fix: apply 2026-09-05 skill-audit findings and release five plugins - #17
Merged
Conversation
…validation hardening - docs/audits/2026-09-05: scored record (33 skills, 6 plugins, 11 findings), readable report, probe results, reproductions, publication receipt - scripts/publish_skill_audit.py: converts a reviewed record into ops signals under the skill_audit domain; publishes only with --publish; tests included - scripts/validate_plugins.py: the CI structure check, now parsing skill frontmatter with a real YAML parser instead of a field-presence regex (F01) - scripts/test_skill_regressions.py: YAML rejection, git-guard command forms, a11y surface discovery — the executable audit findings as regression tests - validate.yml: runs the script, the regression tests, and the official `claude plugin validate` on every in-repo plugin; scripts/** triggers the job - MAINTAINING.md: description guidance asks for positive and negative discovery tests per host/model instead of assuming undertriggering (F09) Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…5 F06 F09; v0.15.3 - githits-research: description is a YAML block scalar so the frontmatter parses; the host validator no longer drops the skill's metadata (F01) - plugin-release: --dry-run previews from a temporary copy and never edits or restores the working tree or index, so pre-existing edits survive (F02) - a11y-audit: surface inventory and handler probe include .astro and .templ; zero matches is a hypothesis to inspect, not a stop (F04) - git-guard: recognizes /path/to/git, env, env -i, VAR=val, and command wrappers; header states it is a convenience guard, not a boundary (F05) - test-scaffold: description triggers only on explicit scaffolding; requests for working tests or coverage get executable assertions instead (F06) - skill-audit: allowed-tools reviewed as an approval grant rather than a restrictive boundary; frontmatter parsed as YAML before field checks; triggering assessed per host/model, not assumed to undertrigger (F09) - README: plugin-release row describes the temporary-copy dry-run Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
- component-scaffold: reads the target's styling system first; starter Tailwind tokens apply only in starter projects, never introduced elsewhere (F07) - perf-budget-check: rebuilds before size gates unless the repository's own cache or fingerprint verifies every input; commit timestamps and dist mtime no longer count as freshness; unverifiable builds report as not run (F08) Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
- templ-component-scaffold: styling follows the target's stylesheet config and nearby views; Tailwind and starter class names only where already in use (F07) - test-scaffold: description triggers only on explicit scaffolding; requests for working tests or coverage get executable assertions instead (F06) Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
- test-scaffold: verification runs `cargo test --no-run` with the crate's feature and target flags so test bodies compile; missing toolchains report as unvalidated, never as a pass (F03) - test-scaffold: description triggers only on explicit scaffolding; requests for working tests or coverage get executable assertions instead (F06) Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…v0.5.3 - pezza-design: hard rule 3 now distinguishes altering the stroke master (forbidden) from placing the supplied official filled outlines unchanged (permitted); resolves 2026-09-05 skill-audit finding F10 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Re-reviews all 39 entities at the release revisions that closed findings F01–F11 (code-tools 0.15.3, astro-tools 0.5.2, go-tools 0.3.3, rust-tools 0.1.2, pezza-design-system 0.5.3, product-dev bff7e06). Same rubric; every entity scores 100 with an empty findings summary, which clears the baseline findings in ops once published. Evidence: 642/642 pre-fetch probes (107 commands, bash+zsh, three contexts), 6/6 plugins pass claude plugin validate, 33/33 frontmatter blocks parse, 8/8 regression tests, re-executed guard/a11y/cargo reproductions. Blind behavioral sample not repeated; release dry-run verified by reading only. Publication is pending: the ops publish blocked on 1Password CLI authorization. publication.json records the retry command. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
… publish Ops accepted owned-skills-2026-09-05-post-fix: 39 entities, 195 signals, HTTP 202. Every entity now carries an empty findings summary at severity 0, clearing the eleven baseline findings in the skill_audit domain. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This was referenced Sep 9, 2026
chrispezza
added a commit
that referenced
this pull request
Sep 9, 2026
The first publish of owned-skills-2026-09-05-post-fix recorded branch SHAs that the rebase-merges of #17 and product-dev#58 rewrote. This record pins every entity to revisions on main (plugins cb2e6fd, product-dev 469a06d), includes the code-tools 0.15.4 security-audit probe fix from #18 with its piped-stdin reproduction, and re-collects all evidence at that revision: 642/642 probes, 6/6 host validations, 8/8 tests. Ops accepted it (39 entities, 195 signals); publication.json references the superseded digest. Also untracks scripts/__pycache__, committed by mistake in 9742632, and ignores it going forward. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes all eleven findings from the first owned-skill audit (
owned-skills-2026-09-05) and cuts a patch release of every affected plugin. The audit record, the ops publisher, and a post-fix verification record are committed alongside so the scores in ops trace to exact revisions.Releases
cargo test --no-run, F06F11 lands separately in clownware/product-dev.
CI and tooling
scripts/validate_plugins.pyreplaces the inline CI check and parses skill frontmatter with PyYAML, which is what let F01 through.scripts/test_skill_regressions.pyturns the executable findings into tests: YAML rejection, git-guard command forms, a11y surface discovery.validate.ymlalso runs the officialclaude plugin validateon every in-repo plugin.scripts/publish_skill_audit.pypublishes reviewed audit records to ops;docs/SKILL_AUDITS.mddocuments the flow.Verification
claude plugin validate; 33/33 frontmatter blocks parsedocs/audits/2026-09-05-post-fix/reproductions.json)Not verified: behavioral outcomes (the baseline blind sample was not repeated) and an agent execution of the rewritten dry-run.
Merge
Please merge with rebase, not squash: the per-plugin release commits are what
/plugin-releasederives future deltas from.🤖 Generated with Claude Code