[Heal] Community & Distribution: land the file-based community layer on main - #6
[Heal] Community & Distribution: land the file-based community layer on main#6eddiebelaval wants to merge 3 commits into
Conversation
The Community & Distribution pillar read as "partially shipped" because the
community infrastructure was built on a prior heal branch but never merged to
main. This lands it on the default branch and completes the file-based layer.
Rescued (built earlier, never merged to main):
- CONTRIBUTING.md, .github/ISSUE_TEMPLATE/{bug-report,feature-request,skill-submission}.md
- .github/PULL_REQUEST_TEMPLATE.md
Added (completing the file-based community layer, honoring the no-server/
no-telemetry anti-vision):
- GOVERNANCE.md — benevolent-maintainer model, decision process
- CODE_OF_CONDUCT.md — extracted + expanded from CONTRIBUTING
- SUPPORT.md — GitHub Discussions as the community channel
- DISTRIBUTION.md — no-telemetry, GitHub-native adoption signals
- CHANGELOG.md — versioning hygiene
- .github/ISSUE_TEMPLATE/config.yml — routes questions to Discussions
Triad updated: VISION pillar 6 PARTIAL 55% -> PARTIAL 80%; SPEC gains a
Community & Distribution section; BUILDING records the branch-topology finding
and what shipped.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
📝 WalkthroughWalkthroughThis PR adds repository governance and contribution documentation, GitHub issue and pull request templates, command workflow updates, agent catalog cleanup, and broad skill-document normalization and rewrites covering artifact generation, verification, operations, and distribution guidance. ChangesRepository documentation and workflow refresh
Estimated code review effort: 4 (Complex) | ~60 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e0ef514681
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| curl -fsSL https://raw.githubusercontent.com/eddiebelaval/squire/main/squire.md -o squire.md | ||
| ``` | ||
| 2. **Full installer.** `./install.sh` places commands, skills, agents, and pipeline files. | ||
| Supports `--dry-run`, `--commands-only`, and `--uninstall`. |
There was a problem hiding this comment.
This new distribution guide advertises --commands-only, but I checked ./install.sh --help and the parser only accepts --commands; running ./install.sh --commands-only exits with “Unknown option”. Anyone following this page for a commands-only install will fail before installing, so update this and the matching new support-doc reference to --commands or add the alias in the installer.
Useful? React with 👍 / 👎.
![id8 EOD Bot [bot]](https://github.githubassets.com/images/gravatars/gravatar-user-420.png){kind=avatar}
|
| GitGuardian id | GitGuardian status | Secret | Commit | Filename | |
|---|---|---|---|---|---|
| 23993160 | Triggered | Company Email Password | 31dec47 | skills/appstore-readiness/references/common-rejection-reasons.md | View secret |
🛠 Guidelines to remediate hardcoded secrets
- Understand the implications of revoking this secret by investigating where it is used in your code.
- Replace and store your secret safely. Learn here the best practices.
- Revoke and rotate this secret.
- If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.
To avoid such incidents in the future consider
- following these best practices for managing and storing secrets including API keys and other credentials
- install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.
🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Note
Due to the large number of review comments, Critical severity comments were prioritized as inline comments.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
skills/landing-page-designer/skill.md (1)
17-18: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winPreserve an executable landing-page workflow.
After the overview, this skill jumps straight into slop detection rules without a clear build path. Add or link a concise workflow covering research, page structure, copy, design, implementation, and validation so it can still guide task completion rather than only auditing output.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/landing-page-designer/skill.md` around lines 17 - 18, Add a concise executable workflow after the overview in the landing-page skill, covering research, page structure, copy, design, implementation, and validation in that order. Keep the existing “AI SLOP DETECTOR & CLEANER” guidance intact, and link to an existing workflow if one is already available rather than duplicating it.commands/announce-release.md (1)
186-193: 🩺 Stability & Availability | 🟠 Major | 🏗️ Heavy liftRestore recovery guidance for partial releases.
Removing the error-recovery and
--resumeworkflow leaves no safe restart path after a successful website push but failed social posting. Retrying the full command can duplicate external posts; retain checkpoints and idempotent resume behavior.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@commands/announce-release.md` around lines 186 - 193, Restore the partial-release recovery guidance in the announce-release workflow, including persisted checkpoints and an idempotent --resume path after website or social posting failures. Ensure resuming skips already completed external announcements to prevent duplicate posts, while retaining the existing release checkpoint requirements.
🟠 Major comments (23)
agents/x-viral-optimizer.md-3-3 (1)
3-3: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winReplace the hard-coded X scoring formula.
The agent presents
Quotes×5+Bookmarks×4+Replies×3+Retweets×2+Likes×1as the current X ranking formula, but X’s public guidance does not define those fixed engagement ratios; weights are model/context-dependent and not publicly exposed. This can make the agent fabricate “precise” scores and give misleading optimization advice.Rephrase the description/body to use an evidence-qualified heuristic or require current account-specific data before scoring.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@agents/x-viral-optimizer.md` at line 3, Update the agent description and related scoring guidance to remove the asserted fixed X engagement formula and any implication of precise ranking scores. Describe scoring only as an evidence-qualified heuristic, or require current account-specific performance data before assigning scores, while preserving the agent’s content-optimization purpose.skills/performance-optimization/skill.md-4-6 (1)
4-6: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winRestore the complete skill frontmatter.
This file now retains only
nameanddescription, butskills/skill-creator/SKILL.mdrequiresname,slug,description,category,complexity,version,author,triggers, andtags. Skills that validate or index this metadata may reject or misclassifyperformance-optimization; restore the required fields before the heading.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/performance-optimization/skill.md` around lines 4 - 6, Restore the complete required frontmatter before the “Performance Optimization Skill” heading, adding the missing name, slug, description, category, complexity, version, author, triggers, and tags fields in the format required by the skill-creator contract. Preserve the existing metadata values where applicable and ensure performance-optimization is correctly discoverable and classified..github/ISSUE_TEMPLATE/bug-report.md-36-38 (1)
36-38: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winAdd a sensitive-data redaction warning.
This template asks users to paste logs and configuration into a public issue without warning them to remove credentials, access tokens, private URLs, or personal data.
Proposed fix
## Additional context -Paste logs, screenshots, or config excerpts that help explain the issue. +Paste logs, screenshots, or config excerpts that help explain the issue. +Redact credentials, access tokens, private URLs, and personal data before posting.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/ISSUE_TEMPLATE/bug-report.md around lines 36 - 38, Update the “Additional context” section in the bug report template to warn users that issues are public and instruct them to redact credentials, access tokens, private URLs, and personal data before pasting logs, screenshots, or configuration excerpts.skills/contract-drafter/SKILL.md-10-10 (1)
10-10: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winAvoid shadowing the built-in
createcommand.The new
create contracttrigger conflicts with the built-increatecommand, so contract requests may route to the wrong handler. Use a unique trigger such asdraft contractor a namespaced trigger.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/contract-drafter/SKILL.md` at line 10, Update the contract trigger in SKILL.md from “create contract” to a unique non-conflicting trigger, such as “draft contract” or a namespaced equivalent, while preserving the contract-drafting behavior.Source: Linters/SAST tools
skills/contract-drafter/SKILL.md-165-195 (1)
165-195: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winEscape all interpolated values before generating HTML.
Party names, addresses, descriptions, and other user-provided values are inserted into an HTML document. Add an explicit HTML-escaping/sanitization requirement; otherwise opening a generated contract containing markup can execute injected content.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/contract-drafter/SKILL.md` around lines 165 - 195, Add an explicit requirement to HTML-escape or sanitize every interpolated user-provided value in the contract template, including party names, addresses, descriptions, dates, and contract type, before generating the document. Ensure placeholders in the document template cannot emit executable markup while preserving their displayed text.skills/ci-cd-pipeline-builder/SKILL.md-4-4 (1)
4-4: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winAdd the missing required skill frontmatter fields.
skills/skill-creator/SKILL.mdlistsslug,category,complexity,version,author, andtriggersas required frontmatter, but these files only keepnameanddescription. Add those fields back or update every skill and the skill contract consistently; otherwise these skills break the documented schema.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/ci-cd-pipeline-builder/SKILL.md` at line 4, Add the required frontmatter fields slug, category, complexity, version, author, and triggers to skills/ci-cd-pipeline-builder/SKILL.md:4-4, skills/cli-builder/SKILL.md:4-4, skills/config-manager/SKILL.md:4-4, skills/deployment-automation/skill.md:2-7, skills/state-management/skill.md:2-7, skills/supabase-expert/SKILL.md:2-2, skills/testing-qa/SKILL.md:2-7, skills/tui-builder/SKILL.md:2-8, skills/ui-builder/SKILL.md:4-4, and skills/word-processor-expert/skill.md:4-4. Use values consistent with each skill and the schema documented by skills/skill-creator/SKILL.md, or update that contract and every affected skill consistently so all frontmatter conforms to one documented schema.skills/presentation-maker/SKILL.md-159-160 (1)
159-160: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winAdd speaker notes to every content slide.
The workflow requires notes on every content slide, but only
slide2callsaddNotes; slides 3–5 contain content without notes. Add notes for each generated content slide or relax the stated requirement.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/presentation-maker/SKILL.md` around lines 159 - 160, Ensure every generated content slide, including slides 3–5 alongside slide2, invokes addNotes with appropriate speaker notes; alternatively, update the workflow requirement to no longer mandate notes on every content slide.skills/form-builder/SKILL.md-316-328 (1)
316-328: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winValidate radio and checkbox groups by checked state.
field.value.trim()does not detect an unchecked radio or checkbox, andnovalidatedisables the browser’s native fallback. Required option groups can therefore submit without a selection; validate each group with:checkedinstead.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/form-builder/SKILL.md` around lines 316 - 328, Update the submit handler’s required-field validation to validate radio and checkbox groups using whether a matching option is :checked rather than relying on field.value.trim(). Ensure required option groups are rejected when none is selected, while preserving the existing text-field validation and error display behavior.skills/form-builder/SKILL.md-344-350 (1)
344-350: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winDisable hidden conditional fields.
toggleConditionalchanges onlydisplay; required controls inside a hidden section remain enabled and are still checked by the submit loop. This can block submission after selecting the branch that hides the section, and hidden values can still be serialized. Synchronizedisabled/requiredstate with visibility.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/form-builder/SKILL.md` around lines 344 - 350, Update toggleConditional so each change synchronizes the target section’s controls with its visibility: disable hidden controls and prevent them from participating in required validation or serialization, while restoring their enabled/required behavior when shown. Preserve the existing visible-class toggle and apply the state consistently to all relevant controls within target.skills/pdf-generator/SKILL.md-153-159 (1)
153-159: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick winUse a local or
npm execdependency context for the temporary generators.These snippets install
puppeteer,pptxgenjs,exceljs, anddocxglobally, then later use barerequire()names from temp scripts. Node’s default resolution does not search globally installed modules for library imports, so the generator can fail right after the install succeeds. Use a temporary local environment withpackage.json/node_modulesor run the check and generator throughnpm exec.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/pdf-generator/SKILL.md` around lines 153 - 159, The temporary document generators install dependencies globally while later using bare require() imports, so replace this pattern with a local temporary package.json/node_modules environment or npm exec. Apply the dependency-context fix at skills/pdf-generator/SKILL.md lines 153-159, skills/presentation-maker/SKILL.md lines 277-282, skills/spreadsheet-builder/SKILL.md lines 153-160, and skills/word-document-creator/SKILL.md lines 239-246, ensuring each dependency check and generator invocation resolves the locally available packages.skills/llc-ops/SKILL.md-75-80 (1)
75-80: 🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy liftMake the money/customer approval gate enforceable.
Agent decides, plugin runsplus the approval rule is a policy, but this skill has no required approval state/confirmation, preflight check, execution boundary, or persistence for Eddie’s approval before invoking plugins that can touch money/customers/files. Add a preflight approval protocol, or make the guardrail clearly guidance without treating it as enforcement.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/llc-ops/SKILL.md` around lines 75 - 80, The “Money / customer gate stays human” guardrail is currently stated as policy without an enforceable mechanism. Update the adoption guardrails to either define a required Eddie approval state, preflight confirmation, execution boundary, and persistence before invoking money/customer/file-affecting plugins, or explicitly reframe the rule as guidance rather than enforcement; keep the existing scope and approval behavior clear.skills/appstore-readiness/references/common-rejection-reasons.md-103-108 (1)
103-108: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winReplace static credentials with unmistakable placeholders.
A reusable guide should not contain a copyable password or 2FA code. Use placeholders such as
<generated-demo-password>and document per-submission credential generation, rotation, and secure verification-code handling.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/appstore-readiness/references/common-rejection-reasons.md` around lines 103 - 108, Replace the static demo password and 2FA code in the credential example with unmistakable placeholders such as <generated-demo-password> and <verification-code>. Add concise guidance that credentials must be generated per submission, rotated appropriately, and verification codes handled securely.commands/announce-release.md-100-108 (1)
100-108: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winDo not report KB filing after a failed ingest.
The ingest step is explicitly non-blocking, but this summary always prints
KB FiledandMemPalace. Emit those paths only after verification; otherwise reportpendingorfailedso the completion report remains truthful.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@commands/announce-release.md` around lines 100 - 108, Update the Summary Report output to verify ingest success before displaying the KB Filed and MemPalace paths. When verification fails or ingest remains incomplete, report the corresponding status as pending or failed instead of claiming the paths were created; retain the existing paths only for confirmed successful ingest.commands/test-verify.md-8-16 (1)
8-16: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winUse the detected capabilities to gate execution.
The variables are only displayed; later phases still run
npm run lint,npm test,npm run build, and Playwright unconditionally. For repositories withoutpackage.jsonor those scripts, verification fails even when the project is not Node-based. Gate each phase using the detected scripts/frameworks and provide an explicit not-applicable result.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@commands/test-verify.md` around lines 8 - 16, Update the verification phases following the capability detection block to conditionally run lint, tests, build, and Playwright based on LINT_SCRIPT, TEST_SCRIPT, BUILD_SCRIPT, HAS_PLAYWRIGHT, and HAS_PACKAGE_JSON. Skip unavailable checks and report them explicitly as not applicable, ensuring non-Node repositories do not execute npm commands unconditionally.commands/announce-release.md-94-98 (1)
94-98: 🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy liftMake knowledge ingestion authoritative and idempotent.
announce-releasechains/write-releaseand/publish-essay, while/write-releaseand/write-researchalso ingest saved drafts before approval. Define one canonical ingest contract: either only ingest after the authorial workflow marks an article as publishable, or keep draft records isolated from KB/MemPalace while the publish command performs the authorized upsert.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@commands/announce-release.md` around lines 94 - 98, Define a single authoritative, idempotent ingestion contract across commands/announce-release.md (lines 94-98) and commands/publish-essay.md (lines 45-49): keep drafts isolated from KB/MemPalace and perform the authorized upsert only when the publish workflow marks the article publishable, or consistently ingest only at that publishable stage. Remove duplicate or premature ingestion instructions and ensure repeated publish/ingest operations converge without duplicate records.commands/write-release.md-65-70 (1)
65-70: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winDefer KB ingestion until approval.
Both
/write-releaseand/write-researchinstruct auto-ingestion of generated drafts that may never be approved, which can populate the knowledge system with unpublished/unreviewed content. Quarantine non-published drafts or make ingestion contingent on approval rather than running it immediately.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@commands/write-release.md` around lines 65 - 70, Defer knowledge-system ingestion until generated content is approved and published: update the auto-ingest instructions in commands/write-release.md (lines 65-70) and commands/write-research.md (lines 73-78) so unpublished drafts are only saved or quarantined and are not passed to /ingest-article; retain ingestion through the existing /publish-essay flow for approved content.skills/ship/SKILL.md-93-95 (1)
93-95: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick winDo not skip the quality pass for every config change.
Deployment, CI, authentication, and permissions configuration can contain functional or security-sensitive changes. Restrict this shortcut to documentation-only changes or an explicit allowlist of harmless metadata files.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/ship/SKILL.md` around lines 93 - 95, Update the diff-review instructions so the quality pass is not skipped for configuration changes, including deployment, CI, authentication, or permissions configuration. Limit the skip condition to documentation-only changes or files on an explicit allowlist of harmless metadata files, while preserving the existing three-agent review requirement otherwise.skills/ship/SKILL.md-103-104 (1)
103-104: 🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy liftRequire a trust gate before applying agent findings.
This workflow instructs the command to fix every aggregated finding and silently discard false positives. An incorrect or prompt-injected finding can therefore modify production code before commit without human approval or an audit trail. Limit automatic fixes to deterministic findings and require confirmation for behavior or security changes.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/ship/SKILL.md` around lines 103 - 104, Update the “Aggregate findings” workflow in SKILL.md to apply fixes automatically only for deterministic findings; require explicit user confirmation before applying any behavior or security changes, preserving an auditable record of the approved finding and action instead of silently discarding untrusted or false-positive findings.skills/verify/SKILL.md-2-21 (1)
2-21: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winRestore
allowed-toolsin the Verify skill frontmatter.
skills/verify/SKILL.mdnow hasname,version, anddescription, but the repository’s documented Claude Code skill format requiresallowed-toolsin the YAML header. Add the exact tool permissions the skill needs, or verify that the loader supports optionalallowed-tools.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/verify/SKILL.md` around lines 2 - 21, Restore the allowed-tools entry in the YAML frontmatter of the verify skill, using the exact tool permissions required by its static, test, browser, deployment, curl, and Playwright verification flows. Preserve the existing name, version, and description fields, and do not omit the field unless the repository’s loader explicitly supports optional allowed-tools.skills/verify/SKILL.md-141-145 (1)
141-145: 🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy liftCompare deployed commit identity, not timestamps alone.
The deploy API payloads include commit IDs, so this shouldn’t report “in sync” based only on deployment timestamps: an unrelated recent deploy can be newer than
git HEAD, and timestamp ordering does not prove the running artifact matches the current repo state. Retrieve/report the platform commit hash and use it for the sync gate, or rename this as a timestamp-only heuristic.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/verify/SKILL.md` around lines 141 - 145, Update the “Deploy-platform timestamp check” guidance to retrieve and report the deployed commit ID from the Vercel or Cloudflare API, then compare it directly with the current git HEAD for the sync gate. Do not treat timestamp ordering as proof of synchronization; retain timestamps only as supplemental context or explicitly label the check as a heuristic.skills/verify/SKILL.md-132-139 (1)
132-139: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winUse app readiness selectors instead of a network-idle/3s race.
Playwright discourages
networkidlefor test readiness because apps can have ongoing requests or still be hydrating/data-ready after network activity. Use a bounded app-specific locator/expected-text assertion, orwaitForResponse(...).finished()for exact data dependencies.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/verify/SKILL.md` around lines 132 - 139, Update the “Client-side render check” instructions to replace the network-idle/3s readiness race with a bounded app-specific readiness check, such as waiting for a known locator or asserting the expected text; use waitForResponse(...).finished() only when an exact data dependency is required. Keep the existing console-error, DOM-rendering, expected-text, route iteration, and gate requirements intact.skills/verify/SKILL.md-128-130 (1)
128-130: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick winMake the HTTP gate follow redirects and enforce the 5s limit.
curl -sS -o /dev/null -w "%{http_code} %{time_total}s" <url>does not follow308redirects and has no timeout, so the stated308→200 within 5 secondsgate is not enforced. Add--location --max-redirs <n> --connect-timeout <n> --max-time 5.[stability_and_reliability]
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/verify/SKILL.md` around lines 128 - 130, Update the server-side curl check in the “Server-side check” section to follow redirects and enforce the five-second gate by adding location handling, a bounded redirect count, a connection timeout, and a five-second maximum request time. Preserve the existing status-code and total-time output format.skills/remotion/rules/transitions.md-82-97 (1)
82-97: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winFix the
TransitionSeries.Overlayexample.
TransitionSeries.Overlayonly supportsdurationInFrames, optionaloffset, andchildren;presentationandtimingbelong toTransitionSeries.Transition, so this example will not type-check as written.Proposed fix
- <TransitionSeries.Overlay presentation={fade()} timing={linearTiming({durationInFrames: 15})} /> + <TransitionSeries.Overlay durationInFrames={15}> + <SceneTransitionOverlay /> + </TransitionSeries.Overlay>🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/remotion/rules/transitions.md` around lines 82 - 97, Update the TransitionSeries.Overlay example to use only its supported durationInFrames, optional offset, and children props; move the presentation and timing configuration to a TransitionSeries.Transition element, preserving the intended fade transition and duration calculation.
🟡 Minor comments (9)
commands/GETTING-STARTED.md-152-152 (1)
152-152: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winFix the cheatsheet path casing.
The only command template is
commands/cheatsheet.md, socat ~/.claude/commands/CHEATSHEET.mdcan fail on case-sensitive installs. Rename the template toCHEATSHEET.mdor update these references tocheatsheet.md.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@commands/GETTING-STARTED.md` at line 152, Update the cheatsheet command reference in GETTING-STARTED.md to use the existing lowercase cheatsheet.md filename, or consistently rename the template and all references to CHEATSHEET.md; ensure the documented command works on case-sensitive systems.SPEC.md-57-59 (1)
57-59: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winRemove
trafficfrom the list of public adoption signals.Repository traffic and traffic METRICS endpoints on GitHub require push/write access, so they do not fit this list of public signals. Remove it or relabel it as maintainer-only.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@SPEC.md` around lines 57 - 59, Update the adoption measurement list in SPEC.md to remove “traffic” from the public GitHub signals, while preserving the other listed signals and the prohibition on install telemetry.Source: MCP tools
.github/PULL_REQUEST_TEMPLATE.md-5-7 (1)
5-7: 🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick winUse an explicit issue-number placeholder.
Closes #is incomplete, so leaving the template unchanged will not link or close the issue required byCONTRIBUTING.md. Use a concrete placeholder such as ``Closes `#123``` with an instruction to replace the number.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/PULL_REQUEST_TEMPLATE.md around lines 5 - 7, Update the “Related issue” section in the pull request template to use an explicit issue-number placeholder, such as “Closes `#123`,” and instruct contributors to replace it with the actual issue number.skills/presentation-maker/SKILL.md-281-285 (1)
281-285: 🩺 Stability & Availability | 🟡 Minor | ⚡ Quick winMake temporary-script cleanup unconditional.
skills/presentation-maker/SKILL.md#L281-L285: clean/tmp/gen-presentation.mjsthrough a shelltrap.skills/spreadsheet-builder/SKILL.md#L159-L163: clean/tmp/gen-spreadsheet.mjsthrough a shelltrap.skills/word-document-creator/SKILL.md#L245-L249: clean/tmp/generate-doc.mjsthrough a shelltrap.The current sequential
rmcommands are skipped when generation fails.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/presentation-maker/SKILL.md` around lines 281 - 285, Replace the sequential cleanup commands with shell traps that unconditionally remove the temporary scripts on exit, including failures. Apply this to skills/presentation-maker/SKILL.md lines 281-285 for /tmp/gen-presentation.mjs, skills/spreadsheet-builder/SKILL.md lines 159-163 for /tmp/gen-spreadsheet.mjs, and skills/word-document-creator/SKILL.md lines 245-249 for /tmp/generate-doc.mjs.skills/pdf-generator/SKILL.md-162-177 (1)
162-177: 🩺 Stability & Availability | 🟡 Minor | ⚡ Quick winClose the browser in a
finallyblock.If
page.goto()orpage.pdf()throws,browser.close()is never reached and Puppeteer can leave Chromium running after this one-shot command. Wrap the page work intry/finallyand close the browser on every path.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/pdf-generator/SKILL.md` around lines 162 - 177, Update the Puppeteer script’s async flow after browser creation to wrap page.goto and page.pdf in a try/finally block, and move browser.close into finally so Chromium is closed whether the page work succeeds or throws. Preserve the existing PDF options and success message.skills/word-document-creator/SKILL.md-252-264 (1)
252-264: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winCorrect the DOCX unit mappings.
In
docx,size: 22is 11pt, andline: 360is 1.5 line spacing, so these entries do not match16px/1.6 line height. Update the DOCX values or change the design-foundation equivalents to match the generated defaults.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/word-document-creator/SKILL.md` around lines 252 - 264, The .docx Style Guide mappings for body size and line height are inconsistent with their design-foundation values. Update the `16px body size` entry and `1.6 line height` entry to use correct DOCX units, or revise the equivalent design-foundation values to match the generated defaults, while leaving the other mappings unchanged.commands/morning.md-195-203 (1)
195-203: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winMake the LIFE DELTA output conditional.
The process says to include
DELTA.mdonly when it exists and is less than seven days old, but the output template always prints a delta. Add an explicit unavailable/stale fallback or render this block only when the freshness check passes.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@commands/morning.md` around lines 195 - 203, Update the Life Delta Report instructions around the DELTA.md freshness check so the LIFE DELTA block is rendered only when the file exists and is less than seven days old; otherwise provide an explicit unavailable or stale fallback instead of printing current delta fields.commands/morning.md-18-20 (1)
18-20: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winResolve the conflicting memory source.
This instruction says not to read
~/.claude/MEMORY.md, while the existing deadlines step still says to checkMEMORY.md. Point the deadlines lookup explicitly at the live memory index, or remove the conflicting requirement.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@commands/morning.md` around lines 18 - 20, Update the deadlines step in commands/morning.md to reference the live project memory index at ~/.claude/projects/-Users-eddiebelaval-Development-id8/memory/MEMORY.md instead of the stale ~/.claude/MEMORY.md, preserving the existing deadlines lookup behavior without leaving conflicting memory-source instructions.skills/verify/SKILL.md-148-148 (1)
148-148: 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick winAdd a language to the report fence.
Use
text(or another appropriate language) so markdownlint does not flag this unlabeled fenced block.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/verify/SKILL.md` at line 148, Update the fenced code block near the closing fence in the report documentation to include a language identifier, preferably text, while preserving the block’s existing contents.Source: Linters/SAST tools
🧹 Nitpick comments (2)
.github/ISSUE_TEMPLATE/bug-report.md (1)
30-35: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winCapture the repository revision and install path.
OS, shell, and AI agent details do not identify which Squire revision or installation mode produced the failure. Add the Squire commit/tag and installation path or flags to make reports reproducible.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/ISSUE_TEMPLATE/bug-report.md around lines 30 - 35, Update the Environment section in the bug-report template to request the Squire repository revision, such as its commit or tag, and the installation path or flags. Keep the existing OS, shell, and AI agent fields while adding clear prompts for these reproducibility details.skills/ship/SKILL.md (1)
171-183: 🗄️ Data Integrity & Integration | 🔵 TrivialMake Cortex decision capture idempotent.
A rerun after a partial failure or successful merge can write duplicate
decisionrecords. Include a stable key such as the PR number or merge commit and upsert/deduplicate on that key.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@skills/ship/SKILL.md` around lines 171 - 183, Update the Cortex decision capture instructions in “Step 5b: Cortex Decision Capture” to use a stable identifier, such as the PR number or merge commit, as an idempotency key. Ensure repeated runs upsert or deduplicate the existing decision instead of creating duplicate records, while preserving the current skip-silently behavior when the MCP tool is unavailable.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@commands/announce-release.md`:
- Around line 186-193: Restore the partial-release recovery guidance in the
announce-release workflow, including persisted checkpoints and an idempotent
--resume path after website or social posting failures. Ensure resuming skips
already completed external announcements to prevent duplicate posts, while
retaining the existing release checkpoint requirements.
In `@skills/landing-page-designer/skill.md`:
- Around line 17-18: Add a concise executable workflow after the overview in the
landing-page skill, covering research, page structure, copy, design,
implementation, and validation in that order. Keep the existing “AI SLOP
DETECTOR & CLEANER” guidance intact, and link to an existing workflow if one is
already available rather than duplicating it.
---
Major comments:
In @.github/ISSUE_TEMPLATE/bug-report.md:
- Around line 36-38: Update the “Additional context” section in the bug report
template to warn users that issues are public and instruct them to redact
credentials, access tokens, private URLs, and personal data before pasting logs,
screenshots, or configuration excerpts.
In `@agents/x-viral-optimizer.md`:
- Line 3: Update the agent description and related scoring guidance to remove
the asserted fixed X engagement formula and any implication of precise ranking
scores. Describe scoring only as an evidence-qualified heuristic, or require
current account-specific performance data before assigning scores, while
preserving the agent’s content-optimization purpose.
In `@commands/announce-release.md`:
- Around line 100-108: Update the Summary Report output to verify ingest success
before displaying the KB Filed and MemPalace paths. When verification fails or
ingest remains incomplete, report the corresponding status as pending or failed
instead of claiming the paths were created; retain the existing paths only for
confirmed successful ingest.
- Around line 94-98: Define a single authoritative, idempotent ingestion
contract across commands/announce-release.md (lines 94-98) and
commands/publish-essay.md (lines 45-49): keep drafts isolated from KB/MemPalace
and perform the authorized upsert only when the publish workflow marks the
article publishable, or consistently ingest only at that publishable stage.
Remove duplicate or premature ingestion instructions and ensure repeated
publish/ingest operations converge without duplicate records.
In `@commands/test-verify.md`:
- Around line 8-16: Update the verification phases following the capability
detection block to conditionally run lint, tests, build, and Playwright based on
LINT_SCRIPT, TEST_SCRIPT, BUILD_SCRIPT, HAS_PLAYWRIGHT, and HAS_PACKAGE_JSON.
Skip unavailable checks and report them explicitly as not applicable, ensuring
non-Node repositories do not execute npm commands unconditionally.
In `@commands/write-release.md`:
- Around line 65-70: Defer knowledge-system ingestion until generated content is
approved and published: update the auto-ingest instructions in
commands/write-release.md (lines 65-70) and commands/write-research.md (lines
73-78) so unpublished drafts are only saved or quarantined and are not passed to
/ingest-article; retain ingestion through the existing /publish-essay flow for
approved content.
In `@skills/appstore-readiness/references/common-rejection-reasons.md`:
- Around line 103-108: Replace the static demo password and 2FA code in the
credential example with unmistakable placeholders such as
<generated-demo-password> and <verification-code>. Add concise guidance that
credentials must be generated per submission, rotated appropriately, and
verification codes handled securely.
In `@skills/ci-cd-pipeline-builder/SKILL.md`:
- Line 4: Add the required frontmatter fields slug, category, complexity,
version, author, and triggers to skills/ci-cd-pipeline-builder/SKILL.md:4-4,
skills/cli-builder/SKILL.md:4-4, skills/config-manager/SKILL.md:4-4,
skills/deployment-automation/skill.md:2-7, skills/state-management/skill.md:2-7,
skills/supabase-expert/SKILL.md:2-2, skills/testing-qa/SKILL.md:2-7,
skills/tui-builder/SKILL.md:2-8, skills/ui-builder/SKILL.md:4-4, and
skills/word-processor-expert/skill.md:4-4. Use values consistent with each skill
and the schema documented by skills/skill-creator/SKILL.md, or update that
contract and every affected skill consistently so all frontmatter conforms to
one documented schema.
In `@skills/contract-drafter/SKILL.md`:
- Line 10: Update the contract trigger in SKILL.md from “create contract” to a
unique non-conflicting trigger, such as “draft contract” or a namespaced
equivalent, while preserving the contract-drafting behavior.
- Around line 165-195: Add an explicit requirement to HTML-escape or sanitize
every interpolated user-provided value in the contract template, including party
names, addresses, descriptions, dates, and contract type, before generating the
document. Ensure placeholders in the document template cannot emit executable
markup while preserving their displayed text.
In `@skills/form-builder/SKILL.md`:
- Around line 316-328: Update the submit handler’s required-field validation to
validate radio and checkbox groups using whether a matching option is :checked
rather than relying on field.value.trim(). Ensure required option groups are
rejected when none is selected, while preserving the existing text-field
validation and error display behavior.
- Around line 344-350: Update toggleConditional so each change synchronizes the
target section’s controls with its visibility: disable hidden controls and
prevent them from participating in required validation or serialization, while
restoring their enabled/required behavior when shown. Preserve the existing
visible-class toggle and apply the state consistently to all relevant controls
within target.
In `@skills/llc-ops/SKILL.md`:
- Around line 75-80: The “Money / customer gate stays human” guardrail is
currently stated as policy without an enforceable mechanism. Update the adoption
guardrails to either define a required Eddie approval state, preflight
confirmation, execution boundary, and persistence before invoking
money/customer/file-affecting plugins, or explicitly reframe the rule as
guidance rather than enforcement; keep the existing scope and approval behavior
clear.
In `@skills/pdf-generator/SKILL.md`:
- Around line 153-159: The temporary document generators install dependencies
globally while later using bare require() imports, so replace this pattern with
a local temporary package.json/node_modules environment or npm exec. Apply the
dependency-context fix at skills/pdf-generator/SKILL.md lines 153-159,
skills/presentation-maker/SKILL.md lines 277-282,
skills/spreadsheet-builder/SKILL.md lines 153-160, and
skills/word-document-creator/SKILL.md lines 239-246, ensuring each dependency
check and generator invocation resolves the locally available packages.
In `@skills/performance-optimization/skill.md`:
- Around line 4-6: Restore the complete required frontmatter before the
“Performance Optimization Skill” heading, adding the missing name, slug,
description, category, complexity, version, author, triggers, and tags fields in
the format required by the skill-creator contract. Preserve the existing
metadata values where applicable and ensure performance-optimization is
correctly discoverable and classified.
In `@skills/presentation-maker/SKILL.md`:
- Around line 159-160: Ensure every generated content slide, including slides
3–5 alongside slide2, invokes addNotes with appropriate speaker notes;
alternatively, update the workflow requirement to no longer mandate notes on
every content slide.
In `@skills/remotion/rules/transitions.md`:
- Around line 82-97: Update the TransitionSeries.Overlay example to use only its
supported durationInFrames, optional offset, and children props; move the
presentation and timing configuration to a TransitionSeries.Transition element,
preserving the intended fade transition and duration calculation.
In `@skills/ship/SKILL.md`:
- Around line 93-95: Update the diff-review instructions so the quality pass is
not skipped for configuration changes, including deployment, CI, authentication,
or permissions configuration. Limit the skip condition to documentation-only
changes or files on an explicit allowlist of harmless metadata files, while
preserving the existing three-agent review requirement otherwise.
- Around line 103-104: Update the “Aggregate findings” workflow in SKILL.md to
apply fixes automatically only for deterministic findings; require explicit user
confirmation before applying any behavior or security changes, preserving an
auditable record of the approved finding and action instead of silently
discarding untrusted or false-positive findings.
In `@skills/verify/SKILL.md`:
- Around line 2-21: Restore the allowed-tools entry in the YAML frontmatter of
the verify skill, using the exact tool permissions required by its static, test,
browser, deployment, curl, and Playwright verification flows. Preserve the
existing name, version, and description fields, and do not omit the field unless
the repository’s loader explicitly supports optional allowed-tools.
- Around line 141-145: Update the “Deploy-platform timestamp check” guidance to
retrieve and report the deployed commit ID from the Vercel or Cloudflare API,
then compare it directly with the current git HEAD for the sync gate. Do not
treat timestamp ordering as proof of synchronization; retain timestamps only as
supplemental context or explicitly label the check as a heuristic.
- Around line 132-139: Update the “Client-side render check” instructions to
replace the network-idle/3s readiness race with a bounded app-specific readiness
check, such as waiting for a known locator or asserting the expected text; use
waitForResponse(...).finished() only when an exact data dependency is required.
Keep the existing console-error, DOM-rendering, expected-text, route iteration,
and gate requirements intact.
- Around line 128-130: Update the server-side curl check in the “Server-side
check” section to follow redirects and enforce the five-second gate by adding
location handling, a bounded redirect count, a connection timeout, and a
five-second maximum request time. Preserve the existing status-code and
total-time output format.
---
Minor comments:
In @.github/PULL_REQUEST_TEMPLATE.md:
- Around line 5-7: Update the “Related issue” section in the pull request
template to use an explicit issue-number placeholder, such as “Closes `#123`,” and
instruct contributors to replace it with the actual issue number.
In `@commands/GETTING-STARTED.md`:
- Line 152: Update the cheatsheet command reference in GETTING-STARTED.md to use
the existing lowercase cheatsheet.md filename, or consistently rename the
template and all references to CHEATSHEET.md; ensure the documented command
works on case-sensitive systems.
In `@commands/morning.md`:
- Around line 195-203: Update the Life Delta Report instructions around the
DELTA.md freshness check so the LIFE DELTA block is rendered only when the file
exists and is less than seven days old; otherwise provide an explicit
unavailable or stale fallback instead of printing current delta fields.
- Around line 18-20: Update the deadlines step in commands/morning.md to
reference the live project memory index at
~/.claude/projects/-Users-eddiebelaval-Development-id8/memory/MEMORY.md instead
of the stale ~/.claude/MEMORY.md, preserving the existing deadlines lookup
behavior without leaving conflicting memory-source instructions.
In `@skills/pdf-generator/SKILL.md`:
- Around line 162-177: Update the Puppeteer script’s async flow after browser
creation to wrap page.goto and page.pdf in a try/finally block, and move
browser.close into finally so Chromium is closed whether the page work succeeds
or throws. Preserve the existing PDF options and success message.
In `@skills/presentation-maker/SKILL.md`:
- Around line 281-285: Replace the sequential cleanup commands with shell traps
that unconditionally remove the temporary scripts on exit, including failures.
Apply this to skills/presentation-maker/SKILL.md lines 281-285 for
/tmp/gen-presentation.mjs, skills/spreadsheet-builder/SKILL.md lines 159-163 for
/tmp/gen-spreadsheet.mjs, and skills/word-document-creator/SKILL.md lines
245-249 for /tmp/generate-doc.mjs.
In `@skills/verify/SKILL.md`:
- Line 148: Update the fenced code block near the closing fence in the report
documentation to include a language identifier, preferably text, while
preserving the block’s existing contents.
In `@skills/word-document-creator/SKILL.md`:
- Around line 252-264: The .docx Style Guide mappings for body size and line
height are inconsistent with their design-foundation values. Update the `16px
body size` entry and `1.6 line height` entry to use correct DOCX units, or
revise the equivalent design-foundation values to match the generated defaults,
while leaving the other mappings unchanged.
In `@SPEC.md`:
- Around line 57-59: Update the adoption measurement list in SPEC.md to remove
“traffic” from the public GitHub signals, while preserving the other listed
signals and the prohibition on install telemetry.
---
Nitpick comments:
In @.github/ISSUE_TEMPLATE/bug-report.md:
- Around line 30-35: Update the Environment section in the bug-report template
to request the Squire repository revision, such as its commit or tag, and the
installation path or flags. Keep the existing OS, shell, and AI agent fields
while adding clear prompts for these reproducibility details.
In `@skills/ship/SKILL.md`:
- Around line 171-183: Update the Cortex decision capture instructions in “Step
5b: Cortex Decision Capture” to use a stable identifier, such as the PR number
or merge commit, as an idempotency key. Ensure repeated runs upsert or
deduplicate the existing decision instead of creating duplicate records, while
preserving the current skip-silently behavior when the MCP tool is unavailable.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 27806334-530b-4b6f-82e8-101fdde9b0d1
📒 Files selected for processing (97)
.github/ISSUE_TEMPLATE/bug-report.md.github/ISSUE_TEMPLATE/config.yml.github/ISSUE_TEMPLATE/feature-request.md.github/ISSUE_TEMPLATE/skill-submission.md.github/PULL_REQUEST_TEMPLATE.mdBUILDING.mdCHANGELOG.mdCODE_OF_CONDUCT.mdCONTRIBUTING.mdDISTRIBUTION.mdGOVERNANCE.mdSPEC.mdSUPPORT.mdVISION.mdagents/chat-test-runner.mdagents/database-migration-specialist.mdagents/email-notification-specialist.mdagents/krang-brain-agent.mdagents/leonardo-strategist-agent.mdagents/market-intelligence-analyst.mdagents/mcp-deployment-orchestrator.mdagents/mcp-integration-engineer.mdagents/mcp-protocol-specialist.mdagents/mcp-registry-navigator.mdagents/mcp-security-auditor.mdagents/mcp-server-architect.mdagents/mcp-testing-engineer.mdagents/nana-image-generator.mdagents/nextjs-senior-dev.mdagents/notebooklm-producer.mdagents/operations-manager.mdagents/payment-security-specialist.mdagents/raphael-guardian-agent.mdagents/reality-tv-beat-writer.mdagents/relationship-builder.mdagents/social-media-manager.mdagents/splinter-mentor-agent.mdagents/steve-jobs-advisor.mdagents/strategic-think-tank.mdagents/stripe-integration-specialist.mdagents/text-editor-architect.mdagents/usage-tracking-specialist.mdagents/watcher-code-quality-guardian.mdagents/watcher-database-integrity.mdagents/watcher-payment-flow-tester.mdagents/watcher-security-validator.mdagents/x-viral-optimizer.mdcommands/GETTING-STARTED.mdcommands/WHICH-COMMAND.mdcommands/announce-release.mdcommands/gtm.mdcommands/log-note.mdcommands/morning.mdcommands/publish-essay.mdcommands/ship.mdcommands/test-verify.mdcommands/write-release.mdcommands/write-research.mdskills/appstore-readiness/references/common-rejection-reasons.mdskills/ci-cd-pipeline-builder/SKILL.mdskills/cli-builder/SKILL.mdskills/config-manager/SKILL.mdskills/contract-drafter/SKILL.mdskills/deployment-automation/skill.mdskills/docker-composer/SKILL.mdskills/email-notifications/skill.mdskills/env-setup-assistant/SKILL.mdskills/error-monitoring/skill.mdskills/file-uploads/skill.mdskills/form-builder/SKILL.mdskills/git-workflow-designer/SKILL.mdskills/infrastructure-documenter/SKILL.mdskills/landing-page-designer/skill.mdskills/llc-ops/SKILL.mdskills/log-analyzer/SKILL.mdskills/mcp-builder/SKILL.mdskills/monitoring-setup/SKILL.mdskills/nextjs-project-manager/SKILL.mdskills/omni-vu/SKILL.mdskills/pdf-generator/SKILL.mdskills/performance-optimization/skill.mdskills/presentation-maker/SKILL.mdskills/ralph-loops/SKILL.mdskills/real-time-features/skill.mdskills/remotion/SKILL.mdskills/remotion/rules/transitions.mdskills/report-builder/SKILL.mdskills/ship/SKILL.mdskills/spreadsheet-builder/SKILL.mdskills/state-management/skill.mdskills/supabase-expert/SKILL.mdskills/testing-qa/SKILL.mdskills/tui-builder/SKILL.mdskills/ui-builder/SKILL.mdskills/verify/SKILL.mdskills/word-document-creator/SKILL.mdskills/word-processor-expert/skill.md
💤 Files with no reviewable changes (29)
- agents/mcp-server-architect.md
- agents/raphael-guardian-agent.md
- agents/krang-brain-agent.md
- agents/reality-tv-beat-writer.md
- agents/watcher-security-validator.md
- agents/leonardo-strategist-agent.md
- agents/mcp-integration-engineer.md
- agents/strategic-think-tank.md
- agents/mcp-security-auditor.md
- agents/mcp-testing-engineer.md
- agents/mcp-deployment-orchestrator.md
- agents/watcher-payment-flow-tester.md
- agents/mcp-registry-navigator.md
- agents/mcp-protocol-specialist.md
- agents/steve-jobs-advisor.md
- agents/splinter-mentor-agent.md
- agents/payment-security-specialist.md
- agents/nana-image-generator.md
- agents/watcher-code-quality-guardian.md
- agents/chat-test-runner.md
- agents/database-migration-specialist.md
- agents/stripe-integration-specialist.md
- agents/usage-tracking-specialist.md
- agents/watcher-database-integrity.md
- agents/notebooklm-producer.md
- commands/log-note.md
- agents/text-editor-architect.md
- agents/email-notification-specialist.md
- commands/WHICH-COMMAND.md
1 participant
Summary
Heals the Community & Distribution pillar (was PARTIAL 55%). The root cause of "partially shipped" was branch topology, not missing work: a prior heal session built the community infrastructure (
CONTRIBUTING.md, issue templates, PR template) on a heal branch that was never merged tomain— so the default branch every external contributor sees had none of it. This PR lands that work and completes the file-based community layer.What changed
Rescued (built earlier, orphaned on an unmerged heal branch):
CONTRIBUTING.md.github/ISSUE_TEMPLATE/{bug-report,feature-request,skill-submission}.md.github/PULL_REQUEST_TEMPLATE.mdAdded — completing the layer the Squire way (pure files, honoring the no-server / no-telemetry anti-vision):
GOVERNANCE.md— benevolent-maintainer model, decision process, principles that constrain governance → closes "no formal governance body"CODE_OF_CONDUCT.md— extracted + expanded from the inline section in CONTRIBUTINGSUPPORT.md— establishes GitHub Discussions as the community channel → closes "no community forum" (the file-based forum, no Discord to host)DISTRIBUTION.md— distribution channels + no-telemetry, GitHub-native adoption signals → closes "no adoption metrics beyond stars" (telemetry violates the anti-vision, so we define what is measured)CHANGELOG.md— versioning hygiene.github/ISSUE_TEMPLATE/config.yml— routes questions to DiscussionsTriad updated:
VISION.mdpillar 6: PARTIAL 55% → PARTIAL 80%SPEC.md: new Community & Distribution section (artifacts, community channel, adoption measurement, boundaries)BUILDING.md: records the branch-topology finding and everything that shippedWhy not REALIZED?
Two gaps remain by design: no dedicated Discord (Discussions is the deliberate file-based substitute) and no live adoption dashboard (adoption is read from public GitHub signals, never tracked telemetry). For a files-over-infrastructure product, the file-based layer is the realization — hence 80%, not 100%.
Verification
install.sh --dry-run→ exit 0 (430 items)config.yml→ valid YAMLSafety
Do not merge without review. No code paths changed — docs and GitHub community files only.
🤖 Generated with Claude Code
Summary by CodeRabbit
New Features
Documentation
Refactor