feat(plugins): sync mattpocock/skills v1.2 learnings across five lanes

.claude-plugin/marketplace.json

@@ -492,6 +492,12 @@
           "hosts": ["x.com", "www.x.com", "twitter.com", "www.twitter.com", "mobile.twitter.com", "xtomd.com", "threadreaderapp.com"]
         }
       }
+    },
+    {
+      "name": "wizard",
+      "source": "./plugins/wizard",
+      "category": "development",
+      "tags": ["wizard", "setup", "provisioning", "credentials", "ci-secrets", "migration", "cutover", "bash", "skill"]
     }
   ],
   "renames": {

docs/CATALOG.md

@@ -39,6 +39,7 @@ plugin manifests and kept in sync by CI — never hand-edit it; the category voc
 - [`source-control`](../plugins/source-control) — Git and GitHub delivery workflow: /commit (Conventional Commits + Co-Authored-By trailer via safe heredoc mechanics), /pull-request (prep, create, CI monitoring, review-comment triage, merge, CI-log fetch), /babysit-prs (self-pacing fleet loop — safe by default; opt-in worker/autopilot tiers add gate-checked merge and thread resolution behind a deterministic Python engine), /babysit-loop (the loop-lane merge lane: a standing or drain loop that invokes babysit-prs per cycle, configured through repo-scoped babysit_loop_* keys on the layered source-control.md seam, with merge authority human-only until the target repo's tracked config adopts the lane, a gate-proven C2-mechanical baseline once adopted, and standing merge-rung raises binding from the team-tracked layer only — with one named exception, where an invocation line explicitly typing both the autopilot tier keyword and the dedicated raise argument --merge c3-this-run widens that single invocation's merge authority up to C3 behind a fresh independent frontier-tier resolver, while C4-structural and C5-untrusted-provenance stay unconditionally human-merge), /worktree (create, status, cleanup, audit for parallel-session isolation), /setup (check the effective commit-subject / PR-title convention merged across its config layers and the babysit-prs config, or apply — interview the repo and write the convention config to a chosen layer), and /resolve-conflicts (intent-first merge/rebase conflict resolution with a semantic-conflict sweep — never --abort). The commit-subject / PR-title convention is configurable via a source-control.md config written by a re-runnable setup skill, layered across a ~/.claude user-global file, the tracked team file, and a gitignored .claude/source-control.local.md personal overlay merged per key; Conventional Commits is the default when no convention is declared.
 - [`implementation`](../plugins/implementation) — Disciplined implementation stage: execute approved plans inline (`/implementation:implement`) or via orchestrated worker subagents (`/implementation:implement-dispatch`) with incremental validation, TDD-by-default cadence, green-checkpoint commits, scope-fence drift detection, and divergence detection that routes back to planning. Build/test/lint, testing, and outcome verification live in the companion `toolchain`, `testing`, and `verification` plugins, invoked when installed.
 - [`toolchain`](../plugins/toolchain) — Repo-agnostic polyglot verification toolchain: build + test + lint for changed files across .NET, Python, TypeScript, Bash, PowerShell, Markdown, Go, YAML, and cross-cutting surfaces (`/toolchain:check`, `/toolchain:lint`), plus a re-runnable `/toolchain:setup` with check (report the configured ecosystems and their command surface) and apply (interview, infer, and write the tracked per-ecosystem command config those skills resolve first).
+- [`wizard`](../plugins/wizard) — Generate an interactive bash wizard that walks a human, step by step, through the manual procedures an agent cannot perform — provisioning infrastructure or credentials, setting CI secrets, clicking through third-party dashboards, one-off migrations and cutovers. One skill, generate (/wizard:generate): the agent scopes the stages from the repo (reading key NAMES only from a live .env, never values), authors them onto a fixed hardened library (TTY-only fail-closed prompts, https-only URL opening, hidden secret entry, single-quoted 0600 .env upserts with a gitignore check, repo-confirmed gh secret/variable writes over stdin, names-only summary), prints the full STAGES block for explicit human approval BEFORE the script is made executable, and never runs the wizard itself — the human does, in their own terminal. Ephemeral by default: built for one run, committed only when the setup path should live in the repo. The generated script requires bash (Windows: Git Bash or WSL); gh is optional — CI-secret stages degrade to a visible warning plus a closing-summary entry when it is absent.
 
 ## Testing
 
@@ -56,7 +57,7 @@ plugin manifests and kept in sync by CI — never hand-edit it; the category voc
 - [`mcp-tools`](../plugins/mcp-tools) — Audits MCP server tool definitions against MCP-specification, Anthropic tool-design, and Claude-Code client criteria and reports a per-tool PASS/WARN/FAIL scorecard covering description, parameters, naming, and annotations. Language-agnostic — Python (mcp), TypeScript, and .NET.
 - [`review`](../plugins/review) — Code-review toolkit: six read-only reviewer agents (code, security, architecture, doc drift, build/test/lint, CI-log audit) plus two orchestration skills — a single-lens quality gate and a multi-surface review fan-out with severity-ranked, deduplicated findings.
 - [`codebase-health`](../plugins/codebase-health) — Repo-wide drift audit between docs, config, code, and architecture: verifies every factual claim against reality via parallel subagent fan-out, severity-rates findings, and reports read-only, delegating remediation to the implementation/verification lanes. Audit dimensions are configurable through a tracked .claude/codebase-health.md config file written by the setup skill.
-- [`discipline`](../plugins/discipline) — Discipline correctors that re-anchor a standing rule mid-session, then audit both the work in flight and the pre-existing state and choices it trusts, and correct what has drifted: do-your-research (research and no-assumptions discipline; sibling do-your-research-deep escalates to a typed full inventory of the session's claims — assumptions, asserted facts, concrete specifics, load-bearing premises — verified at a configurable depth and reported as a per-item ledger), follow-our-standards (alignment to the consuming org's engineering conventions), point-dont-copy (pointer-over-copy discipline — no copied content, internal-name coupling, or closed capability lists), reason-dont-recite (interrogate inherited content — precedent is evidence of what is, never self-justifying authority), tighten-your-output (terseness discipline — fewer words or lines with no loss of meaning or correctness), recheck-against-upstream (existing state is not evidence of its own correctness — audit config, code, and infra against current official upstream docs; sibling recheck-against-upstream-deep fans subagents doc-by-doc over a whole subsystem), pick-for-the-problem (tool, library, framework, and approach selection fitted to the problem, not reached for out of habit, availability, incumbency, or preconception), mind-your-maxims (cooperative-communication discipline per Grice plus the AI-augmented transparency maxim), script-the-deterministic-work (offload deterministic sub-work — counts, diffs, sorts, transforms, and scaffolds — to a script that runs, reserving model output for judgment over its real output; the audit runs both ways, also catching an existing script that over-reaches into judgement), use-your-skills (actually use the skills already in context — scan the listing, map the task, invoke the fitting skill instead of reinventing it, and name skills when delegating to a subagent), and reuse-or-replace (anti-fragmentation — new work reuses an established way of doing something or openly replaces it (migrate the old uses, record the decision), never silently stands up a second parallel way; divergence is allowed but owes a recorded reason proportional to blast radius), and scrutinize-dont-coast (adversarial self-scrutiny — stop coasting on your own recent output and re-examine whether it is sound, not merely confidently produced, through a fresh-context pass blind to the reasoning that made it, then remediate with the user; it stops the trajectory first and remediates collaboratively rather than autonomously). Plus sweep-all, a posture-batch runbook — not a corrector but a declared second species that composes them: it fans out an audit-only subagent per in-scope corrector, then applies the corrections on the main thread in a fixed order, with batch membership and order set by each corrector's own colocated tier metadata and an optional userConfig overlay. Firing one is a re-anchor, not an accusation; the audit may return clean.
+- [`discipline`](../plugins/discipline) — Discipline correctors that re-anchor a standing rule mid-session, then audit both the work in flight and the pre-existing state and choices it trusts, and correct what has drifted: do-your-research (research and no-assumptions discipline; sibling do-your-research-deep escalates to a typed full inventory of the session's claims — assumptions, asserted facts, concrete specifics, load-bearing premises — verified at a configurable depth and reported as a per-item ledger), follow-our-standards (alignment to the consuming org's engineering conventions), point-dont-copy (pointer-over-copy discipline — no copied content, internal-name coupling, or closed capability lists), reason-dont-recite (interrogate inherited content — precedent is evidence of what is, never self-justifying authority), tighten-your-output (terseness discipline — fewer words or lines with no loss of meaning or correctness), recheck-against-upstream (existing state is not evidence of its own correctness — audit config, code, and infra against current official upstream docs; sibling recheck-against-upstream-deep fans subagents doc-by-doc over a whole subsystem), pick-for-the-problem (tool, library, framework, and approach selection fitted to the problem, not reached for out of habit, availability, incumbency, or preconception), mind-your-maxims (cooperative-communication discipline per Grice plus the AI-augmented transparency maxim), script-the-deterministic-work (offload deterministic sub-work — counts, diffs, sorts, transforms, and scaffolds — to a script that runs, reserving model output for judgment over its real output; the audit runs both ways, also catching an existing script that over-reaches into judgement), use-your-skills (actually use the skills already in context — scan the listing, map the task, invoke the fitting skill instead of reinventing it, and name skills when delegating to a subagent), and reuse-or-replace (anti-fragmentation — new work reuses an established way of doing something or openly replaces it (migrate the old uses, record the decision), never silently stands up a second parallel way; divergence is allowed but owes a recorded reason proportional to blast radius), and scrutinize-dont-coast (adversarial self-scrutiny — stop coasting on your own recent output and re-examine whether it is sound, not merely confidently produced, through a fresh-context pass blind to the reasoning that made it, then remediate with the user; it stops the trajectory first and remediates collaboratively rather than autonomously). Plus two declared further species that are not correctors: sweep-all, a posture-batch runbook that composes them — it fans out an audit-only subagent per in-scope corrector, then applies the corrections on the main thread in a fixed order, with batch membership and order set by each corrector's own colocated tier metadata and an optional userConfig overlay — and wait-what, a one-shot user-invoked-only communication repair: type /discipline:wait-what when the last message did not land and the model re-pitches it, backing up as far as needed, adding the missing context, in ASD-STE100 Simplified Technical English, using the project's ubiquitous language; never model-invoked and never in the batch. Firing a corrector is a re-anchor, not an accusation; the audit may return clean.
 
 ## Maintenance
 

docs/MIGRATION-PLAYBOOK.md

@@ -1108,6 +1108,66 @@ that is labeled advisory.
 pre-approval, shipping the deferred validating `PreToolUse` hook, or adding an MCP surface each
 re-opens this review.
 
+### Review record — `wizard` (ACCEPT, 2026-08-09)
+
+Reviewed at `0.1.0`; a version bump adding a new trust surface re-triggers this review. Ported
+from mattpocock/skills v1.2.3 (`main@84fdeff`, MIT), hardened; provenance SSOT
+`docs/upstream/mattpocock-skills.md`. The weight here is a surface no prior record carries: the
+plugin's **product is a model-generated executable**. The statusline-shim delta review (above)
+accepted an executable write precisely because it was "a byte-identical copy of a reviewed,
+tested, bundled script — no generation, no templating". This plugin deliberately breaks that
+precedent: the skill's whole capability is authoring per-procedure stages onto a bundled
+library. That is accepted here as an explicit, recorded exception with the mitigations below —
+not a quiet widening of the shim rationale.
+
+- **Code execution (1). The generated-executable surface, accepted with layered conditions.**
+  No hooks, no `bin/`, nothing event-wired; the plugin ships prompt artifacts plus one bundled
+  bash template. The trust argument for generation, layered:
+  - **The agent authors; it never executes.** The skill forbids running the wizard end-to-end
+    (verification is `bash -n`/`shellcheck` plus a fresh-context static trace); the human runs
+    the script in their own terminal. The template enforces the same doctrine mechanically —
+    it aborts without a controlling TTY (`exec 3</dev/tty`, fail-closed), so neither an agent
+    nor piped/pasted input can drive its gates.
+  - **A human reads before anything is runnable.** The skill's verify step is stop-the-line:
+    the full `STAGES` block is printed to the user and explicitly approved BEFORE `chmod +x`
+    and before any run instruction. The generated content a human is asked to trust is exactly
+    the content they are made to read.
+  - **The generated region is bounded.** Model-authored content goes only below the `STAGES`
+    marker; the library above it is fixed, reviewed here, and never hand-edited. Stage authoring
+    composes reviewed helpers whose dangerous edges are hardened in the library itself:
+    https-only `open_url` with the URL printed before dispatch (also closing a Windows UNC/NTLM
+    leak via the `explorer.exe` branch); fail-closed `pause`/`confirm` (fatal on read failure,
+    never `|| true`); key-name validation in every helper; single-quoted escaped `.env` values,
+    `chmod 600` after every write, a gitignore assert, trap-cleaned same-filesystem mktemp;
+    gh writes that resolve/echo/confirm the target repo before the first write, pass explicit
+    `--repo`, pipe values via stdin (`set_secret` pipe, `set_var --body-file -`), refuse empty
+    values, and surface stderr into the closing summary.
+- **MCP servers (2).** None.
+- **Consumer config (3).** No `userConfig`, no tracked config surface; setup-skill exemption
+  recorded in the plugin README ((a)/(b)/(c) all absent for generation itself).
+- **Cache isolation (4).** The skill references only its own bundled `template.sh` relatively;
+  generated wizards are written into the consumer's project or scratch space at the user's
+  direction, which is the deliverable, not a reach-out. No `../`, no constructed absolute paths.
+- **Data egress (5).** None by the plugin. The generated script's egress is operator-visible and
+  operator-driven: browser opens of https URLs printed before dispatch, and `gh` writes to a
+  repo the human explicitly confirmed. Captured values flow terminal → `.env`/`gh` only; the
+  closing summary prints names, never values. The skill's scoping step reads key NAMES only from
+  a live `.env`, and states honestly that a value pasted into chat is in context.
+- **Provenance & third-party trust (6).** Derived from mattpocock/skills (MIT) with the
+  hardening deltas recorded in the plugin CHANGELOG; authored/maintained first-party (Melodic
+  Software), MIT. No third-party service is wired: `gh` is the consumer's own authenticated CLI,
+  optional, degrading to warn + summary when absent.
+- **Main-thread / PATH (7).** None; no `settings.json` `agent`, no plugin `bin/`.
+
+**Verdict: ACCEPT** — surfaces 2/3/7 absent; 1 is the recorded model-generated-executable
+exception, bounded to the below-the-marker region and gated by the mandatory human
+read-and-approve before `chmod +x`, with the library's fail-closed hardening as defense in
+depth; 4 conforms; 5 is operator-driven with names-only output; 6 first-party over an MIT
+upstream. **Conditions shipped, load-bearing for this ACCEPT:** the human STAGES approval gate,
+the agent-never-executes instruction, the TTY-only fail-closed library, https-only `open_url`,
+and the hardened `.env`/gh write path. Removing or weakening any of them re-opens this review,
+as does any move to have the agent execute a generated wizard.
+
 ## Local development loop
 
 For a plugin that already ships here, iterate against your local clone without re-publishing and

docs/PLUGIN-PHILOSOPHY.md

@@ -60,7 +60,7 @@ topic qualifier follows the verb with a hyphen (`audit-noise` beside `audit-enca
 `scan-todos` under `work-items`); the verb keeps its fixed meaning from the table.
 
 Nouns are reserved for knowledge routers (`principles`, `methodology`) and lifecycle-object routers
-(`worktree`, `pull-request`). Five further documented exceptions: a single-skill vendor-CLI wrapper
+(`worktree`, `pull-request`). Six further documented exceptions: a single-skill vendor-CLI wrapper
 repeats its tool name (`firecrawl:firecrawl`); a `-deep` suffix marks the heavier
 isolated-execution tier of a sibling skill (`research`/`research-deep`); a knowledge router named by
 its method's own literature term keeps that term when renaming would destroy recognized craft
@@ -70,7 +70,12 @@ content's identity (`playbooks:boris`, `playbooks:fable-5` — one scheme, perso
 and an object-pronoun qualifier is kept when the skill's defining boundary IS that the object under
 test is the user themself (`education:quiz-me` — the `-me` distinguishes quizzing the human on
 completed work from teach's in-workspace content quizzing, where a bare `quiz` would under-specify
-the object the grammar normally delegates to the namespace).
+the object the grammar normally delegates to the namespace); and an upstream utterance-interjection
+is kept when the skill is a port whose typed phrase IS the mechanism — the user's own words at the
+moment of use — and the upstream name carries cross-repo muscle-memory parity
+(`discipline:wait-what` — the lost reader's literal interjection; an imperative paraphrase destroys
+the zero-translation recall the command depends on precisely when its user is, by definition, lost,
+and orphans users arriving from the upstream repo).
 Every exception is an entry on this list, decided per name — a name class is never
 blanket-sanctioned.