[kyle-sexton]

No related issue: last step of the good-css absorption; write-css landed in #7060

Summary

Two skills that hand-author CSS now point that work at /user-interface:write-css when it is installed, so project-facing CSS applies the project's design system and conventions first. Throwaway HTML mockups and the bundled page chrome keep their own governing inputs.

Fix

• plugins/prototype/skills/explore-directions/SKILL.md (Process, step 2):

  On the real stack, when /user-interface:write-css is installed, use it to write each variant's CSS, since it applies the project's design system and conventions first; without it, write the CSS here. The HTML mockup has no project styling to defer to, so write its CSS here from each variant's declared direction.

• plugins/visualization/skills/visualize/SKILL.md (Step 2: Pick the form):

  When the form hand-authors CSS or SVG styling outside the page chrome (Step 3) and /user-interface:write-css is installed, use it to write that CSS, since it applies the project's design system and conventions first; without it, write the CSS here. The page chrome stays governed by the bundled chrome reference either way.

• One patch changelog fragment each under .changes/prototype/ and .changes/visualization/.

Verification

• grep -c "user-interface:write-css": 1 in each SKILL.md.
• plugins/skill-quality/scripts/check-skill.sh plugins/prototype/skills plugins/visualization/skills: 4 passed, 0 failed (exit 0; warnings are pre-existing size/description advisories).
• scripts/check-changelog-fragments.sh --check-required origin/main: every fragment-mode plugin changed (2) has a fragment.
• markdownlint-cli2 on the four changed files: 0 issues.

Related

• feat(user-interface): add /user-interface:write-css #7060 (write-css skill)
• feat(user-interface): add layered config and /user-interface:setup #7039
• feat(lib): add shared config-cascade resolver and canonical yaml-subset #6984

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-11T07:44:55.832343Z	7d62133	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[claude]

Claude finished @kyle-sexton's task in 2m 35s —— View job

---

Review in progress

• Gather context (PR diff, changed files)
• Review against CODE-REVIEW lane criteria
• Verify candidate finding with adversarial check, then post results

[claude]

Claude finished @kyle-sexton's task in 27s —— View job

---

Security review: no issues found

• Gather context (PR diff, changed files)
• Apply skip gate / check security-relevant surface
• Review changed files for security issues
• Post final findings

Skip gate applied. This PR's diff (git diff origin/main...HEAD) touches only:

• plugins/prototype/skills/explore-directions/SKILL.md — adds one line pointing CSS work at /user-interface:write-css when installed.
• plugins/visualization/skills/visualize/SKILL.md — adds one line pointing CSS/SVG styling work at /user-interface:write-css when installed.
• .changes/prototype/feat-write-css-pointers-8ecebbbb.md and .changes/visualization/feat-write-css-pointers-c8b686d4.md — changelog fragments.

All four changes are pure additions (no deletions, no narrowing of existing guidance), contain no code, no input handling, no secrets/tokens, no authz logic, and no GitHub Actions changes. There is no instruction-surface deletion here (the diff only adds a conditional pointer to another skill), so the instruction-exception-register check does not apply.

No security-relevant surface — review stops here per the skip gate. No findings.

[github-actions]

claude-security-review has reviewed this pull request through 77022dd; a later push is reviewed from there.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7d62133a65

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-actions]

claude-review has reviewed this pull request through 77022dd; a later push is reviewed from there.

[claude]

Claude finished @kyle-sexton's task in 5m 8s —— View job

---

Code review: no issues found

• Gather context (PR diff, incremental changes since 7d62133)
• Run /review:code-review for the incremental scope
• Post findings

Scope. Incremental review of the fix-up commit (7d62133 → 77022dd), limited to the four files it touched: the two changelog fragments and the two SKILL.md pointer edits.

This commit resolves all three issues raised by the prior Codex review and the author's own self-review:

• No stated fallback (P1): both pointers now say "without it, write the CSS here" (plugins/prototype/skills/explore-directions/SKILL.md:200, plugins/visualization/skills/visualize/SKILL.md:91).
• Standalone mockup wrongly delegated to a project-first skill (P2, prototype): the pointer moved out of the HTML-mockup section into ### 2. Generate radically different variants, scoped to "On the real stack..." only, with an explicit note that the mockup has no project styling to defer to and writes its own CSS from the declared direction.
• Delegation could override required page chrome (P2, visualization): the pointer is now scoped to "outside the page chrome (Step 3)", with "the page chrome stays governed by the bundled chrome reference either way."

I had a second pass adversarially check whether that last "either way" clause newly conflicts with the pre-existing Step 5 product-UI exception (which says to match a product's own styling "rather than the plugin chrome"). It doesn't: "either way" grammatically refers back to the write-css-installed/not-installed pair in the same sentence, not to Step 5's separate subject-matter axis, so there's no real ambiguity introduced here.

Changelog fragments accurately reflect the actual wording changes. No findings to post.

[claude]

Claude finished @kyle-sexton's task in 38s —— View job

---

Security review: no issues found

• Gather context (incremental diff, changed files)
• Apply skip gate / check security-relevant surface
• Review changed files for security issues
• Post final findings

Scope. Per the lane header, this pass reviews only what changed since 7d62133 — i.e. .claude-lane/incremental.diff — covering:

• .changes/prototype/feat-write-css-pointers-8ecebbbb.md
• .changes/visualization/feat-write-css-pointers-c8b686d4.md
• plugins/prototype/skills/explore-directions/SKILL.md
• plugins/visualization/skills/visualize/SKILL.md

Skip gate applied. The incremental diff only reworks skill prose addressing the three prior review findings (Codex P1/P2, and the author's own verified fixes):

• explore-directions/SKILL.md#L203: the write-css pointer moved out of the HTML-mockup section into Step 2, now scoped to "the real stack," with an explicit "without it, write the CSS here" fallback, and the mockup sentence restates it keeps its own in-skill CSS from the declared direction.
• visualize/SKILL.md#L91: the pointer is now scoped to CSS/SVG styling "outside the page chrome (Step 3)," adds the same not-installed fallback, and states the chrome stays governed by the bundled chrome reference either way.
• The two .changes/* fragments just reword their one-line changelog entries to match.

This is a pure prose/scope refinement — no deletion or narrowing of a standing instruction (the instruction-surface-deletion lens doesn't apply; if anything these changes add a fallback and narrow the delegation's reach, which tightens rather than loosens guardrails). No code, no input handling, no secrets/tokens, no authz logic, and no GitHub Actions changes. The full-PR surface was already reviewed clean at 7d62133 by this lane.

No security-relevant surface — review stops here per the skip gate. No findings.