0.7.0

What's Changed

🗑️ Purged Skills

• hos-npm-publish-audit is removed from the distribution. Anything that invokes it by name stops finding it after this version is installed

⛱️ Skill Improvements

• hos-gh-pull-request now places the merge-only line of a trunk pull request under # How rather than # Why, and keeps # How for a trunk instead of leaving it out
• hos-session-report counts a subject as the act the session was asked to carry out, not each step of it, so one request lists one line
• hos-session-summary folds work toward one goal into a single subject, and no longer lists the session's own report skills or a bare "go on" prompt as subjects

Change Log

Full Changelog: 0.6.0...0.7.0

0.6.0

What's Changed

🛡️ Security

• GHSA-hp3w-g68c-fv3c is closed. sprintf-js 1.0.3, which has no patched release, has left the tree. It arrived through js-yaml 3.15.2 and its argparse 1.0.10 under @istanbuljs/load-nyc-config, and was development-only, reaching nothing a consumer installs
• Nothing else is outstanding

💪 Enhanced Skills

• The hub issue type is renamed to ⛱️ Umbrella. hos-gh-issue defines it, and hos-gh-open-release and hos-gh-pull-request use the new name. hos-gh-open-release now files a release as ⛱️ Release `x.x.x` where it filed 📂 Release `x.x.x`
• hos-gh-issue lets an issue whose title says it all leave out # As-is and # To-be. The package's own version raise is the usual case, and its body can be a single # Checklist box
• hos-gh-issue gives no parent to an issue a publish issue links inline. The version raise and the merge into main stay steps in the publish issue's description, in the order they are taken, rather than becoming sub-issues
• hos-gh-pull-request leaves # How out where the work took no approach of its own. A trunk merging into main and the package's own version raise are the usual cases
• hos-session-report lists what a ✅ report settled above its verdict, one numbered line per subject, so the verdict says which session it closes
• hos-session-report no longer lists an issue left open after its pull request merged into a trunk, and states how a remaining-work table is written
• hos-session-report and hos-session-summary name the decorated numerals they refuse by their Unicode ranges, covering parenthesized and full-stop forms as well as circled ones

📦️ Dependencies

overrides:

js-yaml is new in this version, and its old version is what the tree resolved to before it.

package name	old version	new version	semver	note
js-yaml	3.15.2	^4.3.2	Major	Closes GHSA-hp3w-g68c-fv3c in sprintf-js, which @istanbuljs/load-nyc-config reached through js-yaml 3 and argparse 1. Its only call is load(), which js-yaml 4 keeps, so the tree now holds the one copy eslint already uses. Contradicts the ^3.13.1 that @istanbuljs/load-nyc-config declares, so it wants revisiting at that package's next major

Change Log

Full Changelog: 0.5.0...0.6.0

0.5.0

What's Changed

🛡️ Security

• GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7 and GHSA-6j4f-fj2g-mc7p are closed. Every copy of brace-expansion now resolves to a patched release: the 1 line 1.1.18 → 1.1.21, the 5 line 5.0.9 → 5.0.12, and the 2 line, reached only through the glob 10.5.0 under test-exclude, has left the tree with it. Every copy was development-only and reaches nothing a consumer installs
• Nothing else is outstanding

🤖 New Skills

• hos-session-report — reports whether a session may be exited: what it leaves behind, and what closing it would strand. Held to the work the session touched; repository widens it to repository level
• hos-session-summary — lists the subjects a session took up, one numbered line each, in the order it took them up. It carries no verdict
• hos-gh-notation — how anything filed to GitHub is set down: tables, headings, backticks, cross-references, the fenced block and the language. hos-gh-issue, hos-gh-pull-request and hos-gh-release-note now defer to it instead of carrying their own copies
• hos-gh-open-release — opens the next release on both ends: the release/x.x.x trunk cut from a freshly fetched origin/main and pushed, and the hub issue that will gather its work
• hos-virtual-research — puts a question to a panel of seven personas who know nothing of the session, and reports how each read it, so that a choice made by one judgement is held against a first reading

💪 Enhanced Skills

• hos-gh-issue settles hubs end to end. A piece of work no child covers gets a child of its own, a hub's title is held against its children, a release hub's # As-is is one line, and where the work already sits on a branch the parent is read off the trunk that branch belongs to
• hos-gh-issue keeps # As-is to what was observed, leaves out what the work will erase, and writes a checklist line per fix rather than per file it reaches
• hos-gh-pull-request titles a pull request into main by the release alone, with no emoji, links no issue but the one it closes, and fetches before working out its base
• hos-skillify ends at a skill written and audited, and takes material at the gate rather than ending the run there
• hos-session-report counts the agent's own memory and any document the session made false, and fetches before gathering
• Seven skills had their description: retaken: hos-documentation-audit, hos-explain, hos-gh-pull-request, hos-gh-release-note, hos-humanize-docs, hos-skillify and hos-user-manual

🐛 Bug Fixes

• hos-npm-publish-audit names the release by the origin/release/x.x.x that HEAD belongs to. It no longer reads the version from package.json, which still holds the published version until the release's last commit
• The README gives the install record as .hora/<package name, without its scope>.json. It read .hora/<package name>.json, while the installer writes .hora/hora-skills-ort-support.json

📦️ Dependencies

devDependencies:

package name	old version	new version	semver	note
jest	^30.5.1	^30.5.2	Patch

overrides:

glob is new in this version, and its old version is what the tree resolved to before it. The other three are removed: the tree resolves each to the same release without them.

package name	old version	new version	semver	note
@humanfs/node	^0.16.8	(kicked)		Resolves to 0.16.8 without the entry
brace-expansion@5	^5.0.9	(kicked)		Resolves to the patched 5.0.12 without the entry
flatted	^3.4.2	(kicked)		Resolves to 3.4.4 without the entry
glob	10.5.0	^13.0.6	Major	test-exclude asks for ^10.4.1, and 10.5.0 is deprecated by its publisher for known vulnerabilities. Lifting it takes the vulnerable brace-expansion 2 line out of the tree. Contradicts the range test-exclude declares, so it wants revisiting at that package's next major

Change Log

Full Changelog: 0.4.0...0.5.0

0.4.0

What's Changed

🛡️ Security

• GHSA-2883-xcg3-v3hh is closed. Both js-yaml lines in the tree moved to a patched release — the 4 line 4.3.1 → 4.3.2, the 3 line 3.15.1 → 3.15.2. Both parents already accepted a patched version, so a lockfile refresh was the whole fix: no overrides: entry was needed and package.json is untouched. Both lines are development-only and reach nothing a consumer installs
• Nothing else is outstanding

🤖 New Skills

• hos-npm-publish-audit — reads what is actually in the tarball before it reaches the npm registry: what an allowlist only declares, the entry points resolved from outside the tree, the document followed the way a reader follows it, and the rules no linter enforces. The inventory goes back in full rather than summarised
• hos-gh-release-note — writes a release note for a tag and sends it, working the range out from the tag and the tag before it. Every body is shown and confirmed before it goes, and a new release is created as a draft
• hos-documentation-audit — audits a maintained document against the conventions it must not contradict and reports what it finds without repairing it. Both sides are quoted with their evidence and a person decides which one is stale

💪 Enhanced Skills

• Whether a body section takes ## headings is decided by the number of subjects it holds, never the number of items. hos-gh-issue and hos-gh-pull-request both carry it, each stated for its own artefact
• Both skills now state the altitude a title is written at, and what to do with a name reaching for and — look for the common name rather than reword
• hos-gh-issue keeps CI-gated checks out of # Checklist. npm test, lint and typecheck are never written in as rows, and a title is held against the branch it was cut for
• hos-skillify enumerates a transcript's message types against the file in front of it rather than assuming three carry material, and phase 2 may return thin where it is too shallow to judge what it was asked to judge
• hos-humanize-docs may move structure where nothing inside it will do. The intended reader still never changes
• ## Referring to a file is now written in each skill's own terms. Three drifting copies of one rule are gone

🐛 Bug Fixes

• hos-gh-pull-request no longer passes --reviewer on create. The default named a team slug that resolves inside one organization only, and a handle that does not resolve fails gh pr create outright. --assignee @me stays, and a reviewer is added afterwards with gh pr edit <number> --add-reviewer <handle>
• hos-gh-pull-request narrows what a # How heading is held against. It no longer claims every heading is the linked issue's # Checklist; only a heading that answers a box is
• hos-gh-issue replaces the 📂 Hub title prefix with two forms. A release hub is titled by its version alone, and every other hub by the overview of what it gathers

🛡️ Supply Chain

• The file watcher under jest changed hands, and allowScripts moved in both directions. jest 30.5.1 has jest-haste-map watch with @parcel/watcher 2.6.0, which carries an install script and is denied here; fsevents left the tree and its entry was kicked out rather than kept as a standing denial for a package nothing pulls
• npm install-scripts ls reports nothing unreviewed

📦️ Dependencies

devDependencies:

package name	old version	new version	semver	note
jest	^30.4.2	^30.5.1	Minor	Swaps the file watcher — see 🛡️ Supply Chain

overrides: is unchanged in this version.

Change Log

Full Changelog: 0.3.0...0.4.0

0.3.0

What's Changed

• Tidy up package

Change Log

Full Changelog: 0.2.0...0.3.0

0.2.0

What's Changed

• Release 0.2.0 > Main by @StewEucen in #46

Full Changelog: 0.1.0...0.2.0

0.1.0

What's Changed

Add new skill /hos-skillify

Change Log

Full Changelog: 0.0.0...0.1.0

0.0.0

What's Changed

• 📦️ Fulfill package.json by @hieuguyen-ort in #2
• Env > Main by @hieuguyen-ort in #3
• 🤖 Add the support skills migrated from hora-skills by @hieuguyen-ort in #5
• 🤖 Author /hos-skillify skill by @StewEucen in #12
• 🏗️ Add the build and the skill-name audit by @hieuguyen-ort in #10
• 🛠️ Add the equip CLI migrated from hora-skills-ort-core by @hieuguyen-ort in #16
• 🏷️ Check the skill names in CI by @hieuguyen-ort in #18
• 📄 Setup LICENSE as Apache-2.0 by @hieuguyen-ort in #14
• 🔗 Check the document links under kit/ by @hieuguyen-ort in #20
• 📦️ Declare the Node version in engines by @hieuguyen-ort in #24
• 📄 Add README by @hieuguyen-ort in #22
• [major] Release 0.0.0 by @hieuguyen-ort in #30

New Contributors

• @hieuguyen-ort made their first contribution in #2
• @StewEucen made their first contribution in #12

Full Changelog: https://github.com/openreachtech/hora-skills-ort-support/commits/0.0.0