From c0a399c77b20cf1a90ebbef67337f2615fab71d5 Mon Sep 17 00:00:00 2001 From: Pieter Viljoen Date: Tue, 1 Sep 2026 16:03:32 -0700 Subject: [PATCH 1/4] Split Two Sentences That Carried Several Instructions Each CodeRabbit on the promotion PR #1179, against text this branch's parent added. The workflow-edit sentence ran ninety words, putting the command, where to run it, what supplies shellcheck, and the CI caveat inside one parenthetical. Now four sentences, one instruction each. The Python tasks-mirror parenthetical was three fragments. Now three sentences stating what the snippet carries, what shape its tasks take, and why the shape matters. The canonical pass over the split then found a clause the split had carried through unchanged: "actionlint invokes `shellcheck` on `run:` blocks, which the wrapper's image provides" attaches "which" to the blocks rather than to shellcheck, and "the wrapper's image" is ambiguous where docker_lint.py runs seven of them, one of which is a separate shellcheck linter. A reader could add `--linter shellcheck` to cover `run:` blocks, get a zero-target skip on a repo with no tracked shell scripts, and conclude the blocks went unchecked. It now says actionlint's own image ships the binary, so `--linter actionlint` already covers them. --- .agents/skills/python-codestyle/SKILL.md | 7 ++++--- .agents/skills/workflow-ci-contract/SKILL.md | 2 +- .claude-plugin/fleet-skills/.source-digest | 2 +- .../skills/python-codestyle/SKILL.md | 7 ++++--- .../skills/workflow-ci-contract/SKILL.md | 2 +- .github/skills/python-codestyle/SKILL.md | 7 ++++--- .github/skills/workflow-ci-contract/SKILL.md | 2 +- reports/canonical-review.json | 16 ++++++++-------- 8 files changed, 24 insertions(+), 21 deletions(-) diff --git a/.agents/skills/python-codestyle/SKILL.md b/.agents/skills/python-codestyle/SKILL.md index d48241ba..ae1edba9 100644 --- a/.agents/skills/python-codestyle/SKILL.md +++ b/.agents/skills/python-codestyle/SKILL.md @@ -92,9 +92,10 @@ repo's type checker: `uv run pyright`, or `uv run mypy src` where mypy is the CI where the repo runs both (see Type checking above). Run it, plus `uv run pytest`, before committing. A **lint-only** profile's clean-compile substitutes its `uvx` and `unittest` equivalents, per Two Profiles above, and has no such command to run before committing beyond -those. These are documented commands, and a VS Code tasks mirror carried per the fleet baseline -(every command-executing task `type: process`, the aggregators dependsOn-only, no `&&` shell -chaining, so it runs the same on any task shell) is in the hub `vscode-tasks-python.json` snippet. +those. These are documented commands, and the hub's `vscode-tasks-python.json` snippet carries a VS +Code tasks mirror the fleet baseline expects. Every command-executing task in it is +`type: process`, and every aggregator is `dependsOn`-only. Neither chains with `&&`, so the +mirror runs the same on any task shell. CI runs the same clean-compile commands as the authoritative backstop. The Python mechanism for a local hook is the `pre-commit` framework, wired from the canonical `catalog/snippets/pre-commit/` directory, hub-local and not carried into every fleet repo. That directory's own README names the diff --git a/.agents/skills/workflow-ci-contract/SKILL.md b/.agents/skills/workflow-ci-contract/SKILL.md index b5b4973d..eb7fc75b 100644 --- a/.agents/skills/workflow-ci-contract/SKILL.md +++ b/.agents/skills/workflow-ci-contract/SKILL.md @@ -44,4 +44,4 @@ The full catalog, each guarantee with the failure mode it prevents, is in `refer ## After Any Workflow Edit -Workflow-only changes are not smoke-built, so run actionlint locally (via the hub-hosted `scripts/docker_lint.py` wrapper, run from the repository being checked as `python3 /path/to/ProjectTemplate/scripts/docker_lint.py --root "$PWD" --linter actionlint`, actionlint invoking `shellcheck` on `run:` blocks, which the wrapper's image provides, and documented in `GOVERNANCE.md`'s hub-only "Running the Linters Locally (Known-Working Invocations)" section) before pushing, and remember a workflow change is only fully exercised by CI, since `secrets: inherit`, `permissions:`, and `needs:` wiring resolve only in a real run. +Workflow-only changes are not smoke-built, so run actionlint locally before pushing. Run it from the repository being checked, as `python3 /path/to/ProjectTemplate/scripts/docker_lint.py --root "$PWD" --linter actionlint`, using the hub-hosted wrapper `GOVERNANCE.md`'s hub-only "Running the Linters Locally (Known-Working Invocations)" section documents. actionlint invokes `shellcheck` on `run:` blocks, and its own image ships that binary, so `--linter actionlint` already covers them. A workflow change is still only fully exercised by CI, since `secrets: inherit`, `permissions:`, and `needs:` wiring resolve only in a real run. diff --git a/.claude-plugin/fleet-skills/.source-digest b/.claude-plugin/fleet-skills/.source-digest index b2cf00c4..e4bfe197 100644 --- a/.claude-plugin/fleet-skills/.source-digest +++ b/.claude-plugin/fleet-skills/.source-digest @@ -1 +1 @@ -2a5718c1f6bca556 +79fb413968874761 diff --git a/.claude-plugin/fleet-skills/skills/python-codestyle/SKILL.md b/.claude-plugin/fleet-skills/skills/python-codestyle/SKILL.md index d48241ba..ae1edba9 100644 --- a/.claude-plugin/fleet-skills/skills/python-codestyle/SKILL.md +++ b/.claude-plugin/fleet-skills/skills/python-codestyle/SKILL.md @@ -92,9 +92,10 @@ repo's type checker: `uv run pyright`, or `uv run mypy src` where mypy is the CI where the repo runs both (see Type checking above). Run it, plus `uv run pytest`, before committing. A **lint-only** profile's clean-compile substitutes its `uvx` and `unittest` equivalents, per Two Profiles above, and has no such command to run before committing beyond -those. These are documented commands, and a VS Code tasks mirror carried per the fleet baseline -(every command-executing task `type: process`, the aggregators dependsOn-only, no `&&` shell -chaining, so it runs the same on any task shell) is in the hub `vscode-tasks-python.json` snippet. +those. These are documented commands, and the hub's `vscode-tasks-python.json` snippet carries a VS +Code tasks mirror the fleet baseline expects. Every command-executing task in it is +`type: process`, and every aggregator is `dependsOn`-only. Neither chains with `&&`, so the +mirror runs the same on any task shell. CI runs the same clean-compile commands as the authoritative backstop. The Python mechanism for a local hook is the `pre-commit` framework, wired from the canonical `catalog/snippets/pre-commit/` directory, hub-local and not carried into every fleet repo. That directory's own README names the diff --git a/.claude-plugin/fleet-skills/skills/workflow-ci-contract/SKILL.md b/.claude-plugin/fleet-skills/skills/workflow-ci-contract/SKILL.md index b5b4973d..eb7fc75b 100644 --- a/.claude-plugin/fleet-skills/skills/workflow-ci-contract/SKILL.md +++ b/.claude-plugin/fleet-skills/skills/workflow-ci-contract/SKILL.md @@ -44,4 +44,4 @@ The full catalog, each guarantee with the failure mode it prevents, is in `refer ## After Any Workflow Edit -Workflow-only changes are not smoke-built, so run actionlint locally (via the hub-hosted `scripts/docker_lint.py` wrapper, run from the repository being checked as `python3 /path/to/ProjectTemplate/scripts/docker_lint.py --root "$PWD" --linter actionlint`, actionlint invoking `shellcheck` on `run:` blocks, which the wrapper's image provides, and documented in `GOVERNANCE.md`'s hub-only "Running the Linters Locally (Known-Working Invocations)" section) before pushing, and remember a workflow change is only fully exercised by CI, since `secrets: inherit`, `permissions:`, and `needs:` wiring resolve only in a real run. +Workflow-only changes are not smoke-built, so run actionlint locally before pushing. Run it from the repository being checked, as `python3 /path/to/ProjectTemplate/scripts/docker_lint.py --root "$PWD" --linter actionlint`, using the hub-hosted wrapper `GOVERNANCE.md`'s hub-only "Running the Linters Locally (Known-Working Invocations)" section documents. actionlint invokes `shellcheck` on `run:` blocks, and its own image ships that binary, so `--linter actionlint` already covers them. A workflow change is still only fully exercised by CI, since `secrets: inherit`, `permissions:`, and `needs:` wiring resolve only in a real run. diff --git a/.github/skills/python-codestyle/SKILL.md b/.github/skills/python-codestyle/SKILL.md index d48241ba..ae1edba9 100644 --- a/.github/skills/python-codestyle/SKILL.md +++ b/.github/skills/python-codestyle/SKILL.md @@ -92,9 +92,10 @@ repo's type checker: `uv run pyright`, or `uv run mypy src` where mypy is the CI where the repo runs both (see Type checking above). Run it, plus `uv run pytest`, before committing. A **lint-only** profile's clean-compile substitutes its `uvx` and `unittest` equivalents, per Two Profiles above, and has no such command to run before committing beyond -those. These are documented commands, and a VS Code tasks mirror carried per the fleet baseline -(every command-executing task `type: process`, the aggregators dependsOn-only, no `&&` shell -chaining, so it runs the same on any task shell) is in the hub `vscode-tasks-python.json` snippet. +those. These are documented commands, and the hub's `vscode-tasks-python.json` snippet carries a VS +Code tasks mirror the fleet baseline expects. Every command-executing task in it is +`type: process`, and every aggregator is `dependsOn`-only. Neither chains with `&&`, so the +mirror runs the same on any task shell. CI runs the same clean-compile commands as the authoritative backstop. The Python mechanism for a local hook is the `pre-commit` framework, wired from the canonical `catalog/snippets/pre-commit/` directory, hub-local and not carried into every fleet repo. That directory's own README names the diff --git a/.github/skills/workflow-ci-contract/SKILL.md b/.github/skills/workflow-ci-contract/SKILL.md index b5b4973d..eb7fc75b 100644 --- a/.github/skills/workflow-ci-contract/SKILL.md +++ b/.github/skills/workflow-ci-contract/SKILL.md @@ -44,4 +44,4 @@ The full catalog, each guarantee with the failure mode it prevents, is in `refer ## After Any Workflow Edit -Workflow-only changes are not smoke-built, so run actionlint locally (via the hub-hosted `scripts/docker_lint.py` wrapper, run from the repository being checked as `python3 /path/to/ProjectTemplate/scripts/docker_lint.py --root "$PWD" --linter actionlint`, actionlint invoking `shellcheck` on `run:` blocks, which the wrapper's image provides, and documented in `GOVERNANCE.md`'s hub-only "Running the Linters Locally (Known-Working Invocations)" section) before pushing, and remember a workflow change is only fully exercised by CI, since `secrets: inherit`, `permissions:`, and `needs:` wiring resolve only in a real run. +Workflow-only changes are not smoke-built, so run actionlint locally before pushing. Run it from the repository being checked, as `python3 /path/to/ProjectTemplate/scripts/docker_lint.py --root "$PWD" --linter actionlint`, using the hub-hosted wrapper `GOVERNANCE.md`'s hub-only "Running the Linters Locally (Known-Working Invocations)" section documents. actionlint invokes `shellcheck` on `run:` blocks, and its own image ships that binary, so `--linter actionlint` already covers them. A workflow change is still only fully exercised by CI, since `secrets: inherit`, `permissions:`, and `needs:` wiring resolve only in a real run. diff --git a/reports/canonical-review.json b/reports/canonical-review.json index fd052ed2..8407e38e 100644 --- a/reports/canonical-review.json +++ b/reports/canonical-review.json @@ -163,11 +163,11 @@ }, { "unit": ".agents/skills/python-codestyle/SKILL.md > Local development loop", - "digest": "sha256:3c48ebba48fbcbdfd018881ae77fcc89396b0989999ba4c339444c86d8e378b5", + "digest": "sha256:e1696033b484b290bc469ee9dc1c336fba55966041b4766791f5a055920e5c5e", "reviewer": "agent-skill", - "findings": 3, - "hubCommit": "a76dda7d67033f43c260d21e3ae6a291e1869c0a", - "stamp": "2026-09-01T06:46:39Z" + "findings": 0, + "hubCommit": "42522c23365390d8a2cee5433c008afcda44465e", + "stamp": "2026-09-01T23:02:38Z" }, { "unit": ".agents/skills/repo-worktree/SKILL.md > Creating a Worktree", @@ -211,11 +211,11 @@ }, { "unit": ".agents/skills/workflow-ci-contract/SKILL.md > After Any Workflow Edit", - "digest": "sha256:c7078ad8a7867aaad6ee740e3208aad3d8b45a7c22f76c4b6a91fcb5bf11fa36", + "digest": "sha256:ef631a448fd6c7910cc59619df174ba6b23dff363b7c00608d271573fd371c97", "reviewer": "agent-skill", - "findings": 0, - "hubCommit": "6b3271c03c1a0dcdb71fd2ad0447ba2b4a1cd04c", - "stamp": "2026-09-01T15:41:23Z" + "findings": 1, + "hubCommit": "42522c23365390d8a2cee5433c008afcda44465e", + "stamp": "2026-09-01T23:02:38Z" }, { "unit": ".agents/skills/workflow-ci-contract/SKILL.md > How the Contract Is Read", From 5664a954bf0c11acb6bab9014b0463697d18da4b Mon Sep 17 00:00:00 2001 From: Pieter Viljoen Date: Tue, 1 Sep 2026 16:10:11 -0700 Subject: [PATCH 2/4] Add the Missing Pronoun, and Claim Only What the Repo States Copilot on #1181, both findings taken. "a VS Code tasks mirror the fleet baseline expects" drops the relative pronoun, which is the same zero-relative-pronoun shape #1119 was filed against and this branch's parent fixed elsewhere. Now "the VS Code tasks mirror that the fleet baseline expects". The actionlint sentence claimed its image ships the shellcheck binary. Nothing in this repository states that. GOVERNANCE.md says only that actionlint includes shellcheck for `run:` blocks, and that is the verified claim, so the text now says that instead and keeps the part that was the point: `--linter actionlint` already covers `run:` blocks, and `--linter shellcheck` is for tracked shell scripts. The image detail may well be true, but asserting a mechanism the repo does not record is how several claims in this branch's history turned out wrong, so the narrower statement is the right one. --- .agents/skills/python-codestyle/SKILL.md | 19 +++++++++---------- .agents/skills/workflow-ci-contract/SKILL.md | 2 +- .claude-plugin/fleet-skills/.source-digest | 2 +- .../skills/python-codestyle/SKILL.md | 19 +++++++++---------- .../skills/workflow-ci-contract/SKILL.md | 2 +- .github/skills/python-codestyle/SKILL.md | 19 +++++++++---------- .github/skills/workflow-ci-contract/SKILL.md | 2 +- reports/canonical-review.json | 14 +++++++------- 8 files changed, 38 insertions(+), 41 deletions(-) diff --git a/.agents/skills/python-codestyle/SKILL.md b/.agents/skills/python-codestyle/SKILL.md index ae1edba9..9812e23d 100644 --- a/.agents/skills/python-codestyle/SKILL.md +++ b/.agents/skills/python-codestyle/SKILL.md @@ -92,16 +92,15 @@ repo's type checker: `uv run pyright`, or `uv run mypy src` where mypy is the CI where the repo runs both (see Type checking above). Run it, plus `uv run pytest`, before committing. A **lint-only** profile's clean-compile substitutes its `uvx` and `unittest` equivalents, per Two Profiles above, and has no such command to run before committing beyond -those. These are documented commands, and the hub's `vscode-tasks-python.json` snippet carries a VS -Code tasks mirror the fleet baseline expects. Every command-executing task in it is -`type: process`, and every aggregator is `dependsOn`-only. Neither chains with `&&`, so the -mirror runs the same on any task shell. -CI runs the same clean-compile commands as the authoritative backstop. The Python mechanism for a -local hook is the `pre-commit` framework, wired from the canonical `catalog/snippets/pre-commit/` -directory, hub-local and not carried into every fleet repo. That directory's own README names the -second file to copy alongside the config. GOVERNANCE.md's hub-only "Running the Linters Locally -(Known-Working Invocations)" section carries the obligation itself, what the hook must cover, its -audit treatment, and the per-clone enablement steps. +those. These are documented commands, and the hub's `vscode-tasks-python.json` snippet carries the +VS Code tasks mirror that the fleet baseline expects. Every command-executing task in it is `type: +process`, and every aggregator is `dependsOn`-only. Neither chains with `&&`, so the mirror runs +the same on any task shell. CI runs the same clean-compile commands as the authoritative backstop. +The Python mechanism for a local hook is the `pre-commit` framework, wired from the canonical +`catalog/snippets/pre-commit/` directory, hub-local and not carried into every fleet repo. That +directory's own README names the second file to copy alongside the config. GOVERNANCE.md's +hub-only "Running the Linters Locally (Known-Working Invocations)" section carries the obligation +itself, what the hook must cover, its audit treatment, and the per-clone enablement steps. A restricted executor gives each task a cache directory under a writable temporary root. Point `UV_CACHE_DIR`, `RUFF_CACHE_DIR`, `MYPY_CACHE_DIR`, and `COVERAGE_FILE` into that directory before diff --git a/.agents/skills/workflow-ci-contract/SKILL.md b/.agents/skills/workflow-ci-contract/SKILL.md index eb7fc75b..e6e6a57a 100644 --- a/.agents/skills/workflow-ci-contract/SKILL.md +++ b/.agents/skills/workflow-ci-contract/SKILL.md @@ -44,4 +44,4 @@ The full catalog, each guarantee with the failure mode it prevents, is in `refer ## After Any Workflow Edit -Workflow-only changes are not smoke-built, so run actionlint locally before pushing. Run it from the repository being checked, as `python3 /path/to/ProjectTemplate/scripts/docker_lint.py --root "$PWD" --linter actionlint`, using the hub-hosted wrapper `GOVERNANCE.md`'s hub-only "Running the Linters Locally (Known-Working Invocations)" section documents. actionlint invokes `shellcheck` on `run:` blocks, and its own image ships that binary, so `--linter actionlint` already covers them. A workflow change is still only fully exercised by CI, since `secrets: inherit`, `permissions:`, and `needs:` wiring resolve only in a real run. +Workflow-only changes are not smoke-built, so run actionlint locally before pushing. Run it from the repository being checked, as `python3 /path/to/ProjectTemplate/scripts/docker_lint.py --root "$PWD" --linter actionlint`, using the hub-hosted wrapper `GOVERNANCE.md`'s hub-only "Running the Linters Locally (Known-Working Invocations)" section documents. actionlint includes `shellcheck` for `run:` blocks, so `--linter actionlint` already covers them and `--linter shellcheck` is for tracked shell scripts instead. A workflow change is still only fully exercised by CI, since `secrets: inherit`, `permissions:`, and `needs:` wiring resolve only in a real run. diff --git a/.claude-plugin/fleet-skills/.source-digest b/.claude-plugin/fleet-skills/.source-digest index e4bfe197..bad39d68 100644 --- a/.claude-plugin/fleet-skills/.source-digest +++ b/.claude-plugin/fleet-skills/.source-digest @@ -1 +1 @@ -79fb413968874761 +b6cf0b4092924a12 diff --git a/.claude-plugin/fleet-skills/skills/python-codestyle/SKILL.md b/.claude-plugin/fleet-skills/skills/python-codestyle/SKILL.md index ae1edba9..9812e23d 100644 --- a/.claude-plugin/fleet-skills/skills/python-codestyle/SKILL.md +++ b/.claude-plugin/fleet-skills/skills/python-codestyle/SKILL.md @@ -92,16 +92,15 @@ repo's type checker: `uv run pyright`, or `uv run mypy src` where mypy is the CI where the repo runs both (see Type checking above). Run it, plus `uv run pytest`, before committing. A **lint-only** profile's clean-compile substitutes its `uvx` and `unittest` equivalents, per Two Profiles above, and has no such command to run before committing beyond -those. These are documented commands, and the hub's `vscode-tasks-python.json` snippet carries a VS -Code tasks mirror the fleet baseline expects. Every command-executing task in it is -`type: process`, and every aggregator is `dependsOn`-only. Neither chains with `&&`, so the -mirror runs the same on any task shell. -CI runs the same clean-compile commands as the authoritative backstop. The Python mechanism for a -local hook is the `pre-commit` framework, wired from the canonical `catalog/snippets/pre-commit/` -directory, hub-local and not carried into every fleet repo. That directory's own README names the -second file to copy alongside the config. GOVERNANCE.md's hub-only "Running the Linters Locally -(Known-Working Invocations)" section carries the obligation itself, what the hook must cover, its -audit treatment, and the per-clone enablement steps. +those. These are documented commands, and the hub's `vscode-tasks-python.json` snippet carries the +VS Code tasks mirror that the fleet baseline expects. Every command-executing task in it is `type: +process`, and every aggregator is `dependsOn`-only. Neither chains with `&&`, so the mirror runs +the same on any task shell. CI runs the same clean-compile commands as the authoritative backstop. +The Python mechanism for a local hook is the `pre-commit` framework, wired from the canonical +`catalog/snippets/pre-commit/` directory, hub-local and not carried into every fleet repo. That +directory's own README names the second file to copy alongside the config. GOVERNANCE.md's +hub-only "Running the Linters Locally (Known-Working Invocations)" section carries the obligation +itself, what the hook must cover, its audit treatment, and the per-clone enablement steps. A restricted executor gives each task a cache directory under a writable temporary root. Point `UV_CACHE_DIR`, `RUFF_CACHE_DIR`, `MYPY_CACHE_DIR`, and `COVERAGE_FILE` into that directory before diff --git a/.claude-plugin/fleet-skills/skills/workflow-ci-contract/SKILL.md b/.claude-plugin/fleet-skills/skills/workflow-ci-contract/SKILL.md index eb7fc75b..e6e6a57a 100644 --- a/.claude-plugin/fleet-skills/skills/workflow-ci-contract/SKILL.md +++ b/.claude-plugin/fleet-skills/skills/workflow-ci-contract/SKILL.md @@ -44,4 +44,4 @@ The full catalog, each guarantee with the failure mode it prevents, is in `refer ## After Any Workflow Edit -Workflow-only changes are not smoke-built, so run actionlint locally before pushing. Run it from the repository being checked, as `python3 /path/to/ProjectTemplate/scripts/docker_lint.py --root "$PWD" --linter actionlint`, using the hub-hosted wrapper `GOVERNANCE.md`'s hub-only "Running the Linters Locally (Known-Working Invocations)" section documents. actionlint invokes `shellcheck` on `run:` blocks, and its own image ships that binary, so `--linter actionlint` already covers them. A workflow change is still only fully exercised by CI, since `secrets: inherit`, `permissions:`, and `needs:` wiring resolve only in a real run. +Workflow-only changes are not smoke-built, so run actionlint locally before pushing. Run it from the repository being checked, as `python3 /path/to/ProjectTemplate/scripts/docker_lint.py --root "$PWD" --linter actionlint`, using the hub-hosted wrapper `GOVERNANCE.md`'s hub-only "Running the Linters Locally (Known-Working Invocations)" section documents. actionlint includes `shellcheck` for `run:` blocks, so `--linter actionlint` already covers them and `--linter shellcheck` is for tracked shell scripts instead. A workflow change is still only fully exercised by CI, since `secrets: inherit`, `permissions:`, and `needs:` wiring resolve only in a real run. diff --git a/.github/skills/python-codestyle/SKILL.md b/.github/skills/python-codestyle/SKILL.md index ae1edba9..9812e23d 100644 --- a/.github/skills/python-codestyle/SKILL.md +++ b/.github/skills/python-codestyle/SKILL.md @@ -92,16 +92,15 @@ repo's type checker: `uv run pyright`, or `uv run mypy src` where mypy is the CI where the repo runs both (see Type checking above). Run it, plus `uv run pytest`, before committing. A **lint-only** profile's clean-compile substitutes its `uvx` and `unittest` equivalents, per Two Profiles above, and has no such command to run before committing beyond -those. These are documented commands, and the hub's `vscode-tasks-python.json` snippet carries a VS -Code tasks mirror the fleet baseline expects. Every command-executing task in it is -`type: process`, and every aggregator is `dependsOn`-only. Neither chains with `&&`, so the -mirror runs the same on any task shell. -CI runs the same clean-compile commands as the authoritative backstop. The Python mechanism for a -local hook is the `pre-commit` framework, wired from the canonical `catalog/snippets/pre-commit/` -directory, hub-local and not carried into every fleet repo. That directory's own README names the -second file to copy alongside the config. GOVERNANCE.md's hub-only "Running the Linters Locally -(Known-Working Invocations)" section carries the obligation itself, what the hook must cover, its -audit treatment, and the per-clone enablement steps. +those. These are documented commands, and the hub's `vscode-tasks-python.json` snippet carries the +VS Code tasks mirror that the fleet baseline expects. Every command-executing task in it is `type: +process`, and every aggregator is `dependsOn`-only. Neither chains with `&&`, so the mirror runs +the same on any task shell. CI runs the same clean-compile commands as the authoritative backstop. +The Python mechanism for a local hook is the `pre-commit` framework, wired from the canonical +`catalog/snippets/pre-commit/` directory, hub-local and not carried into every fleet repo. That +directory's own README names the second file to copy alongside the config. GOVERNANCE.md's +hub-only "Running the Linters Locally (Known-Working Invocations)" section carries the obligation +itself, what the hook must cover, its audit treatment, and the per-clone enablement steps. A restricted executor gives each task a cache directory under a writable temporary root. Point `UV_CACHE_DIR`, `RUFF_CACHE_DIR`, `MYPY_CACHE_DIR`, and `COVERAGE_FILE` into that directory before diff --git a/.github/skills/workflow-ci-contract/SKILL.md b/.github/skills/workflow-ci-contract/SKILL.md index eb7fc75b..e6e6a57a 100644 --- a/.github/skills/workflow-ci-contract/SKILL.md +++ b/.github/skills/workflow-ci-contract/SKILL.md @@ -44,4 +44,4 @@ The full catalog, each guarantee with the failure mode it prevents, is in `refer ## After Any Workflow Edit -Workflow-only changes are not smoke-built, so run actionlint locally before pushing. Run it from the repository being checked, as `python3 /path/to/ProjectTemplate/scripts/docker_lint.py --root "$PWD" --linter actionlint`, using the hub-hosted wrapper `GOVERNANCE.md`'s hub-only "Running the Linters Locally (Known-Working Invocations)" section documents. actionlint invokes `shellcheck` on `run:` blocks, and its own image ships that binary, so `--linter actionlint` already covers them. A workflow change is still only fully exercised by CI, since `secrets: inherit`, `permissions:`, and `needs:` wiring resolve only in a real run. +Workflow-only changes are not smoke-built, so run actionlint locally before pushing. Run it from the repository being checked, as `python3 /path/to/ProjectTemplate/scripts/docker_lint.py --root "$PWD" --linter actionlint`, using the hub-hosted wrapper `GOVERNANCE.md`'s hub-only "Running the Linters Locally (Known-Working Invocations)" section documents. actionlint includes `shellcheck` for `run:` blocks, so `--linter actionlint` already covers them and `--linter shellcheck` is for tracked shell scripts instead. A workflow change is still only fully exercised by CI, since `secrets: inherit`, `permissions:`, and `needs:` wiring resolve only in a real run. diff --git a/reports/canonical-review.json b/reports/canonical-review.json index 8407e38e..2b261dab 100644 --- a/reports/canonical-review.json +++ b/reports/canonical-review.json @@ -163,11 +163,11 @@ }, { "unit": ".agents/skills/python-codestyle/SKILL.md > Local development loop", - "digest": "sha256:e1696033b484b290bc469ee9dc1c336fba55966041b4766791f5a055920e5c5e", + "digest": "sha256:791d791545888299263233bd90f9d3f9a8c517ab38b64423196362c5b68e5fed", "reviewer": "agent-skill", - "findings": 0, - "hubCommit": "42522c23365390d8a2cee5433c008afcda44465e", - "stamp": "2026-09-01T23:02:38Z" + "findings": 1, + "hubCommit": "c0a399c77b20cf1a90ebbef67337f2615fab71d5", + "stamp": "2026-09-01T23:09:43Z" }, { "unit": ".agents/skills/repo-worktree/SKILL.md > Creating a Worktree", @@ -211,11 +211,11 @@ }, { "unit": ".agents/skills/workflow-ci-contract/SKILL.md > After Any Workflow Edit", - "digest": "sha256:ef631a448fd6c7910cc59619df174ba6b23dff363b7c00608d271573fd371c97", + "digest": "sha256:455ae750638b227847f3840107e3389154cdeddca2c3678c7cd77e2743c14246", "reviewer": "agent-skill", "findings": 1, - "hubCommit": "42522c23365390d8a2cee5433c008afcda44465e", - "stamp": "2026-09-01T23:02:38Z" + "hubCommit": "c0a399c77b20cf1a90ebbef67337f2615fab71d5", + "stamp": "2026-09-01T23:09:43Z" }, { "unit": ".agents/skills/workflow-ci-contract/SKILL.md > How the Contract Is Read", From f858a194ce29fa5702e2ce1c6ff8d1f3b221b2ee Mon Sep 17 00:00:00 2001 From: Pieter Viljoen Date: Tue, 1 Sep 2026 16:20:02 -0700 Subject: [PATCH 3/4] Name the Wrapper's Documentation, and Keep type: process on One Line Copilot and CodeRabbit, independently, on the same clause: "using the hub-hosted wrapper `GOVERNANCE.md`'s ... section documents" reads as the wrapper being the section. It is a zero relative pronoun, the third in this branch and the same construction #1119 was filed against. Now "the hub-hosted wrapper documented in ... section". Copilot also caught `type: process` split across a line by an earlier rewrap. Fixed, and fixed the way it kept recurring: a plain textwrap does not know a code span is one token, so the paragraph is now reflowed with spaces inside spans held together and the result checked for an odd backtick count per line before it is written. That check is what caught the second occurrence, after a hand fix had already put the first one back. --- .agents/skills/python-codestyle/SKILL.md | 17 +++++++++-------- .agents/skills/workflow-ci-contract/SKILL.md | 2 +- .claude-plugin/fleet-skills/.source-digest | 2 +- .../skills/python-codestyle/SKILL.md | 17 +++++++++-------- .../skills/workflow-ci-contract/SKILL.md | 2 +- .github/skills/python-codestyle/SKILL.md | 17 +++++++++-------- .github/skills/workflow-ci-contract/SKILL.md | 2 +- reports/canonical-review.json | 12 ++++++------ 8 files changed, 37 insertions(+), 34 deletions(-) diff --git a/.agents/skills/python-codestyle/SKILL.md b/.agents/skills/python-codestyle/SKILL.md index 9812e23d..210a67b7 100644 --- a/.agents/skills/python-codestyle/SKILL.md +++ b/.agents/skills/python-codestyle/SKILL.md @@ -93,14 +93,15 @@ where the repo runs both (see Type checking above). Run it, plus `uv run pytest` committing. A **lint-only** profile's clean-compile substitutes its `uvx` and `unittest` equivalents, per Two Profiles above, and has no such command to run before committing beyond those. These are documented commands, and the hub's `vscode-tasks-python.json` snippet carries the -VS Code tasks mirror that the fleet baseline expects. Every command-executing task in it is `type: -process`, and every aggregator is `dependsOn`-only. Neither chains with `&&`, so the mirror runs -the same on any task shell. CI runs the same clean-compile commands as the authoritative backstop. -The Python mechanism for a local hook is the `pre-commit` framework, wired from the canonical -`catalog/snippets/pre-commit/` directory, hub-local and not carried into every fleet repo. That -directory's own README names the second file to copy alongside the config. GOVERNANCE.md's -hub-only "Running the Linters Locally (Known-Working Invocations)" section carries the obligation -itself, what the hook must cover, its audit treatment, and the per-clone enablement steps. +VS Code tasks mirror that the fleet baseline expects. Every command-executing task in it is +`type: process`, and every aggregator is `dependsOn`-only. Neither chains with `&&`, so the mirror +runs the same on any task shell. CI runs the same clean-compile commands as the authoritative +backstop. The Python mechanism for a local hook is the `pre-commit` framework, wired from the +canonical `catalog/snippets/pre-commit/` directory, hub-local and not carried into every fleet +repo. That directory's own README names the second file to copy alongside the config. +GOVERNANCE.md's hub-only "Running the Linters Locally (Known-Working Invocations)" section carries +the obligation itself, what the hook must cover, its audit treatment, and the per-clone enablement +steps. A restricted executor gives each task a cache directory under a writable temporary root. Point `UV_CACHE_DIR`, `RUFF_CACHE_DIR`, `MYPY_CACHE_DIR`, and `COVERAGE_FILE` into that directory before diff --git a/.agents/skills/workflow-ci-contract/SKILL.md b/.agents/skills/workflow-ci-contract/SKILL.md index e6e6a57a..67cc24b5 100644 --- a/.agents/skills/workflow-ci-contract/SKILL.md +++ b/.agents/skills/workflow-ci-contract/SKILL.md @@ -44,4 +44,4 @@ The full catalog, each guarantee with the failure mode it prevents, is in `refer ## After Any Workflow Edit -Workflow-only changes are not smoke-built, so run actionlint locally before pushing. Run it from the repository being checked, as `python3 /path/to/ProjectTemplate/scripts/docker_lint.py --root "$PWD" --linter actionlint`, using the hub-hosted wrapper `GOVERNANCE.md`'s hub-only "Running the Linters Locally (Known-Working Invocations)" section documents. actionlint includes `shellcheck` for `run:` blocks, so `--linter actionlint` already covers them and `--linter shellcheck` is for tracked shell scripts instead. A workflow change is still only fully exercised by CI, since `secrets: inherit`, `permissions:`, and `needs:` wiring resolve only in a real run. +Workflow-only changes are not smoke-built, so run actionlint locally before pushing. Run it from the repository being checked, as `python3 /path/to/ProjectTemplate/scripts/docker_lint.py --root "$PWD" --linter actionlint`, using the hub-hosted wrapper documented in `GOVERNANCE.md`'s hub-only "Running the Linters Locally (Known-Working Invocations)" section. actionlint includes `shellcheck` for `run:` blocks, so `--linter actionlint` already covers them and `--linter shellcheck` is for tracked shell scripts instead. A workflow change is still only fully exercised by CI, since `secrets: inherit`, `permissions:`, and `needs:` wiring resolve only in a real run. diff --git a/.claude-plugin/fleet-skills/.source-digest b/.claude-plugin/fleet-skills/.source-digest index bad39d68..806fce6d 100644 --- a/.claude-plugin/fleet-skills/.source-digest +++ b/.claude-plugin/fleet-skills/.source-digest @@ -1 +1 @@ -b6cf0b4092924a12 +5801c1b5beb27056 diff --git a/.claude-plugin/fleet-skills/skills/python-codestyle/SKILL.md b/.claude-plugin/fleet-skills/skills/python-codestyle/SKILL.md index 9812e23d..210a67b7 100644 --- a/.claude-plugin/fleet-skills/skills/python-codestyle/SKILL.md +++ b/.claude-plugin/fleet-skills/skills/python-codestyle/SKILL.md @@ -93,14 +93,15 @@ where the repo runs both (see Type checking above). Run it, plus `uv run pytest` committing. A **lint-only** profile's clean-compile substitutes its `uvx` and `unittest` equivalents, per Two Profiles above, and has no such command to run before committing beyond those. These are documented commands, and the hub's `vscode-tasks-python.json` snippet carries the -VS Code tasks mirror that the fleet baseline expects. Every command-executing task in it is `type: -process`, and every aggregator is `dependsOn`-only. Neither chains with `&&`, so the mirror runs -the same on any task shell. CI runs the same clean-compile commands as the authoritative backstop. -The Python mechanism for a local hook is the `pre-commit` framework, wired from the canonical -`catalog/snippets/pre-commit/` directory, hub-local and not carried into every fleet repo. That -directory's own README names the second file to copy alongside the config. GOVERNANCE.md's -hub-only "Running the Linters Locally (Known-Working Invocations)" section carries the obligation -itself, what the hook must cover, its audit treatment, and the per-clone enablement steps. +VS Code tasks mirror that the fleet baseline expects. Every command-executing task in it is +`type: process`, and every aggregator is `dependsOn`-only. Neither chains with `&&`, so the mirror +runs the same on any task shell. CI runs the same clean-compile commands as the authoritative +backstop. The Python mechanism for a local hook is the `pre-commit` framework, wired from the +canonical `catalog/snippets/pre-commit/` directory, hub-local and not carried into every fleet +repo. That directory's own README names the second file to copy alongside the config. +GOVERNANCE.md's hub-only "Running the Linters Locally (Known-Working Invocations)" section carries +the obligation itself, what the hook must cover, its audit treatment, and the per-clone enablement +steps. A restricted executor gives each task a cache directory under a writable temporary root. Point `UV_CACHE_DIR`, `RUFF_CACHE_DIR`, `MYPY_CACHE_DIR`, and `COVERAGE_FILE` into that directory before diff --git a/.claude-plugin/fleet-skills/skills/workflow-ci-contract/SKILL.md b/.claude-plugin/fleet-skills/skills/workflow-ci-contract/SKILL.md index e6e6a57a..67cc24b5 100644 --- a/.claude-plugin/fleet-skills/skills/workflow-ci-contract/SKILL.md +++ b/.claude-plugin/fleet-skills/skills/workflow-ci-contract/SKILL.md @@ -44,4 +44,4 @@ The full catalog, each guarantee with the failure mode it prevents, is in `refer ## After Any Workflow Edit -Workflow-only changes are not smoke-built, so run actionlint locally before pushing. Run it from the repository being checked, as `python3 /path/to/ProjectTemplate/scripts/docker_lint.py --root "$PWD" --linter actionlint`, using the hub-hosted wrapper `GOVERNANCE.md`'s hub-only "Running the Linters Locally (Known-Working Invocations)" section documents. actionlint includes `shellcheck` for `run:` blocks, so `--linter actionlint` already covers them and `--linter shellcheck` is for tracked shell scripts instead. A workflow change is still only fully exercised by CI, since `secrets: inherit`, `permissions:`, and `needs:` wiring resolve only in a real run. +Workflow-only changes are not smoke-built, so run actionlint locally before pushing. Run it from the repository being checked, as `python3 /path/to/ProjectTemplate/scripts/docker_lint.py --root "$PWD" --linter actionlint`, using the hub-hosted wrapper documented in `GOVERNANCE.md`'s hub-only "Running the Linters Locally (Known-Working Invocations)" section. actionlint includes `shellcheck` for `run:` blocks, so `--linter actionlint` already covers them and `--linter shellcheck` is for tracked shell scripts instead. A workflow change is still only fully exercised by CI, since `secrets: inherit`, `permissions:`, and `needs:` wiring resolve only in a real run. diff --git a/.github/skills/python-codestyle/SKILL.md b/.github/skills/python-codestyle/SKILL.md index 9812e23d..210a67b7 100644 --- a/.github/skills/python-codestyle/SKILL.md +++ b/.github/skills/python-codestyle/SKILL.md @@ -93,14 +93,15 @@ where the repo runs both (see Type checking above). Run it, plus `uv run pytest` committing. A **lint-only** profile's clean-compile substitutes its `uvx` and `unittest` equivalents, per Two Profiles above, and has no such command to run before committing beyond those. These are documented commands, and the hub's `vscode-tasks-python.json` snippet carries the -VS Code tasks mirror that the fleet baseline expects. Every command-executing task in it is `type: -process`, and every aggregator is `dependsOn`-only. Neither chains with `&&`, so the mirror runs -the same on any task shell. CI runs the same clean-compile commands as the authoritative backstop. -The Python mechanism for a local hook is the `pre-commit` framework, wired from the canonical -`catalog/snippets/pre-commit/` directory, hub-local and not carried into every fleet repo. That -directory's own README names the second file to copy alongside the config. GOVERNANCE.md's -hub-only "Running the Linters Locally (Known-Working Invocations)" section carries the obligation -itself, what the hook must cover, its audit treatment, and the per-clone enablement steps. +VS Code tasks mirror that the fleet baseline expects. Every command-executing task in it is +`type: process`, and every aggregator is `dependsOn`-only. Neither chains with `&&`, so the mirror +runs the same on any task shell. CI runs the same clean-compile commands as the authoritative +backstop. The Python mechanism for a local hook is the `pre-commit` framework, wired from the +canonical `catalog/snippets/pre-commit/` directory, hub-local and not carried into every fleet +repo. That directory's own README names the second file to copy alongside the config. +GOVERNANCE.md's hub-only "Running the Linters Locally (Known-Working Invocations)" section carries +the obligation itself, what the hook must cover, its audit treatment, and the per-clone enablement +steps. A restricted executor gives each task a cache directory under a writable temporary root. Point `UV_CACHE_DIR`, `RUFF_CACHE_DIR`, `MYPY_CACHE_DIR`, and `COVERAGE_FILE` into that directory before diff --git a/.github/skills/workflow-ci-contract/SKILL.md b/.github/skills/workflow-ci-contract/SKILL.md index e6e6a57a..67cc24b5 100644 --- a/.github/skills/workflow-ci-contract/SKILL.md +++ b/.github/skills/workflow-ci-contract/SKILL.md @@ -44,4 +44,4 @@ The full catalog, each guarantee with the failure mode it prevents, is in `refer ## After Any Workflow Edit -Workflow-only changes are not smoke-built, so run actionlint locally before pushing. Run it from the repository being checked, as `python3 /path/to/ProjectTemplate/scripts/docker_lint.py --root "$PWD" --linter actionlint`, using the hub-hosted wrapper `GOVERNANCE.md`'s hub-only "Running the Linters Locally (Known-Working Invocations)" section documents. actionlint includes `shellcheck` for `run:` blocks, so `--linter actionlint` already covers them and `--linter shellcheck` is for tracked shell scripts instead. A workflow change is still only fully exercised by CI, since `secrets: inherit`, `permissions:`, and `needs:` wiring resolve only in a real run. +Workflow-only changes are not smoke-built, so run actionlint locally before pushing. Run it from the repository being checked, as `python3 /path/to/ProjectTemplate/scripts/docker_lint.py --root "$PWD" --linter actionlint`, using the hub-hosted wrapper documented in `GOVERNANCE.md`'s hub-only "Running the Linters Locally (Known-Working Invocations)" section. actionlint includes `shellcheck` for `run:` blocks, so `--linter actionlint` already covers them and `--linter shellcheck` is for tracked shell scripts instead. A workflow change is still only fully exercised by CI, since `secrets: inherit`, `permissions:`, and `needs:` wiring resolve only in a real run. diff --git a/reports/canonical-review.json b/reports/canonical-review.json index 2b261dab..39537cbd 100644 --- a/reports/canonical-review.json +++ b/reports/canonical-review.json @@ -163,11 +163,11 @@ }, { "unit": ".agents/skills/python-codestyle/SKILL.md > Local development loop", - "digest": "sha256:791d791545888299263233bd90f9d3f9a8c517ab38b64423196362c5b68e5fed", + "digest": "sha256:6f1081d1c1cf0f719f9c154c0b5652a26c7c1f6d2478adc3717becb248a61458", "reviewer": "agent-skill", "findings": 1, - "hubCommit": "c0a399c77b20cf1a90ebbef67337f2615fab71d5", - "stamp": "2026-09-01T23:09:43Z" + "hubCommit": "5664a954bf0c11acb6bab9014b0463697d18da4b", + "stamp": "2026-09-01T23:19:53Z" }, { "unit": ".agents/skills/repo-worktree/SKILL.md > Creating a Worktree", @@ -211,11 +211,11 @@ }, { "unit": ".agents/skills/workflow-ci-contract/SKILL.md > After Any Workflow Edit", - "digest": "sha256:455ae750638b227847f3840107e3389154cdeddca2c3678c7cd77e2743c14246", + "digest": "sha256:4c6d8b55e84a4a2162e6b1e5fc818505db7a4a394ded50487a39804aafea6101", "reviewer": "agent-skill", "findings": 1, - "hubCommit": "c0a399c77b20cf1a90ebbef67337f2615fab71d5", - "stamp": "2026-09-01T23:09:43Z" + "hubCommit": "5664a954bf0c11acb6bab9014b0463697d18da4b", + "stamp": "2026-09-01T23:17:25Z" }, { "unit": ".agents/skills/workflow-ci-contract/SKILL.md > How the Contract Is Read", From 91fdf398b58b55e72036725d0e095fb8b5524625 Mon Sep 17 00:00:00 2001 From: Pieter Viljoen Date: Tue, 1 Sep 2026 16:25:45 -0700 Subject: [PATCH 4/4] Drop a Clause Rather Than Narrow It Again Copilot: "`--linter shellcheck` is for tracked shell scripts" is too narrow for the wrapper it describes. Confirmed: docker_lint.py's ls_files takes include_untracked=True by default, and GOVERNANCE.md states the scope as "tracked or unignored". The clause is removed rather than corrected. It was never needed for the point the sentence makes, which is that `--linter actionlint` already covers `run:` blocks, and naming what a different flag is for invited a claim about discovery scope that the sentence had no reason to make. What remains matches GOVERNANCE.md's own wording exactly. This is the fourth reviewer finding in this branch against a qualifier added to a sentence that did not need one. Each was true of something and wrong about the thing it was attached to, so removing the qualifier is the fix rather than narrowing it a third time. --- .agents/skills/workflow-ci-contract/SKILL.md | 2 +- .claude-plugin/fleet-skills/.source-digest | 2 +- .../fleet-skills/skills/workflow-ci-contract/SKILL.md | 2 +- .github/skills/workflow-ci-contract/SKILL.md | 2 +- reports/canonical-review.json | 6 +++--- 5 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.agents/skills/workflow-ci-contract/SKILL.md b/.agents/skills/workflow-ci-contract/SKILL.md index 67cc24b5..9eaf908f 100644 --- a/.agents/skills/workflow-ci-contract/SKILL.md +++ b/.agents/skills/workflow-ci-contract/SKILL.md @@ -44,4 +44,4 @@ The full catalog, each guarantee with the failure mode it prevents, is in `refer ## After Any Workflow Edit -Workflow-only changes are not smoke-built, so run actionlint locally before pushing. Run it from the repository being checked, as `python3 /path/to/ProjectTemplate/scripts/docker_lint.py --root "$PWD" --linter actionlint`, using the hub-hosted wrapper documented in `GOVERNANCE.md`'s hub-only "Running the Linters Locally (Known-Working Invocations)" section. actionlint includes `shellcheck` for `run:` blocks, so `--linter actionlint` already covers them and `--linter shellcheck` is for tracked shell scripts instead. A workflow change is still only fully exercised by CI, since `secrets: inherit`, `permissions:`, and `needs:` wiring resolve only in a real run. +Workflow-only changes are not smoke-built, so run actionlint locally before pushing. Run it from the repository being checked, as `python3 /path/to/ProjectTemplate/scripts/docker_lint.py --root "$PWD" --linter actionlint`, using the hub-hosted wrapper documented in `GOVERNANCE.md`'s hub-only "Running the Linters Locally (Known-Working Invocations)" section. actionlint includes `shellcheck` for `run:` blocks, so `--linter actionlint` already covers them. A workflow change is still only fully exercised by CI, since `secrets: inherit`, `permissions:`, and `needs:` wiring resolve only in a real run. diff --git a/.claude-plugin/fleet-skills/.source-digest b/.claude-plugin/fleet-skills/.source-digest index 806fce6d..008f19b6 100644 --- a/.claude-plugin/fleet-skills/.source-digest +++ b/.claude-plugin/fleet-skills/.source-digest @@ -1 +1 @@ -5801c1b5beb27056 +fe834763b58313f7 diff --git a/.claude-plugin/fleet-skills/skills/workflow-ci-contract/SKILL.md b/.claude-plugin/fleet-skills/skills/workflow-ci-contract/SKILL.md index 67cc24b5..9eaf908f 100644 --- a/.claude-plugin/fleet-skills/skills/workflow-ci-contract/SKILL.md +++ b/.claude-plugin/fleet-skills/skills/workflow-ci-contract/SKILL.md @@ -44,4 +44,4 @@ The full catalog, each guarantee with the failure mode it prevents, is in `refer ## After Any Workflow Edit -Workflow-only changes are not smoke-built, so run actionlint locally before pushing. Run it from the repository being checked, as `python3 /path/to/ProjectTemplate/scripts/docker_lint.py --root "$PWD" --linter actionlint`, using the hub-hosted wrapper documented in `GOVERNANCE.md`'s hub-only "Running the Linters Locally (Known-Working Invocations)" section. actionlint includes `shellcheck` for `run:` blocks, so `--linter actionlint` already covers them and `--linter shellcheck` is for tracked shell scripts instead. A workflow change is still only fully exercised by CI, since `secrets: inherit`, `permissions:`, and `needs:` wiring resolve only in a real run. +Workflow-only changes are not smoke-built, so run actionlint locally before pushing. Run it from the repository being checked, as `python3 /path/to/ProjectTemplate/scripts/docker_lint.py --root "$PWD" --linter actionlint`, using the hub-hosted wrapper documented in `GOVERNANCE.md`'s hub-only "Running the Linters Locally (Known-Working Invocations)" section. actionlint includes `shellcheck` for `run:` blocks, so `--linter actionlint` already covers them. A workflow change is still only fully exercised by CI, since `secrets: inherit`, `permissions:`, and `needs:` wiring resolve only in a real run. diff --git a/.github/skills/workflow-ci-contract/SKILL.md b/.github/skills/workflow-ci-contract/SKILL.md index 67cc24b5..9eaf908f 100644 --- a/.github/skills/workflow-ci-contract/SKILL.md +++ b/.github/skills/workflow-ci-contract/SKILL.md @@ -44,4 +44,4 @@ The full catalog, each guarantee with the failure mode it prevents, is in `refer ## After Any Workflow Edit -Workflow-only changes are not smoke-built, so run actionlint locally before pushing. Run it from the repository being checked, as `python3 /path/to/ProjectTemplate/scripts/docker_lint.py --root "$PWD" --linter actionlint`, using the hub-hosted wrapper documented in `GOVERNANCE.md`'s hub-only "Running the Linters Locally (Known-Working Invocations)" section. actionlint includes `shellcheck` for `run:` blocks, so `--linter actionlint` already covers them and `--linter shellcheck` is for tracked shell scripts instead. A workflow change is still only fully exercised by CI, since `secrets: inherit`, `permissions:`, and `needs:` wiring resolve only in a real run. +Workflow-only changes are not smoke-built, so run actionlint locally before pushing. Run it from the repository being checked, as `python3 /path/to/ProjectTemplate/scripts/docker_lint.py --root "$PWD" --linter actionlint`, using the hub-hosted wrapper documented in `GOVERNANCE.md`'s hub-only "Running the Linters Locally (Known-Working Invocations)" section. actionlint includes `shellcheck` for `run:` blocks, so `--linter actionlint` already covers them. A workflow change is still only fully exercised by CI, since `secrets: inherit`, `permissions:`, and `needs:` wiring resolve only in a real run. diff --git a/reports/canonical-review.json b/reports/canonical-review.json index 39537cbd..cb008295 100644 --- a/reports/canonical-review.json +++ b/reports/canonical-review.json @@ -211,11 +211,11 @@ }, { "unit": ".agents/skills/workflow-ci-contract/SKILL.md > After Any Workflow Edit", - "digest": "sha256:4c6d8b55e84a4a2162e6b1e5fc818505db7a4a394ded50487a39804aafea6101", + "digest": "sha256:7dc31b8f1e7e25effd4b85078f9099b89cf3663452ed0400cf255df019fbef0e", "reviewer": "agent-skill", "findings": 1, - "hubCommit": "5664a954bf0c11acb6bab9014b0463697d18da4b", - "stamp": "2026-09-01T23:17:25Z" + "hubCommit": "f858a194ce29fa5702e2ce1c6ff8d1f3b221b2ee", + "stamp": "2026-09-01T23:24:57Z" }, { "unit": ".agents/skills/workflow-ci-contract/SKILL.md > How the Contract Is Read",