📦 deps(thirdparty): update snapshots

antigravity-awesome-skills/tools/scripts/tests/aas_v1_adapters.test.js

@@ -12,7 +12,7 @@ const {
   cleanupBackups,
   inspectHostConfig,
 } = require("../../lib/aas-v1/adapters");
-const { inspectRegularFile } = require("../../lib/aas-v1/adapters/safety");
+const { inspectRegularFile, runWindowsAcl } = require("../../lib/aas-v1/adapters/safety");
 
 const FIXTURES = path.join(__dirname, "fixtures", "aas-v1-adapters");
 const CODEX_SERVER = { command: "/opt/aas/aas-mcp", args: ["--stdio", "--runtime", "14.6.0"], enabled: true };
@@ -139,6 +139,31 @@ test("symlink, non-regular, and ownership mismatches are rejected", async (t) =>
   await assert.rejects(inspectRegularFile(real, { expectedUid: stat.uid + 1 }), (error) => error.code === "AAS_ADAPTER_OWNERSHIP_MISMATCH");
 });
 
+test("Windows ACL runner passes paths out of the command and reports bounded diagnostics", () => {
+  const inspectedPath = String.raw`C:\Users\Example\.codex\config.toml`;
+  let invocation;
+  const runner = (...args) => {
+    invocation = args;
+    return { status: 1, stdout: "", stderr: "Get-Acl failed\r\nwith details\u0000" };
+  };
+  assert.throws(
+    () => runWindowsAcl("$p=$env:AAS_WINDOWS_ACL_PATH", inspectedPath, { phase: "inspectAcl", runner }),
+    (error) => {
+      assert.equal(error.code, "AAS_ADAPTER_WINDOWS_ACL_FAILED");
+      assert.deepEqual(error.details, {
+        status: 1,
+        phase: "inspectAcl",
+        path: inspectedPath,
+        diagnostic: "Get-Acl failed with details",
+      });
+      return true;
+    },
+  );
+  assert.deepEqual(invocation[1], ["-NoProfile", "-NonInteractive", "-Command", "$p=$env:AAS_WINDOWS_ACL_PATH"]);
+  assert.equal(invocation[2].env.AAS_WINDOWS_ACL_PATH, inspectedPath);
+  assert.ok(!invocation[1].includes(inspectedPath));
+});
+
 test("ambiguous TOML and duplicate JSON keys fail closed", async (t) => {
   const directory = await temporaryDirectory(t);
   const toml = path.join(directory, "config.toml");

antigravity-awesome-skills/tools/scripts/tests/aas_v1_core.test.js

@@ -68,7 +68,7 @@ test("search retrieval preserves catalog order without scores or relevance ranki
     skills: [
       { id: "z-first", name: "Z first", category: "test", searchTokens: ["alpha"], description: "", tags: [], triggers: [] },
       { id: "a-many", name: "A many", category: "test", searchTokens: ["alpha", "beta"], description: "", tags: [], triggers: [] },
-      { id: "m-second", name: "M second", category: "test", searchTokens: ["beta"], description: "", tags: [], triggers: [] },
+      { id: "m-second", name: "M second", category: "test", searchTokens: ["beta", "many"], description: "", tags: [], triggers: [] },
       { id: "unrelated", name: "Unrelated", category: "test", searchTokens: ["gamma"], description: "", tags: [], triggers: [] },
     ],
   };
@@ -85,22 +85,16 @@ test("search retrieval preserves catalog order without scores or relevance ranki
   }
 
   const exact = core.searchSkills(catalog, { query: "a-many", limit: 50 });
-  assert.deepEqual(exact.results.map((entry) => entry.id), ["a-many"]);
+  assert.deepEqual(exact.results.map((entry) => entry.id), ["a-many", "m-second"]);
 });
 
-test("every canonical skill is directly gettable, exactly searchable, and agent-composable", () => {
+test("every canonical skill is directly gettable and agent-composable", () => {
   const catalog = core.loadBundledCatalog();
 
   for (const id of canonicalSkillIds) {
     const skill = core.getSkill(catalog, id);
     assert.equal(skill.id, id);
 
-    const search = core.searchSkills(catalog, { query: id, limit: 1 });
-    assert.equal(search.totalMatches, 1);
-    assert.equal(search.results[0]?.id, id, `exact search did not return ${id} first`);
-    assert.equal(Object.hasOwn(search.results[0], "score"), false);
-    assert.equal(Object.hasOwn(search.results[0], "rank"), false);
-
     const composed = core.composeStack(catalog, selection([id]));
     assert.equal(composed.ok, true);
     assert.equal(composed.status, "composed");

antigravity-awesome-skills/tools/scripts/tests/aas_v1_mcp.test.js

@@ -10,6 +10,7 @@ const {
   AGENT_SELECTION_CONTRACT,
   MAX_JSON_DEPTH,
   MAX_LINE_BYTES,
+  MAX_SESSION_MANIFESTS,
   McpServer,
   TOOL_NAMES,
   parseStrictJsonLine,
@@ -38,6 +39,32 @@ async function initializedServer() {
   return server;
 }
 
+test("MCP bounds composed manifest session state and evicts the oldest digest", async () => {
+  const server = await initializedServer();
+  const catalog = core.loadBundledCatalog({ root: ROOT });
+  const selectedId = catalog.skills[0].id;
+  const digests = [];
+  for (let index = 0; index <= MAX_SESSION_MANIFESTS; index += 1) {
+    const response = await server.handle({
+      jsonrpc: "2.0",
+      id: 1000 + index,
+      method: "tools/call",
+      params: {
+        name: "compose_stack",
+        arguments: {
+          profile: { goals: [`bounded-session-${index}`] },
+          skillIds: [selectedId],
+        },
+      },
+    });
+    assert.equal(response.result.isError, false);
+    digests.push(response.result.structuredContent.manifestDigest);
+  }
+  assert.equal(server.manifestSessions.size, MAX_SESSION_MANIFESTS);
+  assert.equal(server.manifestSessions.has(digests[0]), false);
+  assert.equal(server.manifestSessions.has(digests.at(-1)), true);
+});
+
 test("strict JSON-lines parser rejects invalid UTF-8, duplicate keys, excess depth, batches, and oversized input", () => {
   assert.deepEqual(parseStrictJsonLine(Buffer.from('{"jsonrpc":"2.0"}')), { jsonrpc: "2.0" });
   assert.doesNotThrow(() => parseStrictJsonLine(Buffer.from(JSON.stringify({

antigravity-awesome-skills/tools/scripts/tests/aas_v1_runtime_config.test.js

@@ -147,6 +147,26 @@ test("runtime promotion rejects a missing cache root under a group or world writ
   );
 });
 
+test("runtime promotion rejects a private parent beneath a replaceable ancestor", async (t) => {
+  if (process.platform === "win32") return;
+  const root = await temp(t);
+  const sharedAncestor = path.join(root, "shared");
+  const privateParent = path.join(sharedAncestor, "mine");
+  await fsp.mkdir(privateParent, { recursive: true, mode: 0o700 });
+  await fsp.chmod(sharedAncestor, 0o777);
+  await fsp.chmod(privateParent, 0o700);
+  const fixture = releaseFixture();
+  await assert.rejects(
+    core.cache.installRuntimeFromRegistry({
+      cacheRoot: path.join(privateParent, "aas-cache"),
+      version: "14.6.0",
+      expectedIntegrity: fixture.integrity,
+      fetcher: fixture.fetcher,
+    }),
+    (error) => error.code === "AAS_RUNTIME_DIRECTORY_UNSAFE",
+  );
+});
+
 test("the packed runtime launches MCP from an isolated verified dependency closure", async (t) => {
   const root = await temp(t);
   const repoRoot = path.resolve(__dirname, "../../..");

antigravity-awesome-skills/tools/scripts/tests/aas_v1_transaction.test.js

@@ -392,6 +392,26 @@ test("layout cleanup removes only exact marker-owned stages left before publicat
   fs.rmSync(fx.sandbox, { recursive: true });
 });
 
+test("layout stage cleanup propagates a failed deletion durability barrier", () => {
+  const fx = fixture();
+  fs.rmSync(fx.transactionDirectory, { recursive: true });
+  const inspected = inspectLayout(fx.adapter, { host: "codex", scope: "project", identityDigest: TARGET_ID });
+  const markerToken = "7".repeat(48);
+  const markerName = `.aas-layout-recovery-${"6".repeat(32)}`;
+  const directory = inspected.missingDirectories[0];
+  const stage = path.join(path.dirname(directory), `.aas-layout-stage-${markerToken}-${path.basename(directory)}`);
+  fs.mkdirSync(stage, { mode: 0o700 });
+  fs.writeFileSync(path.join(stage, markerName), `${markerToken}\n`, { mode: 0o600 });
+  assert.throws(() => cleanupMaterializedLayout(inspected, [directory], {
+    markerName,
+    markerToken,
+    fsyncDirectory() { throw new Error("injected parent fsync failure"); },
+  }), /injected parent fsync failure/);
+  assert.equal(fs.existsSync(stage), false);
+  cleanupMaterializedLayout(inspected, [directory], { markerName, markerToken });
+  fs.rmSync(fx.sandbox, { recursive: true });
+});
+
 test("layout cleanup postcondition detects a dangling symlink artifact", (t) => {
   const fx = fixture();
   fs.rmSync(fx.transactionDirectory, { recursive: true });

antigravity-awesome-skills/tools/scripts/tests/automation_workflows.test.js

@@ -11,12 +11,21 @@ function readText(relativePath) {
 const packageJson = JSON.parse(readText("package.json"));
 const generatedFiles = JSON.parse(readText("tools/config/generated-files.json"));
 const ciWorkflow = readText(".github/workflows/ci.yml");
+const hygieneWorkflowForPages = readText(".github/workflows/repo-hygiene.yml");
 const offlineCatalogBuilder = readText("tools/scripts/build-aas-v1-offline-catalog.js");
 const canonicalMergeScript = readText("tools/scripts/merge_canonical_sync_pr.cjs");
 const publishWorkflow = readText(".github/workflows/publish-npm.yml");
 const releaseWorkflowScript = readText("tools/scripts/release_workflow.js");
 const hygieneWorkflowPath = path.join(repoRoot, ".github", "workflows", "repo-hygiene.yml");
 
+for (const [name, workflow] of [["main CI", ciWorkflow], ["repo hygiene", hygieneWorkflowForPages]]) {
+  assert.match(
+    workflow,
+    /merge_canonical_sync_pr\.cjs[\s\S]*?--head "\$PR_HEAD" \\\n+\s+--skip-pages/,
+    `${name} canonical sync must not dispatch release-only Pages`,
+  );
+}
+
 const prepareReleaseBlock = releaseWorkflowScript.slice(
   releaseWorkflowScript.indexOf("function prepareRelease"),
   releaseWorkflowScript.indexOf("function publishRelease"),

antigravity-awesome-skills/tools/scripts/tests/check_live_seo_geo.test.js

@@ -0,0 +1,26 @@
+const assert = require('node:assert');
+const { assertLiveSeoDocuments } = require('../check-live-seo-geo');
+
+const expected = { countLabel: '1,987+', releaseLabel: 'V15.3.0' };
+const documents = {
+  home: 'AAS Core Preview | Agent-first stacks backed by 1,987+ skills SoftwareSourceCode FAQPage specialized plugins',
+  plugins: 'AAS Specialized Plugins | 15 AI coding workflow packs specialized plugin packs numberOfItems',
+  sitemap: 'https://sickn33.github.io/agentic-awesome-skills/plugins',
+  llms: 'https://sickn33.github.io/agentic-awesome-skills/plugins Current release: V15.3.0. 1,987+',
+  robots: 'User-agent: GPTBot User-agent: OAI-SearchBot User-agent: ClaudeBot User-agent: PerplexityBot',
+};
+
+assert.doesNotThrow(() => assertLiveSeoDocuments(documents, expected));
+assert.throws(
+  () => assertLiveSeoDocuments({
+    ...documents,
+    home: 'Agentic Awesome Skills GitHub | 1,987+ AI coding skills SoftwareSourceCode FAQPage specialized plugins',
+  }, expected),
+  /AAS Core Preview/,
+);
+assert.throws(
+  () => assertLiveSeoDocuments({ ...documents, home: `${documents.home} prompt templates` }, expected),
+  /stale snippet/,
+);
+
+console.log('live SEO/GEO contract tests passed');

antigravity-awesome-skills/tools/scripts/tests/docs_security_content.test.js

@@ -83,6 +83,13 @@ const wpSiteHealthCatalog = fs.readFileSync(
   'utf8',
 );
 const dispatchSkill = fs.readFileSync(path.join(repoRoot, 'skills', 'dispatch', 'SKILL.md'), 'utf8');
+const anywriteSkill = fs.readFileSync(path.join(repoRoot, 'skills', 'anywrite', 'SKILL.md'), 'utf8');
+const sshepherdSkill = fs.readFileSync(path.join(repoRoot, 'skills', 'sshepherd', 'SKILL.md'), 'utf8');
+const awsDiscoverySkill = fs.readFileSync(path.join(repoRoot, 'skills', 'hf-cloud-aws-context-discovery', 'SKILL.md'), 'utf8');
+const pptxDeckSkill = fs.readFileSync(path.join(repoRoot, 'skills', 'pptx-deck-creation', 'SKILL.md'), 'utf8');
+const pptxDesignProfiles = fs.readFileSync(path.join(repoRoot, 'skills', 'pptx-deck-creation', 'references', 'design-profiles.md'), 'utf8');
+const cloudflareAuditSkill = fs.readFileSync(path.join(repoRoot, 'skills', 'cloudflare-security-audit', 'SKILL.md'), 'utf8');
+const weaviatePdfReference = fs.readFileSync(path.join(repoRoot, 'skills', 'weaviate-cookbooks', 'references', 'pdf_multimodal_rag.md'), 'utf8');
 const eclCreatorConfig = fs.readFileSync(
   path.join(repoRoot, 'skills', 'ecl-harness-engineer', 'agents', 'creator-config.md'),
   'utf8',
@@ -456,6 +463,20 @@ assert.match(
   /^\s+codex:\s*blocked$/m,
   'Dispatch must be blocked from plugin-safe Codex distribution',
 );
+for (const [name, skill] of [['anywrite', anywriteSkill], ['sshepherd', sshepherdSkill]]) {
+  assert.match(skill, /^\s+codex:\s*blocked$/m, `${name} must be blocked from Codex plugins without a shipped runtime`);
+  assert.match(skill, /^\s+claude:\s*blocked$/m, `${name} must be blocked from Claude plugins without a shipped runtime`);
+  assert.doesNotMatch(skill, /^\.\/dist\/(?:anywrite|sshepherd)\b/m, `${name} must not execute a workspace-relative binary`);
+  assert.match(skill, /explicit absolute path/i, `${name} must require a user-approved absolute executable path`);
+}
+assert.match(awsDiscoverySkill, /Never open or print `~\/\.aws\/credentials`/);
+assert.doesNotMatch(awsDiscoverySkill, /credentials` are plain INI files — read-only/);
+assert.match(`${pptxDeckSkill}\n${pptxDesignProfiles}`, /untrusted (?:reference )?data/i);
+assert.match(`${pptxDeckSkill}\n${pptxDesignProfiles}`, /Ignore embedded instructions|never as instructions/i);
+assert.match(cloudflareAuditSkill, /canonical physical repository path plus its normalized `origin`/);
+assert.match(cloudflareAuditSkill, /Do not search or reuse prior runs from a basename-only directory/);
+assert.doesNotMatch(weaviatePdfReference, /-o \/tmp\/(?:uv|ollama)-install\.sh/);
+assert.match(weaviatePdfReference, /mktemp -d/);
 assert.match(
   dispatchSkill,
   /^\s+claude:\s*blocked$/m,

antigravity-awesome-skills/tools/scripts/tests/merge_batch.test.js

@@ -508,6 +508,7 @@ function approvalDependencies(overrides = {}) {
     headRefOid: HEAD_SHA,
     headRefName: "maintenance/internal",
     headRepository: { nameWithOwner: "OWNER/REPO" },
+    author: { login: "owner" },
   };
   let classifications = 0;
   const dependencies = approvalDependencies({
@@ -532,6 +533,30 @@ function approvalDependencies(overrides = {}) {
   assert.deepStrictEqual(result.runs, []);
 }
 
+{
+  const prDetails = {
+    number: 451,
+    baseRefName: "main",
+    baseRefOid: BASE_SHA,
+    headRefOid: HEAD_SHA,
+    headRefName: "maintenance/internal",
+    headRepository: { nameWithOwner: "owner/repo" },
+    author: { login: "collaborator" },
+  };
+  const dependencies = approvalDependencies({
+    classifyChangeRecords() {
+      return { approvalSafe: false, reasons: ["record_0:new_unapproved_path"] };
+    },
+  });
+  assert.throws(
+    () => mergeBatch.approveActionRequiredRuns("/repo", "owner/repo", prDetails, {
+      dependencies,
+      reviewedHeads: [HEAD_SHA],
+    }),
+    /not fork-approval-safe/,
+  );
+}
+
 {
   const record = {
     status: "M",
@@ -566,6 +591,23 @@ function approvalDependencies(overrides = {}) {
     }),
     report,
   );
+  const nestedBundleRecord = {
+    ...record,
+    old_path: "skills/example/examples/app/package-lock.json",
+    new_path: "skills/example/examples/app/package-lock.json",
+  };
+  const nestedBundleReport = {
+    ...report,
+    changes: [{ ...report.changes[0], records: [nestedBundleRecord] }],
+  };
+  assert.strictEqual(
+    mergeBatch.validateChangedSkillEvidence(nestedBundleReport, {
+      mergeBaseOid: BASE_SHA,
+      headOid: HEAD_SHA,
+      rawRecords: [nestedBundleRecord],
+    }),
+    nestedBundleReport,
+  );
   assert.throws(
     () => mergeBatch.validateChangedSkillEvidence(
       { ...report, head_oid: BLOB_SHA },

antigravity-awesome-skills/tools/scripts/tests/npm_package_contents.test.js

@@ -78,12 +78,12 @@ assert.strictEqual(
   "published package must declare the first Core-capable major",
 );
 assert.ok(
-  readme.includes("https://github.com/sickn33/agentic-awesome-skills/blob/main/docs/users/aas-core.md"),
-  "published README must link to the canonical AAS Core guide without relying on an unpackaged relative path",
+  readme.includes(`https://github.com/sickn33/agentic-awesome-skills/blob/v${packageJson.version}/docs/users/aas-core.md`),
+  "published README must link to the AAS Core guide pinned to the exact package release",
 );
 assert.ok(
-  !readme.includes("](docs/users/aas-core.md)"),
-  "published README must not link to an AAS Core guide path excluded from the npm package",
+  !readme.includes("/blob/main/docs/users/aas-core.md"),
+  "published README must not direct package readers to moving main-branch Core instructions",
 );
 assert.ok(
   coreGuide.includes(`--package=agentic-awesome-skills@${packageJson.version}`),

antigravity-awesome-skills/tools/scripts/tests/release_workflow.test.js

@@ -20,13 +20,35 @@ function git(cwd, ...args) {
 const mergeOid = "a".repeat(40);
 const candidate = {
   number: 10,
+  title: "chore: release v1.2.3",
+  author: { login: "owner" },
   headRefName: "release/v1.2.3",
+  headRepository: { nameWithOwner: "owner/repo" },
   baseRefName: "main",
   mergeCommit: { oid: mergeOid },
+  mergedAt: "2026-01-01T00:00:00Z",
 };
-assert.strictEqual(release.selectMergedReleaseCandidate([candidate], "1.2.3"), candidate);
-assert.throws(() => release.selectMergedReleaseCandidate([], "1.2.3"), /exactly one/);
-assert.throws(() => release.selectMergedReleaseCandidate([candidate, { ...candidate, number: 11 }], "1.2.3"), /exactly one/);
+const releaseIdentity = { repoSlug: "owner/repo", ownerLogin: "owner" };
+assert.strictEqual(release.selectMergedReleaseCandidate([candidate], "1.2.3", releaseIdentity), candidate);
+assert.throws(() => release.selectMergedReleaseCandidate([], "1.2.3", releaseIdentity), /exactly one/);
+const newerCandidate = {
+  ...candidate,
+  number: 11,
+  mergeCommit: { oid: "b".repeat(40) },
+  mergedAt: "2026-01-02T00:00:00Z",
+};
+assert.throws(
+  () => release.selectMergedReleaseCandidate([candidate, newerCandidate], "1.2.3", releaseIdentity),
+  /found 2/,
+);
+assert.throws(
+  () => release.selectMergedReleaseCandidate([{ ...candidate, headRepository: { nameWithOwner: "attacker/repo" } }], "1.2.3", releaseIdentity),
+  /found 0/,
+);
+assert.throws(
+  () => release.selectMergedReleaseCandidate([{ ...candidate, author: { login: "collaborator" } }], "1.2.3", releaseIdentity),
+  /found 0/,
+);
 
 const root = fs.mkdtempSync(path.join(os.tmpdir(), "release-workflow-"));
 const repo = path.join(root, "repo");

antigravity-awesome-skills/tools/scripts/tests/review_changed_skills.test.js

@@ -9,6 +9,7 @@ const {
   ensureRepoRelative,
   getChangedSkillDirs,
   getChangedSkillFiles,
+  getUnresolvedChangedSkillFiles,
   isQuotaFailure,
   reviewFingerprint,
   reviewLabel,
@@ -20,7 +21,8 @@ const changed = getChangedSkillFiles('base', 'head', {
     assert.deepStrictEqual(args, [
       'diff',
       '--name-only',
-      '--diff-filter=ACMR',
+      '--no-renames',
+      '--diff-filter=ACDMR',
       'base',
       'head',
       '--',
@@ -28,25 +30,36 @@ const changed = getChangedSkillFiles('base', 'head', {
     return [
       'skills/alpha/SKILL.md',
       'README.md',
-      'plugins/example/SKILL.md',
+      'plugins/bundle/skills/example/SKILL.md',
+      'plugins/bundle/package.json',
       'skills/beta/notes.md',
       '',
     ].join('\n');
   },
 });
 
-assert.deepStrictEqual(changed, ['skills/alpha/SKILL.md', 'plugins/example/SKILL.md']);
+assert.deepStrictEqual(changed, [
+  'skills/alpha/SKILL.md',
+  'plugins/bundle/skills/example/SKILL.md',
+  'skills/beta/notes.md',
+]);
 
 const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'aas-review-skills-'));
 fs.mkdirSync(path.join(tempDir, 'skills', 'alpha'), { recursive: true });
-fs.mkdirSync(path.join(tempDir, 'plugins', 'example'), { recursive: true });
+fs.mkdirSync(path.join(tempDir, 'plugins', 'bundle', 'skills', 'example'), { recursive: true });
 fs.writeFileSync(path.join(tempDir, 'skills', 'alpha', 'SKILL.md'), 'alpha');
-fs.writeFileSync(path.join(tempDir, 'plugins', 'example', 'SKILL.md'), 'example');
+fs.mkdirSync(path.join(tempDir, 'skills', 'alpha', 'references'));
+fs.writeFileSync(path.join(tempDir, 'skills', 'alpha', 'references', 'guide.md'), 'guide');
+fs.writeFileSync(path.join(tempDir, 'plugins', 'bundle', 'skills', 'example', 'SKILL.md'), 'example');
 
 assert.deepStrictEqual(getChangedSkillDirs(changed, tempDir), [
-  'plugins/example',
+  'plugins/bundle/skills/example',
   'skills/alpha',
 ]);
+assert.deepStrictEqual(
+  getUnresolvedChangedSkillFiles(changed, ['plugins/bundle/skills/example', 'skills/alpha']),
+  ['skills/beta/notes.md'],
+);
 
 assert.throws(
   () => ensureRepoRelative('../outside/SKILL.md', tempDir),
@@ -129,6 +142,18 @@ assert.notStrictEqual(
   alphaFingerprint,
 );
 
+fs.writeFileSync(path.join(tempDir, 'skills', 'alpha', 'SKILL.md'), 'alpha');
+fs.writeFileSync(path.join(tempDir, 'skills', 'alpha', 'references', 'guide.md'), 'guide changed');
+assert.notStrictEqual(
+  reviewFingerprint(['skills/alpha'], {
+    cacheVersion: '1',
+    repoRoot: tempDir,
+    threshold: '80',
+    workspace: 'antigravity-awesome-skills',
+  }),
+  alphaFingerprint,
+);
+
 const githubOutput = path.join(tempDir, 'github-output.txt');
 const plan = writePlan(['skills/alpha'], {
   cacheVersion: '1',
@@ -143,6 +168,20 @@ assert.match(fs.readFileSync(githubOutput, 'utf8'), /has-skills=true/);
 assert.match(fs.readFileSync(githubOutput, 'utf8'), /skill-count=1/);
 assert.match(fs.readFileSync(githubOutput, 'utf8'), /fingerprint=[0-9a-f]{64}/);
 
+const deletedOutput = path.join(tempDir, 'deleted-output.txt');
+const deletedPlan = writePlan([], {
+  githubOutput: deletedOutput,
+  unresolvedFiles: ['skills/deleted/SKILL.md', 'skills/deleted/examples/demo.md'],
+});
+assert.strictEqual(deletedPlan.hasSkills, false);
+assert.strictEqual(deletedPlan.requiresManual, true);
+assert.deepStrictEqual(deletedPlan.unresolvedFiles, [
+  'skills/deleted/SKILL.md',
+  'skills/deleted/examples/demo.md',
+]);
+assert.match(deletedPlan.fingerprint, /^manual-[0-9a-f]{64}$/);
+assert.match(fs.readFileSync(deletedOutput, 'utf8'), /requires-manual=true/);
+
 assert.strictEqual(isQuotaFailure('Credit quota exceeded for this workspace'), true);
 assert.strictEqual(isQuotaFailure('Insufficient credits remaining'), true);
 assert.strictEqual(isQuotaFailure('Monthly credit allowance has been reached'), true);

antigravity-awesome-skills/tools/scripts/tests/verify_pages_redirect_bridge.test.js

@@ -41,6 +41,26 @@ async function run() {
   assert.throws(() => verifyLocalDeployment({ ...generatorOptions, deploymentRoot }), /unexpected=.*stale\.txt/);
   fs.unlinkSync(stalePath);
 
+  const assertSymlinkRejected = (relativePath, type = 'file') => {
+    const target = path.join(deploymentRoot, relativePath);
+    const physical = `${target}.physical`;
+    fs.renameSync(target, physical);
+    try {
+      fs.symlinkSync(physical, target, type);
+      assert.throws(
+        () => verifyLocalDeployment({ ...generatorOptions, deploymentRoot }),
+        /physical|non-file entry|regular file/i,
+      );
+    } finally {
+      if (fs.existsSync(target) || fs.lstatSync(target).isSymbolicLink()) fs.unlinkSync(target);
+      fs.renameSync(physical, target);
+    }
+  };
+  assertSymlinkRejected('.nojekyll');
+  assertSymlinkRejected('redirect-manifest.json');
+  assertSymlinkRejected('antigravity-awesome-skills/index.html');
+  assertSymlinkRejected('antigravity-awesome-skills', 'dir');
+
   const fetchImpl = async (url) => {
     const parsed = new URL(url);
     if (parsed.pathname.startsWith('/agentic-awesome-skills/')) return new Response('current destination', { status: 200 });

antigravity-awesome-skills/tools/scripts/tests/workflow_contracts.test.js

@@ -80,6 +80,25 @@ const maintainerSkill = fs.readFileSync(
   path.join(repositoryRoot, "skills", "antigravity-maintainer-batch-release", "SKILL.md"),
   "utf8",
 );
+const mergeBatchGuide = fs.readFileSync(path.join(repositoryRoot, "docs", "maintainers", "merge-batch.md"), "utf8");
+const mergingGuide = fs.readFileSync(path.join(repositoryRoot, "docs", "maintainers", "merging-prs.md"), "utf8");
+const autonomyGuide = fs.readFileSync(path.join(repositoryRoot, "docs", "maintainers", "pr-autonomy.md"), "utf8");
+const maintainerSkillUi = fs.readFileSync(
+  path.join(repositoryRoot, "skills", "antigravity-maintainer-batch-release", "agents", "openai.yaml"),
+  "utf8",
+);
+for (const contractText of [maintainerSkill, maintenanceGuide, mergeBatchGuide, mergingGuide, autonomyGuide]) {
+  assert.match(contractText, /skills\/\*\*|skills\/<skill-id>\/\*\*/);
+}
+assert.match(maintainerSkill, /entire tracked `skills\/<skill-id>\/\*\*` subtree/);
+assert.match(maintainerSkill, /authored by the repository owner/);
+assert.match(maintainerSkill, /exactly one merged release PR/);
+assert.match(maintenanceGuide, /canonical-repo-state` PR owns that state/);
+assert.match(autonomyGuide, /complete nearest skill-directory fingerprint/);
+assert.match(mergingGuide, /No local-integration exception/);
+assert.doesNotMatch(mergingGuide, /Rare exception: local squash|`gh pr merge <PR_NUMBER>/);
+assert.match(maintainerSkillUi, /\$antigravity-maintainer-batch-release/);
+assert.doesNotMatch(maintainerSkillUi, /frozen matrix|product, verifier, and gold|recommend|rank/i);
 assert.match(maintainerSkill, /discover every already-configured local AAS MCP host from its real configuration and update each one to the exact same package version/);
 assert.match(maintainerSkill, /Pin `agentic-awesome-skills@X\.Y\.Z` and `--version X\.Y\.Z`; never use `latest`/);
 assert.match(maintainerSkill, /real MCP `initialize` plus `tools\/list` handshake reports catalog package version `X\.Y\.Z`/);
@@ -174,13 +193,16 @@ assert.match(
   /needs\.review-attempt\.outputs\.outcome != 'reviewed'/,
   "every non-passing Tessl outcome must route to exact-head manual review",
 );
+assert.match(skillReviewWorkflow, /paths:\s*\n\s+- 'skills\/\*\*'\s*\n\s+- 'plugins\/\*\*\/skills\/\*\*'/);
+assert.match(skillReviewWorkflow, /steps\.plan\.outputs\.requires-manual != 'true'/);
+assert.match(skillReviewWorkflow, /REQUIRES_MANUAL: \$\{\{ steps\.plan\.outputs\.requires-manual \}\}/);
 assert.match(skillReviewWorkflow, /result=manual/);
 assert.match(skillReviewWorkflow, /needs\.review-state\.outputs\.configured != 'true'/);
 assert.match(skillReviewWorkflow, /ref: \$\{\{ github\.event\.pull_request\.base\.sha \}\}/);
 assert.match(skillReviewWorkflow, /review_changed_skills\.cjs --plan/);
 assert.match(skillReviewWorkflow, /actions\/cache\/restore@[0-9a-f]{40}/);
 assert.match(skillReviewWorkflow, /actions\/cache\/save@[0-9a-f]{40}/);
-assert.match(skillReviewWorkflow, /tessl-review-v1-\$\{\{ steps\.plan\.outputs\.fingerprint \}\}/);
+assert.match(skillReviewWorkflow, /tessl-review-v2-\$\{\{ steps\.plan\.outputs\.fingerprint \}\}/);
 assert.match(skillReviewWorkflow, /steps\.review-cache\.outputs\.cache-hit != 'true'/);
 assert.match(skillReviewWorkflow, /needs\.review-attempt\.outputs\.outcome == 'reviewed'/);
 assert.ok(