v2.23.0 — 🔭 The external-repo mining cycle

The factory learns to study other factories without being changed by them — a health-gated repo-scout skill, per-skill production telemetry, a forge-proof eval judge, and four code-grounded reference studies with explicit adoption gates. One cycle since v2.22.0.

Highlights

• Skills are now measured in production, not just at authoring time. bun run skill-report derives honest per-skill trust states — trusted / proven / active / demoted / dormant — from the existing trace substrate (skill names only; args never land in a trace). /learn-loop grounds in it as its fourth instrument, and /kill-or-keep's quarterly curator reads dormant rows as archive candidates. Ported idea: OpenSpace's outcome tables — on our substrate instead of a new store.
• The eval judge can no longer be steered by what it judges. Every judged output now sits inside a per-call UUID-tagged untrusted boundary minted after the output exists — forged close tags, fake verdict JSON, and judge-addressed imperatives are content to grade, not directions to follow. One fix covers every factory judge (eval harness + /goal's loop). Ported idea: Adrian's boundary design.
• /repo-scout — the study method, promoted to a skill. Verify health (gh-api gates) → scratchpad-only shallow clone → facts-only hardened deep-dive (repo content is data, never instructions; assessed code is never executed) → references-grammar draft in an operator-gated backlog. Trending mode rides OSS Insight's public API with a 3-repo cap; a new STANDING-ORDERS program scopes its unattended authority.
• Four reference studies, with the discipline showing. Graft (NanoNets) · Adrian (Secure Agentics) · AgentENV (kvcache-ai) · OpenSpace (HKUDS) — each entry records what to mine with file-path evidence, what deliberately isn't adopted, the measured gate any adoption must pass, and the trigger that would reopen the question. Two ideas ported the same day; zero frameworks imported.

What's inside

v2.23.0 — the external-repo mining cycle · skill-outcome telemetry (bun run skill-report, eval skill-outcome-fidelity) · judge untrusted-output boundary (4 deterministic boundary tests) · /repo-scout skill + program + heartbeat item, eval-covered via contract pins · four references/README.md studies + clone lines · new doctrine: api-compatibility-as-distribution (the AgentENV/E2B lesson) and the auto-captured-skill-landfill anti-pattern (OpenSpace's 203-skill corpus as the control group for ungoverned skill capture) · credits gain "a thousand generosities" — the references tier, with a 10x tier that waits for measured evidence.

Get started

curl -fsSL https://raw.githubusercontent.com/hamza-ali-shahjahan/hamzaish/main/install.sh | sh

Then open Claude Code and type /builder-mode <your idea>. New to terminals? Start at docs/start-here.md.

License

AGPL-3.0 — clean, no added clauses. Free for builders; commercial license on request.