The tagger searched the entire commit message for a bracketed marker as a
substring. The commit that introduced the manifest-bump step described that
marker in its own body — so the tagger read its own documentation as an
instruction and skipped the release. Run 15 reported success with no tag, no
manifest bump and no error. Same failure family as everything else in this
sweep: the wrong thing happened silently.
The rule is now a git trailer matched anchored to its own line, consistent
with Bump-Type, and it lives in bin/should-skip-release rather than untested
inside YAML. tests/release_skip_test.sh pins six cases, including the exact
regression: a message that spells the marker out in prose must still tag.
A marker you cannot mention without triggering is a footgun, not a mechanism.
Bump-Type: patch
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BeAp5LTscnz2W7Ubt4eJ6m
CI now writes the computed semver into .claude-plugin/plugin.json before
tagging, committed with [skip-release] so it does not re-trigger the tagger.
Claude Code gates plugin updates on that field: without the bump, installed
hosts never see a new tag no matter how many releases go out. `task check`
enforces manifest/tag equality so the two cannot silently diverge.
Docs rewritten around the two delivery paths, and the checkout location is now
stated as load-bearing rather than incidental: SKILLS_CHECKOUT_DIR defaults to
~/.local/share/skills because that is host-local and outside any synced
directory. The previous docs told you to clone into ~/dev, which on this fleet
is an iCloud folder shared by two Macs spanning two path roots — a git working
tree with concurrent writers, and absolute links that are broken on one side by
construction. That advice is what #23 is about; it is now inverted with the
reason attached.
Antigravity and Vibe removed from the docs along with their targets.
Bump-Type: patch
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BeAp5LTscnz2W7Ubt4eJ6m
Every failure this fleet actually hit was silent. 243 dangling symlinks were
invisible to git because **/.claude/skills/ is in the global gitignore. A
checkout 20 skills behind still resolved, so nothing complained. A loose
secret-hygiene.md loaded in no harness and errored in none. Two machines had
the library missing entirely. Exit status is the signal that was absent.
bin/doctor reports, with a non-zero exit:
- dangling links, anywhere under the harness dirs
- links that RESOLVE but land outside the active checkout — the dangerous
case, because it works while serving stale content
- skill-count mismatch between a harness and the checkout
- stray entries where <name>/SKILL.md was expected
- leftover per-skill Claude symlinks (plugin skills do not override
same-named user skills, so leftovers mean everything loads twice)
- divergence between the plugin copy and the copy the other harnesses link to
Wired as a SessionStart hook with --quiet, so a healthy host prints nothing and
a drifting one says so at the top of the next session. That beats a timer:
no launchd/systemd wiring, and it reaches every host that installs the plugin.
27ms on koala, no network, no git fetch.
Two design points found by the tests, both worth keeping:
- The canonical checkout is whatever ~/.agents/skills resolves to, NOT the
copy doctor runs from. As a plugin hook $0 lives in the plugin cache, which
is legitimately a second copy; judging harness links against it flagged
every one of them as "outside".
- "cd X/.." resolves ".." lexically against the link path and lands back in
~/.agents. Resolve the link first, then take the parent.
tests/doctor_test.sh drives seven fixtures through $HOME and $DOCTOR_CHECKOUT,
so no test touches the real host. Each asserts both the non-zero exit and that
the report names the fault — an exit-code-only assertion would pass while the
message said nothing useful.
Bump-Type: minor
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BeAp5LTscnz2W7Ubt4eJ6m
The plugin now carries the two hooks Mathias owns and the brain/gitea/infra
MCP server definitions, not just skills.
Why this matters more than tidiness: both hooks existed ONLY in koala's
~/.claude/, which is host-local and unsynced. flamingo and iguana have been
running with no secret-guard at all — that is the control which blocks the
decrypt-and-print shape behind the 2026-08-05 ntfy-token leak, the op-item-get
shape behind 2026-07-30, and the base64-bypass shape behind 2026-06-11. Its
absence on two of three machines is a security gap, not a config gap. Shipping
it in the plugin means installing the plugin installs the guard.
.mcp.json references tokens as ${BRAIN_MCP_TOKEN} / ${GITEA_MCP_TOKEN} only —
env indirection, never literal values, so the manifest is safe to commit.
tests/secret_guard_test.sh pins 14 cases. It asserts on
hookSpecificOutput.permissionDecision, NOT exit status: the guard always exits
0 by contract, so an exit-status assertion would pass vacuously while the guard
silently allowed everything. Each deny case names the incident that produced it.
gsd-* hooks are deliberately NOT migrated — GSD owns and updates those in place.
Bump-Type: minor
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BeAp5LTscnz2W7Ubt4eJ6m
Skills move to skills/<name>/SKILL.md and the repo gains both manifests, so
it is now a marketplace hosting exactly one plugin whose root is the repo
root (source: "."). Claude Code installs it from git; no symlinks involved.
Why: install.sh wired the library into every consuming repo as an ABSOLUTE
symlink to $CHECKOUT_DIR. The checkout moved three times, most recently when
local-dev@1966d5a dropped the embedded .skills/ copy, and nothing migrated
the links — 243 dangling links across 12 repos, hidden from git by the
**/.claude/skills/ ignore rule. Worse, ~/dev spans two path roots
(/Users/mathias on the iCloud-shared Macs, /home/mathias on koala), so an
absolute link stored there is broken on one side by construction. Re-running
the installer cannot fix that; only removing the mechanism can.
install.sh keeps the harnesses with no plugin system and drops from 42 links
per harness to one directory link, via the convergent ~/.agents/skills
convention that Pi and OpenCode both read:
~/.agents/skills -> $CHECKOUT_DIR/skills
~/.config/crush/skills -> ~/.agents/skills
~/.config/opencode/skills -> ~/.agents/skills
wire_claude_repo is deleted outright rather than gated behind a flag — on a
mixed-root fleet it cannot be made correct. Antigravity and Vibe targets go
too; both unused. CHECKOUT_DIR keeps its host-local default deliberately:
pointing it into ~/dev would put a git working tree inside iCloud with two
concurrent writers.
Taskfile drops five near-identical wiring loops (they had already drifted)
and delegates to install.sh. `task check` gains frontmatter validation, a
stray-root-entry gate, and manifest/tag version parity — the loose
secret-hygiene.md sat unloadable for months because nothing checked layout.
Verified: claude plugin validate . passes clean; a probe skill loaded as
skills:zzprobe through --plugin-dir; task check green at 42 skills.
Refs: #23
Bump-Type: minor
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BeAp5LTscnz2W7Ubt4eJ6m
Was a loose secret-hygiene.md at the root of ~/.claude/skills — not
dir/SKILL.md, so no harness ever loaded it. Promoted to a real skill so
it installs to Claude Code, Crush, Antigravity and Vibe alike.
Frontmatter description carries load-before triggers (kubectl exec/env,
whole-file SOPS decrypt, token rotation) so it fires ahead of the command
that would leak, not after.
Bump-Type: minor
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BeAp5LTscnz2W7Ubt4eJ6m
set -euo pipefail + `... | grep -iE '^Bump-Type:' | head -1 | awk ...`
inside `bump=$(...)`: when the last commit has no Bump-Type footer (the
normal default-to-patch case), grep exits 1 on no-match. Under
pipefail, that propagates as the whole pipeline's exit status even
though head/awk both succeed -- set -e then kills the script before it
ever reaches the case statement. Broke on every push since 2026-06-22
once a footer-less commit landed after the last one that happened to
carry a Bump-Type line. Appended `|| true` to swallow the expected
no-match case.
Verified this session: `task install` (and its sub-targets) wipe/skip the
per-skill symlinks (0/40 across all harnesses), while install.sh wires 40/40
reliably. Point the wiring docs at install.sh until the Taskfile bug is fixed.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The index still described local-dev's old wire-skills.sh / ~/dev/.skills
mechanism. This repo is now the canonical home; wiring is `task install`
(claude global+repo, crush, antigravity, vibe) or the curl|bash install.sh.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Ports the Vibe wiring from local-dev's wire-skills.sh so this repo's installer
covers all four harnesses. Vibe uses a flat layout — ~/.vibe/skills/<name>.md
symlinked to the skill's SKILL.md file (not the directory, unlike Claude/Crush/
Antigravity). Added to both `task install` and install.sh, idempotent.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Consolidating the divergence between this repo and local-dev's embedded
~/dev/.skills/ (the two had drifted; the 19 overlapping skills were byte-identical).
- Import the 17 skills that existed only in local-dev: discovery-framing,
stage-gate-review, web-shot, and the 14 superpowers-* skills. This repo is now
the superset / single source of truth.
- SKILLS_INDEX.md: add rows for the 17.
- install.sh + Taskfile.yml: git.d-ma.be host (was stale gitea.d-ma.be, which
broke the one-line curl|bash installer post-rename).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The two new skills shipped without the name/description frontmatter every
other skill carries, so harnesses surfaced them as a bare directory name
with no description to match against intent. Add frontmatter (body unchanged).
Bump-Type: patch
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The koala act_runner has labels [self-hosted, linux, amd64]. The
default ubuntu-latest label doesn't match, so the release workflow
silently produced zero runs on every push. Matches the convention
used by hyperguild + infra workflows.
Runner is offline at time of this commit — bring it up on koala via
the act_runner systemd unit before expecting tags to appear.
[skip-release]
Phase 2 of mathias/skills extraction. Adds two new per-tool wirers
alongside Claude Code:
- Crush — ~/.config/crush/skills/<name>/SKILL.md (charmbracelet/crush,
successor to opencode-ai/opencode which is archived)
- Antigravity — ~/.gemini/antigravity/skills/<name>/SKILL.md (Google
VS Code extension). Our SKILL.md frontmatter (name + description)
is already in the format Antigravity expects — no manifest
translation step needed.
Both wirers added to Taskfile.yml (install:crush + install:antigravity)
and install.sh (wire_crush + wire_antigravity). The aggregate `install`
target now calls all four targets (claude:global, claude:repo, crush,
antigravity). Idempotent symlinks, same shape as the Claude Code wirer.
Per-host env overrides documented in README: SKILLS_REF for tag pinning,
CRUSH_SKILLS_DIR + ANTIGRAVITY_SKILLS_DIR for non-default paths.
Skipped:
- opencode (opencode-ai/opencode): archived, succeeded by Crush; its
Custom Commands surface is user prompt templates, not system skills
- gitea-resident agents: consume via per-repo .claude/skills or brain
MCP, no special target needed
Bump-Type: minor
Phase 1 of mathias/skills extraction (infra#62 Track D — homelab
next-step plan addendum). Imports ~/dev/.skills/ verbatim (19 skill
dirs + SKILLS_INDEX.md) and adds the installation surface:
- Taskfile.yml — install / update / list / release / check targets
- install.sh — bootstrap installer for hosts without Task. Idempotent
symlink wirer; default checkout at ~/.local/share/skills/ on every
host; SKILLS_REF env var pins a tag (default: main).
- .gitea/workflows/release.yml — auto-tag every push to main by
Bump-Type footer (major/minor/patch, default patch). Skipped when
commit contains [skip-release].
- README — usage, versioning, contribution flow, secret-hygiene rule.
Phase 1 wires Claude Code only (~/.claude/skills/<name> global +
<repo>/.claude/skills/<name> per-repo). Phase 2 adds Crush, opencode,
antigravity, and gitea-resident agents (cobalt-dingo, agentsquad)
once their skill conventions are researched.
Public repo, markdown-only — no secrets, no client names. Verified
via pre-push grep before initial push.
[skip-release]
mathiasandClaude Opus 5