v1.8.4

The ai-shipping pack now reads rule first: code-review, derive-tests, document-app, independent-review, intended-vs-implemented, performance-audit-static, security-audit-static, ship-check, shipping-artifacts and test-harness (release-gate went first, in v1.8.1). Every section and rule opens with one bold sentence you can quote as it stands, and the dated stories behind the rules moved to a receipts.md beside code-review, independent-review and test-harness.

What agents do is unchanged. Two review rounds read the new text against the old. The first restored what compression had dropped, among them that a sandbox flag alone does not make a reviewer's tools read-only, and the reason the two hardest lenses in code-review need an explicit probe.

Also:

• independent-review says to delete only what the session generated, and otherwise to gitignore it or ask the owner, where it used to say delete.
• security-audit-static names the OWASP Top 10 edition its category numbers come from (2021).

What to do: nothing. If you copied one of these skills into your own repository, copy its receipts.md with it.

agent-harness and agent-teams follow as a patch.

Install: README § Install. Lost at any point? Type /product:start-here (Codex: $product:start-here) and say what you have.