Skip to content

refactor!: flatten to a top-level skills/ layout under the crod951/skills name - #6

Merged
crodris merged 2 commits into
mainfrom
refactor/flatten-skills
Jul 30, 2026
Merged

refactor!: flatten to a top-level skills/ layout under the crod951/skills name#6
crodris merged 2 commits into
mainfrom
refactor/flatten-skills

Conversation

@crodris

@crodris crodris commented Jul 30, 2026

Copy link
Copy Markdown
Owner

Summary

Adopts the mattpocock/skills repository shape after the rename to crod951/skills:

  • skills/ at the repo top level; the repo root is the plugin (marketplace.json source: "./", plugin.json beside it in .claude-plugin/)
  • workbench guide moves to docs/workbench.md
  • bin/scan-skills.sh and bin/sync-versions.sh drop the plugins/* indirection; SkillSpector baseline moves to the repo root; workflow paths updated
  • every crod951/claude-plugins reference becomes crod951/skills (GitHub redirects cover stragglers)

skills.sh now discovers the skills via its canonical skills/<name>/SKILL.md location instead of the recursive fallback.

Test plan

bin/scan-skills.sh
  • Scan run 3x consecutively: PASS each time, 0 active findings, suppressions documented in the root baseline
  • bash -n clean on both scripts; marketplace.json and plugin.json parse; bin/sync-versions.sh runs clean against the new layout
  • Sandboxed npx skills add <repo> -a kiro-cli: found 3 skills, installed execute, scaffold, workbench-shared; ../workbench-shared/ refs resolve post-install
  • Not covered: a live Claude Code marketplace install of the root-sourced plugin; verify with /plugin install workbench@crod951 after merge

Summary by CodeRabbit

  • New Features

    • Added shared workbench contract documentation for approvals, conventions, memory, and tracker integrations.
    • Extended skill security scanning to discover skills from the top-level skills/ directory.
  • Bug Fixes

    • Improved scanning resilience and reporting (separate handling for scanner crashes vs findings).
    • Updated memory checklist and tracker adapter behavior to better match lifecycle and counting expectations.
    • Tightened “merge closer” record selection to avoid ambiguous .workbench/ matches.
  • Documentation

    • Updated installation and verification guidance to use the consolidated crod951/skills setup, including updated references throughout.
  • Chores

    • Updated marketplace and manifest repository/homepage metadata; synced versions to the consolidated source.

…1/skills name

The repo root is now the plugin, matching the mattpocock/skills shape:
skills/ at the top level, plugin.json beside marketplace.json in
.claude-plugin/, and marketplace source "./". The workbench guide moves
to docs/workbench.md. scan-skills.sh and sync-versions.sh drop the
plugins/* indirection, the baseline moves to the repo root, and the
SkillSpector workflow watches the new paths. All crod951/claude-plugins
references become crod951/skills following the repository rename;
GitHub redirects keep old URLs working.
@coderabbitai

coderabbitai Bot commented Jul 30, 2026

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: c1e65d25-0ce1-49d9-97df-2be3cacf1cda

📥 Commits

Reviewing files that changed from the base of the PR and between dfed215 and e335994.

📒 Files selected for processing (8)
  • README.md
  • bin/scan-skills.sh
  • skills/scaffold/SKILL.md
  • skills/workbench-shared/memory/beads.md
  • skills/workbench-shared/memory/checklist.md
  • skills/workbench-shared/trackers.md
  • skills/workbench-shared/trackers/asana.md
  • skills/workbench-shared/trackers/linear.md
🚧 Files skipped from review as they are similar to previous changes (4)
  • README.md
  • skills/workbench-shared/memory/beads.md
  • skills/workbench-shared/memory/checklist.md
  • skills/workbench-shared/trackers.md

📝 Walkthrough

Walkthrough

The repository is reorganized around root-level skills. It adds scaffold and execute workflows, shared approval, memory, convention, and tracker contracts, Asana and Linear adapter specifications, updated scanning automation, and refreshed installation and repository metadata.

Changes

Skills workbench migration

Layer / File(s) Summary
Root skills packaging and scanning
.claude-plugin/*, .github/workflows/skillspector.yml, .skillspector-baseline.yaml, bin/*, README.md, docs/workbench.md
Marketplace metadata, documentation, version synchronization, SkillSpector scanning, and installation paths now target the root-level skills/ layout.
Scaffold and execute workflows
skills/execute/SKILL.md, skills/scaffold/SKILL.md, skills/workbench-shared/SKILL.md, skills/workbench-shared/approval.md, skills/workbench-shared/conventions.md
The skills define tracker-bound issue scaffolding, implementation, approval-mode handling, staging and commit rules, plan structure, verification, and progress reporting.
Durable task memory adapters
skills/workbench-shared/memory.md, skills/workbench-shared/memory/*
Memory contracts define backend selection, resume behavior, exclusive task state, overlays, and checklist and beads adapter operations.
Tracker adapter contracts and integrations
skills/workbench-shared/trackers.md, skills/workbench-shared/trackers/*, skills/workbench-shared/agents.md
Tracker contracts and Asana and Linear mappings specify opaque destinations, state transitions, merge matching, structured mutation handling, and installation references.

Estimated code review effort: 4 (Complex) | ~60 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Operator
  participant ScaffoldSkill
  participant TrackerMCP
  participant ExecuteSkill
  participant MemoryBackend
  Operator->>ScaffoldSkill: provide requirements and approval mode
  ScaffoldSkill->>TrackerMCP: resolve destination and create issue hierarchy
  ScaffoldSkill->>ExecuteSkill: hand off issue reference
  ExecuteSkill->>MemoryBackend: claim and persist implementation tasks
  ExecuteSkill->>TrackerMCP: update issue phases and comments
Loading
🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately summarizes the main repo refactor to a top-level skills/ layout under crod951/skills.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch refactor/flatten-skills

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 14

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/skillspector.yml:
- Around line 11-14: Update the pull_request.paths filter in the skillspector
workflow to include bin/scan-skills.sh and .github/workflows/skillspector.yml,
matching the corresponding push filter while preserving the existing skills and
baseline paths.

In `@bin/scan-skills.sh`:
- Around line 156-160: Update the failure tracking and final report in
bin/scan-skills.sh so scanner or provider/install crashes are distinguished from
non-suppressed findings. Track crash failures separately from findings, or use
neutral wording in the failures summary, ensuring crash failures are not
described as baseline issues while preserving the existing failure exit
behavior.

In `@README.md`:
- Line 87: Update the README scan command and baseline instructions to use the
repository-root skills layout: invoke bin/scan-skills.sh against the appropriate
root-level skill path or supported target, replace plugin-specific <plugin-name>
references, and point baseline guidance to the repository-root
.skillspector-baseline.yaml.

In `@skills/execute/SKILL.md`:
- Around line 50-61: Reapply the approval mode confirmed by first-run setup
before continuing with the procedure. In skills/execute/SKILL.md lines 50-61,
replace the provisional mode with the setup-confirmed mode before loading or
creating the tracker profile; apply the same update in skills/scaffold/SKILL.md
lines 40-57 before draft approval or automatic creation.

In `@skills/scaffold/SKILL.md`:
- Around line 85-90: Update step 10 in the handoff procedure to pass the
canonical full Asana task URL to execute, while retaining the short Asana ref
only for display. Keep Linear handoffs using the existing key/ref and preserve
the ask-versus-auto behavior.

In `@skills/workbench-shared/memory/beads.md`:
- Line 16: The status() instructions currently omit in_progress from the
open-task total. Update the open count calculation to sum open, blocked,
deferred, and in_progress, while preserving the separate current-task lookup and
done count behavior.

In `@skills/workbench-shared/memory/checklist.md`:
- Line 41: Update the createTask commit instruction in the checklist
documentation to cover adopted existing sub-issues: when no scaffold commit is
created, include the task line in the breakdown/adoption commit. Preserve the
existing requirement to commit newly created task lines with their scaffold
commit.
- Around line 42-45: Update claimNext() to prevent concurrent runners for the
same issue from claiming or resuming the same task: add an exclusive per-issue
lock or compare-and-swap around reading and rewriting the checklist, or
explicitly reject a second active runner. Preserve the existing behavior of
resuming an existing [>] task and claiming the first eligible [ ] task, while
ensuring only one runner can perform either transition.

In `@skills/workbench-shared/trackers.md`:
- Around line 16-18: Update the shared tracker destination contract in
skills/workbench-shared/trackers.md (anchor lines 16-18) so listDestinations,
resolveDestination, and createIssue use an adapter-owned destination value
containing teamId and optional projectId rather than a single native id. Update
the corresponding Linear destination flow in
skills/workbench-shared/trackers/linear.md (sibling lines 15-17) to resolve and
pass that teamId/projectId value through issue creation.
- Around line 74-75: Update the bulk `gh pr list --state all --json
headRefName,state,mergedAt` sweep to request all relevant pull requests by
setting an explicit sufficiently large `--limit` or by paginating results,
ensuring older recorded branches are not skipped as the backlog grows.

In `@skills/workbench-shared/trackers/asana.md`:
- Around line 113-119: Update the branch-to-tracker lookup in
skills/workbench-shared/trackers/asana.md at lines 113-119 so it does not select
an arbitrary matching record: detect multiple Asana candidates and fail, or
validate the selected task URL before updating. Apply the same ambiguity
handling to the corresponding lookup in
skills/workbench-shared/trackers/linear.md at lines 108-114 before updating the
Linear issue.
- Around line 66-80: Update the Asana merge-closer setup flow to explicitly
offer and persist one of three choices: native, installed, or declined/sweep. In
the profile-loading check around the merge-closer selection, recognize
merge-closer: native exactly like installed so it never prompts again, while
retaining the sweep backstop; ensure the native option is offered before the
GitHub Action and records merge-closer: native.
- Line 21: Update updateState(ref, phase) in
skills/workbench-shared/trackers/asana.md:21-21 to return without section,
custom-field, or comment fallback when the profile mapping for phase is
unmapped; retain completed=true for done only when a mapped transition is
processed. Update the corresponding state-mutation logic in
skills/workbench-shared/trackers/linear.md:19-19 to skip mutation when the
profile records the phase as unmapped.

In `@skills/workbench-shared/trackers/linear.md`:
- Around line 133-145: Replace the string-pattern response matching in the
Linear mutation handling with jq-based JSON parsing: inspect .errors for GraphQL
failures and .data.issueUpdate.success for successful updates. Preserve the
existing success message for true results and unexpected-response error handling
for invalid or unsuccessful responses, including the response payload in
diagnostics.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 2a11a373-6aca-40a8-aa91-d0f07e6ec5a8

📥 Commits

Reviewing files that changed from the base of the PR and between 14b5f01 and dfed215.

📒 Files selected for processing (20)
  • .claude-plugin/marketplace.json
  • .claude-plugin/plugin.json
  • .github/workflows/skillspector.yml
  • .skillspector-baseline.yaml
  • README.md
  • bin/scan-skills.sh
  • bin/sync-versions.sh
  • docs/workbench.md
  • skills/execute/SKILL.md
  • skills/scaffold/SKILL.md
  • skills/workbench-shared/SKILL.md
  • skills/workbench-shared/agents.md
  • skills/workbench-shared/approval.md
  • skills/workbench-shared/conventions.md
  • skills/workbench-shared/memory.md
  • skills/workbench-shared/memory/beads.md
  • skills/workbench-shared/memory/checklist.md
  • skills/workbench-shared/trackers.md
  • skills/workbench-shared/trackers/asana.md
  • skills/workbench-shared/trackers/linear.md

Comment thread .github/workflows/skillspector.yml
Comment thread bin/scan-skills.sh Outdated
Comment thread README.md

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Caution

Inline review comments failed to post. This is likely due to GitHub's internal server error or limits when posting large numbers of comments. If you are seeing this consistently it is likely a permissions issue. Please check "Moderation" -> "Code review limits" under your organization settings.

Actionable comments posted: 14

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/skillspector.yml:
- Around line 11-14: Update the pull_request.paths filter in the skillspector
workflow to include bin/scan-skills.sh and .github/workflows/skillspector.yml,
matching the corresponding push filter while preserving the existing skills and
baseline paths.

In `@bin/scan-skills.sh`:
- Around line 156-160: Update the failure tracking and final report in
bin/scan-skills.sh so scanner or provider/install crashes are distinguished from
non-suppressed findings. Track crash failures separately from findings, or use
neutral wording in the failures summary, ensuring crash failures are not
described as baseline issues while preserving the existing failure exit
behavior.

In `@README.md`:
- Line 87: Update the README scan command and baseline instructions to use the
repository-root skills layout: invoke bin/scan-skills.sh against the appropriate
root-level skill path or supported target, replace plugin-specific <plugin-name>
references, and point baseline guidance to the repository-root
.skillspector-baseline.yaml.

In `@skills/execute/SKILL.md`:
- Around line 50-61: Reapply the approval mode confirmed by first-run setup
before continuing with the procedure. In skills/execute/SKILL.md lines 50-61,
replace the provisional mode with the setup-confirmed mode before loading or
creating the tracker profile; apply the same update in skills/scaffold/SKILL.md
lines 40-57 before draft approval or automatic creation.

In `@skills/scaffold/SKILL.md`:
- Around line 85-90: Update step 10 in the handoff procedure to pass the
canonical full Asana task URL to execute, while retaining the short Asana ref
only for display. Keep Linear handoffs using the existing key/ref and preserve
the ask-versus-auto behavior.

In `@skills/workbench-shared/memory/beads.md`:
- Line 16: The status() instructions currently omit in_progress from the
open-task total. Update the open count calculation to sum open, blocked,
deferred, and in_progress, while preserving the separate current-task lookup and
done count behavior.

In `@skills/workbench-shared/memory/checklist.md`:
- Line 41: Update the createTask commit instruction in the checklist
documentation to cover adopted existing sub-issues: when no scaffold commit is
created, include the task line in the breakdown/adoption commit. Preserve the
existing requirement to commit newly created task lines with their scaffold
commit.
- Around line 42-45: Update claimNext() to prevent concurrent runners for the
same issue from claiming or resuming the same task: add an exclusive per-issue
lock or compare-and-swap around reading and rewriting the checklist, or
explicitly reject a second active runner. Preserve the existing behavior of
resuming an existing [>] task and claiming the first eligible [ ] task, while
ensuring only one runner can perform either transition.

In `@skills/workbench-shared/trackers.md`:
- Around line 16-18: Update the shared tracker destination contract in
skills/workbench-shared/trackers.md (anchor lines 16-18) so listDestinations,
resolveDestination, and createIssue use an adapter-owned destination value
containing teamId and optional projectId rather than a single native id. Update
the corresponding Linear destination flow in
skills/workbench-shared/trackers/linear.md (sibling lines 15-17) to resolve and
pass that teamId/projectId value through issue creation.
- Around line 74-75: Update the bulk `gh pr list --state all --json
headRefName,state,mergedAt` sweep to request all relevant pull requests by
setting an explicit sufficiently large `--limit` or by paginating results,
ensuring older recorded branches are not skipped as the backlog grows.

In `@skills/workbench-shared/trackers/asana.md`:
- Around line 113-119: Update the branch-to-tracker lookup in
skills/workbench-shared/trackers/asana.md at lines 113-119 so it does not select
an arbitrary matching record: detect multiple Asana candidates and fail, or
validate the selected task URL before updating. Apply the same ambiguity
handling to the corresponding lookup in
skills/workbench-shared/trackers/linear.md at lines 108-114 before updating the
Linear issue.
- Around line 66-80: Update the Asana merge-closer setup flow to explicitly
offer and persist one of three choices: native, installed, or declined/sweep. In
the profile-loading check around the merge-closer selection, recognize
merge-closer: native exactly like installed so it never prompts again, while
retaining the sweep backstop; ensure the native option is offered before the
GitHub Action and records merge-closer: native.
- Line 21: Update updateState(ref, phase) in
skills/workbench-shared/trackers/asana.md:21-21 to return without section,
custom-field, or comment fallback when the profile mapping for phase is
unmapped; retain completed=true for done only when a mapped transition is
processed. Update the corresponding state-mutation logic in
skills/workbench-shared/trackers/linear.md:19-19 to skip mutation when the
profile records the phase as unmapped.

In `@skills/workbench-shared/trackers/linear.md`:
- Around line 133-145: Replace the string-pattern response matching in the
Linear mutation handling with jq-based JSON parsing: inspect .errors for GraphQL
failures and .data.issueUpdate.success for successful updates. Preserve the
existing success message for true results and unexpected-response error handling
for invalid or unsuccessful responses, including the response payload in
diagnostics.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 2a11a373-6aca-40a8-aa91-d0f07e6ec5a8

📥 Commits

Reviewing files that changed from the base of the PR and between 14b5f01 and dfed215.

📒 Files selected for processing (20)
  • .claude-plugin/marketplace.json
  • .claude-plugin/plugin.json
  • .github/workflows/skillspector.yml
  • .skillspector-baseline.yaml
  • README.md
  • bin/scan-skills.sh
  • bin/sync-versions.sh
  • docs/workbench.md
  • skills/execute/SKILL.md
  • skills/scaffold/SKILL.md
  • skills/workbench-shared/SKILL.md
  • skills/workbench-shared/agents.md
  • skills/workbench-shared/approval.md
  • skills/workbench-shared/conventions.md
  • skills/workbench-shared/memory.md
  • skills/workbench-shared/memory/beads.md
  • skills/workbench-shared/memory/checklist.md
  • skills/workbench-shared/trackers.md
  • skills/workbench-shared/trackers/asana.md
  • skills/workbench-shared/trackers/linear.md
🛑 Comments failed to post (11)
skills/execute/SKILL.md (1)

50-61: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Reapply the approval mode selected during first-run setup.

Both procedures resolve the mode before loading or creating the tracker profile, but skills/workbench-shared/approval.md requires a mode established during first-run setup to govern the remainder of that run. Without reassigning the resolved mode, setup can silently leave the skill in the initial default mode, causing unexpected prompts or unapproved auto-execution.

  • skills/execute/SKILL.md#L50-L61: replace the provisional mode with the setup-confirmed mode before continuing.
  • skills/scaffold/SKILL.md#L40-L57: apply the same update before draft approval or automatic creation.
📍 Affects 2 files
  • skills/execute/SKILL.md#L50-L61 (this comment)
  • skills/scaffold/SKILL.md#L40-L57
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@skills/execute/SKILL.md` around lines 50 - 61, Reapply the approval mode
confirmed by first-run setup before continuing with the procedure. In
skills/execute/SKILL.md lines 50-61, replace the provisional mode with the
setup-confirmed mode before loading or creating the tracker profile; apply the
same update in skills/scaffold/SKILL.md lines 40-57 before draft approval or
automatic creation.
skills/scaffold/SKILL.md (1)

85-90: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

Pass the canonical Asana URL during execute handoff.

The procedure states that an Asana short ref cannot be resolved alone, but step 10 only says to invoke execute on “that ref.” Explicitly pass the full task URL for Asana; retain the short ref for display only.

🧰 Tools
🪛 SkillSpector (2.4.4)

[warning] 90: [EA2] Autonomous Decision Making: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Remediation: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.

(Excessive Agency (EA2))


[warning] 3: [RA2] Session Persistence: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Remediation: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.

(Rogue Agent (RA2))

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@skills/scaffold/SKILL.md` around lines 85 - 90, Update step 10 in the handoff
procedure to pass the canonical full Asana task URL to execute, while retaining
the short Asana ref only for display. Keep Linear handoffs using the existing
key/ref and preserve the ask-versus-auto behavior.
skills/workbench-shared/memory/beads.md (1)

16-16: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

Include in-progress tasks in the beads open count.

Line 16 sums open, blocked, and deferred but omits in_progress. skills/workbench-shared/memory/checklist.md defines open work as [ ] plus [>], so equivalent runs report inconsistent counts and a running task can incorrectly produce an open count of zero. Include the in_progress bucket while still reporting the current task separately.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@skills/workbench-shared/memory/beads.md` at line 16, The status()
instructions currently omit in_progress from the open-task total. Update the
open count calculation to sum open, blocked, deferred, and in_progress, while
preserving the separate current-task lookup and done count behavior.
skills/workbench-shared/memory/checklist.md (2)

41-41: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

Define commit behavior for adopted sub-issues.

The execute workflow allows existing children to be adopted without calling createSubIssue, so there is no scaffold commit for Line 41’s task record to accompany. Specify that this task line must be included in the breakdown/adoption commit; otherwise checklist state can remain uncommitted and be lost across machines.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@skills/workbench-shared/memory/checklist.md` at line 41, Update the
createTask commit instruction in the checklist documentation to cover adopted
existing sub-issues: when no scaffold commit is created, include the task line
in the breakdown/adoption commit. Preserve the existing requirement to commit
newly created task lines with their scaffold commit.

42-45: 🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift

Make checklist claiming atomic or explicitly prohibit concurrent runners.

claimNext() reads and rewrites a shared file, so two runners can observe the same [ ] task—or resume the same [>] task—and both implement it. The “at most one” invariant does not prevent this race. Add an exclusive per-issue lock/compare-and-swap check, or explicitly enforce one active runner per issue.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@skills/workbench-shared/memory/checklist.md` around lines 42 - 45, Update
claimNext() to prevent concurrent runners for the same issue from claiming or
resuming the same task: add an exclusive per-issue lock or compare-and-swap
around reading and rewriting the checklist, or explicitly reject a second active
runner. Preserve the existing behavior of resuming an existing [>] task and
claiming the first eligible [ ] task, while ensuring only one runner can perform
either transition.
skills/workbench-shared/trackers.md (2)

16-18: 🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n== trackers.md ==\n'
cat -n skills/workbench-shared/trackers.md | sed -n '1,220p'

printf '\n== linear.md ==\n'
cat -n skills/workbench-shared/trackers/linear.md | sed -n '1,220p'

printf '\n== search for destination types/usages ==\n'
rg -n "resolveDestination\\(|createIssue\\(|listDestinations\\(|destination" skills/workbench-shared -g '!**/node_modules/**'

Repository: crod951/skills

Length of output: 39580


🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n== project/team destination searches ==\n'
rg -n "projectId|teamId|destination\s*[:=].*project|destination\s*[:=].*team|native destination" skills/workbench-shared -g '!**/node_modules/**'

printf '\n== adapter file list ==\n'
git ls-files 'skills/workbench-shared/trackers/*'

printf '\n== asana.md relevant section ==\n'
cat -n skills/workbench-shared/trackers/asana.md | sed -n '1,120p'

Repository: crod951/skills

Length of output: 11813


Carry Linear’s project selection through the shared destination contract.
skills/workbench-shared/trackers.md#L16-L18 only allows a single native destination id, so the optional project resolved in skills/workbench-shared/trackers/linear.md#L15-L17 has nowhere to flow and can be dropped before create. Thread an adapter-owned destination value with teamId + optional projectId through listDestinations, resolveDestination, and createIssue instead.

📍 Affects 2 files
  • skills/workbench-shared/trackers.md#L16-L18 (this comment)
  • skills/workbench-shared/trackers/linear.md#L15-L17
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@skills/workbench-shared/trackers.md` around lines 16 - 18, Update the shared
tracker destination contract in skills/workbench-shared/trackers.md (anchor
lines 16-18) so listDestinations, resolveDestination, and createIssue use an
adapter-owned destination value containing teamId and optional projectId rather
than a single native id. Update the corresponding Linear destination flow in
skills/workbench-shared/trackers/linear.md (sibling lines 15-17) to resolve and
pass that teamId/projectId value through issue creation.

74-75: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

git ls-files skills/workbench-shared/trackers.md
wc -l skills/workbench-shared/trackers.md
sed -n '60,110p' skills/workbench-shared/trackers.md
rg -n "gh pr list|number,title,url|mergedAt|headRefName|abandoned" skills/workbench-shared/trackers.md

Repository: crod951/skills

Length of output: 7647


🏁 Script executed:

#!/bin/bash
set -euo pipefail

rg -n "gh pr list --state all|headRefName,state,mergedAt|number,title,url|PR closed unmerged|abandoned attempt|mergedAt is null|gh pr view" .

Repository: crod951/skills

Length of output: 1670


🏁 Script executed:

#!/bin/bash
set -euo pipefail

sed -n '70,110p' skills/workbench-shared/trackers.md

Repository: crod951/skills

Length of output: 5451


🏁 Script executed:

#!/bin/bash
set -euo pipefail

python3 - <<'PY'
from pathlib import Path
p = Path("skills/workbench-shared/trackers.md")
for i, line in enumerate(p.read_text().splitlines(), 1):
    if 70 <= i <= 110:
        print(f"{i}:{line}")
PY

Repository: crod951/skills

Length of output: 5585


🏁 Script executed:

#!/bin/bash
set -euo pipefail

python3 - <<'PY'
from pathlib import Path
p = Path("skills/workbench-shared/trackers.md")
for i, line in enumerate(p.read_text().splitlines(), 1):
    if 90 <= i <= 105:
        print(f"{i}:{line}")
PY

Repository: crod951/skills

Length of output: 2372


🌐 Web query:

gh cli manual gh pr list default limit 30 --json headRefName state mergedAt limit documentation

💡 Result:

The GitHub CLI (gh) command gh pr list has a default limit of 30 items [1][2][3]. The --limit flag (or -L) is used to specify the maximum number of items to fetch [1][2]. When the --json flag is used, it outputs data in JSON format containing only the specified fields [1][4]. To list pull requests with specific fields like headRefName, state, and mergedAt while setting a limit, you can use the following command structure: gh pr list --limit --json headRefName,state,mergedAt For example, to list 50 pull requests with those fields, you would run: gh pr list --limit 50 --json headRefName,state,mergedAt The --json flag requires a comma-separated list of field names [4]. If you are unsure which fields are available, you can run the command with the --json flag but without specifying any fields to see a list of valid options, or consult the official GitHub CLI documentation [4].

Citations:


🏁 Script executed:

#!/bin/bash
set -euo pipefail

rg -n "headRefName,state,mergedAt|number,title,url|gh pr list --state all|gh pr list --limit|PR closed unmerged" .

Repository: crod951/skills

Length of output: 819


Paginate the bulk gh pr list sweep. The default 30-item limit will skip older branches once the backlog grows; set an explicit --limit or paginate the results.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@skills/workbench-shared/trackers.md` around lines 74 - 75, Update the bulk
`gh pr list --state all --json headRefName,state,mergedAt` sweep to request all
relevant pull requests by setting an explicit sufficiently large `--limit` or by
paginating results, ensuring older recorded branches are not skipped as the
backlog grows.
skills/workbench-shared/trackers/asana.md (3)

21-21: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Make both adapters honor unmapped phases.

  • skills/workbench-shared/trackers/asana.md#L21-L21: skip the section/custom-field/comment fallback when the profile records unmapped.
  • skills/workbench-shared/trackers/linear.md#L19-L19: skip the state mutation when the profile records unmapped.
📍 Affects 2 files
  • skills/workbench-shared/trackers/asana.md#L21-L21 (this comment)
  • skills/workbench-shared/trackers/linear.md#L19-L19
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@skills/workbench-shared/trackers/asana.md` at line 21, Update
updateState(ref, phase) in skills/workbench-shared/trackers/asana.md:21-21 to
return without section, custom-field, or comment fallback when the profile
mapping for phase is unmapped; retain completed=true for done only when a mapped
transition is processed. Update the corresponding state-mutation logic in
skills/workbench-shared/trackers/linear.md:19-19 to skip mutation when the
profile records the phase as unmapped.

66-80: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

Offer native as an explicit first-run merge-closer choice.

This setup flow only asks whether to install the GitHub Action and records installed or declined, while Lines 66-69 recommend and support native. A repository already using Asana’s native integration cannot reach the documented native profile state and may be prompted to install a redundant Action.

Offer native, installed, or declined/sweep explicitly and persist the selected value.

🧰 Tools
🪛 LanguageTool

[locale-violation] ~69-~69: In American English, ‘afterward’ is the preferred variant. ‘Afterwards’ is more commonly used in British English and other dialects.
Context: ...Treat native exactly like installed afterwards: never ask again, and let the sweep sta...

(AFTERWARDS_US)


[uncategorized] ~78-~78: The official name of this software platform is spelled with a capital “H”.
Context: ...pository. When the answer is yes, write .github/workflows/workbench-close.yml from the...

(GITHUB)

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@skills/workbench-shared/trackers/asana.md` around lines 66 - 80, Update the
Asana merge-closer setup flow to explicitly offer and persist one of three
choices: native, installed, or declined/sweep. In the profile-loading check
around the merge-closer selection, recognize merge-closer: native exactly like
installed so it never prompts again, while retaining the sweep backstop; ensure
the native option is offered before the GitHub Action and records merge-closer:
native.

113-119: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

Do not choose an arbitrary tracker record for a matching branch.

  • skills/workbench-shared/trackers/asana.md#L113-L119: fail when more than one Asana candidate matches, or validate the selected task URL before updating.
  • skills/workbench-shared/trackers/linear.md#L108-L114: apply the same ambiguity handling before updating the Linear issue.
📍 Affects 2 files
  • skills/workbench-shared/trackers/asana.md#L113-L119 (this comment)
  • skills/workbench-shared/trackers/linear.md#L108-L114
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@skills/workbench-shared/trackers/asana.md` around lines 113 - 119, Update the
branch-to-tracker lookup in skills/workbench-shared/trackers/asana.md at lines
113-119 so it does not select an arbitrary matching record: detect multiple
Asana candidates and fail, or validate the selected task URL before updating.
Apply the same ambiguity handling to the corresponding lookup in
skills/workbench-shared/trackers/linear.md at lines 108-114 before updating the
Linear issue.
skills/workbench-shared/trackers/linear.md (1)

133-145: 🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win

Parse the GraphQL response as JSON.

The success branch only matches the exact text "success":true; valid JSON containing whitespace or a different field layout will be reported as a failure even when the mutation succeeded. Use jq to inspect .errors and .data.issueUpdate.success.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@skills/workbench-shared/trackers/linear.md` around lines 133 - 145, Replace
the string-pattern response matching in the Linear mutation handling with
jq-based JSON parsing: inspect .errors for GraphQL failures and
.data.issueUpdate.success for successful updates. Preserve the existing success
message for true results and unexpected-response error handling for invalid or
unsuccessful responses, including the response payload in diagnostics.

- count scanner crashes separately from findings in the scan summary
- correct the README local-scan usage for the flat layout
- make the tracker destination value adapter-owned and possibly composite,
  with Linear bundling team UUID plus optional project id
- require an explicit --limit on the bulk sweep pr list
- include in_progress in the beads open count, matching the checklist
- commit adopted task lines with the breakdown commit
- document the checklist single-runner assumption and second-runner stop
- fail the merge-closer templates on an ambiguous branch-to-record match
- parse the Linear mutation response with jq instead of string matching
- treat an explicitly unmapped phase as a documented no-op in updateState
- hand off from scaffold with the resolvable reference (full Asana URL)
@crodris

crodris commented Jul 30, 2026

Copy link
Copy Markdown
Owner Author

Fixes Applied Successfully

Fixed 8 file(s) based on 11 of 14 CodeRabbit feedback item(s); 3 dispositioned.

Fixed:

  • bin/scan-skills.sh — scanner crashes counted and reported separately from findings
  • README.md — local scan usage corrected for the flat layout, baseline path updated
  • skills/workbench-shared/trackers.md — destination value is now adapter-owned and possibly composite; bulk sweep gh pr list requires an explicit --limit
  • skills/workbench-shared/trackers/linear.md — destination bundles team UUID + optional project id; merge-closer template parses responses with jq; unmapped phase is a documented no-op; ambiguous branch match fails
  • skills/workbench-shared/trackers/asana.md — ambiguous branch-to-record match fails instead of guessing; unmapped phase documented no-op (completed flag still set on done)
  • skills/workbench-shared/memory/beads.md — open count includes in_progress, matching the checklist adapter
  • skills/workbench-shared/memory/checklist.md — adopted task lines ride the breakdown commit; single-runner assumption documented with a second-runner stop
  • skills/scaffold/SKILL.md — hand-off passes the resolvable reference (full Asana URL; short ref display-only)

Dispositioned without change:

  • workflow pull_request paths — already identical to the push filter at this head
  • Asana merge-closer native — already offered before the Action, persisted, and treated exactly like installed ("Closing on merge without any workbench machinery" section)
  • approval-mode reapply after first-run setup — already mandated by approval.md ("When first-run setup then establishes a mode later in the same run, that answer governs the rest of that run"), which both skills must read before any tracker work

Commit: e335994

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant