@1aboveio/skills 0.20.2 → 0.20.3

package/README.md

@@ -57,8 +57,8 @@ Running `install` with no `--group` opens the interactive bundle picker; `update
 - `--disable-tdd` — keep TDD installed but allow only explicit user invocation.
 
 Selecting several groups (interactive picker, repeated `--group`, or `--all`) installs their
-members as one native `skills add` per skill from the unpacked package, so one skill's failure is
-reported by name and never aborts the rest of the selection. Every native add uses `--yes` because
+members as one native `skills add` per skill from the unpacked package. A failure is reported by
+name, blocks only transitive dependents, and never aborts unrelated skills. Every native add uses `--yes` because
 `skills@1.5.22` has no independent `--symlink` flag: this selects the default canonical store plus
 per-harness symlinks without an installation-method prompt, and also confirms replacement of each
 planned same-named skill. The coordinator still owns group and new-member consent before planning.
@@ -69,7 +69,9 @@ planned same-named skill. The coordinator still owns group and new-member consen
 - `delivery-infrastructure` — Delivery Infrastructure: cloud-build, cloud-debug, cloud-deploy, docker, google-cloud, mergify, podman
 - `backend` — Backend: app-debug, python-backend
 - `data-science` — Data Science: airflow, pyspark
-- `payment` — Payment: fraud-analysis, payment-analysis, tld-detection
+- `payment` — Payment: fraud-analysis, payment-analysis, tld-detection, similar-domain
+- `document-utilities` — Document Utilities: doc-to-md, reg-parser (required: reg-parser -> doc-to-md)
+- `compliance` — Compliance: compliance-audit, doc-authenticity, report-writing (required: compliance-audit -> doc-to-md; optional: compliance-audit -> reg-parser)
 - `fullstack` — Fullstack: better-auth, monorepo, nextjs-fullstack, prisma-setup, shadcn, zod-v4
 
 Internal dependencies, installed with the groups above and not selectable on their own: `harness-runtime`.
@@ -102,7 +104,8 @@ copy. The default is No; `--yes` accepts archival non-interactively. Removal is
 same pinned native Skills CLI, only after the declared replacement is installed or already current.
 Declined or failed archival remains in selection memory so a later update offers it again.
 
-Install and update are best-effort per skill: they continue after a single skill failure, summarize
+Install and update are best-effort per skill: they continue after a single skill failure except for
+skills whose required dependency is unavailable, summarize
 every skill as succeeded, unchanged, declined, or failed, and exit non-zero if anything failed. There
 is no rollback or transactional group update; the native CLI remains the sole filesystem write
 authority. Selection memory follows the same per-skill rule: it is rewritten when
@@ -130,7 +133,11 @@ npx skills@1.5.22 remove --global --agent universal claude-code --skill app-debu
 # Data Science
 npx skills@1.5.22 remove --global --agent universal claude-code --skill airflow pyspark
 # Payment
-npx skills@1.5.22 remove --global --agent universal claude-code --skill fraud-analysis payment-analysis tld-detection
+npx skills@1.5.22 remove --global --agent universal claude-code --skill fraud-analysis payment-analysis tld-detection similar-domain
+# Document Utilities
+npx skills@1.5.22 remove --global --agent universal claude-code --skill doc-to-md reg-parser
+# Compliance
+npx skills@1.5.22 remove --global --agent universal claude-code --skill compliance-audit doc-authenticity report-writing
 # Fullstack
 npx skills@1.5.22 remove --global --agent universal claude-code --skill better-auth monorepo nextjs-fullstack prisma-setup shadcn zod-v4
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1aboveio/skills",
-  "version": "0.20.2",
+  "version": "0.20.3",
   "description": "Install the 1AboveIO first-party skill groups through the native Skills CLI.",
   "license": "MIT",
   "type": "module",

package/runtime/skills/distribution/generated/recipes.json

@@ -24,7 +24,7 @@
       "id": "first-party",
       "type": "first-party",
       "package": "@1aboveio/skills",
-      "version": "0.20.2",
+      "version": "0.20.3",
       "updatePolicy": "pinned-npm-version",
       "members": [
         {
@@ -159,6 +159,51 @@
           "role": "skill",
           "licenseResponsibility": "1aboveio-mit"
         },
+        {
+          "installName": "similar-domain",
+          "path": "skills/payment/similar-domain",
+          "role": "skill",
+          "licenseResponsibility": "1aboveio-mit"
+        },
+        {
+          "installName": "doc-to-md",
+          "path": "skills/document-utils/doc-to-md",
+          "role": "skill",
+          "licenseResponsibility": "1aboveio-mit"
+        },
+        {
+          "installName": "reg-parser",
+          "path": "skills/document-utils/reg-parser",
+          "role": "skill",
+          "licenseResponsibility": "1aboveio-mit",
+          "requires": [
+            "doc-to-md"
+          ]
+        },
+        {
+          "installName": "compliance-audit",
+          "path": "skills/compliance/compliance-audit",
+          "role": "skill",
+          "licenseResponsibility": "1aboveio-mit",
+          "requires": [
+            "doc-to-md"
+          ],
+          "optionalRequires": [
+            "reg-parser"
+          ]
+        },
+        {
+          "installName": "doc-authenticity",
+          "path": "skills/compliance/doc-authenticity",
+          "role": "skill",
+          "licenseResponsibility": "1aboveio-mit"
+        },
+        {
+          "installName": "report-writing",
+          "path": "skills/compliance/report-writing",
+          "role": "skill",
+          "licenseResponsibility": "1aboveio-mit"
+        },
         {
           "installName": "better-auth",
           "path": "skills/fullstack/better-auth",
@@ -218,7 +263,7 @@
             "sourceId": "first-party",
             "sourceType": "first-party",
             "package": "@1aboveio/skills",
-            "version": "0.20.2",
+            "version": "0.20.3",
             "installPath": null,
             "members": [
               "harness-runtime",
@@ -252,7 +297,7 @@
             "sourceId": "first-party",
             "sourceType": "first-party",
             "package": "@1aboveio/skills",
-            "version": "0.20.2",
+            "version": "0.20.3",
             "installPath": null,
             "members": [
               "harness-runtime",
@@ -296,7 +341,7 @@
             "sourceId": "first-party",
             "sourceType": "first-party",
             "package": "@1aboveio/skills",
-            "version": "0.20.2",
+            "version": "0.20.3",
             "installPath": null,
             "members": [
               "harness-runtime",
@@ -329,7 +374,7 @@
             "sourceId": "first-party",
             "sourceType": "first-party",
             "package": "@1aboveio/skills",
-            "version": "0.20.2",
+            "version": "0.20.3",
             "installPath": null,
             "members": [
               "harness-runtime",
@@ -372,7 +417,7 @@
             "sourceId": "first-party",
             "sourceType": "first-party",
             "package": "@1aboveio/skills",
-            "version": "0.20.2",
+            "version": "0.20.3",
             "installPath": null,
             "members": [
               "harness-runtime",
@@ -400,7 +445,7 @@
             "sourceId": "first-party",
             "sourceType": "first-party",
             "package": "@1aboveio/skills",
-            "version": "0.20.2",
+            "version": "0.20.3",
             "installPath": null,
             "members": [
               "harness-runtime",
@@ -438,7 +483,7 @@
             "sourceId": "first-party",
             "sourceType": "first-party",
             "package": "@1aboveio/skills",
-            "version": "0.20.2",
+            "version": "0.20.3",
             "installPath": null,
             "members": [
               "harness-runtime",
@@ -466,7 +511,7 @@
             "sourceId": "first-party",
             "sourceType": "first-party",
             "package": "@1aboveio/skills",
-            "version": "0.20.2",
+            "version": "0.20.3",
             "installPath": null,
             "members": [
               "harness-runtime",
@@ -504,18 +549,19 @@
             "sourceId": "first-party",
             "sourceType": "first-party",
             "package": "@1aboveio/skills",
-            "version": "0.20.2",
+            "version": "0.20.3",
             "installPath": null,
             "members": [
               "harness-runtime",
               "fraud-analysis",
               "payment-analysis",
-              "tld-detection"
+              "tld-detection",
+              "similar-domain"
             ],
             "commands": [
               {
                 "transport": "local",
-                "command": "npx skills@1.5.22 add . --global --agent universal claude-code --skill harness-runtime fraud-analysis payment-analysis tld-detection"
+                "command": "npx skills@1.5.22 add . --global --agent universal claude-code --skill harness-runtime fraud-analysis payment-analysis tld-detection similar-domain"
               }
             ],
             "onFailure": {
@@ -533,18 +579,155 @@
             "sourceId": "first-party",
             "sourceType": "first-party",
             "package": "@1aboveio/skills",
-            "version": "0.20.2",
+            "version": "0.20.3",
             "installPath": null,
             "members": [
               "harness-runtime",
               "fraud-analysis",
               "payment-analysis",
-              "tld-detection"
+              "tld-detection",
+              "similar-domain"
+            ],
+            "commands": [
+              {
+                "transport": "local",
+                "command": "npx skills@1.5.22 add . --global --agent universal claude-code --skill harness-runtime fraud-analysis payment-analysis tld-detection similar-domain"
+              }
+            ],
+            "onFailure": {
+              "action": "stop",
+              "message": "Source first-party fetch failed; stop this recipe before running another source."
+            }
+          }
+        ]
+      },
+      "uninstall": {
+        "command": "npx skills@1.5.22 remove --global --agent universal claude-code --skill fraud-analysis payment-analysis tld-detection similar-domain",
+        "removesDependencies": false
+      }
+    },
+    {
+      "id": "document-utilities",
+      "displayName": "Document Utilities",
+      "dependsOn": [
+        "harness-runtime"
+      ],
+      "install": {
+        "stopOnFailure": true,
+        "steps": [
+          {
+            "sourceId": "first-party",
+            "sourceType": "first-party",
+            "package": "@1aboveio/skills",
+            "version": "0.20.3",
+            "installPath": null,
+            "members": [
+              "harness-runtime",
+              "doc-to-md",
+              "reg-parser"
+            ],
+            "commands": [
+              {
+                "transport": "local",
+                "command": "npx skills@1.5.22 add . --global --agent universal claude-code --skill harness-runtime doc-to-md reg-parser"
+              }
+            ],
+            "onFailure": {
+              "action": "stop",
+              "message": "Source first-party fetch failed; stop this recipe before running another source."
+            }
+          }
+        ]
+      },
+      "update": {
+        "mode": "rerun-install-recipe",
+        "stopOnFailure": true,
+        "steps": [
+          {
+            "sourceId": "first-party",
+            "sourceType": "first-party",
+            "package": "@1aboveio/skills",
+            "version": "0.20.3",
+            "installPath": null,
+            "members": [
+              "harness-runtime",
+              "doc-to-md",
+              "reg-parser"
+            ],
+            "commands": [
+              {
+                "transport": "local",
+                "command": "npx skills@1.5.22 add . --global --agent universal claude-code --skill harness-runtime doc-to-md reg-parser"
+              }
+            ],
+            "onFailure": {
+              "action": "stop",
+              "message": "Source first-party fetch failed; stop this recipe before running another source."
+            }
+          }
+        ]
+      },
+      "uninstall": {
+        "command": "npx skills@1.5.22 remove --global --agent universal claude-code --skill doc-to-md reg-parser",
+        "removesDependencies": false
+      }
+    },
+    {
+      "id": "compliance",
+      "displayName": "Compliance",
+      "dependsOn": [
+        "harness-runtime"
+      ],
+      "install": {
+        "stopOnFailure": true,
+        "steps": [
+          {
+            "sourceId": "first-party",
+            "sourceType": "first-party",
+            "package": "@1aboveio/skills",
+            "version": "0.20.3",
+            "installPath": null,
+            "members": [
+              "harness-runtime",
+              "doc-to-md",
+              "compliance-audit",
+              "doc-authenticity",
+              "report-writing"
+            ],
+            "commands": [
+              {
+                "transport": "local",
+                "command": "npx skills@1.5.22 add . --global --agent universal claude-code --skill harness-runtime doc-to-md compliance-audit doc-authenticity report-writing"
+              }
+            ],
+            "onFailure": {
+              "action": "stop",
+              "message": "Source first-party fetch failed; stop this recipe before running another source."
+            }
+          }
+        ]
+      },
+      "update": {
+        "mode": "rerun-install-recipe",
+        "stopOnFailure": true,
+        "steps": [
+          {
+            "sourceId": "first-party",
+            "sourceType": "first-party",
+            "package": "@1aboveio/skills",
+            "version": "0.20.3",
+            "installPath": null,
+            "members": [
+              "harness-runtime",
+              "doc-to-md",
+              "compliance-audit",
+              "doc-authenticity",
+              "report-writing"
             ],
             "commands": [
               {
                 "transport": "local",
-                "command": "npx skills@1.5.22 add . --global --agent universal claude-code --skill harness-runtime fraud-analysis payment-analysis tld-detection"
+                "command": "npx skills@1.5.22 add . --global --agent universal claude-code --skill harness-runtime doc-to-md compliance-audit doc-authenticity report-writing"
               }
             ],
             "onFailure": {
@@ -555,7 +738,7 @@
         ]
       },
       "uninstall": {
-        "command": "npx skills@1.5.22 remove --global --agent universal claude-code --skill fraud-analysis payment-analysis tld-detection",
+        "command": "npx skills@1.5.22 remove --global --agent universal claude-code --skill compliance-audit doc-authenticity report-writing",
         "removesDependencies": false
       }
     },
@@ -572,7 +755,7 @@
             "sourceId": "first-party",
             "sourceType": "first-party",
             "package": "@1aboveio/skills",
-            "version": "0.20.2",
+            "version": "0.20.3",
             "installPath": null,
             "members": [
               "harness-runtime",
@@ -604,7 +787,7 @@
             "sourceId": "first-party",
             "sourceType": "first-party",
             "package": "@1aboveio/skills",
-            "version": "0.20.2",
+            "version": "0.20.3",
             "installPath": null,
             "members": [
               "harness-runtime",
@@ -644,7 +827,7 @@
             "sourceId": "first-party",
             "sourceType": "first-party",
             "package": "@1aboveio/skills",
-            "version": "0.20.2",
+            "version": "0.20.3",
             "installPath": null,
             "members": [
               "harness-runtime"
@@ -670,7 +853,7 @@
             "sourceId": "first-party",
             "sourceType": "first-party",
             "package": "@1aboveio/skills",
-            "version": "0.20.2",
+            "version": "0.20.3",
             "installPath": null,
             "members": [
               "harness-runtime"
@@ -702,7 +885,7 @@
           "sourceId": "first-party",
           "sourceType": "first-party",
           "package": "@1aboveio/skills",
-          "version": "0.20.2",
+          "version": "0.20.3",
           "installPath": null,
           "members": [
             "harness-runtime",
@@ -728,6 +911,12 @@
             "fraud-analysis",
             "payment-analysis",
             "tld-detection",
+            "similar-domain",
+            "doc-to-md",
+            "reg-parser",
+            "compliance-audit",
+            "doc-authenticity",
+            "report-writing",
             "better-auth",
             "monorepo",
             "nextjs-fullstack",
@@ -738,7 +927,7 @@
           "commands": [
             {
               "transport": "local",
-              "command": "npx skills@1.5.22 add . --global --agent universal claude-code --skill harness-runtime e2e-test ensure-coverage implement-and-pr rush-issues rush-release review-pr smoke engineering-runtime cloud-build cloud-debug cloud-deploy docker google-cloud mergify podman app-debug python-backend airflow pyspark fraud-analysis payment-analysis tld-detection better-auth monorepo nextjs-fullstack prisma-setup shadcn zod-v4 && npm --prefix \"$(realpath \"$HOME/.agents/skills/engineering-runtime/scripts\")\" ci --ignore-scripts"
+              "command": "npx skills@1.5.22 add . --global --agent universal claude-code --skill harness-runtime e2e-test ensure-coverage implement-and-pr rush-issues rush-release review-pr smoke engineering-runtime cloud-build cloud-debug cloud-deploy docker google-cloud mergify podman app-debug python-backend airflow pyspark fraud-analysis payment-analysis tld-detection similar-domain doc-to-md reg-parser compliance-audit doc-authenticity report-writing better-auth monorepo nextjs-fullstack prisma-setup shadcn zod-v4 && npm --prefix \"$(realpath \"$HOME/.agents/skills/engineering-runtime/scripts\")\" ci --ignore-scripts"
             }
           ],
           "onFailure": {
@@ -756,7 +945,7 @@
           "sourceId": "first-party",
           "sourceType": "first-party",
           "package": "@1aboveio/skills",
-          "version": "0.20.2",
+          "version": "0.20.3",
           "installPath": null,
           "members": [
             "harness-runtime",
@@ -782,6 +971,12 @@
             "fraud-analysis",
             "payment-analysis",
             "tld-detection",
+            "similar-domain",
+            "doc-to-md",
+            "reg-parser",
+            "compliance-audit",
+            "doc-authenticity",
+            "report-writing",
             "better-auth",
             "monorepo",
             "nextjs-fullstack",
@@ -792,7 +987,7 @@
           "commands": [
             {
               "transport": "local",
-              "command": "npx skills@1.5.22 add . --global --agent universal claude-code --skill harness-runtime e2e-test ensure-coverage implement-and-pr rush-issues rush-release review-pr smoke engineering-runtime cloud-build cloud-debug cloud-deploy docker google-cloud mergify podman app-debug python-backend airflow pyspark fraud-analysis payment-analysis tld-detection better-auth monorepo nextjs-fullstack prisma-setup shadcn zod-v4 && npm --prefix \"$(realpath \"$HOME/.agents/skills/engineering-runtime/scripts\")\" ci --ignore-scripts"
+              "command": "npx skills@1.5.22 add . --global --agent universal claude-code --skill harness-runtime e2e-test ensure-coverage implement-and-pr rush-issues rush-release review-pr smoke engineering-runtime cloud-build cloud-debug cloud-deploy docker google-cloud mergify podman app-debug python-backend airflow pyspark fraud-analysis payment-analysis tld-detection similar-domain doc-to-md reg-parser compliance-audit doc-authenticity report-writing better-auth monorepo nextjs-fullstack prisma-setup shadcn zod-v4 && npm --prefix \"$(realpath \"$HOME/.agents/skills/engineering-runtime/scripts\")\" ci --ignore-scripts"
             }
           ],
           "onFailure": {
@@ -803,7 +998,7 @@
       ]
     },
     "uninstall": {
-      "command": "npx skills@1.5.22 remove --global --agent universal claude-code --skill e2e-test ensure-coverage implement-and-pr rush-issues rush-release review-pr smoke engineering-runtime cloud-build cloud-debug cloud-deploy docker google-cloud mergify podman app-debug python-backend airflow pyspark fraud-analysis payment-analysis tld-detection better-auth monorepo nextjs-fullstack prisma-setup shadcn zod-v4 harness-runtime"
+      "command": "npx skills@1.5.22 remove --global --agent universal claude-code --skill e2e-test ensure-coverage implement-and-pr rush-issues rush-release review-pr smoke engineering-runtime cloud-build cloud-debug cloud-deploy docker google-cloud mergify podman app-debug python-backend airflow pyspark fraud-analysis payment-analysis tld-detection similar-domain doc-to-md reg-parser compliance-audit doc-authenticity report-writing better-auth monorepo nextjs-fullstack prisma-setup shadcn zod-v4 harness-runtime"
     }
   }
 }

package/runtime/skills/distribution/scripts/bundles.mjs

@@ -354,6 +354,9 @@ export function planBundleCommands(action, groupIds, {
   const recipes = readRecipes(recipesPath);
   assertLocalRoot(localRoot);
   const groups = new Map(recipes.groups.map((group) => [group.id, group]));
+  const memberMetadata = new Map((recipes.sources ?? [])
+    .flatMap((source) => source.members ?? [])
+    .map((member) => [member.installName, member]));
   const requested = [];
   for (const groupId of groupIds) {
     if (!groups.has(groupId) || SUPPORT_GROUPS.has(groupId)) throw new Error(`Unknown bundle: ${groupId}`);
@@ -409,6 +412,9 @@ export function planBundleCommands(action, groupIds, {
           command: skillCommand,
           cwd: localRoot,
           failureMessage: step.onFailure.message,
+          ...(memberMetadata.get(skill)?.requires?.length > 0
+            ? { requires: memberMetadata.get(skill).requires }
+            : {}),
         };
         plannedByMember.set(skill, entry);
         planned.push(entry);
@@ -419,20 +425,27 @@ export function planBundleCommands(action, groupIds, {
   return planned;
 }
 
-// Continue-on-failure (#1129): every planned per-skill add is attempted in dependency order; a
-// failed skill is recorded (its recipe failure message goes to stderr) and the run proceeds to the
-// remaining skills. Nothing here stops early — the caller summarizes the buckets and decides the
-// exit status, and selection persistence sees exactly which members succeeded.
+// Continue-on-failure (#1129): planned per-skill adds run in dependency order. A failed skill blocks
+// only members that require it; unrelated later skills still run. The caller summarizes the buckets,
+// decides the exit status, and persists only members whose required closure is ready.
 export function runBundleCommands(commands, {
   execute = (command, cwd) => spawnSync('/bin/bash', ['-lc', command], { cwd, stdio: 'inherit' }),
   applyPolicy = applyInvocationPolicy,
   skillsRoot,
   stdout = process.stdout,
   stderr = process.stderr,
+  satisfiedMembers = [],
 } = {}) {
   const succeeded = [];
   const failed = [];
+  const available = new Set(satisfiedMembers);
   for (const planned of commands) {
+    const blockedBy = (planned.requires ?? []).filter((dependency) => !available.has(dependency));
+    if (blockedBy.length > 0) {
+      stderr.write(`Dependency failed for ${planned.member}: ${blockedBy.join(', ')} is not available\n`);
+      failed.push({ planned, status: 1, blockedBy });
+      continue;
+    }
     stdout.write(`\nInstalling ${planned.member} (${planned.sourceId})...\n`);
     const result = execute(planned.command, planned.cwd);
     if (result.status === 0) {
@@ -445,6 +458,7 @@ export function runBundleCommands(commands, {
           });
         }
         succeeded.push(planned);
+        available.add(planned.member);
         continue;
       } catch (error) {
         stderr.write(`Invocation policy failed for ${planned.member}: ${error.message}\n`);
@@ -458,6 +472,25 @@ export function runBundleCommands(commands, {
   return { succeeded, failed };
 }
 
+export function enforceReadyDependencies(readyMembers, records, stderr = process.stderr) {
+  const metadata = new Map(records.map((record) => [record.member, record]));
+  const blocked = [];
+  let changed = true;
+  while (changed) {
+    changed = false;
+    for (const member of [...readyMembers]) {
+      const record = metadata.get(member);
+      const blockedBy = (record?.requires ?? []).filter((dependency) => !readyMembers.has(dependency));
+      if (blockedBy.length === 0) continue;
+      readyMembers.delete(member);
+      blocked.push({ planned: record, status: 1, blockedBy });
+      stderr.write(`Dependency unavailable for ${member}: ${blockedBy.join(', ')} is not ready\n`);
+      changed = true;
+    }
+  }
+  return blocked;
+}
+
 // The four run buckets, printed after every non-dry run. `unchanged` (digest-identical skip, #1127)
 // and `declined` (new-member consent, #1128) render from empty lists until those units land — the
 // summary contract is stable from here on, so both buckets are always shown.
@@ -508,7 +541,12 @@ export function expectedMemberDigest(source, member, { localRoot }) {
 // installed store (`~/.agents/skills`); the member lives under it by installName.
 export function classifyInstalledMember(source, member, { enableTdd = true, localRoot, skillsRoot }) {
   const directory = join(skillsRoot, member.installName);
-  const entry = { member: member.installName, sourceId: source?.id ?? null, directory };
+  const entry = {
+    member: member.installName,
+    sourceId: source?.id ?? null,
+    directory,
+    ...(member.requires?.length > 0 ? { requires: member.requires } : {}),
+  };
   if (!statSync(directory, { throwIfNoEntry: false })?.isDirectory()) {
     return { ...entry, status: 'missing' };
   }
@@ -952,11 +990,17 @@ export async function runCli(args, {
       skillsRoot,
       stdout,
       stderr,
+      satisfiedMembers: buckets?.unchanged.map((entry) => entry.member),
     });
     const readyMembers = new Set([
       ...succeeded.map((planned) => planned.member),
       ...(buckets?.unchanged.map((entry) => entry.member) ?? []),
     ]);
+    failed.push(...enforceReadyDependencies(
+      readyMembers,
+      [...commands, ...(buckets?.unchanged ?? [])],
+      stderr,
+    ));
     const archives = runArchiveCommands(
       archiveCandidates.filter((candidate) => !declinedArchives.has(candidate.installName)),
       readyMembers,

package/runtime/skills/engineering/engineering-runtime/scripts/workflow-coherence.mjs

@@ -154,6 +154,10 @@ const TEST_FIXTURE = /\.fixtures?\.[^.]+$/;
 export function publishedContentExcluded(name) {
   return name.startsWith('.')
     || name === 'node_modules'
+    || name === '__pycache__'
+    || name === 'evals'
+    || name === 'samples'
+    || name === 'tests'
     || name.endsWith('-workspace')
     || name.endsWith('.test.mjs')
     || TEST_FIXTURE.test(name);

package/runtime/skills/engineering/engineering-runtime/scripts/workflow-policy.mjs

@@ -86,7 +86,7 @@ export const WORKFLOW_TRUSTED_SOURCES = deepFreeze({
     id: 'first-party',
     type: 'first-party',
     package: '@1aboveio/skills',
-    version: '0.20.2',
+    version: '0.20.3',
   },
   matt: {
     id: 'matt-pocock',

package/skills/compliance/compliance-audit/LICENSE

@@ -0,0 +1,3 @@
+MIT License
+
+Copyright (c) 2026 1AboveIO