Skip to content

docs(plugins): normalize operative cross-skill chains to explicit Skill-tool phrasing - #3070

Merged
kyle-sexton merged 7 commits into
mainfrom
claude/pocock-steering-course-00zkvd
Aug 21, 2026
Merged

docs(plugins): normalize operative cross-skill chains to explicit Skill-tool phrasing#3070
kyle-sexton merged 7 commits into
mainfrom
claude/pocock-steering-course-00zkvd

Conversation

@kyle-sexton

Copy link
Copy Markdown
Contributor

Closes #3002

Summary

Lane 6 of the AI Hero course vetting adopted the cross-skill invocation-phrasing doctrine
(docs/conventions/invocation-mode/README.md, "Cross-skill invocation phrasing"), but could only
scope it to new and edited skill text because the fleet's existing practice was mixed. This is the
sweep that retires that scoping.

Operative cross-skill hand-offs across plugins/*/skills/** and plugins/*/agents/** now name the
mechanism explicitly — "invoke /plugin:skill via the Skill tool" — and the rubric's scope becomes
unconditional. Wording only: every presence gate, fallback, threshold and step order is preserved.
The two offenders the issue named as calibration cases (knowledge:map-corpus,
knowledge:docpage-digest) are among them.

Enumeration was mechanical, then hand-classified. Mentions were deliberately left alone — identity
and ownership statements, "Related skills" lists and capability catalogs, verdict annotations, text
that explicitly recommends to the human rather than invoking, emitted templates and eval fixtures,
and any chain whose target is disable-model-invocation: true (unreachable from a skill under the
rubric's own invocation-reach invariant). Each keep class is recorded in the touched plugin's
CHANGELOG.

Fix

  • Retire the scoping. docs/conventions/invocation-mode/README.md — "this binds NEW and EDITED
    skill text" becomes "Scope: unconditional." Adds the operative-vs-mention test the sweep ran
    on, so the next author has the rule rather than the precedent. docs/upstream/aihero-course.md
    gains the matching retirement sentence, with its historical wording left intact so the lane record
    survives.

  • Rewrite the operative chains. Notable: the knowledge pipeline's queue and interview hand-offs;
    implementation's dispatch cadence; planning's design→plan gate, stress-test dispatch and
    research iteration; verification:confirm's delegation set; docs-hygiene:extract-ssot's rename
    sweeps. Multi-row composition tables name the mechanism once in a preamble rather than in every
    cell.

  • A /plugin:name token is not automatically a skill. New rubric subsection, because the sweep
    hit it: /codex:review and /code-review:code-review are slash commands from upstream
    marketplaces, not Skill-tool-reachable skills, so text directing them stays as written. Verified
    against the upstream sources rather than inferred — openai/codex-plugin-cc ships
    plugins/codex/commands/review.md (itself disable-model-invocation: true), and
    anthropics/claude-plugins-official ships plugins/code-review/commands/code-review.md with no
    skills/ directory at all. /caveman:compress is the opposite case — a real skill — so it takes
    the phrasing.

  • Enforcement decision: declined, and recorded with a regenerable measurement. No
    skill-quality:check criterion. skill-quality/fleet: enforce the invocation-mode rubric — explicit disable-model-invocation on 17 skills, check criterion, skill-authoring pointer #2968's check 24 is the explicit-key criterion, a different axis.
    A static scan cannot separate an operative chain from a mention, and that separation is the whole
    rule. The rubric now commits the two shell commands that produce its figures beside them, so any
    reader can regenerate the pair rather than trusting it. playbooks:skill-authoring gains an
    authoring-time pointer, which is where the rule is decidable.

  • claude-ops:morning-brief gains its first eval suite. The sweep touched its SKILL.md, and
    check-changed-skills.sh runs with --require-evals. Seven cases pin the shipped contract
    (run-the-script-and-print-verbatim, the read-only refusal, repo resolution, per-section
    degradation, the two authority route-outs, the post-merge timestamp discriminator).

  • Pre-existing bug fixed in passing. plugins/claude-ops/skills/morning-brief/scripts/morning-brief.sh
    called fetch_repo_label_names at line 221 but defined it at line 337, so that call died with
    command not found and two of the skill's own tests had been failing. This reproduces unchanged
    on main and is not caused by this diff
    — it is fixed here because it lives in a shipped script,
    in a plugin this PR already bumps, in the very skill this PR adds evals for. morning-brief.test.sh
    goes from exit 1 (2 failing cases) to exit 0 (all 83 passing).

Verification

Every gate below was confirmed green on the base commit before this work landed, so any failure
would be attributable to this diff. All re-run on the final merged tree:

Gate Result
scripts/validate-plugins.sh exit 0
generate-catalog.mjs --check / generate-cheatsheet.mjs --check exit 0 (no frontmatter touched, so no regeneration due)
check-changelog-parity.sh--check, --check-order, --check-bump, --check-preserved exit 0; all changed changelogs preserve every prior heading
check-changed-skills.sh origin/main exit 0
markdownlint-cli2 over 139 changed .md 0 issues
typos exit 0
skill-quality/scripts/check-skill.test.sh exit 0
morning-brief.test.sh exit 0, all 83 cases (was exit 1)
check-jsonschema + check-evals-quality.sh on the new evals.json exit 0, PASS (0 warnings)

Three independent fresh-context audits were run against the landed tree, each with the author's
rationale withheld, and their findings fixed:

  1. Classification and completeness — found 5 mentions wrongly rewritten (including a skill
    instructed to invoke itself), 4 sites where a named-step citation had been converted into a
    whole-skill invocation creating a re-entry loop, and 12 missed operative sites.
  2. Release mechanics and the new eval suite — changelogs proven insert-only by a zero-deletion
    git diff --numstat check across every changed file; all 7 eval cases traced by hand to shipped
    behavior; found 6 further misses and the stale aihero-course.md mirror.
  3. Remediation audit — confirmed the reverts are byte-identical to main where they should be,
    reproduced the committed measurement to the digit, and found 3 residual bare chains
    (planning:design-handoff ×2, coupling:reduce, work-items:work) which are now fixed.

Two audit findings were disputed with evidence and deliberately not applied:
testing:diagnose:42 and review:quality-gate's downstream route both sit under column headers
literally reading Suggest / "not executed here", so rewriting them would have manufactured fresh
false positives of exactly the class audit 1 was catching. The third audit independently agreed with
both calls.

Related

Refs #2968 (check 24 — the explicit-key criterion this decision coordinates with, different axis)
Refs #2994 (AI Hero course journey roadmap)


Generated by Claude Code

@claude

claude Bot commented Aug 21, 2026

Copy link
Copy Markdown
Contributor

Claude finished @kyle-sexton's task in 1m 8s —— View job


Security review (/review:security-review)

  • Gather context (read repo instructions, PR diff)
  • Invoke /review:security-review skill
  • Post findings

Skip gate triggered — no security-relevant surface.

Per /review:security-review's skip gate, I read the full diff (git diff origin/main...HEAD, 176 files, +944/-270) before deep review:

  • 99% of the diff is markdown wording changes across plugins/*/skills/**/SKILL.md, CHANGELOG.md, and reference docs — normalizing cross-skill hand-off phrasing to name the Skill tool explicitly. No executable logic, no trust boundaries, no user input handling.
  • Every .claude-plugin/plugin.json change is a version-string bump only.
  • The one shell script touched, plugins/claude-ops/skills/morning-brief/scripts/morning-brief.sh, moves the fetch_repo_label_names/label_exists_in_repo function definitions earlier in the file (fixing a pre-existing "defined after first call" bug) plus two whitespace-only condition reformats. Function bodies are byte-identical to what already shipped — no new gh/jq invocation shape, no new input source, nothing exploitable introduced.
  • The new plugins/claude-ops/skills/morning-brief/evals/evals.json is static eval fixture data, not executed code.
  • No .github/workflows/** files, no permission/config changes, no dependency or action-pin changes are in this diff.

No CRITICAL / IMPORTANT / SUGGESTION findings — this PR has no security-relevant surface, so per the skill's skip gate I'm stopping here rather than manufacturing findings.

@github-actions

github-actions Bot commented Aug 21, 2026

Copy link
Copy Markdown

Last security-reviewed head: 3f29d221ed497f1b9b3bf4548e47f415f26ee14b. On the next push, the relevance gate compares only the commits since this SHA; delete this comment to force a full re-review.

@claude

claude Bot commented Aug 21, 2026

Copy link
Copy Markdown
Contributor

Claude finished @kyle-sexton's task in 3m 20s —— View job


CI code review (/review:code-review)

  • Gather context (PR body, changed files list, custom instructions)
  • Invoke /review:code-review skill and follow its instructions
  • Analyze diff against origin/main (176 files, 944/-270, matches PR stats)
  • Post inline findings
  • Post summary comment

Skip gate: not applicable — PR is open, not a draft, and this is the sweep's substantive first review.

What I checked

  • The one real functional change: plugins/claude-ops/skills/morning-brief/scripts/morning-brief.shfetch_repo_label_names moved ahead of its first call site (was defined at the old line 337, called at line 221/246). Confirmed by reading the script: the function now sits at line 210, first called at line 246 — the fix is correct.
  • plugins/claude-ops/skills/morning-brief/evals/evals.json — 7 cases, structurally sound, and each one's expectation traces to a corresponding line in the sibling SKILL.md (verified the cross-references section and "What this skill does NOT do" match evals 5/6 verbatim).
  • docs/conventions/invocation-mode/README.md — the core policy rewrite. Traced the "operative vs. mention" test against several rewritten sites (knowledge:map-corpus, knowledge:docpage-digest, implementation:implement-dispatch) — phrasing is correct and the self-invocation-loop case in implement-dispatch's "Prerequisites" section is handled properly (enumerated in place rather than invoking the skill that chains back to it).
  • CHANGELOG insert-only claim: ran git diff origin/main...HEAD --numstat -- '*CHANGELOG.md' myself — every changed changelog shows 0 deletions, across all 34 files. Confirms this specific verification claim independently.
  • I could not independently run morning-brief.test.sh, check-changelog-parity.sh, markdownlint-cli2, typos, or the other gates the PR table claims — this lane's tool grants don't extend to executing arbitrary scripts. Those results are author-claimed and unverified by me.

Finding (posted inline)

One inline comment on docs/conventions/invocation-mode/README.md:132 — the committed regenerable measurement (1,634 lines / 186 operative / 88.6% false-positive) is stale on this same branch. Re-running the two grep commands the doc gives immediately above that line reproduces the same denominator (1,634) but a different numerator: 189, not 186 (~88.4% false-positive, not 88.6%). Root cause: commit 6fcb34f ("close the three residual bare operative chains") landed after the paragraph was last written and added 4 more "via the Skill tool" sites (planning:design-handoff ×2, coupling:reduce, work-items:work) without updating the recorded count. Since the PR's stated rationale for committing these commands is so a reader can regenerate the pair rather than trust it, this is worth a quick fixup before merge.

No other high-signal correctness issues found across the sampled wording sites, the bug fix, or the eval suite.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 63888c1236

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread plugins/codebase-health/skills/audit/SKILL.md Outdated
Comment thread docs/conventions/invocation-mode/README.md Outdated
@github-actions

github-actions Bot commented Aug 21, 2026

Copy link
Copy Markdown

Claude has reviewed this PR 3 times. The lane skips further automatic reviews after 5; deleting this comment resets the count.

kyle-sexton pushed a commit that referenced this pull request Aug 21, 2026
…efresh the measurement (#3002)

Two review findings from PR #3070.

codebase-health:audit — the sweep rewrote the "Route remediation to the
dedicated lanes" preamble into a Skill-tool invocation, but the --fix
paragraph four lines below requires "an explicit user-directed suggestion"
and says "Do NOT auto-invoke either skill — the user drives both". A
read-only audit could have launched the source-editing implementation lane.
Reverted to the recommendation form; the CHANGELOG now records why that
route is a mention rather than an operative chain.

The rubric's committed measurement went stale against its own tree: commit
6fcb34f added four "via the Skill tool" sites after the paragraph was last
written, and this commit's revert removes one. Re-measured on the final
merged tree: 1,635 lines carry the token, 189 are operative, 88.4% false
positives. Both copies updated — the rubric and the skill-quality CHANGELOG.
The two grep commands beside the figures reproduce them exactly.
@claude

claude Bot commented Aug 21, 2026

Copy link
Copy Markdown
Contributor

Claude finished @kyle-sexton's task in 4m 13s —— View job


CI code review (/review:code-review)

  • Gather context (PR body, changed files list, custom instructions)
  • Invoke /review:code-review skill and follow its instructions
  • Analyze diff against origin/main (179 files, +948/-322 at current HEAD 3f29d22)
  • Post inline findings (none — see below)
  • Post summary comment

What changed since the last review pass on this lane

The last full review ran at 63888c1. Since then, two commits landed that fix the two findings raised by the prior passes:

  • 8a83e2d reverts plugins/codebase-health/skills/audit/SKILL.md's remediation preamble back to a recommendation — this resolves Codex's P2 finding that the --fix gate's "Do NOT auto-invoke either skill" (lines 271-274) contradicted a Skill-tool-invocation rewrite four lines above it. Verified: lines 271-274 in the current tree still read "Do NOT auto-invoke either skill — the user drives both," and the preamble above it is back to plain recommendation phrasing.
  • 8a83e2d also refreshes the regenerable measurement in docs/conventions/invocation-mode/README.md — this resolves my prior stale-count inline finding. I re-ran both committed grep commands myself on the current HEAD and reproduced 1,635 / 189 / 88.4% exactly as now recorded (previously 186/88.6% was stale).
  • 3f29d22 drops a duplicate blank line in plugins/review/CHANGELOG.md (MD012). Cosmetic, correct.

What I checked on this pass

  • plugins/claude-ops/skills/morning-brief/scripts/morning-brief.sh — confirmed fetch_repo_label_names/label_exists_in_repo now sit ahead of their first call site (was the "defined after first call" bug), and the two brace-spacing changes are whitespace-only. Read the whole diff; correct.
  • evals/evals.json (7 cases) — traced each expected_output/expectations against the sibling SKILL.md by hand (queues/merge-ready/decisions/telemetry/stranded-findings sections, the read-only guarantee, gh repo view derivation, and the two "invoked via the Skill tool" route-outs to babysit-prs and observability). All 7 trace to shipped content.
  • Self-invocation-loop handling — spot-checked implementation:implement-dispatch: its "Prerequisites" section correctly enumerates /implementation:implement's Step 1 criteria in place rather than invoking that skill, with an explicit note that Step 0 of implement chains back here (would re-enter). The Step 3/Step 4 citations elsewhere in the same file are left as named-step citations (not rewritten to "invoke via Skill tool"), consistent with avoiding the same loop.
  • The two disputed-and-declined audit findings — verified both are still correctly left bare: testing:diagnose recommends /implementation:implement fix and /verification:confirm under a Handoff table literally headed "Suggest" (line 39 of plugins/testing/skills/diagnose/SKILL.md). No case found where a Suggest/non-executed route was wrongly converted.
  • CHANGELOG consistencyplugins/codebase-health/CHANGELOG.md (0.8.1) and plugins/skill-quality/CHANGELOG.md (0.17.3) entries match their respective .claude-plugin/plugin.json version bumps, and both record the refreshed 1,635/189/88.4% figures consistently with the rubric doc.

I could not independently run morning-brief.test.sh, check-changelog-parity.sh, markdownlint-cli2, typos, or the other gates in the PR's verification table — this lane's tool grants don't extend to executing arbitrary scripts. Those results remain author-claimed and unverified by me.

Result

No CORRECTNESS or MAINTAINABILITY findings on this pass. Both issues raised by the prior review round (Codex's P2 and my own stale-measurement comment) are fixed in 8a83e2d, and the fixes are correct and consistent with the rest of the tree.

claude added 4 commits August 21, 2026 07:47
…ll-tool phrasing

Sweep the fleet's operative cross-skill hand-offs onto the invocation-mode
rubric's explicit phrasing ("invoke `/plugin:skill` via the Skill tool"), and
retire the scoping note that limited the doctrine to new and edited text.

Enumeration was mechanical (every non-frontmatter body line in
plugins/*/skills/** and plugins/*/agents/** carrying a cross-skill
/plugin:skill token), then hand-classified. Mentions were left alone:
identity/ownership statements, "Related skills" and capability-catalog tables,
text that explicitly recommends to the human rather than invoking, emitted
templates, eval fixtures, plugin README/CHANGELOG, and any chain whose target is
`disable-model-invocation: true` (unreachable from a skill under the rubric's
invocation-reach invariant).

Enforcement decision, recorded in the rubric: no skill-quality:check criterion.
A static scan cannot separate an operative chain from a mention, and that
separation is the whole rule — 1,129 body lines fleet-wide carry a cross-skill
token against roughly 120 operative sites. `playbooks:skill-authoring` gains an
authoring-time pointer instead.

Per-plugin patch bumps and CHANGELOG entries for all 34 touched plugins.

Closes #3002

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QbfCrj3X9FfGL7VRZYmrn4
…gate requires

The cross-skill phrasing sweep touched morning-brief's SKILL.md, and
check-changed-skills runs check-skill with --require-evals, which FAILs any
touched SKILL.md that ships no evals/evals.json. morning-brief was the one
swept skill without a suite; its siblings (known-issues, observability) already
have one.

Seven cases pinning the shipped contract: run-the-script-and-print-verbatim,
the read-only refusal, repo derived from `gh repo view` rather than hardcoded,
per-section degradation when no telemetry issue or queue labels exist, the
merge-readiness authority routing to /source-control:babysit-prs, local
telemetry routing to /claude-ops:observability, and the post-merge timestamp
discriminator behind the Stranded findings section.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QbfCrj3X9FfGL7VRZYmrn4
… 20 misses, 2 false claims

Two independent fresh-context audits of the landed sweep found defects in
three classes. This commit fixes all of them, plus one pre-existing runtime
bug found in passing.

False positives reverted (mentions the sweep wrongly rewrote):

- `toolchain:lint`'s comparison-table positioning line, which the sweep turned
  into a self-invocation (`/toolchain:lint` IS that skill).
- `planning:brainstorm`'s route-onward step, which the sweep converted into an
  invocation against its own body's "**Does not decide** — the skill
  recommends".
- The three private-surface banners under `docs-hygiene:extract-ssot/actions/`
  — self-references and access contracts, not chains.
- Clause 1 of `verification:confirm`'s four-clause capability catalog; the
  other three were left, so the paragraph no longer read as one list.
- `planning:wayfind`'s blanket rewrite over a three-way route whose other arms
  are a PLUGIN name and "small enough to just do → say so"; the phrasing now
  attaches to `/planning:interview` alone.

Semantics restored: `implementation:implement-dispatch` cited another skill's
NAMED STEPS in five places ("run its 'Step 1: Prerequisite Check' preflight");
the sweep turned each into a whole-skill invocation. That is a different
action, and a re-entry hazard — `/implementation:implement` Step 0 chains back
into this skill. The citation form is back, and the Prerequisites paragraph
now names the loop it would otherwise create.

Operative sites the sweep missed, now phrased (20): `planning:plan`'s
test-strategy `/tdd:principles` directive (its twin in `plan-template.md` was
rewritten); `verification:confirm`'s PRIMARY live-app delegation, left bare
while its own fallback was rewritten; `work-items:work-loop` cycle step 4;
`work-items:attend-queue`'s `[escalated]` row; `work-items:scan-todos`;
`work-items:ship`'s container-discovery dead end; `code-tidying:tidy`'s
overflow filing; `education:teach`'s tiers 2 and 3 and its adjacent-sources
line, plus `context/lessons.md`; `disk-hygiene:clean`'s worktree hand-off;
`implement-dispatch`'s `/toolchain:check` table row; both `event-storming`
glossary-graduation delegations; `discipline:do-your-research`'s escalation to
its deep sibling (the exact reciprocal of a rewritten line);
`repo-fleet-hygiene:setup`; `songwriting:diagnose`;
`discipline:pick-for-the-problem`; `session-flow:retro`'s skill-candidate
hand-off; `session-flow:workflow`'s phase-boundary save-point;
`implementation:implement`'s two remaining handoff-table rows; and
`source-control:pull-request`'s post-merge retrospective step.

Two false claims removed. The rubric's "1,129 body lines" measurement was not
reproducible under any reading; it and the CHANGELOG copy now carry 1,635 /
186 (88.6% false positives) alongside the exact two `grep` commands that
produce them, so any reader can regenerate the pair. And
`docs/upstream/aihero-course.md` still said the doctrine was "scoped to
new/edited text", contradicting the rubric's "Scope: unconditional" in the
same PR; the lane record survives with a sentence retiring the scoping note.

The rubric also gains the answer to the open classification question: a
`/plugin:name` token is not automatically a skill. `/codex:review` and
`/code-review:code-review` are slash COMMANDS in their upstream plugins, not
Skill-tool-reachable skills, so they are correct keeps; `/caveman:compress`
is a skill and takes the phrasing.

Pre-existing bug fixed in passing: `morning-brief.sh` called
`fetch_repo_label_names` 116 lines before defining it, so that call died with
`command not found` and the fixture short-circuit never fired. It reproduces
unchanged at origin/main. Both definitions now precede their first caller;
`morning-brief.test.sh` goes from exit 1 (2 failing cases) to all 83 passing.

`repo-fleet-hygiene` was never touched by the sweep and gains its first bump
and entry (0.23.7); the other 17 plugins amend the entries they already
carry.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QbfCrj3X9FfGL7VRZYmrn4
A third audit pass found three operative cross-skill chains still carrying
bare `/name` prose, which falsified the rubric's own new "Scope: unconditional
... no grandfathered set" claim:

- `planning:design-handoff` :32 and :56 — two of the three FAIL routes back to
  `/planning:design`, four lines from the one the sweep did rewrite.
- `coupling:reduce` :130 — the filing arm of the same sentence whose
  design-exploration arm was rewritten; the hand-off table's preamble does not
  reach it because it is prose outside the table.
- `work-items:work` :260 — the post-green PR hand-off, bare while the same
  paragraph's `/work-items:track add` was phrased.

Each target is `disable-model-invocation: false`, so the invocation-reach
carve-out does not apply, and none carried a keep rationale. The three plugin
CHANGELOG entries are amended to name the added sites rather than gaining new
version bumps.
@claude

claude Bot commented Aug 21, 2026

Copy link
Copy Markdown
Contributor

Claude finished @kyle-sexton's task in 55s —— View job


Security review (/review:security-review)

  • Gather context (read repo instructions, PR diff since last reviewed SHA)
  • Invoke /review:security-review skill
  • Post findings

Skip gate triggered — no security-relevant surface.

Per the security-review skill's relevance gate, the last reviewed head was 63888c12365670e902944e3f8f7053d35ad07814. This run covers the three commits added since then, up to the current HEAD 3f29d221ed497f1b9b3bf4548e47f415f26ee14b:

  • 8a83e2d — addresses the two open review findings on this PR (the codex --fix gate contradiction in plugins/codebase-health/skills/audit/SKILL.md, and my own stale-measurement finding in docs/conventions/invocation-mode/README.md). Both changes are wording-only: reverting one paragraph to a user-directed recommendation and updating two recorded numbers plus their derived percentage in the doc and two CHANGELOG.md files.
  • 25c9ef7 — a merge of origin/main bringing in an already-landed, already-reviewed commit (29caf82); no new diff content of its own.
  • 3f29d22 — removes one stray blank line in plugins/review/CHANGELOG.md (a markdownlint MD012 fixup).

No executable code, permissions, workflow files, dependency pins, or trust boundaries are touched by any of these three commits — same conclusion as the prior pass on this PR: no security-relevant surface.

No CRITICAL / IMPORTANT / SUGGESTION findings.

cursoragent and others added 3 commits August 21, 2026 07:48
…#3002)

The #3002 sweep rewrote audit's "Route remediation" preamble into an
operative Skill-tool invocation. That contradicts the same section's
--fix rule: present a user-directed suggestion and do not auto-invoke
/implementation:implement or /verification:confirm. The preamble is a
mention (recommendation to the human), so restore the original wording
and record that keep in the 0.8.1 changelog entry.

Co-authored-by: Kyle Sexton <kyle-sexton@users.noreply.github.com>
…#3002)

Re-ran the two committed grep commands over plugins/*/skills
plugins/*/agents on the rebased tree. Denominator is 1,635 (was 1,634);
numerator is 189 (was 186). Derived false-positive rate is 88.4% (was
88.6%). The same pair is mirrored in skill-quality's 0.17.3 notes.

Co-authored-by: Kyle Sexton <kyle-sexton@users.noreply.github.com>
… mention

Expand the 0.8.1 keep rationale so the next phrasing sweep does not re-flag
the user-driven --fix gate as an operative chain.

Co-authored-by: Kyle Sexton <kyle-sexton@users.noreply.github.com>
@cursor
cursor Bot force-pushed the claude/pocock-steering-course-00zkvd branch from 3f29d22 to 762ec44 Compare August 21, 2026 07:49
@claude

claude Bot commented Aug 21, 2026

Copy link
Copy Markdown
Contributor

Claude finished @cursor[bot]'s task in 1m 48s —— View job


CI code review (/review:code-review)

  • Gather context (PR body, changed files list, custom instructions)
  • Invoke /review:code-review skill and follow its instructions
  • Analyze diff against origin/main
  • Post inline findings (none — see below)
  • Post summary comment

What changed since the last full review pass on this lane

This trigger fired on a synchronize after two rounds of prior review (security lane, this
code-review lane, and Codex) plus author remediation. Diffing 6a9dc2c..HEAD (the commit the
prior code-review pass's findings were measured against) shows only 4 files changed since
then, all of them fixes to previously-raised findings:

  • docs/conventions/invocation-mode/README.md
  • plugins/codebase-health/CHANGELOG.md
  • plugins/codebase-health/skills/audit/SKILL.md
  • plugins/skill-quality/CHANGELOG.md

I reviewed all four directly (not the full 176-file diff, which the two prior review passes
already covered and which is unchanged since).

Verification of the two prior findings

1. Codex's P2 (codebase-health:audit remediation-gate contradiction) — confirmed fixed.
plugins/codebase-health/skills/audit/SKILL.md
— the "Route remediation to the dedicated lanes" preamble (line 259) no longer says "invoking each
via the Skill tool"; it now reads as a plain route list. The --fix paragraph four lines below
(line 273) still says "Do NOT auto-invoke either skill — the user drives both." The two are
consistent again, matching main's original behavior on that line. The CHANGELOG entry
correctly records why this route stays a mention (the gate) while the sibling config-lane
route-out (line 69, unconditional, no --fix gate) correctly keeps the operative phrasing —
verified that's a genuinely different, ungated hand-off so no contradiction there either.

2. My own finding (stale regenerable measurement) — confirmed fixed. Re-ran both grep
commands myself on the current tree (762ec44):

$ grep -rnE --include='*.md' '`/[a-z0-9-]+:[a-z0-9-]+' plugins/*/skills plugins/*/agents | wc -l
1635
$ grep -rnE --include='*.md' '`/[a-z0-9-]+:[a-z0-9-]+' plugins/*/skills plugins/*/agents | grep -c 'Skill tool'
189

Matches the recorded 1,635 / 189 → 88.4% exactly in both
docs/conventions/invocation-mode/README.md
and the mirrored plugins/skill-quality/CHANGELOG.md entry.

Result

No new findings. The remaining ~172 files were already covered by the prior security-review and
code-review passes on this branch, and are unchanged since. Both previously-flagged issues are
correctly resolved with no regressions introduced by the fix commits themselves.

@kyle-sexton
kyle-sexton merged commit 69b3584 into main Aug 21, 2026
49 checks passed
@kyle-sexton
kyle-sexton deleted the claude/pocock-steering-course-00zkvd branch August 21, 2026 07:58
kyle-sexton added a commit that referenced this pull request Aug 21, 2026
…ight plugins (#3069)

No linked issue

## Summary

A fresh-context verification pass ran over #3065 **after** it merged and
found defects in what that PR shipped: **12 in the eight plugins it
touched, 12 in the provenance record, and 1 wrong count inside a
released changelog entry.** Two of the twelve are behavioural — a
completion gate that reverses its own skill's first instruction, and a
cite into another plugin's private files. The rest are unresolvable
pointers, a schema field with no writer, an eval that cannot fail for
the reason it claims to test, and claims in
`docs/upstream/cursor-pstack.md` that do not survive checking against
the pinned upstream.

Two more adversarial verifiers then ran over **this PR's own first
commit**, one of them reaching the live upstream. They found eight
further defects in work this PR introduced, plus one from a Codex
review. All nine are fixed and described below.

Every plugin whose shipped text changed takes a **patch bump with its
own `### Fixed` entry**. #3065's release entries describe what #3065
shipped and cannot be retrofitted to describe corrections made after it
merged.

## Fix

### The two behavioural defects in #3065

**`docs-hygiene:write-for-humans` graded against the wrong standard
(0.18.2).** The skill's first instruction is to resolve the consuming
project's own style guide before applying anything bundled — that
re-posture *is* the port, and it is what
`PLUGIN-PHILOSOPHY.md:198-202`'s two-lane rule demands. But 0.18.0
shipped the seven-question self-check unconditionally, and four of those
seven restate a bundled layer (1 is Diátaxis, 2 and 3 are ASD-STE100, 5
is Global English's ambiguity set). A run that followed the skill to its
end would resolve a project's declared Microsoft guide, write against
it, then grade the result against the bundled standards and **rewrite it
to conform**. That is a lane-1 hardcode wearing lane-2 clothing, and it
falsifies two of the skill's six evals. The gate is **split, not
switched off wholesale** — see below for why the first attempt was
wrong.

**`review:quality-gate downstream` cited into another plugin's private
files (0.26.2).** Its "say plainly what is unverified" step path-cited
the `playbooks` plugin's `fable-5` skill inside that skill's own
`context/` directory, which the encapsulation contract makes private.
Now `/playbooks:fable-5 verification` — the chapter argument is
load-bearing, see below.

### The rest of #3065's defects

| Plugin | Bump | Defect |
|---|---|---|
| `architecture` | 0.6.2 | `graft-record:` was added to the candidate
schema and **no step wrote it** — the Handoff step named `status` and
`agreed-shape` and stopped. A field nothing fills is always empty, so
the left-behind half of a graft survived nowhere. Handoff now fills it;
the research file's "travels into `agreed-shape`" named the wrong field
and is replaced. |
| `discovery` | 0.16.2 | Two routes back to the code-shape exclusion the
skill is built around: "test names" listed as source-control evidence (a
test name is a symbol, not someone writing down a reason), and a gotcha
calling a named constant plus a convention "a hypothesis at best",
colliding with `Speculative`'s own *Competing hypotheses* output
section. Separately a **body-vs-eval gap on the neighbouring rule** —
the version-control-behaviour ceiling said "never `Direct`" while the
eval graded "never `Direct` or `Supported`". Plus an eval whose target
behaviour was **indistinguishable from correct behaviour**: it told the
model not to check the tracker but never stipulated one existed, and the
category is presence-gated, so a bare checkout's correct output was
graded a failure. Plus a link-target normalization to the fleet's
`${CLAUDE_PLUGIN_ROOT}` convention. |
| `implementation` | 0.15.2 | "the same grounding rule the loop lanes
apply" — an unresolvable pointer for a consumer who installs
`implementation` alone. Now names `work-items:work-loop` and
`source-control:babysit-loop`. |
| `prototype` | 0.9.2 | `explore-directions` step 6 restated the shared
capture discipline in its **pre-0.9.0 form** — "record which variant won
and why" — directly above the bullets that delete the losing variants
irreversibly. |
| `session-flow` | 0.32.2 | Both retro skills "handed" an accepted skill
candidate to `/playbooks:skill-authoring`, which takes no arguments and
performs no actions. Handing it a candidate resolves to nothing, so the
destination 0.32.0 set out to give did not exist. Both now read it for
the doctrine and draft against it. |
| `testing` | 0.7.2 | "Prefer no new test to a bad one" is the upstream
cursor/plugins `tdd` cost branch (`cursor/plugins@60c641e4`
`pstack/skills/tdd/SKILL.md`). Cited inline as `(upstream cursor/plugins
tdd)`. `/tdd:principles` contains neither the phrase nor the six
triggers. |

### One declared in-place correction to a released body

`scripts/check-changelog-parity.sh` sanctions corrections inside an
already-released version section when the correcting PR names each edit
in its body **and** in the new release entry. Exactly one qualifies, and
it is the only removed changelog line in the whole diff: architecture
0.6.0 said "the five-part schema was pinned in three places"; commit
`228a2b19` changed the count in exactly two spots. Corrected in place;
heading untouched.

Nothing else was edited in place. Three blocks initially drafted as
appends into released `### Added` sections were lifted back out and
re-homed under the new patch entries, because attributing post-release
work to a released version misleads anyone reading the changelog to
learn what that version contains.

### Concurrent-bump resolutions — #3067, #3068, #3070

Main bumped these plugins three separate times while this branch was
open, and each time it claimed a number this branch had already taken.

- **#3067** shipped `review` 0.25.1 → this branch moved to 0.25.2.
- **#3068** shipped `review` 0.26.0 → this branch moved to 0.26.1.
- **#3070** shipped a **fleet-wide** `### Changed` sweep that claimed
**the same patch number on all eight plugins this PR bumps** → every
entry here moved to `.2`.

The third one is worth recording, because it was invisible to the usual
check. `git merge-tree` reported **zero conflict markers**: each side
had edited a different region of each file, so a clean-looking merge
would have produced eight changelogs in which two different releases
share one heading. That is precisely the corruption `--check-preserved`
exists to catch. The real merge surfaced nine conflicts once the bodies
collided. In every case main's heading and body are untouched and this
branch's entry moves up; no release is folded, relabelled, or dropped.

**One of those nine was semantic rather than numeric.** #3070 respelled
`retro/context/session.md`'s route as *"Hand it off by invoking
`/playbooks:skill-authoring` via the Skill tool"* — which reintroduces
the exact claim this PR fixes, since that skill takes no arguments and
performs no actions. Both changes are kept: the invocation still names
the Skill tool (it is invoked in order to be *read*), but it reads the
doctrine and drafts against it rather than handing anything over. The
sibling `running-retro` is deliberately **not** aligned to match —
#3070's own entry says it left that list alone because it sits under
"Offer routing — never auto-apply", so the asymmetry is intentional and
is now recorded in the 0.32.2 entry.

### The provenance record — 12 corrections

`docs/upstream/cursor-pstack.md` carried twelve claims that did not
survive checking against `cursor/plugins@60c641e4`:

1. A judge instruction reported as an unconditional `must`; upstream
says "**Prefer** a different model family from the parent's" and `must`
appears zero times in that file.
2. "upstream spawns candidates under `isolation: worktree`" — the word
never appears upstream. Its mechanism is a per-candidate output path,
which is why this fleet's three recorded `isolation:` rejections were
not in conflict with it.
3. The `arena` omission's grounds now rest on the Rule of Three alone.
4. The `technical-writing` row credited our third always-rule to
upstream's above-the-layers trio; it comes from upstream's separate
word-list and anti-jargon paragraphs.
5–7. Three non-verbatim quotes: `debugging:debug` phase 5, upstream's
`tdd` description, and the above-the-layers rule text.
8. `ai-slop`'s catalog path — `reference/catalog.md` →
`skills/audit/reference/catalog.md`.
9. A bare `context/spec.md` — the real file is
`review/skills/quality-gate/context/spec.md`, and `review/context/`
holds no `spec.md`, so the short form pointed nowhere.
10. "four always-listed descriptions" → six, now named individually.
11. "`bro` is seven lines, two of them body" → one.
12. "Five of its six operating principles" → upstream states **two**
separate six-item lists, and across both, every item but one ("no
shortcut by code-reading") restates historiographical source criticism
and IC analytic tradecraft.

An independent verifier re-checked 1, 2, 11 and 12 against the live
upstream files and confirmed each verbatim.

### Convention record

`docs/conventions/upstream-drift` 1.6.0 adds the adopter row for
`write-for-humans`' source records. **Three carry a publication-event
trigger; Google's is a page-content divergence**, because that guide is
a continuously-edited site with no edition to pin. The contract admits
either shape, and the row says which record uses which.

## Defects in this PR's own diff, found and fixed

Two fresh-context verifiers ran over commit `b1bf09c6` with the
rationale withheld; a Codex review ran alongside.

1. **The new `write-for-humans` gate contradicted itself** — "the seven
below do not apply" under a declared guide, then "the three rules above
apply either way", when questions 4, 6 and 7 **are** those three rules.
Now split per question: four stand down, three always apply.
2. **An undescribed compression pass rode along in that same file** —
nine hunks the changelog never mentioned, three of them lossy (a bullet
lost "of a published standard"; two gotchas lost their actionable half;
one lost the "only" whose placement the skill's own ambiguity rule
governs). The worked example lost "(and ambiguity)" from a fix that *is*
an ambiguity fix, and misquoted its own Before block. Reverted to main,
with only the two described fixes re-applied.
3. **`interface-design.md` named two destinations for one record.**
Replaced rather than annotated.
4. **`explore-directions` step 6 was still short a clause** — it dropped
"what the discarded parts held that the graft deliberately left behind"
while the changelog claimed the widened form.
5. **The bare `/playbooks:fable-5` cite (Codex).** That skill's
`argument-hint` and Arguments paragraph make a bare invocation arm its
**entire operating doctrine as standing session instructions for the
rest of the run**. Now `/playbooks:fable-5 verification`.
6. **The `discovery` umbrella overcounted** — "three routes back to the
code-shape exclusion" when the third is the version-control-behaviour
ceiling, which the same skill says explicitly is *not* code shape.
7. **A link-target normalization was undescribed.** The change is right
and stays; the changelog now names it.
8. **The `review` entry spelled the private path the fix removed.**
Described rather than spelled.
9. **The `upstream-drift` adopter row generalized from three records to
four.** Corrected.

**One Codex finding was accepted after a primary-source check reversed
an earlier decline.** Its claim that `/tdd:principles` contains neither
the phrase nor the six triggers is correct. That skill's nearest
sentence is Khorikov's *"It's better to not write a test at all than to
write a bad test"* in `testable-architecture-khorikov.md` — the 2×2 /
Humble Object chapter, which this port used as grounds to *reject*
upstream's five-item bad-test definition as already owned. The phrase
and the six triggers come from upstream `tdd` (*"Prefer no new test over
a bad test"*, plus the identical trigger list), which
`cursor-pstack.md:34` already recorded as **Taken**. The original cite
therefore contradicted this PR's own provenance document. Now `(upstream
cursor/plugins tdd)`.

## Verification

Every gate re-run locally at the branch tip against the current base
(`69b3584`), all green:

- `check-changelog-parity` — all four modes. `--check-bump`: each of the
eight version changes has its own new entry and is strictly greater than
the base's. `--check-preserved`: 9 changed changelogs, **322 headings
compared**, none dropped — including every heading #3067, #3068 and
#3070 added. `--check-order`: newest-first, no duplicates.
- `check-changed-skills` — 9 skills checked, 0 failed.
- `validate-plugins` (manifests + catalog, `--strict`),
`validate-plugin-contracts` (48 setup skills, 2823 files).
- `check-skill-portability`, `check-skill-count-claims`,
`check-skill-leaf-names`, `check-cross-plugin-source-drift`,
`check-plugin-manifest-presence`, `check-orphaned-fixtures`,
`check-silent-skips`, `check-fleet-audit-doc-grammar`,
`check-lane-coverage`, `check-contract-clause-coverage`,
`check-contract-slice-prune`, `check-stale-base-overlap`.
- `markdownlint-cli2` over **every tracked markdown file** — 0 issues.
- Eval sets: all `evals.json` validate against the bundled schema, 0
failures. `check-evals-quality` returns **PASS with advisory warnings
fleet-wide** (the WARN tier never fails the step); **the two suites this
PR touches carry 0 warnings**. An earlier revision said "PASS, 0
warnings" without that distinction — a verifier caught the
overstatement.
- **No executable file is touched anywhere in this PR** — the diff is
markdown, eight `plugin.json` version bumps, and one `evals.json` — so
the plugin test suite cannot be affected by it.

## Related

- #3065 — the merged PR these corrections apply to.
- #3067, #3068, #3070 — the three concurrent bumps this branch
renumbered around; all of their headings survive.
- `docs/upstream/cursor-pstack.md` — the single source of truth for
everything derived from `cursor/plugins@60c641e4`.
- `docs/conventions/upstream-drift` — the four-part stamp contract the
new adopter row conforms to.
- `docs/PLUGIN-PHILOSOPHY.md:198-202` — the two-lane convention posture
the `write-for-humans` self-check violated.
- `scripts/check-changelog-parity.sh` — the released-entry body-edit
clause the one in-place correction is declared under, and the
concurrent-bump guidance every resolution here follows.

---------

Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Kyle Sexton <kyle-sexton@users.noreply.github.com>
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

docs(plugins): normalize existing cross-skill chains to explicit Skill-tool phrasing (invocation-mode doctrine sweep)

3 participants