docs(upstream): record the show-me-your-work lane, closing the attribution table's last gap

[kyle-sexton]

No linked issue.

Summary

docs/upstream/cursor-pstack.md claims to be the single source of truth for everything this
marketplace derived from cursor/plugins' pstack/skills/ collection, and its recheck trigger fires
only on skills named in the attribution table. show-me-your-work had shipped derivatives in two
plugins and no row — so drift in that upstream skill fired nothing.

This is the second and last instance of the gap #3094 closed for unslop. One row added.

The table is now complete, proven by enumeration rather than assertion: nine pstack/skills
members have derived surfaces here — why, blast-radius, technical-writing, teach, tdd,
reflect, arena, unslop, show-me-your-work — and all nine are named. The upstream collection
carries 44 skills at the pin; none of the rest has a derived surface in this repo. recall took
nothing and is tabled anyway.

Fix

Relation: Absorbed (skill omitted) — exact sibling vocabulary, with tdd as the structural
precedent: rules absorbed into two different plugins, no skill shipped. Derived would be wrong (no
surface here is a reauthor of upstream's) and Partial (…) is for a skill that shipped with
mechanics dropped.

What the row records as taken:

• Four deviation-log rules into implement-dispatch's DEVIATIONS.md (implementation 0.15.0),
  each traced to upstream's own text — append-only supersession, the evidence column preferring
  committed scripts, INCONCLUSIVE as a real result, one row per decision.
• The formula-injection guard in claude-ops:audit-install-state's install_state.py
  (claude-ops 0.35.1), from upstream's scripts/log.sh clean(). The exposure was live rather
  than hypothetical: git show 228a2b19^:…/install_state.py shows write_csv passing row.relpath
  raw to csv.writer before the port. This repo's version is stricter than upstream's — upstream
  strips tabs and newlines then tests =+-@; csv_safe tests "=+-@\t\r\n" directly and quotes
  rather than strips.

And what was rejected, with reasons drawn from the existing decision section rather than restated:
the skill itself, and upstream's proposal that other skills route their audit trails through it.

This verdict was formed at the pin, and the row says so — the opposite of the unslop row's
disclaimer, and stated explicitly so a reader does not assume that caveat carries over. Commit
228a2b19 (#3065) introduced both plugin changelog entries and this file with its main@60c641e4
pin, so the derivation and the audit are the same commit and this file's git history dates the
derivation correctly. No date correction was needed.

git diff 60c641e4 HEAD -- pstack/skills/show-me-your-work/ against a fresh clone of upstream is
empty: no drift outstanding at the time of writing.

Verification

Check	Result
Scope	1 file, 1 insertion, 0 deletions; nothing under plugins/, so no version bump
Column count	4 columns, identical to the header
Table contiguity	rows 29–40, no blank line splitting it
Upstream claims	grounded in pstack/skills/show-me-your-work/SKILL.md at the pin — upstream was cloned through the session's git proxy, not paraphrased from this repo's own account of it
"All ten lanes are decided"	unchanged and still true — the ten are 8 original rows + bro and show-me-your-work (section-only). Giving this lane a row moves it from section-only to section-plus-row, exactly as arena, teach, tdd, reflect and recall already are. unslop stays outside the count by its own row's text, and this row now states its own side, so the arithmetic is legible from both.
All four relative links	resolve (test -f)
Anchor target	### Why show-me-your-work ships neither a skill nor a convention exists exactly once
markdownlint-cli2, typos, editorconfig-checker	clean
SSOT completeness	nine derived members enumerated from plugin changelogs; all nine now tabled; no third untabled member

One deliberate divergence from sibling rows: the Ours column links install_state.py directly,
a plugin-internal script, where every sibling links only .md. The formula guard has no markdown
surface, and pointing at the changelog alone would leave a reader hunting for the code the row
attests to. Flagged rather than hidden; it is a one-cell edit if you would rather the row point only
at the CHANGELOG.

One check not run here: lychee is not installed in this environment, so the anchor fragment was
verified by construction and by the precedent of the shipped #why-arena-ships-no-skill link rather
than by running CI's offline link lane. lychee.toml sets include_fragments = "full", so CI will
settle it.

Related

• docs(upstream): record the unslop lane in the cursor/plugins attribution table #3094 — closed the same gap for unslop; its adversarial pass found this one.
• feat: port the cursor/plugins pstack collection — 2 new skills, 8 argued absorb/omit verdicts #3065 — added this file, its table, and both derivations recorded here.

---

Generated by Claude Code

[claude]

Claude finished @kyle-sexton's task in 2m 35s —— View job

---

Code review — /review:code-review

• Gather context (diff, PR body, CLAUDE.md/REVIEW.md)
• Apply skip gate
• Verify the row's factual claims (links resolve, anchor exists, column count, table contiguity)
• Check formatting/lint cleanliness
• Post findings (inline + summary)

Scope: 1 file, 1 insertion — a single new row in docs/upstream/cursor-pstack.md's attribution table for show-me-your-work. No code, no plugins/ changes. REVIEW.md's "always check" items (audit logging, multi-write atomicity) don't apply to a docs-only table row, and this lane is scoped away from security findings.

Verified independently (not just restating the PR body's own claims):

• All four relative links in the new row resolve: plugins/implementation/skills/implement-dispatch/SKILL.md, plugins/implementation/CHANGELOG.md, plugins/claude-ops/skills/audit-install-state/scripts/install_state.py, plugins/claude-ops/CHANGELOG.md.
• The anchor #why-show-me-your-work-ships-neither-a-skill-nor-a-convention matches the heading at docs/upstream/cursor-pstack.md#L295 exactly once, via GitHub's slug algorithm (backticks stripped, hyphens kept).
• Table integrity: every row from 29–40, including the new one, has exactly 5 | (4 columns), matching the header; no blank line splits the block.
• Content claims check out against the actual sources:
  • implementation CHANGELOG.md [0.15.0] and implement-dispatch/SKILL.md (lines 65–70) confirm the four DEVIATIONS.md rules (append/supersede, evidence-as-pointer, unverified outcome, one-entry-one-decision) as described.
  • claude-ops CHANGELOG.md [0.35.1] and install_state.py's csv_safe (lines 1221–1240) confirm the formula-injection guard and the specific claim that it's stricter than upstream (tests "=+-@\t\r\n" directly and quotes rather than strips) — matches the code exactly.
  • test_install_state.py:590 has TestCsvFormulaInjection, backing the "discriminating test" claim.

Not independently verified: markdownlint-cli2, typos, and editorconfig-checker aren't installed in this environment and couldn't be run here — the PR's cleanliness claim for those is author-asserted, not confirmed by this review. Likewise the broader "44 upstream skills, none else derived" enumeration is a whole-repo/whole-upstream claim outside this diff's verifiable scope and wasn't re-cloned to check.

Findings: none. This is a well-substantiated, internally-consistent documentation change; nothing here rises to a correctness or maintainability issue a reviewer would block on.

[github-actions]

Claude has reviewed this PR 1 time. The lane skips further automatic reviews after 5; deleting this comment resets the count.