moldea 10.0.2

Install and prepare manual testing

npx skills add "moldea-ai/skill#v10.0.2"

The skill installs from the immutable tag. Installation does not install the moldea CLI globally and does not refresh an existing repository instruction block. For an adopted repository, ask Fix moldea to assess the installed tooling and bridge. Apply a managed-region refresh only where instruction edits are permitted. Where they are prohibited, obtain the exact printed handoff for an authorized editor; integration remains incomplete until it is applied and validated. Preserve shared instruction symlinks and surrounding instructions.

Use two separate setups for instruction-routing tests: fresh 10.0.2 integration, and 10.0.1 upgraded and refreshed to 10.0.2. Start a new conversation after each setup, without a preloaded moldea entrypoint or prior troubleshooting. Setup conversations do not establish routing behavior.

Changes

• Repair attribute inspection supports contained directory symlinks and Windows junctions, including the reported 32-link layout. Resolution is bounded and retains refusals for escapes, cycles, dangling links, unsafe filters, and linked parents during written-file review. An absolute link may use the already-verified supplied root spelling or physical root; unknown outside aliases remain refused.
• The managed instruction template distinguishes loading another skill's instructional resources from actual project work before both routing branches. Actual project inputs, outputs, implementation, and skill behavior changes retain the appropriate routing.
• Standalone validation uses the launcher without a repair checkpoint. Repair keeps actor Git reads, including preliminary configuration lookup, inside the bounded helper.
• Pending authorized context maintenance can continue after an installation reply. Install-only requests, pauses, and topic changes constrain that continuation. Host implementation and release authorization remain host responsibilities.
• Upgrade guidance covers stale bridges, authorized refresh, protected-file print handoffs, ignored local instruction files, shared and local Claude-file precedence, warning eligibility, accurate owner counts, and local versus committed/cloud observations.
• Validation digests identify results rather than every canonical document body. Content changes use the relevant inspect/content identities and still require reassessment.
• Skip-link regression coverage verifies keyboard behavior in both themes, at 320px and desktop widths, after client navigation, and with an earlier hidden non-page link.

CLI 13.0.1, Core 9.0.0, CLI JSON schema 7, supported CLI/Core ranges, and the inherited dependency closure remain unchanged. Website UI remains 4.5.1, including the previously merged source-preview behavior. Portable runtime requirements remain Node.js >=22.17.0 and Git >=2.32.0. No schema migration is required.

Release identity

Identity	Value
Skill	10.0.2
Immutable tag	v10.0.2
Release commit	c2f7decd2301ef4c8953c0ebf13e5d066492f005
Reviewed and tested tree	b4db73975989bdc14ba4173e81249a270d40ea22
Annotated tag object	0c415245bfece2a33ef85c9a5cbe7bb70bccb0b4
Portable artifact SHA-256	17874ecad78914db17f7f110b5dc2b9b6ab2a51cefea482ec90d408216176ad6
Portable files / bytes	36 / 1,888,462
SKILL.md SHA-256	d34e4d19a542e5a4ffed0206c7c22cbf44a430e9a0c5882cd57f7c41f1e2f7bf
Managed template SHA-256	e7a0114a8047622092ea466057166646b340040cfc8d1a832df1cc899f3b581d
Managed writer SHA-256	9438af808e855a2ca7ac347124b476180770845c1280a1952a704e71bb371db2
Repair helper SHA-256	6b9ca29e8a5519c4741a64a4903a07246dce169366d2e064b1b8a5dce8fbf822

The tag's SSH signature was verified locally. An isolated project-local installation using skills@1.5.22 and the exact public tag matched every file and byte against the release commit, including the template and generated helpers. The developer's installed skills were not replaced.

Completed verification

• Release integration, PR #88 merged through the protected branch workflow.
• Tag conformance passed all 10 jobs: root correctness, repository quality, Linux Node.js 22.17.0/24.11.0/26.8.1, macOS portable integration, Windows portable/deep-path installation checks, minimum Git 2.32, classification, and the aggregate result.
• Pages verification, production build, and deployment passed for the release commit, including sitemap submission.
• The corrected local candidate passed 1,053 unit tests, 720 integration tests with two existing skips, 219 recorded browser tests, and five clean-development browser tests. The 59 repair integration tests passed three consecutive runs with retries disabled. The managed-writer fixtures and four new keyboard cases also passed three runs each without retries.
• Portable generation checks, typechecking, lint, formatting, path checks, documentation checks, release identity, website checks, selected-evidence preparation, and the 57-page production build passed. Production artifact inspection found no tests. Canonical specification validation passed with zero errors; the isolated specification worktree reported its expected missing protected-instruction bridge warning.
• The live home, documentation, and evidence pages returned HTTP 200 in all 12 theme/viewport cases: light/dark at 320px and 1440px. All 12 keyboard checks passed, with visible first skip-link focus, activation into main content, and subsequent focus within main. No horizontal overflow, page errors, or serious/critical axe violations were observed. Four home-page focus screenshots were reviewed.

Known limitations and evidence qualification

Manual checks below have not been claimed as completed by this release. No new model trials, semantic evaluation, or mock-project campaign were run. Deterministic tests establish tooling mechanics and tested browser behavior; they do not establish fresh-conversation instruction adherence or complete owner assessment by a coding agent.

The website retains the historical Skill 8.2.3 / CLI 11.0.6 semantic selection: 120 included cases, 115 passes, five recoveries, and two disclosed exclusions. It supplies no current-release semantic assurance. The ordinary-hit-launcher-unavailable semantic case remains unrecorded.

An earlier parallel browser run timed out in three unchanged mobile artifact/dialog accessibility tests. Each passed three isolated runs with retries disabled, and the corrected full candidate run passed. The original traces were retained for diagnosis. No assertion, timeout, scanner threshold, or workflow was weakened.

The deployed site still reports one moderate axe region finding on the skip link in each of the 12 audited cases. A hidden preceding /cdn-cgi/content link was observed, consistent with interference in axe's skip-link heuristic. The injecting feature has not been identified. Cloudflare settings and scanner policies are unchanged. Keyboard behavior passed independently; this residual scanner finding is the accepted release limitation.

Manual-test checklist

For each scenario, record the installed skill/template identity, CLI/Node.js/Git versions, host, exact request, gate calls and paths, instruction loading, interventions, and actual outcome. Disclose inherited personal skills, blocked scenarios, and failures. Do not count setup conversations as routing evidence, work around host denials, or fix an unrelated test project to manufacture a pass.

#	Scenario	Expected observation
1	Validate with an uncommitted contained skill-directory link.	Launcher validation without a repair checkpoint or writes.
2	Repair that checkout in a fresh conversation.	Supported checkpoint succeeds; all actor Git reads, including configuration lookup, stay inside the helper.
3	Retest the 32-junction Windows layout with multiple context owners.	Links, index, and ignore state remain unchanged; tooling and owners are assessed; final validation or an accurate completed count and continuation is reported. The issue report's complete owner assessment remains unverified until this check.
4	Run the menu-card skill in both fresh and upgraded/refreshed setups.	Loading instructional resources alone triggers neither moldea route; actual project paths retain routing.
5	Upgrade while retaining the old 10.0.1 bridge.	Existing block is preserved and reported stale; the agent does not claim the routing fix is active.
6	Refresh where instruction edits are permitted.	Only the managed region changes; the stale warning clears; repeating refresh is a no-op.
7	Refresh where instruction edits are prohibited.	Exact printed handoff; the file stays untouched; integration remains incomplete until the handoff is applied and validated.
8	Keep AGENTS.md local and ignored.	Accurate local versus committed/cloud explanation, existing acceptance eligibility, no tracking changes, and no invented cloud results.
9	Omit root CLAUDE.md; test nested shared and local fallback files separately.	The governing import subject and exact permitted repair/handoff are identified; absence of the root file does not dismiss integration. Shared files retain precedence over the local fallback.
10	Use another skill on a relevant project input or implementation path.	Normal relevance handling for actual project work.
11	Request code-only pricing work without eligible CLI tooling.	After a relevance hit, one actionable notice; no canonical reads or automatic installation.
12	Reply “install it” to a blocked authorized context update.	Install the identified tooling under host rules, refresh evidence, and finish the pending authorized maintenance.
13	Reply “only install it; leave the context update for later.”	Install only and report the deferred obligation.
14	Pause or change topic.	No silent resumption of old context writes.
15	Change canonical wording without changing validation outcomes.	Validation digest may remain unchanged; relevant inspect/content identities change and the affected assessment is refreshed.
16	Edit a project-owned skill in a permitted environment.	Correct routing; any host denial is reported as blocked without evasion.
17	Navigate the deployed website by keyboard in both themes at 320px and desktop widths.	A visible, reachable skip link enters main content; the next focus target is within main. Report scanner observations separately.

Stop for developer manual feedback before starting semantic evaluation.

Rollback

npx skills add "moldea-ai/skill#v10.0.1"

Use the matching 10.0.1 bridge through an authorized managed-region refresh or exact protected-file handoff, then validate the resulting integration. Preserve project state and dependency policies. The immutable rollback commit is 1cfa4b83c9d98a7947253fc5c7b97d7ea39837b2. Never move either tag or rewrite publication history.