kyberforge
source: ./plugins/kyberforge
category: Developer Tools
- name: bin
source: ./plugins/bin
category: Utilities
- name: git
source: ./plugins/git
category: Version Control
- name: gitea
source: ./plugins/gitea
category: Version Control
- name: onedev
source: ./plugins/onedev
category: Version Control
- name: core
source: ./plugins/core
category: Productivity
- name: lint
source: ./plugins/lint
category: Developer Tools