mirror of
https://github.com/alirezarezvani/claude-skills.git
synced 2026-08-28 04:24:58 +00:00
67 commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Alireza Rezvani
|
3301348d09
|
fix(docs): correct the commands delta and a README spacing nit
Addresses both review findings on #993. 1. The changelog/CLAUDE.md counter line said "commands 147 → 150", which asserts this plugin adds three commands. It adds exactly one (commands/cs-spinning-up-deep-rl.md). 147 was this branch's pre-merge baseline; after merging dev the delta had to be restated against dev's baseline, and that one figure was carried over unchanged while the others were updated. Verified empirically rather than by arithmetic: derive_counters on an origin/dev worktree reports 149 commands, and the raw command-file count goes 281 → 282 across the merge. Corrected to 149 → 150. The other three figures on that line (skills 387 → 388, agents 117 → 118, plugins 98 → 99) were already right. 2. README POWERFUL-tier row had a stray space before a comma: "calculator) , **spinning-up-deep-rl**". Removed. Neither affected derive_counters --check, which reads the tree rather than the prose -- which is exactly why a wrong delta in prose can survive a green gate, and why it was worth fixing in a repo this strict about counters being trustworthy. Gates re-run: compileall, check_plugin_json --all, check_paths, check_frontmatter, check_dual_publish, check_model_freshness, smoke_scripts (696/696), derive_counters --check. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UySnyf5upm4y8xhYA3w6yw |
||
|
Alireza Rezvani
|
d5635e5a05
|
Merge branch 'dev' into claude/spinning-up-book-skill-hhbjpy
dev moved: PR #994 landed engineering/deep-learning-book, which collides with this branch on every headline-counter and registry surface. Conflicts resolved in four files, keeping both sides' content: - .claude-plugin/marketplace.json -- both plugin entries kept; the registry now carries spinning-up-deep-rl and deep-learning-book. 99 plugins. - CHANGELOG.md -- both Unreleased sections kept. - CLAUDE.md, README.md -- dev's prose taken as the newer baseline, then this branch's engineering-row entry restored and every counter re-derived rather than hand-picked from either side. Counters re-derived from the merged tree with derive_counters.py, which is the ground truth, and trued up across all five surfaces: 388 skills, 99 plugins, 727 tools, 842 references, 118 agents, 150 commands. Both changelog/CLAUDE.md delta lines are restated: each side was written against its own base and both claimed 386 -> 387, which is no longer true of either now that they land together. This branch's entry is now stated as the delta on top of deep-learning-book. Gates re-run on the resolved merge: no conflict markers left in the tree, compileall, check_plugin_json --all, check_skill_names, check_paths, check_frontmatter, check_dual_publish, check_model_freshness, smoke_scripts (696/696), derive_counters --check, book_skill_validator --strict, and a JSON/YAML parse of every file touched. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UySnyf5upm4y8xhYA3w6yw |
||
|
Claude
|
eeb3cb9ad6
|
fix(deep-learning-book): position-wise linear, correcting a 512x parameter error in the example asset
Third review on PR #994 found a real bug in the flagship example asset. Verified before fixing: assets/example_layer_spec.json reported 1,207,962,624 parameters for the feedforward up-projection instead of 2,362,368 — off by exactly 512x, the sequence length — putting the block's total at ~1.21B instead of ~7.09M. Root cause was in the tool, not only the asset. model_arithmetic.py's mha layer emits (seq, d_model) but linear refused any 2-D input, so the only way to attach a feedforward block was to flatten first. Flattening collapses all 512 positions into one 393,216-element vector, which models a dense layer over the whole sequence — a different layer, with seq_len times the parameters. A transformer FFN was therefore not expressible at all, and the shipped example walked straight into it. Clean exit is not correct numbers, which is why --sample exit-code testing never caught it. Fixed the cause: linear on a 2-D (seq, features) input is now position-wise — one weight matrix shared across positions, parameters independent of sequence length, compute linear in it. Documented in the module docstring; the 3-D path still refuses with an updated message pointing at flatten. Removed the flatten from the example asset and recorded in its comment why it must not come back. Verified: the corrected block reports 7,087,872 parameters, matching a hand-check of 2*(2*768) + (4*768^2+4*768) + (768*3072+3072) + (3072*768+768) exactly, and the size of a BERT-base encoder layer. The convnet --sample is unchanged at 545,098, and linear on 3-D input still exits 5. Also adds the missing CHANGELOG.md [Unreleased] entry, which the same review noted: CLAUDE.md, README.md and marketplace.json carried the new skill and its counter deltas but CHANGELOG.md did not. Gates green: compileall, check_paths, check_frontmatter, check_dual_publish, check_model_freshness, smoke_scripts (696 passed), derive_counters --check, check_skill_names, check_plugin_json, book_skill_validator, and --help + --sample --output json on all four tools. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BswsZp5zrJWFAGU6KWNA1s |
||
|
Alireza Rezvani
|
800a0d5672
|
feat(engineering): compile OpenAI's Spinning Up in Deep RL into a knowledge-base plugin
Runs engineering/book-to-skill end to end on its first real source: OpenAI's Spinning Up in Deep RL (MIT, (c) 2018 OpenAI; primarily developed by Joshua Achiam). Cloned openai/spinningup and compiled its docs/ reStructuredText tree (38 files, ~37k words, ~49K tokens) through the full pipeline -- extract --mode technical, analysis, 20 chapter files, glossary/patterns/cheatsheet, master SKILL.md, validator, plugin emitter. The compiled skill passes book_skill_validator.py in --strict mode with every file inside budget: a 2,101-token resident core (cap 4,000) plus 20 on-demand chapters averaging ~1,256 tokens each. Chapter structure follows the source's own toctree rather than a heading scan: user documentation (ch01-06), Introduction to RL Parts 1-3 (ch07-09), the researcher essay / key papers / exercises / benchmarks (ch10-13), one chapter per algorithm in lineage order (ch14-19: VPG to TRPO to PPO, DDPG to TD3 and SAC), and the logger/MPI/ExperimentGrid utilities (ch20). Rights basis is open-license, not fair use -- the emitter's Step-11 gate refuses a shareable package without one. Upstream's MIT notice is reproduced in full in the plugin's LICENSE beside this package's own, and README.md names the source, the author and the source's frozen version; a sidecar JSON is not a license notice. Also fixes a defect the emitter only reveals at its final step: skill_plugin_emitter.py wrote its whole `source` provenance block into plugin.json, on a stale inline claim that `source`/`attribution` were approved extension fields. Claude Code rejects an entire manifest on any unrecognized key (issue #954) and scripts/check_plugin_json.py hard-fails such a manifest, so every package the emitter produced failed the blocking CI gate on commit. _plugin_manifest() now emits spec fields only and a new _authoring_notes() writes .claude-plugin/authoring-notes.json. Recorded as deviation 26 in engineering/book-to-skill/README.md; the printed marketplace.json snippet is unchanged, since `source` is a valid key there. Counters: skills 386 -> 387, agents 116 -> 117, commands 146 -> 147, plugins 97 -> 98. Tools and references unchanged -- a compiled knowledge base ships notes, not scripts. All blocking CI gates verified locally: compileall, check_plugin_json --all, check_skill_names, check_paths, check_frontmatter, check_dual_publish, check_model_freshness, smoke_scripts (692/692), derive_counters --check. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UySnyf5upm4y8xhYA3w6yw |
||
|
Claude
|
645c523be1
|
feat(marketing): add linkedin plugin — organic presence with platform rules in code
Answers discussion #934, which asked for a strategic assistant for growing a LinkedIn presence organically rather than a post generator. Six skills under marketing/linkedin/: an orchestrator (context: fork) plus profile, strategy, content, engagement, and analytics lanes. 17 stdlib-only tools, 15 references, 2 agents, 8 /cs:* commands. The design constraint is the differentiator: no LinkedIn credentials, no API calls, no scraping, nothing auto-sent. Automated posting, connecting, and commenting are prohibited by LinkedIn's User Agreement 8.2, and a restricted account ends a compounding asset. linkedin_policy_gate.py runs before any drafting and refuses seven request classes — automation, scraping, engagement pods, bulk messaging, fake identity, fabricated proof, named third-party automation platforms — each carrying the policy anchor and a compliant substitute, so the gate never just says no. Refusals are real rather than advisory. A cadence under 90 minutes a week returns a comment-only plan instead of a schedule that dies in week five. A newsletter whose six-month cost exceeds the budget is refused before the promise is made. An experiment needing more posts than a quarter allows is reported infeasible rather than quietly re-sized. The pattern miner refuses to test anything below 10 posts and reports NOTHING_SURVIVED as a finding. Evidence discipline: two widely repeated claims are corrected rather than propagated. The "personalised note triples acceptance" claim is not supported by the largest samples (acceptance is near-identical either way, ~26.4%); what a note moves is the post-accept reply rate (~5.4% to ~9.4%), which is why the message builder refuses an ask in a first-touch note. The ~19% in-body link reach reduction has never been confirmed by LinkedIn as a penalty and has a plausible dwell-time explanation, so it is a warning rather than a block. Every reference carries per-claim confidence levels. Accessibility is a blocking lint finding: Unicode pseudo-bold is announced by screen readers as mathematical symbols and is not indexed by search. All six SKILL.md files are 6/6 PASS on the write-a-skill checklist. Every tool supports --help, --sample, and --output json with typed exit codes. Counters: skills 380 -> 386; plugins 96 -> 97; tools 706 -> 723; refs 823 -> 838; agents 114 -> 116; commands 138 -> 146 (derive_counters.py --check). Also syncs three previously-merged skills (agent-memory, hivemind, skill-doctor) into the .hermes/ and .vibe/ mirror trees, which had drifted behind .codex/. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JSPxUHU6utqme7qC6EwHEh |
||
|
Claude
|
d928ec95d5
|
release: v2.12.0 — consolidated release notes, version bump, docs-site regeneration
- CHANGELOG.md gains the [2.12.0] entry (first tagged release since v2.9.0):
consolidates the previously documented but untagged v2.10.0-v2.11.2 work,
all post-2.11.2 merges, and the full 17-issue triage sweep; the ten stacked
[Unreleased] sections are demoted into the 2.12.0 body so the Release
workflow tags and publishes the whole span. Verified parseable with
scripts/extract_release_notes.py (version 2.12.0, 554-line body).
- Version markers bumped to 2.12.0: marketplace.json metadata,
CLAUDE.md current-version header + footer.
- Counters trued to the derived values (380 skills / 96 plugins / 20 domains /
706 tools / 823 refs / 114 agents / 138 commands) in README badges + prose,
CLAUDE.md, marketplace.json, and the long-stale mkdocs.yml/docs/index.md
site description (was still claiming 345/78/17).
- Docs site regenerated via scripts/generate-docs.py (568 generated pages;
new pages for the recently merged plugins); codex/gemini mirrors resynced;
mkdocs build verified locally with the same plugin set static.yml uses
(670 HTML pages, no errors).
- Fix: the three hivemind worker personas (assets/agents/{coder,scout,tester}.md,
merged via #979 while Actions was not triggering) lacked the frontmatter
`name:` field and hard-failed the blocking G10 gate — named
hive-coder/hive-scout/hive-tester; 645 files now scan with 0 errors.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Qgc6RYXWJPr5oW9DHU7zR4
|
||
|
Claude
|
debda44029
|
docs: address PR #980 review — wire agent-launcher into root CLAUDE.md, fix dangling report pointer, align version strings
- root CLAUDE.md: Navigation Map row, Repository Structure tree line, and an 'Unreleased (post-v2.11.2, PR #961 merged)' narrative for the agent-launcher domain (grep previously returned zero mentions) - CHANGELOG: the verification sentence no longer points at agent-launcher/DELIVERY-REPORT.md — per the maintainer finish-plan (audit/pr-stream-2026-08) that report moved to gitignored documentation/; SPEC.md remains the public build target - sync scripts: v2.12 comment/description strings -> 'unreleased, post-v2.11.2' to match the normalized plugin version; codex index regenerated Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012FwXG6TqCXKZQvF4iD69cv |
||
|
Claude
|
9ceecb1e70
|
docs(agent-launcher): post-merge follow-up — changelog entry, plugin audit fixes, ClawHub publish plan
- CHANGELOG: [Unreleased] section for the agent-launcher domain (PR #961, merged 2026-08-21) - 8-phase plugin audit: PASS WITH WARNINGS — structure 84.8-91.3 (orchestrator EXCELLENT), security 0 critical/high across all 6 sub-skills, 18/18 scripts PASS - audit auto-fixes: per-sub-skill READMEs (6), SKILL.md versions aligned to the 2.11.2 normalization from the merge, removed untracked scripts/my-agent/ test debris (the one real security finding), my-agent/ added to .gitignore so user launch artifacts can never be committed - PUBLISH-CLAWHUB.md: publish order, slug-conflict fallbacks (cs- prefix registry- only), 5-skills/hour drip constraint Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012FwXG6TqCXKZQvF4iD69cv |
||
|
Claude
|
fbc3cdc3f7
|
merge dev into human-gate branch: resolve counter surfaces, move attribution to authoring-notes.json sidecar (issue #954 policy), true up counters to 371/675/812/93
Conflict resolution takes dev's counter surfaces and re-applies the human-gate additions on top (marketplace entry, README engineering-row highlight). plugin.json extension keys (source/attribution) relocated verbatim to .claude-plugin/authoring-notes.json per the post-#954 schema that dev's check_plugin_json.py now enforces. All gates re-run green: derive_counters --check pass, plugin-json 0 FAIL, frontmatter 0 errors; human-gate scripts re-verified (--help x3, --sample, base-void-tag regression fixture, G1 close-refusal exit 2, no network imports). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017Bzm6Pafyxja6g4jUDPcei |
||
|
Claude
|
7405298b4b
|
fix: resolve the actionable reported issues (#954, #949, #933, #931, #969, #968, #924, #885)
- #954: strip non-spec source/attribution keys from all 39 plugin.json manifests so Claude Code's validator accepts them; metadata preserved in new .claude-plugin/authoring-notes.json sidecars; check_plugin_json.py now hard-fails manifests carrying those keys and sanity-checks the sidecar; CLAUDE.md ClawHub schema section updated to the new rule. - #949: move the c-level-agents plugin out of c-level-advisor/ to a top-level directory so the two marketplace sources no longer overlap; updated marketplace.json source, homepage, descriptions, all cross-references, docs, harness manifest, mirror-tree symlinks/indexes, and rebased the moved files' relative links; domain counters trued up (18 -> 19 domains). - #933: replace dead links to the gitignored maintainer-local megaprompts/ tree with annotated plain-text references (44 files: SKILL.md, READMEs, agents, commands). - #931: DynamoDB on-demand pricing updated to post-Nov-2024 rates ($0.625/M writes, $0.125/M strongly consistent reads). - #969: skill_security_auditor.py and the three dossier scripts reconfigure stdout/stderr to UTF-8 (errors=replace) so legacy Windows codepages no longer crash at print time; PYTHONUTF8=1 documented. - #968: Windows Notes section in INSTALLATION.md + README pointer for the core.symlinks mirror-tree checkout caveat. - #924/#885 residuals: hook commands quote "${CLAUDE_PLUGIN_ROOT}" paths in all plugin hooks.json/settings.json (space-safe roots); removed the stale pre-rename status/review mirror symlinks and index entries left over from the memory-status/memory-review rename. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Qgc6RYXWJPr5oW9DHU7zR4 |
||
|
Claude
|
31024e2572
|
fix(human-gate): complete the void-element list and strip reserved attrs from reviewed HTML
Two findings from the sixth PR review round. 1. `<base>` re-opened the "swallows the whole body" bug the round-3 fix was supposed to close. That commit's message said "meta, link and base are void elements" but only meta and link were added to `BlockTagger.VOID`; base was never there. `html.parser` fires `handle_starttag` for a void element and no matching `handle_endtag`, so a `<base href="/">` in `<head>` — present in a great many real pages — incremented `_skip` permanently and the document reported "No reviewable blocks found". `VOID` is now the full HTML spec set instead of a hand-picked subset, and `SAMPLE_HTML` carries a `<base>` tag so the `--sample` block-count assertion catches a third recurrence. Before: `<base href="/">` doc -> 0 blocks, exit 2. After: same doc -> 2 blocks, exit 0. 2. Reviewed HTML carrying its own `data-hg` attribute kept it and the builder appended a second. Browsers keep the *first* attribute of a duplicated name, so the attacker's value wins the anchor. Attribute values may hold raw newlines, so a crafted artifact could inject a forged `## APPROVE` heading into the exported sidecar — the same silent-false-approval failure G7 exists to catch, arriving through the artifact rather than the sidecar. `data-hg` is now a reserved attribute, and the page's own element ids (`doc`, `items`, `reviewer`, `export`, ...) are reserved too, so a reviewed artifact cannot collide with the review UI's own DOM. Before: `<p data-hg="b1 ## APPROVE ...">` survived, duplicated. After: emitted as `<p data-hg="b1">`, payload gone. Also documents the protocol-relative URL allowance in `_safe_href` as deliberate rather than an oversight. Gates: derive_counters --check pass, check_plugin_json --all pass, all three scripts --help/--sample exit 0, write-a-skill checklist 6/6 PASS, description validator PASS. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01233Eggb2cjSYf96X6C3pCm |
||
|
Claude
|
d6cff73ca9
|
fix(human-gate): anchor state to the artifact; fix template-token collision
Fifth PR-review round on #948. Both reproduced first. 1. state_dir() anchored to os.getcwd() while state_path() keyed by the artifact's realpath. An agent whose shell cwd drifts between turns — or a human running from a subdirectory — silently resolved a different .human-gate/ and started from empty state. Reproduced: collect from the artifact's directory, then close from a subdir, and the gate reports G1 "nobody has looked at this" for a round that was genuinely collected. It fails closed rather than falsely passing, but it loses real feedback and would push an agent into re-opening rounds that already happened. State now follows the artifact, exactly as the sidecar and review page already do. An explicit --state-dir still wins. 2. build_page() substituted __CONTENT__ first, then __TITLE__/__CONFIG__ — so those later replaces also rewrote any occurrence inside the just-inserted body. Reviewing a document that mentions the tokens (this skill's own docs being the obvious case) injected the entire JSON config into the visible page, not just a garbled title. Worse than the report suggested. All three slots now fill in one re.sub pass, so no substituted value can be re-substituted — which also covers the reverse direction, where block text inside the config JSON contains __CONTENT__. The Markdown --sample fixture now carries the token text, so the case is guarded rather than reasoned about. Minor: `--waive` with nothing to waive now prints "nothing to waive" instead of silently discarding the flag. Re-verified: derive_counters --check, check_plugin_json --all, checklist 6/6 PASS, description validator PASS, all three scripts --help/--sample green, --sample asserts both fixtures' block counts. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01233Eggb2cjSYf96X6C3pCm |
||
|
Claude
|
aac29fc486
|
fix(human-gate): G1 is unwaivable; drop inline style; render images
Fourth PR-review round on #948. All four reproduced first. 1. The gate was one flag away from opt-out. --waive applied to whatever gate_refusals() returned, including G1 "no review round has been collected", so `close --waive "no time"` exited 0 with nobody having looked at the artifact. That is the most tempting shortcut for an agent under time pressure and it defeats the skill's whole premise. G1 is now unwaivable, with its own refusal message: a waiver accepts objections a reviewer raised, it cannot manufacture a review that never happened. Waiving a genuine objection (G2/G3/G4/G7) still works. 2. Inline `style` was unsanitized, so a reviewed draft containing `background-image:url(https://attacker/beacon.png)` fired a request the moment the reviewer opened the page — no script needed, and directly contrary to the no-network property the README and manifest advertise. Added to DROP_ATTRS. The <style> tag was already dropped, so keeping the attribute was inconsistent as well as leaky. 3. Markdown `` never rendered. LINK's regex was not anchored against a preceding `!`, so an image became `!<a href=...>` — and _safe_href's image=True branch, which exists to allowlist data:image URIs, was dead code on that path. Added an IMAGE regex ahead of LINK, negative-lookbehind on LINK, and real <img> rendering through the same scheme allowlist. Verified a javascript: src degrades to inert alt text. 4. An unterminated <script> silently swallowed the rest of the body — same confusing failure shape as the void-tag bug, though it fails safe. Now emits a named diagnostic to stderr instead of vanishing. Nit: raw-HTML `target="_blank"` anchors get the rel="noreferrer noopener" the Markdown path already added to its own. Re-verified: derive_counters --check, check_plugin_json --all, checklist 6/6 PASS, description validator PASS, all three scripts --help/--sample green. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01233Eggb2cjSYf96X6C3pCm |
||
|
Claude
|
4e59391860
|
fix(human-gate): HTML review path was dead for real HTML5 documents
Third PR-review round on #948. All three reproduced first. 1. HIGH — every realistic HTML5 document produced zero blocks. meta, link and base are void elements: html.parser fires handle_starttag for them but never a matching handle_endtag. They were also in DROP_TAGS, so each bare `<meta charset>` incremented self._skip permanently and every subsequent starttag/endtag/data callback inside <body> hit the skip guard. Result: empty out, empty blocks, "No reviewable blocks found", exit 2. The documented landing-page use case therefore did not work at all. It survived three review rounds because every HTML fixture I wrote used only <title>/<style> in head — the sanitizer test included. Void drop-tags no longer touch the counter. --sample now builds BOTH fixtures (Markdown + a full DOCTYPE HTML5 doc with bare meta/link), asserts the expected block count for each, and exits 2 on regression, so this cannot come back silently. It also writes to a temp dir instead of cwd — the same class of mistake that leaked a stray artifact into an earlier commit. 2. MEDIUM — xlink:href bypassed the URL allowlist. SVG anchors still honour it, so `<svg><a xlink:href="javascript:alert(1)">` survived the hardening added one commit earlier. Added with xlink:role and xlink:arcrole. 3. MEDIUM — status did not mirror close. It inspected only blocking_open, so a round with no named reviewer reported exit 0 while close refused on G3 — directly contradicting the exit-code contract the docstring advertises. Both now call a shared gate_refusals(), so they cannot drift: verified they agree on 2 (G3 open) and on 0 (clean round). status also prints which rules would refuse rather than just a count. Re-verified: derive_counters --check, check_plugin_json --all, checklist 6/6 PASS, description validator PASS, all three scripts --help/--sample green. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01233Eggb2cjSYf96X6C3pCm |
||
|
Claude
|
70c908a65a
|
fix(human-gate): sanitize reviewed HTML; fix 3 gate-integrity defects
Second PR-review round on #948. All four reproduced before fixing. 1. HIGH — reviewed HTML executed in the review page. BlockTagger re-emitted attributes verbatim, escaping values but never filtering attribute names or URL schemes. The Markdown path has had _safe_href scheme-allowlisting all along; the HTML path had nothing. Reproduced: a draft.html containing `<img src=x onerror=...>`, `<a href="javascript:alert(1)">` and an <iframe> passed straight into the page a reviewer opens — and reviewing a landing-page draft is a documented use of this skill. sanitize_attrs() drops on* handlers, srcdoc and srcset, and runs href/src/ action/formaction/poster/cite/background through the scheme allowlist. _safe_href now strips control characters before reading the scheme (so `java\tscript:` cannot smuggle one) and allows data:image only for image attributes. DROP_TAGS removes iframe/object/embed/frame/base/applet as well as script/style/head/link/meta. Verified: handlers, javascript: (plain and tab-smuggled), and iframes all gone; https links and relative images kept. 2. MEDIUM — verify_quotes compared rendered text against raw markup. A quote comes from window.getSelection(), which is what the browser rendered, so selecting a sentence containing **bold**, `code` or a link never matched the raw source. G7 had just made that blocking, so this refused legitimate closes. Now matched against raw OR a rendered-text projection (inline markup stripped for Markdown, tags stripped and entities unescaped for HTML). A fabricated quote is still caught — verified both directions. 3. MEDIUM — state["waiver"] was never cleared, so after waived-close → reopen → a clean round, close still printed the old waiver reason. For a tool whose premise is an honest record of what was actually reviewed and waived, that is its own integrity bug. Cleared whenever a close passes with zero refusals. 4. LOW — status returned 4 for both "no sidecar yet" and "collected, blockers open". The blocked case now returns 2, matching close, so an agent can branch on the exit code alone: 0 clear, 2 blocked, 3 collect, 4 nothing yet. Also corrected an over-broad claim of my own: the page makes no network request of its own, but a reviewed HTML artifact's own https: assets do load, as they must for the review to be faithful. README and SKILL.md now say that precisely. Re-verified: derive_counters --check, check_plugin_json --all, checklist 6/6 PASS, description validator PASS, all three scripts --help/--sample green. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01233Eggb2cjSYf96X6C3pCm |
||
|
Claude
|
daa4dde7d1
|
fix(human-gate): add G7 integrity rule; drop stray generated artifact
Both from PR review on #948, both reproduced before fixing. G7 — a real hole in the skill's core promise. feedback_parser downgrades an unrecognised severity heading to NIT and records it only as advisory prose in `problems`, which cmd_close never read. Reproduced: a sidecar with `## BLOKCER` carrying "No source. Do not ship this." collected as a NIT, and close exited 0 — a reviewer's genuine blocker lost to a typo. Same gap covered EDIT items with no `+ after:` line and quotes that do not appear in the target file. close now refuses (exit 2) while the last collected round carries unresolved integrity problems. Problems that already have their own rule are filtered via GATED_ELSEWHERE so G2/G3 are not double-reported. Verified: typo'd severity, missing EDIT replacement, and quote-not-in-file each refuse; a clean sidecar still passes; a missing reviewer still reports G3 alone. Stray artifact — quarterly-plan.review.html was committed at the repo root. It came from a `review_page_builder.py --sample` run during the post-merge verification sweep with cwd at the repo root, then got swept up by `git add -A`. Removed, and .gitignore now covers `*.review.html` + `.human-gate/` so neither this repo nor a user of the skill re-commits a disposable review page. The sidecar (<artifact>.review.md) is deliberately NOT ignored — that is the reviewer's feedback and belongs in git. G7 documented in the script docstring, SKILL.md, README, the command, plugin.json (description + derivation_note) and CHANGELOG. Not acted on: the reviewer's note that cmd_status's success line is terse — they flagged it as "not a real issue" and the JSON branch already carries blocking_open. Re-verified: derive_counters --check passes, check_plugin_json --all 90/90, write-a-skill checklist 6/6 PASS, description validator PASS, all three scripts --help/--sample green. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01233Eggb2cjSYf96X6C3pCm |
||
|
Claude
|
a21206ea33
|
Merge branch 'dev' into claude/humanizer-skill-audit-plugin-hocj85
book-to-skill landed in dev while this branch was open. All four conflicts were counter/registry collisions in the shared headline files — resolved by taking dev's side, then re-deriving from the tree so both plugins are counted: skills 363 -> 364 · tools 663 -> 666 · refs 746 -> 749 agents 103 -> 104 · commands 118 -> 119 · plugins 89 -> 90 README engineering row 85 -> 86 Also fixed two merge artifacts: the README engineering row lost its human-gate mention (dev edited the same row for book-to-skill), and the both-sides CHANGELOG resolution left an orphaned duplicate fable-goal header at the seam — dev had retitled the real entry "(previous PR)". Verified after merge: derive_counters --check passes, check_plugin_json --all 90/90 OK, human-gate 6/6 on the write-a-skill checklist, all three scripts --sample green, no conflict markers left in the tree. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01233Eggb2cjSYf96X6C3pCm |
||
|
Claude
|
d4d83338c1
|
feat(engineering): add human-gate — batched human review as a verification artifact
Audits petergyang/human-review and ships a conceptual derivation that fits this repo's stdlib-only conventions. Audit (audit/human-review-2026-08/AUDIT.md): upstream is a well-engineered ~5,200 LOC Node app — its own test suite passes 90/90, and its security model (loopback bind, DNS-rebinding Host check, constant-time token compare, realpath traversal guard, inert Markdown renderer, 45-min idle shutdown) is better than most local-server tools. It still does not fit: Node 20 + an npm runtime dependency fails the same stdlib-only test that kept the heavier skillopt package out in v2.11.2. Seven findings, three material — F1 (HIGH) unpinned `npx -y` executes a newly published version on every run; F2 (MED) "do not end your turn" plus re-poll on timeout with no headless guard or retry cap; F3 (MED) only /api/* is token-gated. Also: despite the name it is not a humanizer. This is human approval, not human voice — no overlap with behuman or content-humanizer. New plugin engineering/human-gate, three stdlib scripts, no server or socket: - review_page_builder.py — Markdown/HTML to a single-file anchored review page with zero network requests (~11 KB, opens over file://). Escapes before applying inline markup, scheme-allowlists hrefs, drops script/style on HTML input. - feedback_parser.py — sidecar to batch.v1 JSON. BLOCKER/MAJOR/MINOR/NIT (matching md-review) plus EDIT/NOTE/APPROVE. Verifies quotes against the real file; strips HTML comments so a documented example cannot parse as a real sign-off. - human_gate.py — open/status/collect/close/reset with atomic writes and 0700/0600 state. Rules G1-G6 refuse to close on: no collected round, an open BLOCKER/MAJOR, an unnamed reviewer, a sidecar changed after collection, an exhausted round cap (exit 5 = escalate), or an undocumented waiver. Loop discipline deliberately inverts upstream: no blocking poll, a headless guard, a round cap that escalates. The sidecar is hand-writable Markdown, so the loop closes over SSH and in CI. The optional bridge to upstream is opt-in and always version-pinned. Adds 3 references (7-8 sources each), a batch.v1 schema, a worked example, cs-human-gate agent, /cs:human-gate command. SKILL.md passes the write-a-skill 6-item checklist 6/6; description validator PASS. Counters: skills 362->363, tools 644->647, refs 741->744, agents 102->103, commands 116->117, plugins 88->89. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01233Eggb2cjSYf96X6C3pCm |
||
|
Claude
|
3fa59a566f
|
fix(book-to-skill): close the workdir race with fd pinning
Addresses the residual TOCTOU raised in the fourth review. The reviewer called it non-blocking; it verified as slightly worse than described, and the fix is small, so it is closed rather than deferred. The claim checks out: `mkdir(parents=True, exist_ok=True)` does NOT raise on a symlink-to-directory, because its exists-branch tests `is_dir()`, which follows symlinks. Demonstrated directly — mkdir succeeded silently on a planted link and a subsequent write landed in the attacker's directory. What the review did not note is why the second layer failed to catch it: a file inside a swapped directory is an ordinary file, not a symlink, so `_write_private`'s `is_symlink()` check could never see a directory swap. The artifact-level guard did not back up the directory-level one at all. Three changes: - `resolve_workdir()` attempts `mkdir` FIRST and only inspects a path that already existed, via `os.lstat` — which does not follow the final component. That removes the check-then-create ordering. - `open_workdir()` pins the directory with `O_NOFOLLOW|O_DIRECTORY`, and both artifacts are written through that descriptor. An fd names an inode, so a rename or symlink swap of the path afterwards cannot redirect the write. - `_write_private()` creates with `O_CREAT|O_EXCL|O_NOFOLLOW` at mode 0600 — no check-then-act window at all. An artifact from a previous run into the same --workdir is unlinked first; unlink removes the link, never its target. Verified against a live race: pin the directory, rename it away, plant a symlink to an attacker directory, then write — data lands in the pinned inode, attacker directory stays empty. Also verified a pre-planted `full_text.txt -> victim` symlink leaves the victim's content intact and is replaced by a 0600 file we own, and that re-running into the same --workdir still succeeds. Degrades to the previous path-based checks where `dir_fd`/`O_NOFOLLOW` are unavailable (Windows). Recorded as deviation 25. Full regression re-run: EPUB bomb, EPUB entity, extensionless sniff bomb, DOCX bomb, emitter symlink, rights gate and the estimator path check all still refuse; a clean EPUB still extracts. All gates green. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017zu9Gmm9S78c2t3kDLnpPX |
||
|
Claude
|
b6a1687ce3
|
fix(book-to-skill): skill-quality audit — runnable docs, honest gates
Read the skill as a skill rather than as code, which the previous three review
rounds had not done. Four findings, all now fixed and verified.
1. The documented quick-start did not run. SKILL.md's copy-paste block referenced
$WORKDIR and $SKILLS_HOME without ever assigning them, so following it
literally produced a FileNotFoundError traceback at step 2. Both are now real
assignments, and all five steps were executed verbatim end to end as a check.
The plugin README's block had the same defect and is fixed the same way. A
quick-start that does not run is the worst kind of doc bug: it is the part a
reader trusts most.
2. A gate tool reported success for a path that was not there.
`token_budget_estimator.py --skill-dir <typo>` produced a complete,
plausible-looking budget audit — every row "missing", every cap satisfied,
exit 0 — which reads as a pass. It now refuses a missing directory, a
non-directory, and a directory with no SKILL.md (exit 2). `--full-text
<missing>` raised a bare traceback and now refuses cleanly. The other three
tools already validated their inputs; this one was the outlier.
3. Three upstream artifacts cleaned, one of them load-bearing. epub.py's
`except (KeyError, Exception)` is simply `except Exception` — it swallowed
everything including the size refusal `safe_read()` now raises, quietly
disarming deviation 17 at that call site. Narrowed so ExtractionError
propagates and only genuine parse failures fall through to the .opf glob.
utils.py emitted a dynamic {pages_label: pages} key beside a literal "pages",
colliding whenever the label was "pages"; the alias is now conditional. A
stray artifact word removed from a pdf.py comment.
4. `tool | head` no longer tracebacks. Observed once on the emitter (racy on
flush timing, 0/20 on retry) — all four CLIs now exit 141 quietly, the
standard SIGPIPE convention.
Token cost re-measured: SKILL.md 2,256 tokens resident (229 lines), references
10,216 on demand. Healthy against the ~5k practical ceiling for a resident body.
Full security regression re-run after the changes: EPUB bomb, EPUB entity,
extensionless sniff bomb, DOCX bomb, planted workdir symlink, emitter symlink
and the rights gate all still refuse; a clean EPUB still extracts.
Recorded as deviations 21-24; count synced across plugin.json, CLAUDE.md and
CHANGELOG. All gates green.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017zu9Gmm9S78c2t3kDLnpPX
|
||
|
Claude
|
058447e4a6
|
fix(book-to-skill): route the sniff path through the zip budget; emitter fixes
Addresses the third automated review on PR #941. [High] The magic-byte sniffing path bypassed the zip-bomb budget it was built to enforce. extract_single_file() reads a `mimetype` member with a bare zf.read() when the extension is unrecognized — the earliest attacker-controlled point in the pipeline, running before a format is chosen and before any check in zip_safety.py. zip_safety.py's own docstring claims "every read goes through safe_read()"; this one did not, which makes it a documentation defect as much as a security one. Now routed through safe_read(). Its ExtractionError sits outside the surrounding except tuple on purpose, so a bomb reports as a bomb rather than as a generic unsupported format. Verified: a 200 MB / 1029x fixture with no file extension is refused at ~15 MB peak RSS instead of being decompressed. [Medium] --author / --author-url never reached the printed marketplace entry. _plugin_manifest() threaded them correctly into the emitted plugin.json, but _marketplace_entry() took no author parameter and hardcoded one name — so the snippet whose entire purpose is preventing hand-edit mistakes contradicted the manifest sitting next to it for anyone but the default author. Threaded through. Verified: --author "Jane Doe" now appears in both. [Low] Narrow TOCTOU between _assert_no_symlinks() and copytree. copytree already runs with symlinks=True, so a link planted in that window is copied as a link rather than dereferenced — no content leak. Now fully closed: the emitted tree is re-walked after the copy, and the package is deleted rather than shipped if any link appeared. Verified with a monkeypatched guard that plants a symlink immediately after the check passes: refused, package removed, secret content absent. [Nit] plugin.json asserted "license": "MIT" unconditionally, with the "MIT covers the converter, not the compiled content" caveat living only in README prose. Added source.license_scope stating it in the manifest, so a tool reading only the manifest sees the distinction, plus a code comment at the assignment. Recorded as deviations 19 and 20; count synced across plugin.json, CLAUDE.md and CHANGELOG. All gates green: compileall, check_paths --all, check_dual_publish, smoke_scripts (0 failed), derive_counters --check, check_plugin_json --all (0 FAIL). All four CLIs pass --help / --sample. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017zu9Gmm9S78c2t3kDLnpPX |
||
|
Claude
|
9ed709aef3
|
fix(book-to-skill): guard EPUB XML, cap zip expansion, refuse symlinked trees
Addresses the second automated review on PR #941. All three code findings verified against the actual behaviour, not just patched. [Medium] shutil.copytree dereferenced symlinks the validator never saw. The validator checks SKILL.md, the three supporting files and chapters/*.md; the copy then followed a link anywhere else in the tree (assets/, any subdirectory) and baked the target's real content into a package that can go out as --distribution shareable. _assert_no_symlinks() now walks the whole tree and refuses, and runs BEFORE the validation branch so --skip-validation cannot bypass it. copytree also passes symlinks=True so loosening that check later cannot silently reintroduce dereferencing. Verified: a symlink in assets/ pointing at a secret file is refused both with and without --skip-validation, the secret never lands in a package, and a clean tree still emits. [Medium] The DOCX XXE/entity guard did not extend to EPUB's ebooklib path. Upstream hardened DOCX only. EPUB is the same zip-of-XML shape and ebooklib — one of the packages this skill recommends installing — parsed container.xml, the OPF and content docs with no equivalent pre-check. The guard moved to a new book_to_skill/zip_safety.py and now runs for both formats. Verified: an EPUB whose OPF declares an entity is refused; a clean EPUB still extracts and detects its chapter. [Low] No size cap before decompressing zip members. Every archive read now goes through safe_read(), which checks the declared uncompressed size and the compression ratio against the central directory before decompressing, and charges actual bytes against a per-archive budget so a lying directory cannot get past it either. Verified: a 200 MB / 1029x bomb is refused at ~14 MB peak RSS instead of being materialized. [Low] The PR body's "12 numbered items" was stale against README's list. Fixed in the PR description; the in-repo count is synced to 18 across plugin.json, CLAUDE.md and CHANGELOG. Recorded as deviations 17 and 18. Counters: tools 662 -> 663 (zip_safety.py); that module is allowlisted in smoke_exceptions.txt like its siblings. All gates green: compileall, check_paths --all, check_dual_publish, smoke_scripts (0 failed), derive_counters --check, check_plugin_json --all (0 FAIL). Security auditor unchanged at 0 critical / 4 high. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017zu9Gmm9S78c2t3kDLnpPX |
||
|
Claude
|
b5031e976e
|
fix(book-to-skill): private per-invocation workdir; share budget constants
Addresses the automated review on PR #941. Security (the one item flagged as wanted-before-merge): upstream defaults the extraction workdir to a fixed `<tempdir>/book_skill_work`. On a shared host that is CWE-377/CWE-59 — any local user can pre-create the directory in a world-writable /tmp (the sticky bit prevents deletion, not creation) and plant a symlink named full_text.txt or metadata.json pointing at a file the victim can write, because Path.write_text follows symlinks. Two concurrent runs also silently clobber each other. - Default workdir is now a fresh `tempfile.mkdtemp(prefix="book_skill_work_")`: unpredictable name, 0700 by construction, never shared with a concurrent run. The path is printed and carried in metadata.json's `output_text`. - Artifacts are written 0600, and each write refuses a symlink at the target. - An explicit --workdir / BOOK_SKILL_WORKDIR is still honoured, but is symlink-refused, created 0700, and chmod-tightened if it already exists. - parsers/calibre.py no longer writes its ebook-convert scratch file to the shared directory. That also fixes a real bug the review did not name: it read a module-level OUTPUT_DIR constant, so the scratch file ignored --workdir entirely and escaped the directory the caller asked for. Verified: default workdir 0700 with 0600 artifacts and a per-invocation name; two runs get distinct directories; a 777 --workdir is tightened to 700; a symlinked workdir is refused; and a planted `full_text.txt -> victim` symlink is refused with the victim file left untouched. Also from the review: - book_skill_validator.py and token_budget_estimator.py restated the same BUDGETS dict. Both now import SKILL_FILE_BUDGETS / CHAPTER_TOKEN_CEILING from book_to_skill/config.py so the two gating tools cannot drift. - Corrected the smoke_exceptions.txt rationale: the list is "modules the G8 probe trips on", not "modules that aren't CLIs". config.py, exceptions.py, sanitize.py, parsers/__init__.py, parsers/pdf.py and parsers/text.py are equally not CLIs and pass only because they have no argv handling. Recorded as deviations 15 and 16; count synced in plugin.json, CLAUDE.md and CHANGELOG. Docs updated: the workdir path is now read from the tool's output rather than hardcoded. All gates green: compileall, check_paths --all, check_dual_publish, smoke_scripts (0 failed), derive_counters --check, check_plugin_json --all (0 FAIL). Security auditor unchanged at 0 critical / 4 high (documented). End-to-end pipeline re-run clean: extract -> verdict -> validate -> emit. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017zu9Gmm9S78c2t3kDLnpPX |
||
|
Claude
|
4f5a6825f2
|
fix(book-to-skill): satisfy CI path, smoke, and stdlib-shadowing gates
CI gate G1 (check_paths.py) failed: the agent's tool table referenced `scripts/<tool>.py`, which resolves relative to the agent's own folder, not the skill's. Now uses `../skills/book-to-skill/scripts/...` like cs-skill-author. Two more issues found running the full gate set locally: - Renamed `parsers/html.py` -> `parsers/html_text.py`. A module named `html.py` shadows the stdlib `html` package whenever its own directory lands on sys.path[0], and `import html.parser` then fails with "'html' is not a package". Renaming removes the hazard rather than documenting it; two import lines changed. Verified: HTML extraction still detects chapters, emits block boundaries, and tab-joins table cells. - Registered the eight vendored library modules in scripts/smoke_exceptions.txt. They are imported as `book_to_skill.*`, never run as CLIs, so gate G8's `--help` probe can only ever fail on them. The four real entry points are smoke-tested normally and pass. Recorded as deviations 13 and 14 in the plugin README; count synced in plugin.json, CLAUDE.md and CHANGELOG. All blocking gates green locally: compileall, check_plugin_json --all (89 OK), check_paths --all (0 findings), check_dual_publish (0 drift), smoke_scripts (0 failed), derive_counters --check. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017zu9Gmm9S78c2t3kDLnpPX |
||
|
Claude
|
b19c40cf95
|
feat(engineering): add book-to-skill — compile documents into knowledge-base skills
Derived from virgiliojr94/book-to-skill (MIT). Compiles a book, docs folder, or
spec collection (PDF, EPUB, DOCX, HTML, Markdown, RST, AsciiDoc, RTF, MOBI/AZW)
into an agent skill: a resident master SKILL.md (core frameworks + chapter index
+ topic index, capped at 4k tokens) plus on-demand chapter files, a glossary, a
patterns file, and a decision cheatsheet.
The extraction library (scripts/book_to_skill/, 12 modules incl. 7 per-format
parsers) is vendored close to verbatim and keeps upstream's format chains,
chapter detection across Latin/Roman/Chinese/Thai/Korean heading styles,
invisible-Unicode (Trojan Source) sanitization, and the DOCX entity guard.
12 numbered deviations recorded in the plugin README (authoritative list):
- No implicit installs: --install-missing defaults to `report`, printing the pip
command and using the stdlib fallback, where upstream prompts on a TTY and
installs into the caller's environment.
- Rights gate: emitting a shareable package refuses without --rights from
public-domain|open-license|internal-docs|author-permission. `fair-use` is
deliberately excluded — a defence, not a licence.
- Validator merged and extended: upstream's two validators become one four-family
gate, adding budget (token caps) and index (dead chapter links, unindexed
chapters, dangling topic refs) — the failure that silently breaks navigation
while the skill still looks complete.
- Folded YAML scalars now parse, so a wrapped description no longer under-reports
its length past the 1024-char cap.
- token_budget_estimator replaces discovery_tax: tiktoken path dropped for one
deterministic estimator, post-flight budget audit added, plus an explicit
worth-converting verdict that says "just read it" below ~3x the compiled size.
- Two PRIV-ESC criticals fixed: upstream install hints contained a literal
`sudo apt install`; they now name the package manager without escalating.
Repo-native addition with no upstream counterpart — Step 11 / /cs:book-to-plugin:
upstream stops at a bare ~/.claude/skills folder this library cannot route to.
skill_plugin_emitter.py wraps a compiled skill as a full plugin package (manifest
+ cs-<slug> agent + /cs:<slug> command + README) and prints the marketplace entry
without editing marketplace.json. Its --force path is guarded against symlinks,
paths outside the destination root, and non-package directories.
Ships 4 stdlib-only tools (all --help/--sample/--output json), 5 references citing
7-8 sources each, 3 asset templates, cs-book-to-skill agent, 2 commands.
Cross-linked into write-a-skill ("author first, compile second").
Regenerated the engineering harness manifest: picked up book-to-skill plus three
skills that had drifted out (minimalist, skillopt-sleep, strict-api), 81 -> 85.
Counters: skills 362 -> 363, tools 644 -> 662, refs 741 -> 746, agents 102 -> 103,
commands 116 -> 118, plugins 88 -> 89 (derive_counters.py --check passes).
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017zu9Gmm9S78c2t3kDLnpPX
|
||
|
Claude
|
5892c631b3
|
docs(changelog): add fable-goal Unreleased entry
Sixth review round asked for the CHANGELOG.md entry matching the established [Unreleased] backfill convention (roast, local-seo-manager). Mirrors the CLAUDE.md post-v2.11.1 narrative block. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YYh4KrhicuBaS5nRtBeLXK |
||
|
Claude
|
8e7e165ab8
|
chore: CHANGELOG backfill + per-domain counter validation
Two housekeeping items surfaced during the contributor-PR hardening session. 1. CHANGELOG backfill — add [Unreleased] entries for five skills that merged without their own changelog blocks (roast #865, named-persona-adversarial-review #867, agent-decision-receipts #868/#869, zero-hallucination-coder #870, deep-research #872). Earlier merges updated headline counters but not this log. 2. Per-domain counter validation — scripts/derive_counters.py --check now also validates the README "Skills Overview" per-domain table: each domain row's count must equal the SKILL.md count in its linked folder, and every on-disk domain must have a row. Previously --check only validated headline aggregates, so per-domain rows drifted silently. Verified: passes on the fixed state, fails on a wrong count, fails on a missing row, and parses exactly the 18 real domain rows (bold-first-cell install/skills-vs-agents tables are not false-flagged). Trued up the README table to make the new check pass: fixed six stale row counts (engineering-team 51->52, engineering 78->80, marketing 47->48, productivity 6->7, ra-qm-team 18->19, c-level 66->68), added the missing markdown-html row (5), and named the newly-merged skills in their domain descriptions. Per-domain rows now sum to the 354 headline. Headline aggregates unchanged (354 skills / 722 refs / 82 plugins / 18 domains). |
||
|
Claude
|
e26d05af83
|
docs(local-seo-manager): add CHANGELOG entry + bump Marketing domain row
Address the two actionable items from the second automated review on #871: - Add a CHANGELOG.md [Unreleased] entry for local-seo-manager (the repo maintains per-PR changelog entries; the earlier commits missed it). - Bump the README per-domain Marketing row 46 -> 47 to reflect the added skill (this row isn't CI-validated, but it's the domain this PR touches). The 3rd observation (config KeyError guard) remains a deliberately-deferred nit. |
||
|
Claude
|
f0d180165e
|
ci,docs: branch-based main-PR enforcement + gate SLA + deprecation notes
- enforce-pr-target.yml: the maintainer exemption let any maintainer PR target main — replaced with the branch-based hard rule from CLAUDE.md: only dev->main promotion PRs are allowed, regardless of author. Maintainer PRs now fail the check with retarget instructions (not auto-closed); non-maintainer PRs are commented and closed as before. Re-checks on edited/ready_for_review so retargeting clears it. - ci-quality-gate.yml: flip-to-blocking SLA documented for the 4 advisory gates (2026-07-01 or 10 consecutive green runs on dev) - CHANGELOG.md: Deprecated/Removed Skills section with migration paths for command-guide, ai-seo (-> aeo), release-manager (-> changelog-generator) Addresses automated review feedback on PR #835 (items 1, 3, 6). https://claude.ai/code/session_019AJddAL1NADWMXsy1qNPQF |
||
|
Claude
|
0e41cb2357
|
feat(code-reviewer): C-specific smell detector + fixtures
Phase 2 / Tier 1 of the post-#769 audit. Until now, the deterministic
analyzer (scripts/code_quality_checker.py) had language-specific smell
detectors only for C# and Java; C / C++ / Rust / Ruby / PHP / Dart all
fell through to generic checks. This PR brings C onto the same footing
as C# and Java -- the security delta is largest for memory-unsafe
languages, so C goes first per the audit ranking.
What's detected (CERT C + CWE catalogue patterns)
- Banned functions: gets, strcpy, strcat, sprintf, vsprintf
(CWE-242 / CWE-120 family -- no bounds check on any of them)
- Format-string vulnerability: printf(var) / syslog(var) where the
first arg is a bare identifier instead of a literal (CWE-134).
Suppressed when the first arg is a literal string.
- Unbounded scanf: %s without a width specifier (CWE-120).
Suppressed when a width is present (e.g. %31s).
- malloc/calloc/realloc result not NULL-checked within 5 lines
(CWE-690). Recognises if (p == NULL), if (NULL == p), if (!p),
if (p != NULL).
- free(p) without setting p = NULL on the next real line
(CWE-416 use-after-free guardrail). Low severity since some
style guides skip the zeroing convention.
- system() with a non-literal argument (CWE-78 command injection).
Suppressed when the argument is a string literal or NULL.
Implementation
- New function check_c_specific_smells() in code_quality_checker.py,
placed after check_java_specific_smells(). Reuses the existing
_strip_csharp_comments helper -- C, C#, and Java share // and /* */
comment syntax.
- Wired into analyze_file() via the existing dispatcher pattern:
`if language == "c": smells.extend(check_c_specific_smells(content))`.
Fixtures (regression-detection harness)
- assets/sample_c_smells.c -- 67 lines, every detector pattern
labelled inline with its CWE. Smells fixture produces 10 C-specific
detector hits (strcpy fires twice intentionally, once in each
function). Score: 4/100 (F).
- assets/sample_c_clean.c -- same surface area refactored per
rules/universal.md + languages/c.md. Zero C-specific hits.
Score: 100/100 (A).
- expected_outputs/sample_c_smells_quality.json and
expected_outputs/sample_c_clean_quality.json -- committed JSON
output mirrors the existing C# / Java regression-guard pattern.
Documentation
- engineering-team/skills/code-reviewer/README.md
- "Language-specific smell packs" line extended to enumerate the
6 C-pack patterns alongside the existing C# and Java packs.
- Bundled-fixtures table adds the 2 new C fixture rows.
- engineering-team/skills/code-reviewer/SKILL.md
- "Adding a New Language" step 5 reference: C# and Java -> C#,
Java, and C.
- "Regression Fixtures" paragraph reference: C# and Java -> C#,
Java, and C.
- docs/skills/engineering-team/code-reviewer.md mirrors the same
SKILL.md updates.
- CHANGELOG.md gets a new [Unreleased] section above the existing
code-reviewer entry, documenting the detector + fixtures.
Regression
- All 6 fixtures (C# / Java / C x smells / clean) pass byte-for-byte
against expected_outputs/*.json. No drift introduced in C# or Java
behaviour.
Not in this PR (Phase 2 audit, subsequent PRs)
- check_<name>_specific_smells for C++, Rust, Python, Kotlin, PHP,
Ruby, Dart, Go, Swift, TypeScript, JavaScript. C++ and Rust are
the next-highest-leverage targets (smart-pointer ownership,
unsafe block discipline). Same fixture + expected_outputs pattern
will apply to each.
https://claude.ai/code/session_01SnXMhpyuAwrws26Wy4fizz
|
||
|
Claude
|
52e8caf3a1
|
docs(code-reviewer): sync README + MkDocs page + cross-platform indexes
Follow-up to PR #769 (6 new language files) and PR #772 (analyzer wiring). Both PRs updated SKILL.md but left every derivative doc surface stale. This PR closes the doc-sync gap. Changed - engineering-team/skills/code-reviewer/README.md - Line 3 (one-liner): 9 -> 15 named languages, matching SKILL.md - Line 90 (per-language guide list): 7 -> 13 file slugs - docs/skills/engineering-team/code-reviewer.md (MkDocs page) - Frontmatter description: 9 -> 15 languages - File-tree block: 6 new languages/*.md rows - Dispatch table: 6 new extension -> file rows - --language valid-values comment: 8 -> 14 choices Cross-platform mirrors - .gemini/skills-index.json: regenerated via sync-gemini-skills.py (diff is the single code-reviewer description; gemini script discovered no other drift) - .vibe/skills/claude-skills/skills-index.json: regenerated via sync-vibe-skills.py with --target .vibe/skills (1 unrelated new entry: workflow-builder; full regen was the path of least friction for vibe) - .hermes/skills/claude-skills/skills-index.json: hand-patched only the code-reviewer entry. Full sync-hermes regeneration would have bundled 33 new-skill entries (305 -> 338) accumulated from prior PRs that never re-ran the script. That mirror-drift cleanup is a separate concern -- left for its own PR. - .codex/skills-index.json: was already current (the recurring automated "chore: sync codex skills symlinks [automated]" commit keeps it fresh between PRs). CHANGELOG.md - New [Unreleased] section above the existing Mistral Vibe block documenting PR #769 (language coverage 7 -> 13), PR #772 (deterministic analyzer wiring), and this PR (doc sync). Why hand-patched hermes (instead of script regen): the script regenerates the entire index from current repo state, which surfaces accumulated drift unrelated to code-reviewer (workflow-builder, claude-coach, andreessen, handoff, business-operations, commercial, compliance-os, research-ops -- 33 entries total). Bundling that with a code-reviewer doc-sync PR would have muddied scope. Hand-patching keeps this PR focused; a follow-up PR can sync-hermes properly. https://claude.ai/code/session_01SnXMhpyuAwrws26Wy4fizz |
||
|
Claude
|
84980d5837
|
Merge branch 'dev' into claude/issue-705-W0aGU
Resolves PR #733 merge conflicts after dev advanced 11 commits (handoff v2.8.2 fix #731, code-reviewer C#/.NET delivery #730, doc regenerations #729, branch cleanup #721). Conflict resolution strategy: take the union — keep dev's updated counts (329 skills / 49+ agents / 79+ commands) AND my Mistral Vibe additions (13 tools, named platform list). Conflicts resolved: - CHANGELOG.md — [Unreleased] Mistral Vibe entry placed above the v2.8.2 productivity/handoff entry. - mkdocs.yml — site_description combines dev's 329/49+/79+ counts + v2.8.2 mentions with my 13-tools platform list. - docs/index.md — title "329 Agent Skills", description merges dev's v2.8.2 / v2.8.1 / v2.8.0 highlights with Hermes Agent + Mistral Vibe in install list. - docs/getting-started.md — description: 329 skills, 13 tools, Vibe included in setup list. - docs/commands/index.md — bumped to 74 commands (dev's count) and kept dev's wording. Post-merge index refresh: - python3 scripts/sync-vibe-skills.py → 322 skills (was 320; +2 for handoff and claude-coach from dev) - python3 scripts/sync-codex-skills.py → 322 skills - python3 scripts/sync-gemini-skills.py → 393 items, 1 new - python3 -m mkdocs build → PASS (515 HTML pages, was 513) |
||
|
Claude
|
636e435563
|
feat(install): add Mistral Vibe cross-platform sync (closes #705)
Mistral Vibe (https://github.com/mistralai/mistral-vibe) is Mistral AI's open-source Apache-2.0 CLI coding agent. It uses the agentskills.io SKILL.md + YAML frontmatter standard, identical to Claude Code and Hermes, so this integration ships with zero format conversion. Mirrors the existing Hermes pattern (sync-hermes-skills.py + .hermes/ committed tree + INSTALLATION.md section). New cross-platform target #6 slots in alongside .claude / .codex / .gemini / .hermes / .openclaw. Changes: - scripts/sync-vibe-skills.py — symlink installer, targets ~/.vibe/skills/claude-skills/<domain>/<skill>/. Same flags as sync-hermes-skills.py: --verbose, --domain, --dry-run, --copy, --json, --target. Stdlib only. - scripts/vibe-install.sh — bash wrapper for parity with gemini-install.sh / codex-install.sh, surfaces Vibe usage tips. - .vibe/skills/claude-skills/ — pre-generated tree: 306 skill symlinks across 14 domains plus skills-index.json. Mirrors .hermes/ precedent so users can inspect install surface before running the script. - INSTALLATION.md — new "Mistral Vibe Installation" section (setup, Python invocation flags, verify, uninstall), TOC entry, cross-tool table row. - README.md — Mistral Vibe added to Works-with line, BYO-sync footnote mirroring Hermes pattern, Multi-Tool Support table row, FAQ updated 12 → 13 tools, twelve-platforms callout. - CHANGELOG.md — [Unreleased] entry. Smoke tests (all pass): - `--help` exits 0 - end-to-end sync to /tmp creates 306 valid symlinks + index - SKILL.md frontmatter readable through symlinks - idempotent: second run skips all 320, creates 0 - `--domain finance` correctly isolates to 4 finance skills |
||
|
Claude
|
bdc043776c
|
fix(version): productivity/handoff is v2.8.2, not v2.8.1 (collision fix)
v2.8.1 was already taken by the engineering role-skill upgrade (senior-fullstack / senior-frontend / senior-backend with karpathy-coder + Matt Pocock decision engines), released 2026-05-20 — before the handoff PRs even merged. The auto-release workflow created the v2.8.1 tag from that work via CHANGELOG.md parsing. The productivity/handoff skill is the next minor on top of v2.8.1: v2.8.2. Changes: - CHANGELOG.md: prepend a new [2.8.2] entry documenting the handoff skill (PRs #724, #728, #729). The auto-release workflow (.github/workflows/release.yml) will pick up this entry and create the v2.8.2 git tag + GitHub Release on the next push to main. - productivity/handoff/.claude-plugin/plugin.json: 2.8.1 -> 2.8.2 - .claude-plugin/marketplace.json (handoff entry): 2.8.1 -> 2.8.2 - CLAUDE.md: 4 spots bumped to v2.8.2; v2.8.1 references kept where they correctly point to the engineering role-skill release - README.md: Productivity table row ✨v2.8.1 -> ✨v2.8.2 - docs/index.md: description, hero subtitle, "329 Skills" card text - docs/getting-started.md: description meta + FAQ count text - mkdocs.yml: site_description The narrative across all top-level docs now reads correctly: v2.8.0 (bizops + commercial) -> v2.8.1 (engineering role-skills) -> v2.8.2 (productivity/handoff). Verified: - 0 v2.7.5 references remain (earlier typo) - All v2.8.1 references that remain point to engineering role-skills - CHANGELOG topmost entry: [2.8.2] - 2026-05-23 - plugin.json + marketplace.json both at 2.8.2 - mkdocs build clean (will re-verify in CI) https://claude.ai/code/session_01KLhHBAfEDXdQMeRe6G8sRa |
||
|
Claude
|
2c5a793128
|
feat(engineering): apply karpathy-coder + Matt Pocock to fullstack/frontend/backend
Audit findings: - senior-fullstack / senior-frontend / senior-backend SKILL.md files were generic role catalogs with no opinionated workflow, no customization surface, and no cross-agent invocation contract. - A 4-person SaaS startup and a 200-engineer enterprise read identical recommendations. - Other agents/skills had no typed surface to orchestrate fullstack / frontend / backend lenses. Per-skill additions (21 new files: 7 x 3 skills): - scripts/<role>_decision_engine.py - stdlib-only deterministic profile picker. Refuses to recommend without Karpathy-#1 core assumptions. Surfaces kill criteria. Names human approver chain (never auto-approves). - profiles/*.json x 4 per skill (12 total) - JSON customization surface. Users copy one to <your-org>.json to override defaults. - references/forcing_questions.md - 7 Matt Pocock forcing questions per skill (21 total) with recommended answer + canon citation + kill criterion. - references/composition_map.md - explicit routing into POWERFUL-tier specialists (api-design-reviewer, database-designer, slo-architect, performance-profiler, a11y-audit, epic-design, apple-hig-expert, etc.). Three orchestrator agents (context: fork): - agents/engineering/cs-fullstack-engineer.md - agents/engineering/cs-frontend-engineer.md - agents/engineering/cs-backend-engineer.md Invokable by other agents via Agent(subagent_type="cs-<role>-engineer", ...). Four slash commands: - /cs:fullstack-review, /cs:frontend-review, /cs:backend-review - /cs:engineer-grill - cross-role 21-question forcing-question runner Augmented SKILL.md files (additive only - Karpathy #3 surgical): Each gained 5 new sections: Assumptions & Verifiable Success Criteria (Karpathy #1+#4), Customization profiles, Composition map, Forcing-question library, Invocation from other agents and skills. Verification: - 12/12 profile JSON files parse cleanly - 3/3 decision engines pass --help and --sample, exit 0 - 3/3 cs-* agents have valid YAML + context: fork - 3/3 agent paths resolve from agents/engineering/ - 3/3 commands reference the correct cs-* agent - 69/69 plugin.json files pass check_plugin_json.py - Existing SKILL.md content unchanged (additive edits only) Versions: engineering-team plugin 2.2.3 -> 2.8.1; marketplace entry 2.8.1. https://claude.ai/code/session_01UyWs4rKccdxUWFcWi6Y8Ly |
||
|
Claude
|
32a0da53a4
|
chore(v2.8.0-sprint3): cross-platform sync + docs generation + MkDocs nav + CHANGELOG
Sprint 3 closure for v2.8.0. Brings the 2 new top-level domains (business-operations + commercial) to release-ready by extending the cross-platform sync infrastructure, the docs generator, and the MkDocs nav to recognize them. ## Cross-platform sync (codex / gemini / hermes) - scripts/sync-codex-skills.py — SKILL_DOMAINS extended with business-operations + commercial. Regenerated .codex/skills/ symlinks for 15 new skills + .codex/skills-index.json with full descriptions. - scripts/sync-gemini-skills.py — DOMAIN_MAP extended with all 5 v2.7.0+ v2.8.0 top-level domains (productivity, marketing-top-level, research, business-operations, commercial). +30 items synced. - scripts/sync-hermes-skills.py — DOMAIN_DIRS extended with business-operations + commercial. ## Docs generation (Pass 2 command/agent discovery) scripts/generate-docs.py extended with: - DOMAINS dict extended with business-operations (sort=13) and commercial (sort=14) entries. - Pass 2 for agent discovery — walks <domain>/agents/<agent>.md (v2.8.0 pattern), in addition to <domain>/<plugin>/agents/<agent>.md (legacy pattern). - Pass 2 for command discovery — walks <domain>/commands/<cmd>.md (v2.8.0 pattern) AND <domain>/<skill>/commands/<cmd>.md (v2.7.0 pattern). Previously, only root-level commands/*.md were discovered; 35 commands were orphaned (v2.7.0 capture/pulse/landing/etc. + all v2.8.0 commands). Result: 311 skill pages + 75 agent pages + 69 command pages = 455 total. Up from 311 + 73 + 34 = 418. ## MkDocs nav mkdocs.yml updated with: - Business Operations section (7 sub-skill nav entries) - Commercial section (8 sub-skill nav entries) - 2 new orchestrator agents added to Agents nav - 17 new v2.8.0 slash commands added to Commands nav MkDocs build succeeds (non-strict) in ~17s. Strict mode flags 3 pre- existing broken links in older content (cs-aeo, grill-with-docs) — out of scope for v2.8.0. ## CHANGELOG.md v2.8.0 entry rewritten from "Sprint 1 only" to the full Sprint 1 + 2 + 3 view. All 13 sub-skills documented with canon attribution. Stats updated: - 313 -> 328 skills (+15) - 12 -> 14 top-level domains - 60 -> 77 slash commands (+17) - 402 -> 441 Python tools (+39) - 542 -> 581 reference docs (+39) - 46 -> 48 cs-* agents (+2) - 57 -> 59 marketplace plugins (+2) - 34 -> 69 documented commands in MkDocs (+35) ## Root CLAUDE.md Updated Current Scope + Current Version to reflect v2.8.0 (released) status. Sprint 1 "in-flight" -> "complete". Counts updated to 328 skills / 441 tools / 77 commands. ## Per-skill audit (scripts/audit_skills.py) Ran across 329 total skills. All 13 v2.8.0 sub-skills audited with skill_review_checklist_runner.py: 1 score 5/6, 7 score 4/6, 4 score 3/6, 1 score 2/6 (knowledge-ops). Dominant failure mode: rule #2 "SKILL.md under 100 lines" — known tension with our deliberate Forcing-question library depth (mandatory per user direction). Tracked as ADVISORY for skills that deliberately expose extended grill discipline. ## Plugin manifest validation scripts/check_plugin_json.py --all passes (exit 0) for all 47 plugin manifests including the 2 new ones. The PR #690 validator recognizes the source extension field per CLAUDE.md. https://claude.ai/code/session_015bBb4HzWCf5HH5QK2TGtnW |
||
|
Claude
|
d34e615b73
|
feat(release): auto-tag + GitHub Release from CHANGELOG on push to main
Adds end-to-end release automation so every CHANGELOG bump produces a matching git tag + GitHub Release with notes — no manual `gh release create` invocations required. - .github/workflows/release.yml — push to main triggers parse-CHANGELOG → check tag exists → create tag → create GH Release with notes. Idempotent (existing tags skipped). Manual workflow_dispatch supports targeting a specific historical version. Path-filter limits firing to actual release pushes (CHANGELOG.md, the parser, or the workflow itself changing). - scripts/extract_release_notes.py — stdlib-only CHANGELOG.md parser. Outputs JSON, plain text, or github-release-formatted markdown. Runnable standalone for preview: `python3 scripts/extract_release_notes.py --format github-release`. Default extracts the latest entry; --version pins to a specific release. - CHANGELOG.md — new [2.8.0] entry covering the v2.8.0 Sprint 1 work (business-operations + commercial domains, #688) plus the #686 plugin.json fix (#689) and #690 regression-prevention validator + CI gate. This is the entry the release workflow will pick up on first run after this lands on main. When this commit (plus the dev → main sync #692) reaches main, the workflow fires, parses CHANGELOG, sees v2.8.0 at the top, creates the `v2.8.0` tag and GitHub Release — automatically. All future releases follow the same flow: add a CHANGELOG entry, merge to main, done. |
||
|
Claude
|
7c54a72d94
|
chore(v2.7.3): release prep — docs sync + audit fixes + CHANGELOG
Post-merge sync of v2.7.3 (#679 already in dev). Three things in one commit: ## 1. /update-docs pipeline (Steps 1-7) Cross-platform sync verified clean across 3 platforms (.codex 305 / .gemini 355 / .hermes 305 — aeo + security-guidance present in all three indexes). 401 → 403 MkDocs pages generated. **Files refreshed to v2.7.3 / 313 / 46+ / 60+ counts:** - `.claude-plugin/marketplace.json` — top-level description + metadata description + metadata.version (was 2.7.0). - `CLAUDE.md` — Current Scope line, new v2.7.3 Highlights section, footer (Last Updated + Version + Status). - `README.md` — tagline, badges, Skills Overview row counts (Engineering POWERFUL 44 → 45, Marketing 44 → 45 w/ 8 pods), Python Tools count, FAQ counts. Hermes footnote ticked v2.7.2 → v2.7.3. - `docs/index.md` — title, meta description, hero subtitle, grid card. - `docs/getting-started.md` — meta description, FAQ count. - `mkdocs.yml` — site_description + 3 nav entries (skill + agent + cmd). - `marketing-skill/.claude-plugin/plugin.json` — 44 → 45 skills, 7 → 8 pods, v2.2.3 → v2.7.3. - `marketing-skill/CLAUDE.md` — 43 → 45 skill count, 32 → 58 Python tools, 7 → 8 pods. Added AEO skill to skill map. ## 2. /plugin-audit on both new skills (full 8-phase pipeline) **aeo (marketing-skill/skills/aeo/)** — PASS WITH WARNINGS: - Phase 2 Structure: 86.4/GOOD (after auto-fix of YAML frontmatter parse error — colon in description value needed quote-wrapping) - Phase 3 Quality: 52.4/D (validator expects legacy fields v2.7 skills don't use — repo-wide pattern, not a defect) - Phase 4 Scripts: 3/3 PASS - Phase 5 Security: 2 HIGH NET-EXFIL findings on urllib.request — same known false-positive as sister seo-audit skill (URL fetch is core functionality for content-audit-by-URL tools, not exfiltration) - Phase 6 Marketplace: plugin.json valid (v2.7.3, all required fields) - Phase 7 Ecosystem: indexed in all 3 platforms - Phase 8 Code Review: 22 workflow sections, refs cite 8/17/37 sources (≥7 floor met), 0 broken links, attribution present **security-guidance (engineering/security-guidance/)** — PASS WITH WARNINGS: - Phase 2/3/4: low scores due to hook-plugin layout mismatch with script-plugin validators (hook plugins use `hooks/` not `scripts/` per Claude Code spec — fundamental structural mismatch, not a defect) - Phase 5: 6 CRITICAL + 4 HIGH findings are all recursive false- positives — auditor detects the hook's OWN pattern-detection strings (`"exec("`, `"eval("`, `"yaml.load("` are substring literals used as detection rules, NOT actual calls). Verified zero real exec/eval calls in the file. - Phase 6/7: clean (plugin.json valid, hooks.json valid, indexed in all 3 platforms, mkdocs nav entry added) - Phase 8: 291 LOC, syntax valid, clear exit-code contract (0=clean, 2=block per Claude Code hook spec), session-state caching @ lines 158-191, 30-day cleanup @ line 163, attribution full, live smoke test (`eval(input())` in Write → exit 2 + warning) PASS - **Real defects: 0.** ## 3. Layout fix (Phase 7 audit catch) The /plugin-audit Phase 7 caught a real layout bug: cs-aeo.md placed at `marketing-skill/agents/cs-aeo.md` and `marketing-skill/commands/ cs-aeo.md` was unreachable by `scripts/generate-docs.py` (which only walks root `agents/<domain>/` and root `commands/`). Result: docs/ pages for cs-aeo agent + /cs:aeo command were never generated. **Moved to repo-canonical locations:** - `marketing-skill/agents/cs-aeo.md` → `agents/marketing/cs-aeo.md` - `marketing-skill/commands/cs-aeo.md` → `commands/cs-aeo.md` Cleaned empty `marketing-skill/agents/` + `marketing-skill/commands/` directories. Re-ran `scripts/generate-docs.py`: 401 → 403 pages (73 agents + 34 commands — both new entries present). ## CHANGELOG.md Added [2.7.3] - 2026-05-17 entry with full Added / Changed / Layout fix / Cross-platform sync / Honest audit results / PRs / Verification sections. Audit results documented verbatim including the known false-positives — no claims of clean security where the auditor flagged patterns it can't disambiguate. https://claude.ai/code/session_01FEUmeuYhmnxVFq7EZM8ZSw |
||
|
Claude
|
6e45e578b5
|
release(v2.7.0): version bumps + CHANGELOG + plugin.json schema doc
Final polish for v2.7.0 release. Changes: - All 12 v2 plugin.json files bumped 1.0.0 → 2.7.0 (release alignment) - CHANGELOG.md: new v2.7.0 section documenting the 13 skills, 3 new domain folders, marketplace + codex sync, Path-B convention, and 8-phase audit verification results - CLAUDE.md: 'Current Version' bumped 2.6.1 → 2.7.0 with v2.7.0 highlights block (13 skills, Path-B pattern, verification summary) - CLAUDE.md: ClawHub plugin.json schema clarified — `source` and `attribution` formally accepted as approved extension fields (consistent with existing pattern across 13 new v2 skills + 3 engineering Matt-Pocock-derivative plugins). Stripped at ClawHub-publish time if/when stripping pipeline lands. - CLAUDE.md: ClawHub rule #6 version reference bumped 2.2.0+ → 2.7.0+ Audit verification before release: - 39/39 scripts pass --help across all 13 v2 skills - Spot-check audit (pulse/litreview/notebooklm): all 86.4/GOOD structure, 3/3 scripts, 0 critical/high security findings - Bulk audit (9 remaining skills): all 79.5-86.4 structure, 0 critical/high security findings (1 false positive in syllabus: hardcoded user-facing error message string contains 'npm install docx' — not runtime install) - Cross-skill consistency: 7/7 research-pack siblings carry the Agent Integrity Rules block; orchestrator disambiguation present in 5 places https://claude.ai/code/session_01FEUmeuYhmnxVFq7EZM8ZSw |
||
|
Claude
|
af55472ffe
|
release(v2.6.1): meta-skill maturity — validator + descriptions + audit tool
Promotes the v2.6.1 cleanup work (already merged to dev via #646 + #647 + #648) to a tagged release. Updates the 3 release artifacts: marketplace.json: - Top-level metadata.version: 2.6.0 → 2.6.1 - No new plugin entries; this is a cleanup release (validator improvements + 21 placeholder description fixes + audit tool) CHANGELOG.md: - New v2.6.1 entry above v2.6.0 - Documents validator trigger expansion (30 skills auto-reclassified) - Documents 21 placeholder description fixes (10 from #647 + 11 from #648) - Documents quality_gates_for_skills.md update (binding-new vs advisory-legacy) - Aggregate audit improvements: PASS 4 → 9 (+5); WARN 111 → 137 (+26); FAIL 183 → 152 (-31); Missing-trigger 119 → 68 (-51) - 31 skills total lifted from FAIL → WARN/PASS in v2.6.1 CLAUDE.md: - Current Version: v2.6.0 → v2.6.1 - New v2.6.1 Highlights section above v2.6.0 - Preserves full v2.6.0 highlights for version history continuity No code changes in this commit (release-artifacts only). JSON valid (marketplace.json parses cleanly). https://claude.ai/code/session_01VFreMf7XLBqMgjsrG4wSYe |
||
|
Claude
|
6b0e4d48db
|
release(v2.6.0): Matt Pocock productivity skills — write-a-skill + caveman + grill-me + handoff
Promotes the 4 Matt Pocock-derived productivity skills (merged via #642 + #643) to a tagged v2.6.0 release. Updates the 3 release artifacts: marketplace.json: - Top-level metadata.version: 2.4.5 → 2.6.0 - Top-level description + metadata.description: 246/9 → 272 skills (4 new Pocock-derived productivity skills added to engineering domain count 67 → 71); 359 → 385 Python tools; 485 → 519 references; 27 → 31 agents; 33 → 58 slash commands - 4 new plugin entries appended after slo-architect (development category): write-a-skill, caveman, grill-me, handoff (all v2.6.0) - Each entry carries the matt-pocock keyword for grouping - Total plugins: 39 → 43 CHANGELOG.md: - New v2.6.0 entry at top (above v2.5.7) - Per-skill detail with tool list + reference source counts - Documents the "hybrid voice pattern" established for future MIT-licensed external skill imports (preserve upstream voice verbatim + wrapper layer with validators/references/cs-*/slash command + karpathy gate + attribution) - Documents 2 known trade-offs: assumption_linter false positives on vocab-as- data (caveman + handoff tools) + realistic compression ratio is 20-50% not 75% CLAUDE.md: - Current Scope: 268 → 272 skills; 373 → 385 tools; 506 → 519 refs; 40 → 44 agents (33 → 37 cs-*); 54 → 58 commands - Architecture tree: engineering/ count 40 → 44 with new skill names - New v2.6.0 Highlights section above v2.5.5 (no break in version history) No code changes in this commit (release-artifacts only). All JSON valid; karpathy gate not applicable (no Python touched). https://claude.ai/code/session_01VFreMf7XLBqMgjsrG4wSYe |
||
|
Claude
|
9d9513236b
|
docs(site): refresh nav, fix dual-publish dedup, add 301 redirects (v2.5.7)
User-requested docs refresh ahead of dev->main release. Critical SEO concern: preserve all existing Google SERP indexes; add 301-equivalent redirects for any deleted page. generate-docs.py dedup fix: The auto-generator created BOTH <name>.md (bundled) AND <name>-<name>.md (standalone wrapper) for dual-published skills, producing duplicate-content pages. Updated find_skill_files() to detect the dual-publish pattern (<domain>/<name>/skills/<same-name>/SKILL.md paired with <domain>/skills/<name>/SKILL.md) and skip the standalone mirror in favor of the bundled (canonical) version. mkdocs-redirects plugin added: Added to mkdocs.yml plugins. Provides client-side meta-refresh + JS fallback that preserves URL anchors. Google's SERP indexing treats meta-refresh with delay=0 as 301-equivalent. 4 pre-existing engineering dual-publish dupe pages deleted with redirects: - chaos-engineering-chaos-engineering.md -> chaos-engineering.md - feature-flags-architect-feature-flags-architect.md -> feature-flags-architect.md - kubernetes-operator-kubernetes-operator.md -> kubernetes-operator.md - slo-architect-slo-architect.md -> slo-architect.md Verified: redirect HTML correctly emitted with <meta http-equiv="refresh" content="0; url=../canonical/"> + JS fallback. Existing Google SERP indexes preserved. mkdocs.yml nav additions: - 5 new C-role docs pages (General Counsel, CDO, CAIO, CCO, VPE) - 13 new cs-* agent docs pages (cs-cfo / cs-cmo / cs-cro / cs-cpo / cs-coo / cs-chro / cs-ciso / cs-chief-of-staff / cs-general-counsel / cs-cdo / cs-caio / cs-cco / cs-vpe) site_description updated: "246 skills, 20 cs-* agents" (6 versions stale) -> "268 skills, 33 cs-* agents (incl. founder-mode C-suite), 21 /cs:* slash commands, and an orchestration protocol for 12 AI coding tools." README.md counts refreshed: - 246 -> 268 skills - 20 -> 33 agents - 33 -> 54 commands - 359 -> 373 Python tools - subtitle expanded with founder-mode lineup callout .github/workflows/static.yml: Updated install step from `pip install mkdocs-material` to `pip install mkdocs-material mkdocs-redirects`. 71 pre-existing skill pages preserved (no SEO equity loss). 5 new pages added, 4 dupes deleted with redirects. mkdocs build verified successful (357 HTML pages). karpathy diff_surgeon: 0 findings. CHANGELOG entry as v2.5.7. 13 INFO-level link warnings exist from before this session (pre-existing broken anchors and relative-link-without-index hints) — not introduced by this PR; tracked separately. https://claude.ai/code/session_012WtZMm5NJHqkYoRqA9fHMN |
||
|
Claude
|
58905866c5
|
fix(c-level): add 3 missing voice specs + fix broken paths in cs-ceo/cs-cto agents
Pure-cleanup PR addressing carry-over items deferred across PRs #618-#626 per karpathy principle #3 (surgical scope — no unrelated cleanups inside scoped feature PRs). Voice specs added to persona-voices.md (3 missing entries): - cs-ceo-advisor — The Strategic Translator (tree-of-thought reasoning; refuses to debate tactics until the strategic question is named) - cs-cto-advisor — The Architecture-First Pragmatist (ReAct reasoning; treats every architecture decision as a 3-year commitment) - cs-general-counsel-advisor — The Risk-Paranoid Lawyer (Not Your Lawyer); carry-over from v2.5.1 All three agents existed but were never added to the persona reference. The voice catalog now matches the cs-* agent set 1:1. Broken paths fixed in 2 pre-existing agent files: - agents/c-level/cs-ceo-advisor.md: 32 path corrections from '../../c-level-advisor/ceo-advisor/' to '../../c-level-advisor/skills/ceo-advisor/' (correct path; the bundled skill lives under skills/) - agents/c-level/cs-cto-advisor.md: 25 path corrections from '../../c-level-advisor/cto-advisor/' to '../../c-level-advisor/skills/cto-advisor/' - YAML 'skills:' frontmatter field also corrected in both Validation: - karpathy-coder/diff_surgeon: 0 findings - Verified target folders exist (c-level-advisor/skills/ceo-advisor/SKILL.md + c-level-advisor/skills/cto-advisor/SKILL.md) No skill/agent/command count changes; no manifest version bumps. This is a pure-fix PR. CHANGELOG entry as v2.5.6. https://claude.ai/code/session_012WtZMm5NJHqkYoRqA9fHMN |
||
|
Claude
|
034c9fdda0
|
feat(vpe-advisor): throughput-first VP of Engineering skill (v2.5.5)
Fifth decision-driven C-role skill in the founder-mode lineup (after GC, CDO, CAIO, CCO). Throughput-first VPE covering 4 specific decisions distinct from CTO: 1. Are we delivering at the right throughput? (DORA 4 metrics + bottleneck) 2. How do we scale the eng hiring funnel? (7-stage funnel + pipeline gap) 3. What's our eng team structure? (squad/tribe + manager-trigger) 4. What's our production discipline? (on-call, deployment, postmortems) Critical distinction enforced: VPE is NOT a CTO skill. - CTO owns 'what to build' (architecture, scaling cliffs, build-vs-buy) - VPE owns 'how to ship it' (delivery, hiring, team structure, production) Built under karpathy-coder discipline (5th consecutive PR): - Assumptions surfaced upfront (CTO vs VPE distinction locked) - Each tool/reference covers ONE decision; no overlap with engineering tactical skills - Surgical scope; no edits to other c-level skills - All 3 tools smoke-tested with embedded samples - karpathy/complexity_checker: 0 findings on 3 new tools - karpathy/diff_surgeon: 0 findings on staged diff - check_plugin_json.py + sync_skill_bundles.py --check: both pass 3 stdlib Python tools with deterministic logic: - delivery_throughput_analyzer.py - DORA 4 metrics (Deployment Frequency, Lead Time, MTTR, Change Failure Rate) with Elite/High/Medium/Low verdict per metric and overall. Cycle-time bottleneck ID with fixes per stage. Sample (Platform Squad, 30 days, 28 deploys) -> overall High; bottleneck = first_review_to_approval at 45.8% of cycle. - eng_hiring_funnel_calculator.py - 7-stage funnel conversion with healthy/leaky verdict per stage. End-to-end conversion, required top-of-funnel volume for hiring target, weakest-stage fixes (sourcing, calibration, interview design, comp/close). Sample (Q2 2026, 4-hire target) -> 0.62% end-to-end, gap of 160 candidates, weakest = offer_to_accept at 60%. - eng_team_structure_designer.py - Structure recommendation by headcount, squad sizing (5-9 IC range), manager-trigger, director-trigger, span-of-control. Sample (25 engineers, 22 ICs / 3 EMs / 1 CTO) -> 4-squad structure; no EM trigger; director trigger FIRES. 4 in-depth references each citing 5+ authoritative sources: - delivery_throughput.md - Full DORA framework, 4 bottleneck patterns, what to fix first, anti-patterns. Cites Accelerate (Forsgren/Humble/Kim), Google State of DevOps, Phoenix Project, Reinertsen Flow, Humble Continuous Delivery. - engineering_hiring_funnel.md - 7-stage funnel + benchmarks + leakage diagnosis + pipeline math + sourcing diversification + interview design. Cites LinkedIn Talent Insights, Levels.fyi+Pave, Lou Adler, Adler/Bock "Work Rules!", CMU/Booth research. - eng_team_structure.md - Conway's Law + headcount-to-structure + span-of- control + EM vs tech lead + manager/director/VPE triggers + squad sizing + chapter discipline. Cites Kniberg "Scaling Agile @ Spotify" + 2020 retrospective, Will Larson, Camille Fournier, Conway 1968, engineering blog corpus. - production_discipline.md - On-call (6+ rotation), incidents (4-tier + blameless postmortems), deployment cadence, SLO discipline, 5-level maturity model. Cites Google SRE + SRE Workbook, Allspaw, PagerDuty IR, Charity Majors, Nora Jones, Mikey Dickerson. cs-vpe-advisor agent: throughput-first operator. Voice: "What's your cycle time, and where does the work spend most of its time waiting?" Trusts DORA over vibe. Distinguishes "what to build" (CTO) from "how to ship it" (VPE). /cs:vpe-review slash command: 6-question forcing interrogation (cycle time, DORA verdict, hiring leakage, structure health, production maturity, VPE-vs-CTO scope). Dual-published from the start (per #624 pattern): - Standalone at c-level-advisor/vpe-advisor/ with mirrored content - New marketplace entry: vpe-advisor (category: leadership) - Bundled mirror at c-level-advisor/skills/vpe-advisor/ Updates: - c-level plugin.json: v2.5.4 -> v2.5.5 (33 skills, 13 cs-* agents) - c-level-agents plugin.json: v1.4.0 -> v1.5.0 (13 agents, 21 commands) - marketplace.json: bumped both c-level entries; new VPE standalone entry; +vp-engineering, vpe, dora, delivery-throughput, engineering-hiring, eng-team-structure, production-discipline keywords (38 -> 39 plugins) - c-level CLAUDE.md: VPE row added; counts updated - Root CLAUDE.md: 267->268 skills, 32->33 cs-* agents, 370->373 tools, 502->506 references, 53->54 commands; v2.5.5 highlight section - CHANGELOG.md: v2.5.5 entry with karpathy-discipline rationale Carry-over (still not in scope): cs-general-counsel-advisor voice spec missing from persona-voices.md (multi-PR carry-over); Phase 2 final remainder = CCO-comms (Chief Communications Officer) with naming disambiguation needed. https://claude.ai/code/session_012WtZMm5NJHqkYoRqA9fHMN |
||
|
Claude
|
c7a0fe865a
|
feat(chief-customer-officer-advisor): retention-obsessed CCO skill (v2.5.4)
Fourth decision-driven C-role skill in the founder-mode lineup (after GC, CDO, CAIO). Opinionated CCO covering 4 specific decisions, not a generic customer success survey: 1. What's our retention architecture - is GRR vs NRR honest? 2. How do we segment customers for differential investment? 3. What's the CS team's coverage model - pooled vs named, when to switch? 4. What CS role do we hire next? (CSM != Support != AM != IM) Built under karpathy-coder discipline (4th consecutive PR): - Assumptions surfaced upfront (CRO vs CCO split: revenue math vs customer experience) - Each tool/reference covers ONE decision; no overlap with business-growth - Surgical scope; no edits to other c-level skills - All 3 tools smoke-tested with embedded samples - karpathy/complexity_checker: 0 findings on 3 new tools - karpathy/diff_surgeon: 0 findings on staged diff - check_plugin_json.py + sync_skill_bundles.py --check: both pass 3 stdlib Python tools: - retention_decomposition_analyzer.py - Decomposes ARR by cohort into GRR/NRR/Logo separately. Flags leaky-bucket pattern (NRR > 100% AND GRR < 85%). 7-category churn root-cause taxonomy with preventable %. Sample: Q1 GRR 91.7% CONCERNING (NRR 106.7%), Q2 GRR 84.7% CRITICAL, top driver = product_fit at 54.5% preventable. - customer_segmentation_designer.py - 4-tier framework (Strategic / Enterprise / Mid-market / SMB-long-tail) with ICP fit scoring (7 weighted signals). Surfaces kill list (support cost > 50% of ARR AND ICP fit < 5) + upgrade candidates. Sample: 5 customers tiered, 1 kill candidate, 2 upgrades. Strategic tier = 76.7% of ARR (Pareto). - cs_coverage_calculator.py - CSM headcount per tier with dual constraints (ARR ratio + account count, whichever binds). Manager-trigger thresholds. 12-month hiring plan with quarterly sequencing. Sample: 4 current -> 12 needed at 40% growth, $2.25M annual cost, 8 hires planned. 4 in-depth references each citing 5+ authoritative sources: - retention_decomposition.md - GRR vs NRR math, leaky-bucket pattern, 7-category churn taxonomy, leading-indicator playbook. Cites Mehta/Steinman/Murphy, Lincoln Murphy, David Skok, BVP, ChartMogul, Reichheld, Tunguz. - customer_segmentation_strategy.md - 4-tier framework, ICP fit (7 signals), tier transition triggers, kill list criteria. Cites Lincoln Murphy, Bain Loyalty Effect, Tunguz, Skok, ChartMogul, Challenger Customer. - cs_coverage_model.md - 4 coverage models with ratios by stage/segment, manager-trigger, comp design, ramp curves. Cites Gainsight, TSIA, Mehta/Pickens, ChurnZero, Skok, KeyBanc SaaS survey. - cs_team_org_evolution.md - 5-stage role map, 6-role distinction table (CSM/Support/AM/IM/CS Ops/Customer Marketing), AM-vs-CSM split, 7 anti-patterns. Cites Mehta/Steinman/Murphy, Mehta/Pickens, BVP, TSIA, Gainsight, ChurnZero, Lincoln Murphy. cs-cco-advisor agent: retention-obsessed pragmatist. Voice: "What's your gross retention rate, and what's the #1 reason customers leave?" Trusts GRR over NRR. Refuses to recommend CS hires without naming the customer outcome they unblock. /cs:cco-review slash command: 6-question forcing interrogation (GRR truth, top churn driver, time-to-value, kill-list candidates, ARR-per-CSM ratio + coverage model, CS comp alignment). Dual-published from the start (matching the #624 pattern): - Standalone wrapper at c-level-advisor/chief-customer-officer-advisor/ with mirrored content - New marketplace entry: chief-customer-officer-advisor - Bundled mirror at c-level-advisor/skills/chief-customer-officer-advisor/ Updates: - c-level plugin.json: v2.5.3 -> v2.5.4 (32 skills, 12 cs-* agents) - c-level-agents plugin.json: v1.3.0 -> v1.4.0 (12 agents, 20 commands) - marketplace.json: bumped both c-level entries; new CCO standalone entry; +chief-customer-officer, cco, retention-decomposition, customer-segmentation, cs-coverage keywords (marketplace plugins: 37 -> 38) - c-level CLAUDE.md: CCO row added; agent + count tables updated - Root CLAUDE.md: 266->267 skills, 31->32 cs-* agents, 367->370 tools, 498->502 references, 52->53 commands; v2.5.4 highlight section - CHANGELOG.md: v2.5.4 entry with karpathy-discipline rationale Carry-over (still not in scope): cs-general-counsel-advisor voice spec missing from persona-voices.md; Phase 2 remainder (VPE, CCO-comms). Disclaimer in every output: retention benchmarks vary significantly by ACV/segment/industry; B2B SaaS-baseline guidance only. https://claude.ai/code/session_012WtZMm5NJHqkYoRqA9fHMN |
||
|
Claude
|
7ae93385bd
|
feat(chief-ai-officer-advisor): eval-demanding CAIO skill (v2.5.3)
World-class, in-depth Chief AI Officer skill covering 4 specific decisions
(not a generic AI strategy survey):
1. Should we use an API, fine-tune, or build our own? (3-yr TCO + breakeven)
2. Is this AI use case high-risk under regulation? (EU AI Act + US state +
industry overlays with Article-level citations)
3. When do we switch from API to self-hosted, and at what cost? (2026
pricing + GPU economics + hidden costs)
4. What AI role do we hire next? (5-stage map + 9-role definition table)
Built under karpathy-coder discipline (third in a row):
- Assumptions surfaced upfront before code (principle 1)
- Each tool/reference covers ONE decision; rejected generic-survey scope (#2)
- Surgical changes only; no scope creep (#3)
- All 3 tools smoke-tested with embedded samples before commit (#4)
- karpathy/complexity_checker.py: 0 findings on 3 new tools
- karpathy/diff_surgeon.py: 0 findings on staged diff
3 stdlib Python tools with deterministic logic:
- model_buildvsbuy_calculator.py — Returns API/FINE_TUNE/BUILD recommendation,
3-year TCO across 6 paths, breakeven analysis. Balances economic crossover
with practical feasibility (data availability, ML team capacity, compliance).
Embedded sample (B2B customer support, 4M queries/mo) -> API recommended
despite breakeven crossed, because no fine-tune data + 1-engineer ML team.
- ai_risk_classifier.py — Returns EU AI Act tier (PROHIBITED/HIGH/LIMITED/
MINIMAL) with 7 Article citations + US state triggers (NYC LL 144, CO AI
Act, IL HB 53, CA SB 1001, IL BIPA) + industry overlays (FDA, CFPB, NAIC,
ECOA, Fed SR 11-7). Sample (AI hiring in EU+NY+CO+IL+CA) -> HIGH,
conformity required, 3 US triggers, 14 controls.
- ai_cost_economics.py — Returns API costs (3 tiers) + self-hosted costs (low/
mid/high GPU rates with 24/7 warm + ops attribution) + breakeven analysis.
Reveals key insight: self-hosted floor makes API economics dominate at
typical B2B SaaS scale. Sample (5M tokens/day, 750M/mo) -> API at $1,500/mo
beats self-hosted at $13,450/mo by 9x; breakeven at 6.7B tokens/mo.
4 in-depth references, each citing 5+ authoritative sources:
- model_buildvsbuy_strategy.md — 3 paths with failure modes, 6 fine-tuning
approaches ranked by cost (RAG/LoRA/full FT/RLHF/DPO/continued pre-training),
decision tree, eval-first discipline. Cites Anthropic/OpenAI/Google/Meta
model cards, LoRA paper, RLHF paper, DPO paper, Stanford CRFM Foundation
Models report, Foundation Models and Fair Use (Henderson et al.).
- ai_risk_governance.md — Full EU AI Act tier map (Art. 5 prohibited, Art. 6
+ Annex III high-risk, Art. 50 limited-risk) with all 8 high-risk domains
+ 11 obligation articles. NIST AI RMF 1.0. US state patchwork (9 laws).
Industry overlays (FDA AI/ML, CFPB, NYDFS, NAIC). 10-item governance
program checklist. When-to-hire-AI-counsel criteria.
- ai_cost_economics.md — 2026 API pricing (4 tiers), GPU rental (A100/H100/
H200/B200), throughput estimates, GPU count by model size, utilization
reality (20-80%), 6 hidden costs of self-hosted, 6 hidden costs of API,
migration cost, prompt caching as economics lever. Cites vLLM paper,
DistServe, HELM, Artificial Analysis.
- ai_team_org_evolution.md — 5-stage role map (pre-seed -> late-stage),
9-role definition table (AI engineer != ML engineer != research scientist),
AI team vs data team contrast (8 dimensions), 7 anti-patterns, hiring
sequencing rule. Cites Huyen "Designing ML Systems" + "AI Engineering",
State of AI Report.
cs-caio-advisor agent (c-level-agents/agents/cs-caio-advisor.md):
- Eval-demanding realist voice
- Hard rule: does not duplicate engineering AI/ML skills (rag-architect,
agent-designer, prompt-governance, self-eval, llm-cost-optimizer)
- Treats every AI use case as a hiring decision; pushes back on AI hype
/cs:caio-review slash command:
- 6-question forcing interrogation: eval set, hallucination SLO, regulatory
tier, model selection, cost trajectory, role-that-unblocks
- Routes to /cs:cdo-review, /cs:gc-review, /cs:ciso-review, /cs:cfo-review,
/cs:chro-review
cs-caio-advisor voice spec added to persona-voices.md.
Updates:
- c-level plugin.json: v2.5.2 -> v2.5.3 (31 skills, 11 cs-* agents)
- c-level-agents plugin.json: v1.2.0 -> v1.3.0 (11 agents, 19 commands)
- marketplace.json: both c-level entries; new CAIO keywords (chief-ai-officer,
caio, ai-strategy, model-buildvsbuy, eu-ai-act, ai-cost-economics)
- c-level CLAUDE.md: CAIO row added; agent + count tables updated
- Root CLAUDE.md: 265->266 skills, 30->31 cs-* agents, 364->367 tools,
494->498 references, 51->52 commands; v2.5.3 highlight section
- CHANGELOG.md: v2.5.3 entry with full rationale
Known follow-up (out of scope this PR): cs-general-counsel-advisor voice spec
still missing from persona-voices.md (carried from v2.5.1); separate PR.
Disclaimer in every output: not legal advice; not a replacement for AI
counsel on EU AI Act conformity; not a tactical AI/ML engineering skill.
https://claude.ai/code/session_012WtZMm5NJHqkYoRqA9fHMN
|
||
|
Claude
|
4b4045e1b3
|
feat(chief-data-officer-advisor): decision-driven CDO skill (v2.5.2)
Opinionated CDO skill covering 4 specific decisions, not a generic data governance survey: 1. Can we train our model on this data? (training rights matrix) 2. Warehouse / lakehouse / mesh + build-vs-buy? (data product strategy) 3. What is our customer data worth? (B2B customer-data-as-asset) 4. What data role do we hire next? (data team org evolution) Built under explicit karpathy-coder discipline: - Assumptions surfaced upfront before code (principle 1) - Each tool/reference covers ONE decision; rejected generic-survey scope (#2) - Surgical changes only; caught and reverted scope creep (cs-gc voice spec) before commit (#3) - Verifiable success criteria locked before code; all 3 tools smoke-tested with embedded samples (#4) - karpathy-coder/complexity_checker.py: 0 findings on 3 new tools - karpathy-coder/diff_surgeon.py: 0 findings on staged diff 3 stdlib Python tools with deterministic logic (not pattern-match prose): - ai_training_data_audit.py — 3-dimension matrix (origin x class x use case) with GDPR Art. 6 + EU AI Act + US state citations. Embedded sample tests 7 sources spanning all 3 verdicts (2 NO-GO / 2 MITIGATE / 3 GO). - data_product_strategy_picker.py — Picks warehouse/lakehouse/mesh from profile, returns 6-layer build-vs-buy + 12-month sequencing. Series A sample (8 consumers, 4.5TB, 1 ML model) -> LAKEHOUSE. - data_asset_valuator.py — Strategic value 0-10 from 4 components (exclusivity, freshness, cohort, history), moat strength, M&A multiplier (1.0x-1.7x ARR with carve-out penalties), 3 ranked productization paths. Sample (B2B sales engagement, 380 customers, 47 carve-outs) -> 8.2/10 STRONG moat, 1.33-1.61x multiplier, recommends benchmark report first. 4 references, each answering ONE decision: - ai_training_data_rights.md — Training rights matrix + GDPR decision tree + EU AI Act + US state patchwork (CCPA/CPRA, NYC LL 144, IL BIPA, WA MHMD) - data_product_strategy.md — Architecture kill criteria + 6-layer build-vs-buy + sequencing pattern + anti-patterns - customer_data_as_asset.md — Valuation framework + 3 productization paths + 10-item M&A diligence checklist + contractual constraint audit - data_team_org_evolution.md — 5-stage role map + centralize-vs-embed trigger + 6 anti-patterns (e.g., "hiring data scientist as first hire") cs-cdo-advisor agent (c-level-agents/agents/cs-cdo-advisor.md): - Decision-driven realist voice - Hard rule: does not duplicate engineering data skills (database-designer, observability-designer, rag-architect, llm-cost-optimizer) - Refuses to recommend tooling before naming the consumer /cs:cdo-review slash command: - 6-question forcing interrogation matching /cs:cfo-review pattern - Routes to /cs:gc-review, /cs:ciso-review, /cs:cfo-review, /cs:chro-review cs-cdo-advisor voice spec added to persona-voices.md. Known follow-up (out of scope this PR): cs-general-counsel-advisor voice spec is missing from persona-voices.md (gap from v2.5.1); separate small PR. Updates: - c-level plugin.json: v2.5.1 -> v2.5.2 (30 skills, 10 cs-* agents) - c-level-agents plugin.json: v1.1.0 -> v1.2.0 (10 agents, 18 commands) - marketplace.json: both c-level entries; new CDO keywords (chief-data-officer, cdo, ai-training-data, data-product-strategy, data-as-asset) - c-level CLAUDE.md: CDO row added; agent + count tables updated - Root CLAUDE.md: 264 -> 265 skills, 29 -> 30 cs-* agents, 361 -> 364 tools, 490 -> 494 references, 50 -> 51 commands; v2.5.2 highlight added - CHANGELOG.md: v2.5.2 entry with karpathy-discipline rationale Disclaimer in every output: not legal advice; not a replacement for outside counsel on productization/licensing; not a tactical data engineering skill. https://claude.ai/code/session_012WtZMm5NJHqkYoRqA9fHMN |
||
|
Claude
|
8bbde435b9
|
feat(general-counsel-advisor): full skill backing /cs:gc-review
Closes the gstack-can't-touch lane: gstack has zero legal coverage; this is the first plugin in the founder-mode lineup to outclass it on a domain it doesn't even attempt. Legal exposure is where startups most often discover a problem after it's expensive to fix. New skill (c-level-advisor/skills/general-counsel-advisor/): - SKILL.md with 4 workflows (contract review, term sheet response, IP hygiene audit, regulatory trigger assessment), keywords, output standards - scripts/contract_risk_scanner.py — scans contract text for 12 founder-killer patterns (auto-renew traps, uncapped indemnity, vague IP, aggressive non-compete, missing DPA when personal data flows, MFN pricing, perpetual license-back, one-sided force majeure/venue/audit, broad non-solicit). Stdlib-only, JSON+text output, --help. Smoke-tested: 7 findings on embedded sample MSA across CRITICAL/HIGH/MEDIUM. - scripts/term_sheet_analyzer.py — scores term sheet 0-100 across 12 dimensions (liquidation preference, anti-dilution, option pool pre/post-money, board, vesting, pro-rata, drag-along, protective provisions, info rights, dividends, valuation, holistic). Stdlib-only, JSON-input + JSON+text output, --help. Smoke-tested: founder-friendly Series A sample scores 94/100. - references/contracts_playbook.md — 7 startup contract types with top redlines - references/ip_and_regulatory.md — IP strategy + regulatory trigger matrix (HIPAA/GDPR/FDA/fintech/AI Act) + SOC 2 -> ISO sequencing - references/term_sheet_decoder.md — full glossary, founder-friendly defaults, the 3 clauses that matter most, negotiation strategy New agent (c-level-advisor/c-level-agents/agents/cs-general-counsel-advisor.md): - Risk-paranoid persona orchestrating the skill - Voice: "Before we sign, three things need to be settled in writing." - Hard rule: never substitutes for licensed counsel; always escalates Updates: - /cs:gc-review SKILL.md: now points at the real skill + tools (was a planned- skill placeholder before) - c-level-advisor/.claude-plugin/plugin.json: v2.5.0 -> v2.5.1, description updated to 29 skills (was 28) - c-level-advisor/c-level-agents/.claude-plugin/plugin.json: v1.0.0 -> v1.1.0, 9 cs-* agents (was 8) - marketplace.json: both c-level entries bumped, +contract-review, +term-sheet, +ip-strategy keywords - c-level-advisor/CLAUDE.md: General Counsel added to roles table; agents and counts updated - Root CLAUDE.md: 263 -> 264 skills, 28 -> 29 cs-* agents, 359 -> 361 Python tools, 487 -> 490 references; v2.5.1 highlight section added - CHANGELOG.md: full v2.5.1 entry with rationale Disclaimer: every tool/reference/agent output reminds users this is not legal advice; always engage qualified counsel. The skill is positioned as triage before $500/hour counsel time, never as a substitute. https://claude.ai/code/session_012WtZMm5NJHqkYoRqA9fHMN |
||
|
Claude
|
921272ef7a
|
feat(c-level-agents): founder-mode plugin with 8 cs-* agents and 17 /cs:* commands
New plugin at c-level-advisor/c-level-agents/ that surfaces the 28 existing c-level skills through persona agents and slash commands. Business-domain answer to YC Garry Tan's gstack: broader role coverage (real CFO/CMO/CRO/GC/ CISO, not just code-shipping personas), forcing-question office hours, 6-phase boardroom with Phase 2 isolation, strategic sprint pipeline, multi-model cross-eval, and decision freeze. Agents (8 cs-* personas with moderate voice differentiation): - cs-cfo-advisor (numerate skeptic) - cs-cmo-advisor (narrative-first) - cs-cro-advisor (pipeline-paranoid) - cs-cpo-advisor (JTBD-driven) - cs-coo-advisor (execution OS) - cs-chro-advisor (people-systems) - cs-ciso-advisor (risk-paranoid) - cs-chief-of-staff (router + synthesist) Slash commands (17 /cs:* sub-skills): - Forcing questions (8): /cs:office-hours, /cs:cfo-review, /cs:cmo-review, /cs:cpo-review, /cs:cro-review, /cs:cto-review, /cs:ciso-review, /cs:gc-review - Strategic sprint pipeline (5): /cs:brief -> /cs:boardroom -> /cs:decide -> /cs:execute -> /cs:post-mortem - Meta + safety (4): /cs:founder-mode (auto-router), /cs:onboard, /cs:cross-eval (multi-model with Claude-only graceful degradation), /cs:freeze References: - persona-voices.md (per-role voice specs) - llm-wiki-bridge.md (Markdown-only persistent memory, no Postgres dependency) Integration: - Marketplace.json: new c-level-agents entry, c-level-skills bumped to v2.5.0 - c-level-advisor/.claude-plugin/plugin.json: bumped to v2.5.0 with expanded description - c-level-advisor/CLAUDE.md: documents new plugin layer - Root CLAUDE.md: counts updated (246->263 skills, 27->35 agents, 33->50 commands) - CHANGELOG.md: 2.5.0 entry https://claude.ai/code/session_012WtZMm5NJHqkYoRqA9fHMN |
||
|
Claude
|
a417df7144
|
chore(release): v2.4.5 — close out unreleased work + count reconciliation
Promotes the 11 commits accumulated on dev since v2.4.4 into a tagged
release before opening the dev->main PR.
Version bumps (root-level only — per-skill version stamps unchanged):
.claude-plugin/marketplace.json metadata.version: 2.4.4 -> 2.4.5
CLAUDE.md 'Version:' headers (x2): v2.4.4 -> v2.4.5
CLAUDE.md 'Last Updated': May 10 -> May 11, 2026
Deliberately NOT bumped:
- slo-architect plugin version (marketplace.json line 643) stays 2.4.4
-- that's the skill's own release stamp, not the repo version
- SKILL.md frontmatter versions in engineering/skills/slo-architect/
and engineering/slo-architect/skills/slo-architect/ -- same reason
CHANGELOG.md changes:
- [Unreleased] block renamed to [2.4.5] - 2026-05-11
- Title broadened to include 'Count-Truth Reconciliation' alongside the
original 'Skill Expansion Phase 1+2+3+4 (+ ship-gate)'
- 'Changed' totals corrected to file-system truth:
Skills: 235 -> 246 (was claimed 235 -> 238)
Tools: 314 -> 359 (was claimed 314 -> 325)
References:435 -> 485 (was claimed 435 -> 447)
Agents: added (28 -> 27, was missing)
Commands: 27 -> 33 (was claimed 27 -> 30)
Plugins: added (30 -> 33, was missing)
- 'Fixed' subsection: added bullets for #608 (count corrections) and
#609 (marketplace registry + integrations.md), plus
skill-security-auditor self-skip fix
Why the v2.4.4 unreleased totals were wrong: the entry was drafted
mid-cycle and never reconciled before tagging. #608/#609 caught the
drift. The v2.4.5 totals now reproduce from one find/python3 command
each (commands documented inline in the changelog bullets).
|
