- #954: strip non-spec source/attribution keys from all 39 plugin.json
manifests so Claude Code's validator accepts them; metadata preserved in
new .claude-plugin/authoring-notes.json sidecars; check_plugin_json.py now
hard-fails manifests carrying those keys and sanity-checks the sidecar;
CLAUDE.md ClawHub schema section updated to the new rule.
- #949: move the c-level-agents plugin out of c-level-advisor/ to a
top-level directory so the two marketplace sources no longer overlap;
updated marketplace.json source, homepage, descriptions, all
cross-references, docs, harness manifest, mirror-tree symlinks/indexes,
and rebased the moved files' relative links; domain counters trued up
(18 -> 19 domains).
- #933: replace dead links to the gitignored maintainer-local megaprompts/
tree with annotated plain-text references (44 files: SKILL.md, READMEs,
agents, commands).
- #931: DynamoDB on-demand pricing updated to post-Nov-2024 rates
($0.625/M writes, $0.125/M strongly consistent reads).
- #969: skill_security_auditor.py and the three dossier scripts reconfigure
stdout/stderr to UTF-8 (errors=replace) so legacy Windows codepages no
longer crash at print time; PYTHONUTF8=1 documented.
- #968: Windows Notes section in INSTALLATION.md + README pointer for the
core.symlinks mirror-tree checkout caveat.
- #924/#885 residuals: hook commands quote "${CLAUDE_PLUGIN_ROOT}" paths in
all plugin hooks.json/settings.json (space-safe roots); removed the stale
pre-rename status/review mirror symlinks and index entries left over from
the memory-status/memory-review rename.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Qgc6RYXWJPr5oW9DHU7zR4
Clears every reference the new G7 lint flags, then makes it blocking so the
class cannot drift back. audit/engineering-agentic-2026-07 marked the
senior-ml-engineer half of this STILL-OPEN.
Deleted rather than updated:
- agent-designer/agent_evaluator.py's _define_cost_benchmarks() held
per-token prices for gpt-4, gpt-3.5-turbo and claude-3 at 2024 rates. The
result was assigned to self.cost_benchmarks and never read by anything, so
the method is gone. Cost analysis uses the cost_usd the caller supplies per
execution log, which is the only figure that can be accurate
Made model-agnostic, following the precedent already set by
senior-prompt-engineer/scripts/prompt_optimizer.py's --price-per-mtok:
- senior-ml-engineer SKILL.md and llm_integration_guide.md drop both 2024
price tables and the context-window table (which claimed GPT-4 = 8,192).
calculate_cost() takes rates as parameters; count_tokens() takes an
encoding name, since encodings outlive model IDs and
encoding_for_model() raises KeyError on anything unmapped
- OpenAIProvider loses its default model, so the caller must pass one
- llm-cost-optimizer's routing table names tiers, not models
Pinned to current IDs where an example genuinely needs one: SKILL_PIPELINE.md
(claude-opus-4-6 -> claude-opus-5), prompt-governance (claude-sonnet-4-5 ->
claude-sonnet-5), agent-designer README. Both dual-publish copies of the CAIO
pricing move together, so G4 stays green.
TEAM_STRUCTURE_GUIDE.md documented `prompt_optimizer.py --model gpt-4 --task
classification`. That contract no longer exists: there is no --task flag and
`prompt` is a required positional. Replaced with a runnable invocation.
Four references stay, with reasons in the allowlist: two litreview examples
where the retired model is the subject of the literature being reviewed, one
dated Computer Use citation, and the embedding benchmark already labelled a
2024 snapshot.
Assisted-by: Claude Code:claude-opus-5
The demo company is explicitly Brazil-set (Jurisdiction: Brazil), so
preserving the local legal-entity term is more faithful than genericizing
it: 'MEI — Microempreendedor Individual, sole-proprietor entity — to be
defined'. Mirror re-synced; example lint PASS; counter (G3) + dual-publish
gates exit 0.
https://claude.ai/code/session_01CUWsrUNZP9jpxvAwq67UiT
- .codex/skills-index.json: reset to dev and re-applied ONLY the two
arquiteto description changes via a JSON round-trip, dropping the
unrelated review/run/status entry reorderings the full regen had pulled
in (diff is now exactly 2 lines, no ambiguous-name churn).
- phase_playbook.md: the data-protection question kept the specific
citation instead of a bare generic — 'data-protection law — e.g. GDPR /
LGPD / CCPA, per jurisdiction' (jurisdiction-aware, not Brazil-only).
- exemplo-bundle/index.md: suggested-next-step no longer says 'finish
problema-solucao.md' (that stub now has content) — points at the real
remaining PHASE-1 gap (manifesto.md) instead.
Mirror identical; example-bundle lint PASS; dual-publish/plugin/counter
gates exit 0.
https://claude.ai/code/session_01CUWsrUNZP9jpxvAwq67UiT
Normalize the usage-line comment gap left misaligned by the earlier
./minha-empresa -> ./my-company rename (path was 3 chars longer).
Cosmetic docstring-only; no behavior change. Mirror re-synced identical.
https://claude.ai/code/session_01CUWsrUNZP9jpxvAwq67UiT
Final review sweep caught two non-accented residuals a prose-grep misses:
- scaffold_bundle.py slugify() fallback "empresa" -> "company" (a code
default, not a preserved slug — fires only on all-punctuation input)
- example destination path ./minha-empresa -> ./my-company in SKILL.md
and the 3 scripts' usage docstrings, so the translated display name
'My Company' no longer maps to a Portuguese folder in the same line
Mirror re-synced identical; scaffold --sample JSON ok; example-bundle
lint PASS; py_compile clean; dual-publish exit 0.
https://claude.ai/code/session_01CUWsrUNZP9jpxvAwq67UiT
Fixes two cosmetic inconsistencies I introduced in the problema-solucao.md
example stub:
- tags: [fundacao, problema-solucao] -> [foundation, problem-solution]
(was residual Portuguese metadata the prose-grep sweep missed)
- 'Café Aurora' -> 'Aurora Café' to match the 7 other uses across the
example bundle's sibling files
Mirror re-synced; example-bundle lint PASS; dual-publish exit 0.
https://claude.ai/code/session_01CUWsrUNZP9jpxvAwq67UiT
Replaces the inline-code workaround for the example's dangling link with a
real stub concept: adds assets/exemplo-bundle/00-fundacao/problema-solucao.md
(type: Problem-Solution + [ASSUMPTION]) and restores the markdown link from
identidade.md so the example shows the OKF link graph it is meant to teach
(okf_conformance Rule 3), instead of merely silencing the linter. Folder
index lists the new concept. Mirror re-synced; example-bundle lint PASS
(0 problems); dual-publish exit 0.
https://claude.ai/code/session_01CUWsrUNZP9jpxvAwq67UiT
Addresses PR #900 review nit — the versao: frontmatter key stayed
Portuguese in 4 template/example/reference files. No script keys on it
(parse_frontmatter is a generic grabber), so it's a safe cosmetic rename.
Mirror re-synced; example-bundle lint still PASS; dual-publish exit 0.
https://claude.ai/code/session_01CUWsrUNZP9jpxvAwq67UiT
Translates the entire arquiteto-de-empresa (Company Architect) skill from
Brazilian Portuguese to professional English across all 18 files in both
dual-published locations:
- SKILL.md, README, cs-arquiteto agent + command, plugin.json description
- 3 references (okf_conformance, type_vocabulary, phase_playbook)
- 7 assets (templates + exemplo-bundle example)
- 3 stdlib scripts (scaffold_bundle, okf_linter, index_generator):
docstrings, argparse help, printed strings, finding-rule slugs
Consistency preserved end-to-end:
- Controlled OKF vocabulary translated (Fundação->Foundation, etc.)
and kept identical across type_vocabulary.md, okf_linter VALID_TYPES,
scaffold_bundle FOLDERS/DASHBOARD labels, and the example-bundle
frontmatter, so the linter still passes.
- Status enum rascunho/em-revisao/aprovado -> draft/in-review/approved.
- [SUPOSIÇÃO] -> [ASSUMPTION]; language: pt-BR -> en.
Identifiers intentionally preserved (published marketplace slug + tool
contract): skill slug arquiteto-de-empresa, cs-arquiteto agent/command,
phase-dir slugs (00-fundacao..11-governanca), concept filename slugs.
A slug rename to English is a separate reversible decision.
Also fixes a pre-existing broken link in the example bundle (identidade.md
pointed at a nonexistent problema-solucao.md — the original pt-BR bundle
also failed the linter there) and trues up two stale README badges
(agents 97->99, commands 103->109) that were drifting on dev.
Validation: okf_linter --sample PASS, example-bundle lint PASS (0 errors),
py_compile clean, all 3 scripts --help ok, dual-publish mirror identical,
plugin/paths/counters/G9 gates all exit 0.
https://claude.ai/code/session_01CUWsrUNZP9jpxvAwq67UiT
Resolves the import-placement asymmetry flagged across review rounds by
moving the remaining inside-guard import (argparse) up to join sys at the
file-level import block.
https://claude.ai/code/session_01CUWsrUNZP9jpxvAwq67UiT
Adds FileNotFoundError / JSONDecodeError / missing-key handling to
team_scaling_calculator's input_file path, matching the other five
sample-pattern tools (pre-existing gap, surfaced by review).
https://claude.ai/code/session_01CUWsrUNZP9jpxvAwq67UiT
Hoists the embedded defaults to SAMPLE_CURRENT_STATE / SAMPLE_GROWTH_TARGETS
module constants so the loading flow can use the same top-of-branch
if/elif/else shape as the other five tools without duplicating the fixture.
The silent default-to-sample when no input is given is pre-existing,
documented behavior (kept; noted in the constant's comment).
https://claude.ai/code/session_01CUWsrUNZP9jpxvAwq67UiT
- incident_triage.py: --sample help text now documents the intentional
exit-2 SEV1 signal so &&-chained callers aren't surprised
- team_scaling_calculator.py: consolidate the split warn/load blocks into
the single if/else pattern the other five tools use
https://claude.ai/code/session_01CUWsrUNZP9jpxvAwq67UiT
- health_score_calculator + pipeline_analyzer: warn on stderr when --sample
overrides a provided input (now consistent across all six tools)
- pmf_scorer: --sample checked before --input (matches the batch), with the
same override warning
- pipeline_analyzer: comment the intentionally stale D-3 fixture deal
- contrast_checker: user-facing --sample help text
https://claude.ai/code/session_01CUWsrUNZP9jpxvAwq67UiT
- team_scaling_calculator.py: move sys import to the file-level import block
(was inline in the conditional); behavior unchanged
- incident_triage.py: warn on stderr when --sample overrides a provided
--input, matching team_scaling_calculator's convention
https://claude.ai/code/session_01CUWsrUNZP9jpxvAwq67UiT
- pmf_scorer.py: the no-input fallback notice now goes to stderr, so a bare
`pmf_scorer.py --json` emits parseable JSON on stdout
- team_scaling_calculator.py: warn on stderr when --sample overrides a
provided input_file instead of silently discarding it
https://claude.ai/code/session_01CUWsrUNZP9jpxvAwq67UiT
Brings G9 JSON-output coverage from 19 to 25 tools (25/25 verified):
- business-growth: health_score_calculator (embedded 2-customer fixture),
pipeline_analyzer (embedded 4-deal pipeline fixture)
- c-level-advisor: pmf_scorer (--sample flag for its existing sample_data(),
suppressing the stdout notice that corrupted JSON piping),
team_scaling_calculator (--sample flag for its embedded defaults)
- engineering-team: incident_triage (embedded synthetic ransomware event),
contrast_checker (--sample as alias of the existing --demo)
Required-arg behavior unchanged when --sample is absent (still exits 2 with
a usage error). All gates green: G9 25/25, G8, dual-publish, path linter.
Together with the 5 #654-named tools, 4 JSON-honor fixes, and the pre-existing
sample-pattern tools, more than 20 tools now support the embedded-sample
convention — meeting #654's acceptance bar.
https://claude.ai/code/session_01CUWsrUNZP9jpxvAwq67UiT
World-class, in-depth Chief AI Officer skill covering 4 specific decisions
(not a generic AI strategy survey):
1. Should we use an API, fine-tune, or build our own? (3-yr TCO + breakeven)
2. Is this AI use case high-risk under regulation? (EU AI Act + US state +
industry overlays with Article-level citations)
3. When do we switch from API to self-hosted, and at what cost? (2026
pricing + GPU economics + hidden costs)
4. What AI role do we hire next? (5-stage map + 9-role definition table)
Built under karpathy-coder discipline (third in a row):
- Assumptions surfaced upfront before code (principle 1)
- Each tool/reference covers ONE decision; rejected generic-survey scope (#2)
- Surgical changes only; no scope creep (#3)
- All 3 tools smoke-tested with embedded samples before commit (#4)
- karpathy/complexity_checker.py: 0 findings on 3 new tools
- karpathy/diff_surgeon.py: 0 findings on staged diff
3 stdlib Python tools with deterministic logic:
- model_buildvsbuy_calculator.py — Returns API/FINE_TUNE/BUILD recommendation,
3-year TCO across 6 paths, breakeven analysis. Balances economic crossover
with practical feasibility (data availability, ML team capacity, compliance).
Embedded sample (B2B customer support, 4M queries/mo) -> API recommended
despite breakeven crossed, because no fine-tune data + 1-engineer ML team.
- ai_risk_classifier.py — Returns EU AI Act tier (PROHIBITED/HIGH/LIMITED/
MINIMAL) with 7 Article citations + US state triggers (NYC LL 144, CO AI
Act, IL HB 53, CA SB 1001, IL BIPA) + industry overlays (FDA, CFPB, NAIC,
ECOA, Fed SR 11-7). Sample (AI hiring in EU+NY+CO+IL+CA) -> HIGH,
conformity required, 3 US triggers, 14 controls.
- ai_cost_economics.py — Returns API costs (3 tiers) + self-hosted costs (low/
mid/high GPU rates with 24/7 warm + ops attribution) + breakeven analysis.
Reveals key insight: self-hosted floor makes API economics dominate at
typical B2B SaaS scale. Sample (5M tokens/day, 750M/mo) -> API at $1,500/mo
beats self-hosted at $13,450/mo by 9x; breakeven at 6.7B tokens/mo.
4 in-depth references, each citing 5+ authoritative sources:
- model_buildvsbuy_strategy.md — 3 paths with failure modes, 6 fine-tuning
approaches ranked by cost (RAG/LoRA/full FT/RLHF/DPO/continued pre-training),
decision tree, eval-first discipline. Cites Anthropic/OpenAI/Google/Meta
model cards, LoRA paper, RLHF paper, DPO paper, Stanford CRFM Foundation
Models report, Foundation Models and Fair Use (Henderson et al.).
- ai_risk_governance.md — Full EU AI Act tier map (Art. 5 prohibited, Art. 6
+ Annex III high-risk, Art. 50 limited-risk) with all 8 high-risk domains
+ 11 obligation articles. NIST AI RMF 1.0. US state patchwork (9 laws).
Industry overlays (FDA AI/ML, CFPB, NYDFS, NAIC). 10-item governance
program checklist. When-to-hire-AI-counsel criteria.
- ai_cost_economics.md — 2026 API pricing (4 tiers), GPU rental (A100/H100/
H200/B200), throughput estimates, GPU count by model size, utilization
reality (20-80%), 6 hidden costs of self-hosted, 6 hidden costs of API,
migration cost, prompt caching as economics lever. Cites vLLM paper,
DistServe, HELM, Artificial Analysis.
- ai_team_org_evolution.md — 5-stage role map (pre-seed -> late-stage),
9-role definition table (AI engineer != ML engineer != research scientist),
AI team vs data team contrast (8 dimensions), 7 anti-patterns, hiring
sequencing rule. Cites Huyen "Designing ML Systems" + "AI Engineering",
State of AI Report.
cs-caio-advisor agent (c-level-agents/agents/cs-caio-advisor.md):
- Eval-demanding realist voice
- Hard rule: does not duplicate engineering AI/ML skills (rag-architect,
agent-designer, prompt-governance, self-eval, llm-cost-optimizer)
- Treats every AI use case as a hiring decision; pushes back on AI hype
/cs:caio-review slash command:
- 6-question forcing interrogation: eval set, hallucination SLO, regulatory
tier, model selection, cost trajectory, role-that-unblocks
- Routes to /cs:cdo-review, /cs:gc-review, /cs:ciso-review, /cs:cfo-review,
/cs:chro-review
cs-caio-advisor voice spec added to persona-voices.md.
Updates:
- c-level plugin.json: v2.5.2 -> v2.5.3 (31 skills, 11 cs-* agents)
- c-level-agents plugin.json: v1.2.0 -> v1.3.0 (11 agents, 19 commands)
- marketplace.json: both c-level entries; new CAIO keywords (chief-ai-officer,
caio, ai-strategy, model-buildvsbuy, eu-ai-act, ai-cost-economics)
- c-level CLAUDE.md: CAIO row added; agent + count tables updated
- Root CLAUDE.md: 265->266 skills, 30->31 cs-* agents, 364->367 tools,
494->498 references, 51->52 commands; v2.5.3 highlight section
- CHANGELOG.md: v2.5.3 entry with full rationale
Known follow-up (out of scope this PR): cs-general-counsel-advisor voice spec
still missing from persona-voices.md (carried from v2.5.1); separate PR.
Disclaimer in every output: not legal advice; not a replacement for AI
counsel on EU AI Act conformity; not a tactical AI/ML engineering skill.
https://claude.ai/code/session_012WtZMm5NJHqkYoRqA9fHMN
Closes the gstack-can't-touch lane: gstack has zero legal coverage; this is
the first plugin in the founder-mode lineup to outclass it on a domain it
doesn't even attempt. Legal exposure is where startups most often discover a
problem after it's expensive to fix.
New skill (c-level-advisor/skills/general-counsel-advisor/):
- SKILL.md with 4 workflows (contract review, term sheet response, IP hygiene
audit, regulatory trigger assessment), keywords, output standards
- scripts/contract_risk_scanner.py — scans contract text for 12 founder-killer
patterns (auto-renew traps, uncapped indemnity, vague IP, aggressive
non-compete, missing DPA when personal data flows, MFN pricing, perpetual
license-back, one-sided force majeure/venue/audit, broad non-solicit).
Stdlib-only, JSON+text output, --help. Smoke-tested: 7 findings on embedded
sample MSA across CRITICAL/HIGH/MEDIUM.
- scripts/term_sheet_analyzer.py — scores term sheet 0-100 across 12 dimensions
(liquidation preference, anti-dilution, option pool pre/post-money, board,
vesting, pro-rata, drag-along, protective provisions, info rights, dividends,
valuation, holistic). Stdlib-only, JSON-input + JSON+text output, --help.
Smoke-tested: founder-friendly Series A sample scores 94/100.
- references/contracts_playbook.md — 7 startup contract types with top redlines
- references/ip_and_regulatory.md — IP strategy + regulatory trigger matrix
(HIPAA/GDPR/FDA/fintech/AI Act) + SOC 2 -> ISO sequencing
- references/term_sheet_decoder.md — full glossary, founder-friendly defaults,
the 3 clauses that matter most, negotiation strategy
New agent (c-level-advisor/c-level-agents/agents/cs-general-counsel-advisor.md):
- Risk-paranoid persona orchestrating the skill
- Voice: "Before we sign, three things need to be settled in writing."
- Hard rule: never substitutes for licensed counsel; always escalates
Updates:
- /cs:gc-review SKILL.md: now points at the real skill + tools (was a planned-
skill placeholder before)
- c-level-advisor/.claude-plugin/plugin.json: v2.5.0 -> v2.5.1, description
updated to 29 skills (was 28)
- c-level-advisor/c-level-agents/.claude-plugin/plugin.json: v1.0.0 -> v1.1.0,
9 cs-* agents (was 8)
- marketplace.json: both c-level entries bumped, +contract-review, +term-sheet,
+ip-strategy keywords
- c-level-advisor/CLAUDE.md: General Counsel added to roles table; agents and
counts updated
- Root CLAUDE.md: 263 -> 264 skills, 28 -> 29 cs-* agents, 359 -> 361 Python
tools, 487 -> 490 references; v2.5.1 highlight section added
- CHANGELOG.md: full v2.5.1 entry with rationale
Disclaimer: every tool/reference/agent output reminds users this is not legal
advice; always engage qualified counsel. The skill is positioned as triage
before $500/hour counsel time, never as a substitute.
https://claude.ai/code/session_012WtZMm5NJHqkYoRqA9fHMN
Same root cause as #587/#591 — Claude Code's runtime loader rejects
array-form skills paths like ["./content-production", "./ai-seo", ...]
even when each entry is a valid subdirectory containing SKILL.md.
`claude plugin validate` accepts them but the loader does not.
The proven canonical layout (used by self-improving-agent in #536):
<plugin>/
├── .claude-plugin/plugin.json skills: "./skills"
└── skills/
├── <skill-1>/SKILL.md
├── <skill-2>/SKILL.md
└── ...
Restructured 9 multi-skill domain plugins:
- business-growth (4 skills moved)
- c-level-advisor (28)
- engineering (36)
- engineering-team (32)
- finance (2)
- marketing-skill (43)
- product-team (12)
- project-management (8)
- ra-qm-team (13)
Also fixed standalone plugins that had root SKILL.md + ./skills/ subdir
(agenthub, autoresearch-agent, executive-mentor, playwright-pro). The
loader rejected them despite skills="./skills" because of the conflicting
root SKILL.md (compare self-improving-agent which works because PR #536
moved its root SKILL.md). Moved each root SKILL.md into ./skills/<name>/.
Restored standalone plugin folders to their original paths after the
multi-skill restructure swept them into parent skills/ directories
(marketplace.json source paths require original locations).
Removed 7 orphaned marketplace entries that pointed to skill folders
without their own plugin.json (content-creator, demand-gen,
fullstack-engineer, aws-architect, product-manager, scrum-master,
skill-security-auditor) — these were already non-functional.
Bumped patch versions on every changed plugin and synced
marketplace.json. Marketplace now lists 29 working plugins (down
from 36).
After merge: users run `/plugin marketplace update claude-code-skills`
followed by `/plugin update --all` to pick up the working layout.
