csh/playbook
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
0c634043e33404464a3eb5f151655e042b395c4b
playbook/antigravity-awesome-skills/walkthrough.md
T
ci[bot] 0c634043e3 📦 deps(thirdparty): update snapshots
2026-07-29 07:59:17 +00:00

30 KiB
Raw Blame History

Maintenance Walkthrough - 2026-07-28

  • Added a fail-closed provenance exception ledger for maintainer-verified upstream repository renames. The initial Modellix entry records that Modellix/modellix-skill and Modellix/modellix-plugin resolve to GitHub repository ID 1150322983; only the exact recorded transition is allowed, while unrelated provenance changes remain blocked.
  • Traced a live Search Console Pagina con reindirizzamento report to the slashless /plugins URL, which GitHub Pages correctly redirects to the indexable /plugins/ route.
  • Normalized every runtime link to workbench, plugin, topic, and skill pages through the existing trailing-slash route helper so crawlers are no longer invited to request redirecting URL variants.
  • Added focused web-app assertions for trailing-slash navigation targets; the sitemap, canonical metadata, and public route remain aligned on /plugins/.

Maintenance Walkthrough - 2026-07-26

  • Imported the MIT-licensed fedora-hyprland-installer contribution from maleksaadi0109/hyprfedora at upstream commit 3ec6d4fc5eecdb188613dd841dce9926ae5c8319.
  • Hardened its privileged Fedora workflow with explicit critical-risk metadata, provenance, limitations, consistent NVIDIA guidance, isolated tests, and claims bounded to the behavior implemented by the bundled scripts.
  • Added the MIT-licensed find-complementary-founders skill from merc1305/findMate.
  • Preserved its own-owner-only invariant, offline evidence assessment, hash-bound publication approvals, expiring profiles, and stop-at-101 star rule while adapting metadata, triggers, provenance, and limitations to the AAS quality contract.
  • Included the complete source skill directory without generated registry artifacts, private owner data, credentials, or publication receipts.
  • Synced the five actionable review fixes from canonical FindMate release v1.3.4: consent-free private drafts, temporal consent validation, one-sided seeking cards, source-identity self-exclusion, and the bundled Russian onboarding reference. The canonical suite passes 40 tests and the portable release resolves to commit c78a78b0280f4168294b72f38aa39317e7b7d7b8.
  • Synced the privacy-preserving G35 publication path from immutable canonical release v1.3.5 at d23cd66d0ee324c0ed7e85156606d8814250c1f8: one exact owner-approved GitHub comment may now carry bounded inline JSON, the existing immutable linked source remains supported, and deleting or unmarking the source removes its current validation receipt. The owner is warned that the publishing login and proof/contact links may connect the alias to a real identity and that public edit history or copies prevent any promise of complete erasure.
  • Preserved the AAS catalog metadata, usage guidance, provenance, limitations, source-only contract, and all owner consent boundaries while updating the five compatible reference/script files. The canonical FindMate suite passes 47 tests; no owner profile, credential, generated registry, or plugin mirror is included in this contributor update.
  • Added the MIT-licensed orchestrate skill from provencher/codex-skills at upstream commit 8aa6c42b73781c905c55f8a1253a18127079ac21.
  • Preserved its concise Codex-native delegation policy and UI metadata while adding the repository-required usage guidance, limitations, immutable provenance, and user-held approval boundaries.
  • Kept the source PR limited to canonical skill content, source credit, and this maintenance evidence; generated registries and plugin mirrors remain owned by protected canonical synchronization.
  • Consolidated the two open UIZZE contribution paths into one protected maintainer repair, preserving the actionable public-catalog research, design-contract, implementation, and hard finish-gate workflow contributed by @samuelbushi in PR #929 together with the bounded preview introduced by PR #983.
  • Kept the free check_ui_slop preview optional while requiring explicit approval before persistent MCP configuration or external HTML/CSS transmission.
  • Added the official MIT license metadata and organizational author while preserving the existing immutable source identity; GitHub redirects the historical upstream URL to the transferred official repository.
  • Left generated registries and plugin mirrors out of the source PR so the protected canonical synchronization workflow remains their sole owner.
  • Merged the consolidated source through PR #985, then converged generated state and plugin mirrors through protected PR #986.

Maintenance Walkthrough - 2026-04-17

  • Imported 8 frontend/design skills from Leonxlnx/taste-skill into skills/:
    • design-taste-frontend
    • gpt-taste
    • redesign-existing-projects
    • high-end-visual-design
    • minimalist-ui
    • industrial-brutalist-ui
    • stitch-design-taste
    • full-output-enforcement
  • Normalized the imported skill metadata to repository conventions:
    • folder names match name
    • risk, source, source_repo, source_type, author, and date_added are present
    • descriptions are shortened for validation
    • ## When to Use sections were added where the upstream files did not have one
  • Preserved the upstream stitch-design-taste/DESIGN.md artifact.
  • Added source attribution for Leonxlnx/taste-skill in README.md and docs/sources/sources.md.

Maintenance Walkthrough - 2026-04-05

  • Merged community PR batch #487, #488, #489, and #490 on GitHub with squash, following the maintainer GitHub-only merge contract instead of local integration.

  • Used the repository batch shortcut for the initial pass, then switched to the manual maintainer playbook when fork metadata drift produced stale pr-policy failures on reopened PRs.

  • Repaired PR #488 on the contributor branch by adding the missing fruitwyatt/puzzle-activity-planner source credit to README.md, then pushed the maintainer fix back to the fork and re-ran the fork workflows.

  • Normalized PR #490 by patching the body to include the required ## Quality Bar Checklist ✅ section, then closed and reopened it to force fresh pull_request checks against the updated metadata.

  • Approved the pending fork workflow runs for PRs #487 through #490 after each reopen/push cycle so Skills Registry CI, Skill Review & Optimize, Dependency Review, and CodeQL could execute on the contributor heads.

  • Ran the mandatory post-merge npm run sync:contributors follow-up after each successful merge and pushed the resulting README contributor-sync commits directly to main when the sync changed tracked files.

  • Prepared the v9.12.0 release notes in CHANGELOG.md to cover the Rayden UI additions, puzzle activity planning, skill diagnostics, and the sales-automator YAML repair before starting the release workflow.

  • Closed issues #455 and #456 with maintainer comments explaining what a follow-up submission must include before reopening:

    • concrete repo diff or implementation PR
    • source-only contributor branch
    • Quality Bar checklist and maintainer validations from .github/MAINTENANCE.md

  • Reviewed open issues #455 and #456 during the maintainer sweep; neither had a matching accepted PR and both remain open pending a source-quality contributor submission.

  • Triaged PR #454 as superseded by #457 because #457 rebuilds the Windows validation/test fixes on top of current main and includes the follow-up batch activation fix requested in review.

  • Verified PR #457 locally on the contributor head with:

    • npm run validate
    • npm run validate:references
    • npm run check:warning-budget
    • npm run check:readme-credits -- --base origin/main --head HEAD
    • npm run test
    • npm run app:test:coverage
    • npm run app:build

  • Cleaned PR #457 back to the repository's source-only PR contract by dropping maintainer-owned generated registry artifacts before merge review.

  • Normalized the PR metadata so the required Quality Bar Checklist is present before re-triggering the fork-based GitHub Actions checks.

Maintenance Walkthrough - 2026-03-30

  • Merged PR #418 on GitHub with squash after approving the pending fork workflow run and waiting for pr-policy, source-validation, and artifact-preview to finish green.
  • Repaired PR #423's stale metadata state by updating the PR body to include the required Quality Bar Checklist, then closed and reopened it to force fresh pull_request runs before squash merging it on GitHub.
  • Synced local main after the PR merge batch so release preparation starts from the canonical remote state.
  • Resolved issue #421 by ensuring the README.md Community Contributed Skills section includes SoulPass on main.
  • Resolved issue #419 by tightening the github-issue-creator frontmatter description and "When to Use" guidance for better discoverability.
  • Prepared the v9.3.0 release notes in CHANGELOG.md and recorded the maintainer actions here before running the release flow.

Maintenance Walkthrough - 2026-03-29

  • Re-triaged the full 2026-03-15 security finding set against current main and wrote a fresh current-head report in docs/maintainers/security-findings-triage-2026-03-29-refresh.md.

  • Added a matching machine-readable export at docs/maintainers/security-findings-triage-2026-03-29-refresh.csv so the refreshed statuses are available in both markdown and CSV form.

  • Kept the old 2026-03-15 markdown/CSV as historical baseline input, preserved the smaller 2026-03-29 addendum as a transition note, and pointed both docs at the new refresh as the current source of truth.

  • The refreshed triage currently lands at:

    • 0 findings still present and exploitable
    • 0 findings still present but low practical risk
    • 26 obsolete/not reproducible on current HEAD
    • 7 duplicates

  • The refresh folds in the hardening shipped today and earlier in the session:

    • symlink/path safety in maintainer/install/web copy flows
    • frontmatter parser robustness
    • removal of shared frontend star writes
    • secure Office unpack behavior
    • migration away from predictable /tmp state files

  • Fixed the remaining production/documentation drift introduced by the web-app and CI hardening work:

    • clarified that the hosted GitHub Pages app runs in static public-catalog mode
    • documented that Sync Skills is development-only unless explicitly enabled in local maintainer runs
    • documented that web-app save/star interactions are intentionally browser-local today

  • Hardened the maintainer documentation so release and CI expectations now match the live workflows:

    • release docs now mention the shared tools/requirements.txt install path, the web-app coverage gate, and blocking npm audit --audit-level=high on publish
    • maintainer docs now document the narrow canonical-artifact auto-sync contract on main

  • Expanded the documented risk-maintenance workflow after the new automation landed:

    • audit:skills exposes suggested_risk
    • sync:risk-labels supports conservative high-confidence legacy cleanup
    • offensive auto-promotions now also insert the canonical AUTHORIZED USE ONLY notice

  • Updated user-facing install docs to mention that the npm installer now uses a shallow clone for lighter first-run installs.

  • Updated the onboarding/trust docs to reflect the real risk taxonomy (unknown, none, safe, critical, offensive) instead of the older simplified wording.

Maintenance Walkthrough - 2026-03-25

  • Imported 14 skills from Dimillian/Skills into skills/:
    • app-store-changelog
    • github
    • ios-debugger-agent
    • macos-menubar-tuist-app
    • macos-spm-app-packaging
    • orchestrate-batch-refactor
    • project-skill-audit
    • react-component-performance
    • simplify-code
    • swift-concurrency-expert
    • swiftui-liquid-glass
    • swiftui-performance-audit
    • swiftui-ui-patterns
    • swiftui-view-refactor
  • Normalized the imported skill metadata to match repository validation requirements:
    • shortened oversized frontmatter descriptions
    • added risk, source, and date_added
    • added ## When to Use sections so the imported batch does not increase the warning budget
  • Added source attribution for Dimillian/Skills in:
    • README.md under Credits & Sources
    • docs/sources/sources.md
  • Merged PR #395 via GitHub squash merge after maintainer refresh of forked workflow approvals and PR body normalization; this added the new snowflake-development skill.
  • Merged PR #394 via GitHub squash merge after converting the contributor branch back to source-only, normalizing the PR checklist body, and shortening an oversized wordpress-penetration-testing description so CI passed.
  • Patched skills/snowflake-development/SKILL.md on main with a ## When to Use section so the repository stayed within the frozen validation warning budget after the PR merge batch.
  • Reworked /apply-optimize automation to address GitHub code scanning alert #36: the public issue_comment trigger now only queues a trusted workflow, while the privileged branch checkout/apply logic runs in a separate workflow_dispatch path limited to same-repository branches.
  • Ran the required direct-main maintainer sync flow after touching skills/:
    • npm run chain
    • npm run check:warning-budget
    • npm run catalog
  • Synced maintainer-owned generated artifacts and metadata to the new 1,325+ skill count:
    • README.md
    • package.json
    • skills_index.json
    • CATALOG.md
    • data/catalog.json
    • data/bundles.json
    • curated user/maintainer docs updated by sync_repo_metadata.py

Maintenance Walkthrough - 2026-03-21 Follow-up Import Sync

  • Imported and normalized a new batch of external skills into skills/, covering Anthropic Claude API/internal comms entries, marketing workflows, SEO orchestration/sub-skills, and Obsidian-focused file-format/CLI skills.
  • Added and standardized the following imported skill families:
    • claude-api, internal-comms
    • ad-creative, ai-seo, churn-prevention, cold-email, content-strategy, lead-magnets, product-marketing-context, revops, sales-enablement, site-architecture
    • seo, seo-competitor-pages, seo-content, seo-dataforseo, seo-geo, seo-hreflang, seo-image-gen, seo-images, seo-page, seo-plan, seo-programmatic, seo-schema, seo-sitemap, seo-technical
    • defuddle, json-canvas, obsidian-bases, obsidian-cli, obsidian-markdown
  • Preserved the existing docx, pdf, pptx, and xlsx aliases as the repository's symlinked *-official entries instead of duplicating those directories.
  • Normalized imported frontmatter so the new skills align with repository validation expectations:
    • shortened oversized descriptions
    • added missing risk, source, and date_added fields where needed
    • added ## When to Use sections across the new imports
    • removed or rewrote imported dangling links that referenced non-existent upstream paths in this repository
  • Added maintainer provenance notes in docs/maintainers/skills-import-2026-03-21.md so the source repository for each imported skill group is documented for future maintenance.
  • Regenerated maintainer-owned derived artifacts after the import:
    • README.md
    • skills_index.json
    • CATALOG.md
    • data/catalog.json
    • data/bundles.json
  • Verified the direct-main maintenance flow with:
    • npm run validate
    • npm run index
    • npm run catalog
    • npm run chain

Maintenance Walkthrough - 2026-03-18

  • Fixed issue #344 by correcting .claude-plugin/marketplace.json so the marketplace plugin entry uses source: "./" instead of ".", matching Claude Code's relative-path schema requirement for marketplace entries.
  • Added tools/scripts/tests/claude_plugin_marketplace.test.js and wired it into the local test suite so invalid marketplace source paths fail fast in CI/maintainer verification.
  • Merged PRs #333, #336, #338, #343, #340, #334, and #345 via GitHub squash merge after maintainer refresh of forked workflows and PR metadata.
  • Closed PR #337 and PR #342 as superseded by #338, then closed issue #339 manually after confirming the accepted fix path; issue #335 auto-closed from the merged PR body.
  • Closed issue #344 with a follow-up comment after shipping the plugin marketplace fix on main, and left PR #341 open with a blocking review comment because the submitted skill content is corrupted even though CI is green.
  • Documented a new maintainer edge case in .github/MAINTENANCE.md: forked runs in action_required, pr-policy failures caused by stale PR bodies, the REST API fallback when gh pr edit fails with the Projects Classic GraphQL error, and the need to close/reopen a PR when a plain rerun does not pick up updated metadata.
  • Refreshed the release-facing docs for 8.2.0 across README.md, docs/users/getting-started.md, docs/users/walkthrough.md, and CHANGELOG.md.
  • Published release v8.2.0 on main with:
    • npm run release:preflight
    • npm run security:docs
    • npm run release:prepare -- 8.2.0
    • npm run release:publish -- 8.2.0

Maintenance Walkthrough - 2026-03-17

  • Synced main after the six merged community PRs and re-verified all forked PR workflows through GitHub before final release prep.
  • Reopened/approved forked GitHub Actions runs where needed, normalized missing PR quality checklists, and merged PRs #331, #330, #326, #324, #325, and #329 with GitHub squash merge.
  • Patched skills/vibers-code-review/SKILL.md on the contributor branch for PR #325 so the skill had valid YAML frontmatter, a When to Use section, and explicit limitations; reran CI and merged after green checks.
  • Closed issue #327 with a release comment pointing to #331, and closed issue #328 as a duplicate of #269 with links to the README recovery guidance and docs/users/windows-truncation-recovery.md.
  • Updated release-facing docs before cutting v8.1.0:
    • README.md
    • docs/users/getting-started.md
    • CHANGELOG.md
    • walkthrough.md
  • Refreshed the README contributor acknowledgements to include the latest merged contributors from the maintenance batch.
  • Release workflow to run for 8.1.0:
    • npm run release:preflight
    • npm run security:docs
    • npm run release:prepare -- 8.1.0
    • npm run release:publish -- 8.1.0

Maintenance Walkthrough - 2026-03-12

  • Merged PRs #277, #272, #275, #278, and #271 via GitHub squash merge after bringing contributor branches into a mergeable state and refreshing PR bodies against the quality checklist in .github/MAINTENANCE.md.
  • Verified PR #271 locally with npm run validate:references and npm run test before merge; confirmed #269 auto-closed from the merged PR body.
  • Added a user-facing Windows truncation recovery guide at docs/users/windows-truncation-recovery.md, linked it from README.md, docs/users/faq.md, docs/users/getting-started.md, and docs/integrations/jetski-cortex.md, and credited the workflow to issue #274.
  • Updated skills/metasploit-framework/SKILL.md to remove the remote installer flow, require an existing Metasploit installation, and add the required offensive-skill warning.
  • Refreshed README.md to remove stale 7.2.0 / 7.4.0 onboarding copy, align the star badge with the current milestone, and fix the TOC link for ## Contributing.
  • Normalized the active English docs (README.md, user guides, Kiro guide, and evergreen maintainer docs) to the current 7.6.0 / 1,250+ skills state and removed emoji from H2 headers where maintenance rules require clean anchors.
  • Ran the required maintenance validations after the direct fixes:
    • npm run validate
    • npm run validate:references
    • npm run chain
    • npm run catalog
  • Final release prep, issue closure comments, and verification were completed on main.

Maintenance Walkthrough - 2026-03-13

  • Fixed tools/scripts/update_readme.py so normal npm run readme runs preserve the existing registry-sync star/timestamp values instead of rewriting them on every execution, which was causing non-deterministic PR drift failures in CI.
  • Updated tools/scripts/sync_repo_metadata.py to expose the same explicit --refresh-volatile behavior for live star/timestamp refreshes, keeping release/metadata refresh flows available without destabilizing contributor PR checks.
  • Updated .github/workflows/ci.yml so generated registry drift is informational on pull requests but still strict on main, with auto-sync remaining the canonical path for shared artifacts after merge.
  • Updated .github/MAINTENANCE.md, docs/maintainers/ci-drift-fix.md, and docs/maintainers/merging-prs.md to document the lower-friction merge flow: validate source changes on PRs, keep main for generated conflicts, and let main auto-sync the final artifact set.
  • Verified the fix with:
    • python3 tools/scripts/update_readme.py --dry-run
    • python3 tools/scripts/sync_repo_metadata.py --dry-run
    • npm run readme
    • npm run validate:references
  • Added tools/config/generated-files.json as the single contract for derived registry artifacts so CI, maintainer scripts, and docs share the same file list.
  • Added scripted workflow entrypoints: npm run pr:preflight, npm run release:preflight, npm run release:prepare -- X.Y.Z, and npm run release:publish -- X.Y.Z.
  • Split PR CI into pr-policy, source-validation, and artifact-preview so PRs stay source-only, policy failures are explicit, and generated drift is previewed separately from source validation.
  • Updated CONTRIBUTING.md and .github/PULL_REQUEST_TEMPLATE.md so contributors are told not to commit derived files and to enable Allow edits from maintainers.

Maintenance Walkthrough - 2026-03-14

  • Added root Claude Code plugin marketplace support via .claude-plugin/plugin.json and .claude-plugin/marketplace.json, exposing the repository as a single plugin entry that points at the existing skills/ tree.
  • Updated the user onboarding trinity (README.md, docs/users/getting-started.md, docs/users/faq.md) so Claude Code users can install via /plugin marketplace add sickn33/antigravity-awesome-skills in addition to the existing npx installer flow.
  • Merged PRs #302, #301, #299, #297, #296, #287, #298, and #293 via GitHub squash merge after maintainer preflight, including a maintained follow-up commit on the contributor branch for #298 and a maintainer conflict-resolution refresh on #293.
  • Verified the issue-driven fixes locally before merge:
    • #301: python3 -m py_compile skills/notebooklm/scripts/browser_utils.py
    • #299: node -c tools/bin/install.js
  • Verified the skill/docs PRs locally before merge:
    • #297, #296, #287, #298: npm run validate
    • #293, #298: npm run validate:references
  • Closed issues #288, #300, #286, and #281 from the merged fixes and release notes flow; documented #294 as a release follow-up because the support already exists in the current catalog.
  • Removed stale Windows core.symlinks=true / Developer Mode guidance from the user docs after the #299 installer fix, keeping the Windows path on the standard clone/install flow.
  • Ran the post-merge maintainer sync on main:
    • npm run chain
    • npm run catalog
  • Refreshed CHANGELOG.md, README.md, docs/users/getting-started.md, docs/users/faq.md, and the contributor acknowledgements to prepare the single 7.8.0 release cut.

Maintenance Walkthrough - 2026-03-21 Initial Import Batch

  • Imported the missing external skill coverage identified from travisvn/awesome-claude-skills, anthropics/skills, coreyhaines31/marketingskills, AgriciDaniel/claude-seo, and kepano/obsidian-skills, bringing the indexed registry to 1,304 skills on main.
  • Added maintainer attribution notes in docs/maintainers/skills-import-2026-03-21.md and refreshed the generated registry artifacts after the import batch.
  • Re-aligned the public documentation surface to the current repository state:
    • README.md
    • package.json
    • docs/users/getting-started.md
    • docs/users/usage.md
    • docs/users/claude-code-skills.md
    • docs/users/gemini-cli-skills.md
    • docs/users/visual-guide.md
    • docs/users/bundles.md
    • docs/users/kiro-integration.md
    • docs/integrations/jetski-cortex.md
    • docs/maintainers/repo-growth-seo.md
    • docs/maintainers/skills-update-guide.md
  • Updated the changelog Unreleased section so the post-v8.4.0 main branch state documents both the imported skill families and the docs/About realignment.
  • Automated the recurring docs metadata maintenance by extending tools/scripts/sync_repo_metadata.py, wiring it into npm run chain, and adding a regression test so future skill-count/version updates propagate through the curated docs surface without manual patching.
  • Added a remote GitHub About sync path (npm run sync:github-about) backed by gh repo edit + gh api .../topics so the public repository metadata can be refreshed from the same source of truth on demand.
  • Added maintainer automation for repo-state hygiene: sync:contributors updates the README contributor list from GitHub contributors, check:stale-claims/audit:consistency catch drift in count-sensitive docs, and sync:repo-state now chains the local maintainer sweep into a single command.
  • Hardened automation surfaces beyond the local CLI: main CI now runs the unified repo-state sync, tracked web artifacts are refreshed through sync:web-assets, release verification now uses a deterministic sync:release-state path plus npm pack --dry-run, the npm publish workflow reruns those checks before publishing, and a weekly Repo Hygiene GitHub Actions workflow now sweeps slow drift on main.
  • Added two maintainer niceties on top of the hardening work: check:warning-budget freezes the accepted 135 validation warnings so they cannot silently grow, and audit:maintainer prints a read-only health snapshot of warning budget, consistency drift, and git cleanliness.

Maintenance Walkthrough - 2026-07-16 Android Overheating Diagnostics

  • Audited the cached third-party adb-performance skill and rejected a direct import because its linked source repository is unavailable, its license cannot be verified, and it mixes weak snapshot heuristics with unguarded device mutations.
  • Added the clean-room canonical diagnose-android-overheating skill, grounded in current Android and AOSP documentation.
  • Replaced generic “optimization” commands with a read-only-first evidence workflow, controlled comparisons, OEM-aware interpretation, confidence labels, privacy handling, explicit approval gates, rollback requirements, and a hardware-safety stop.
  • Added references/evidence-and-interpretation.md for symptom-specific ADB evidence, thermal status interpretation, correlation rules, Batterystats capture discipline, and bugreport privacy.

Maintenance Walkthrough - 2026-07-16 Tessl Workspace Repair

  • Corrected the Skill Review workflow and trusted review helper to use the token-visible antigravity-awesome-skills Tessl workspace instead of the renamed repository slug.
  • Added a repository-variable override so future Tessl workspace migrations can be handled through TESSL_WORKSPACE without another workflow patch.
  • Updated the review command regression test to lock the corrected workspace argument.

Maintenance Walkthrough - 2026-07-16 Tessl Credit Guard

  • Added a deterministic fingerprint over the changed SKILL.md content and active review policy.
  • Reuse a previously successful review for identical content, avoiding Tessl setup and another charged review after unrelated PR pushes or base refreshes.
  • Route an explicit Tessl credit/quota failure to manual-review-required with exact-head attestation; unrelated Tessl failures still fail closed.
  • Added regression coverage for fingerprint invalidation, GitHub Actions cache wiring, quota classification, and truthful review outcomes.

Maintenance Walkthrough - 2026-07-17 Legacy Redirect Infrastructure

  • Preserved the Google Search Console HTML verification file on the legacy Pages path and the Bing Webmaster Tools meta token on the legacy root redirect.
  • Made redirect generation follow the current skills_index.json count while retaining the curated sitemap-count lock and exact route-set validation.
  • Added pages:redirect-verify for byte-exact managed-tree validation plus bounded or full live route probing.
  • Versioned the redirect manifest contract as schema 3, including webmaster-verification evidence consumed by the protected sync.
  • Added explicit source-repository provenance to the live manifest and used that change to exercise the complete protected auto-sync cycle.
  • Documented the protected cross-repository synchronization contract for sickn33/sickn33.github.io.
  • Added regression coverage for webmaster tokens, reserved-path collisions, dynamic skill counts, local drift, stale files, and live manifest/route verification.

Maintenance Walkthrough - 2026-07-22 Security Findings and Windows Preview

  • Remediated the live dependency advisories for fast-uri, brace-expansion, and body-parser in their affected lockfiles.
  • Hardened AAS Core cache ancestry, transaction durability, bounded MCP manifest state, exact-search behavior, redirect-tree reads, release-PR selection, and maintainer merge authorization.
  • Expanded skill-review fingerprints and workflow triggers to cover bundled support files, and tightened unsafe guidance in the affected canonical skills.
  • Fixed native Windows ACL inspection for AAS preview by making PowerShell path handling explicit and returning bounded phase/path diagnostics for unresolved ACL identities.
  • Added regression coverage for every confirmed code-path finding and documented the Windows 10/11 Codex CLI preview contract from discussion #956.
Reference in New Issue View Git Blame Copy Permalink