@1aboveio/skills 1.0.11 → 1.0.12

package/skills/engineering/engineering/references/init-scope.md

@@ -1,6 +1,14 @@
 # What initialization includes
 
-The default is durable project guidance, not an orchestration or infrastructure setup.
+Standalone `/engineering` first asks for Global, Project, or Session scope. Only a
+Project selection, `/engineering init`, or an explicit project save uses the project
+initializer described here. Global saving follows `SKILL.md`'s separate procedure;
+Session keeps the rules in conversation context without writing files.
+On later standalone calls, configured scopes offer a targeted reset with
+[owned-guidance cleanup](scope-management.md#reset-and-clean-up); setup does not
+grant permission to remove pre-existing rules.
+
+Project initialization creates durable guidance, not an orchestration or infrastructure setup.
 This review covers every active first-party skill in the Engineering package and
 the related delivery, CI, and merge-queue convention owners. Archived skills are
 not initialization sources; pinned external skills keep their upstream ownership.

package/skills/engineering/engineering/references/scope-management.md

@@ -0,0 +1,85 @@
+# Scope management
+
+This procedure governs standalone setup and reset. It does not authorize cleanup
+while the skill is loaded for implementation, review, or tracker routing.
+
+## Detect configuration
+
+- Global uses only the current agent's supported user-level instruction file.
+  Project uses the selected Git root, or current directory without Git, and its
+  `AGENTS.md` and `CONTRIBUTING.md`. Apply the save procedure's target validation
+  before setup or reset. Do not scan unrelated projects or agent installations.
+- A valid ownership record, equivalent existing engineering rules, or an explicit
+  active session choice means the corresponding scope is configured. Distinguish
+  fully configured, partially configured, and existing rules not owned by this skill.
+  Rules inherited from another scope do not mean this scope is configured.
+- Inspect files afresh on every standalone call. Keep the session choice in context
+  across reload or compaction; a new session starts without that temporary choice.
+  A reset session choice remains off until the user explicitly enables it again.
+- Report unknown, unreadable, invalid, and conflicting guidance honestly. Offer to
+  resolve that scope rather than presenting a save or reset as safe. An unknown
+  global path does not prevent a known project or session action.
+
+## Record ownership
+
+After an authorized Global or Project save, keep a small JSON ownership record in
+an HTML comment in each changed guidance file:
+
+```markdown
+<!-- engineering:ownership
+{"version":1,"scope":"project","createdFile":false,"additions":[]}
+-->
+```
+
+Populate `additions` from the actual before/after diff, never from the presence of
+a familiar heading. Each entry has `namespace` (`conventions` or `engineering`),
+`id`, and `sha256` fields. These identify the `<!-- <namespace>:<id>:start -->`
+and matching `end` marker, and the SHA-256 of the bytes between them. Store marker
+identifiers, not literal comment strings, so the initializer does not count the
+receipt as duplicate markers. Include any new wrapper heading inside its recorded
+block. Record only newly inserted text. Use the
+existing `conventions:<id>:start/end` markers for new project sections. Wrap any
+new global defaults or new loading pointer in unique `engineering:<id>:start/end`
+comments before recording their hashes. Do not rewrap existing text or claim it as
+owned. Keep existing valid records and add only new entries; deduplicate entries.
+
+Set `createdFile` only when this save created that file. Preserve unrelated bytes
+and existing links. Do not create a sidecar, global settings entry, or project file
+for a session choice. A repeated save with no additions leaves files unchanged.
+If a record is malformed or ownership is uncertain, preserve the affected text and
+report the problem instead of inventing a receipt or claiming complete setup.
+
+## Reset and clean up
+
+A selected reset or an explicit scoped reset request authorizes removal of that
+scope's saved defaults, not a reinstall, refresh, or reset of every scope.
+
+1. Re-read and validate every target in the selected scope before editing. Explain
+   the planned removals and any preserved user rules. A read-only reset preview
+   stays read-only. Cancellation performs no cleanup.
+2. **Session:** Clear only the explicit temporary engineering choice. Do not edit
+   files or agent settings. Continue to honor inherited global and project rules
+   and binding requirements; session reset does not switch those off.
+3. **Global or Project:** Remove recorded additions only when their markers are
+   unique and balanced and their current content matches the recorded hash. Remove
+   their ownership entries as well. Retain edited blocks and their records, explain
+   the difference, and ask before removing user changes. Never delete an entire
+   section just because its heading matches a template.
+4. For older or unrecorded guidance, including legacy tracker blocks, ownership
+   cannot be inferred from markers alone. Identify the exact candidate text and
+   ask for agreement before deleting it. Do not adopt or erase rules written by
+   another skill. Safe, independently owned removals may proceed while an uncertain
+   removal remains unresolved; report the reset as partial.
+5. Remove owned loading pointers only if they are unchanged and no longer needed
+   by retained guidance. Keep a pointer that still loads user policy. Remove an
+   empty ownership record and any empty wrapper heading added by this save.
+   Delete a file only if `createdFile` proves this skill created it and nothing
+   except the original generated title and whitespace remains. Preserve pre-existing
+   files, symlinks, hand edits, and unrelated sections; never delete an instruction
+   directory or skill installation. Do not touch `CLAUDE.md` during project reset,
+   because project init does not own it.
+6. Report what was removed, retained, or blocked and which scopes still apply.
+   Resetting Project does not remove Global defaults, and resetting Global does
+   not erase project policy. Repeating a completed reset makes no file changes.
+   Reset does not disable ordinary read-only use of engineering defaults when a
+   later implementation or routing task loads this skill.

package/skills/engineering/engineering-runtime/SKILL.md

@@ -3,7 +3,7 @@ name: engineering-runtime
 description: Internal support package for shared Engineering Workflow executable behavior. Never select or invoke this package as a user capability.
 disable-model-invocation: true
 user-invocable: false
-release-version: 0.45.0
+release-version: 0.45.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Engineering Runtime

package/skills/engineering/engineering-runtime/coherence/workflow.json

@@ -369,7 +369,7 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "8ab89f526fd30be9a81c8dc602d797e7aa8d2f09c63da0b56d8d214966e7e1fc",
+      "contentDigest": "e1a3eda72480a554a71b876b0803ffadb6d975f57ce73e9ae84e3a30a75630bc",
       "digestExcludes": []
     },
     {
@@ -382,7 +382,7 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "386ab76e0a90f031da690ca27ee5066684d895290ae0c97faabf6aaad94cd495",
+      "contentDigest": "4976da3d810ab0a712121dfc5acbd62f63f8ae42ec0116431ad7d27d0c52a324",
       "digestExcludes": []
     },
     {
@@ -395,7 +395,7 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "0399fc78af9e7823ace55e04aa867b30b12c738f2a47e28395184512525861bf",
+      "contentDigest": "32204a3fe185c2ea79eb27b0dd4055c321ef7b9f152ffc3a374b714ae8d465fa",
       "digestExcludes": []
     },
     {
@@ -408,7 +408,7 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "2bc51a5c6ed89007075d51f174c7b76d0a743b61f0d299c2067487679c86dd3f",
+      "contentDigest": "6dc6606527c8023eb1f79a188ae73bea4fafe8b339ed391a00fae60340107e0c",
       "digestExcludes": []
     },
     {
@@ -421,7 +421,7 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "c3cd951d823c6ce4f2b9b229892e450ad285e27cda157c5eead0d8ddc3d550f5",
+      "contentDigest": "0ec4a9d50c9918d1219a2454ea2aad7eb3ffdabe917319c55d7928c6d5e3580e",
       "digestExcludes": []
     },
     {
@@ -434,7 +434,7 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "639a25b40d67942c5355abee9d791b02784bedc50fa1f5fb8b4d90125f0b95e7",
+      "contentDigest": "388bd68865a9af12e76b1a522f879684546d5d03427649df5639b16d0b0240b9",
       "digestExcludes": []
     },
     {
@@ -447,7 +447,7 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "c595e281773af00b485dcb7d18e762f487b85761db42afa8287015581acdd8b5",
+      "contentDigest": "d7552f7681020f9cd4ed72dbde105adb5b172e40ba4119bcbb0d4685688faf18",
       "digestExcludes": []
     },
     {
@@ -460,7 +460,7 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "ec21e8eb116ccf6b3c1e798f4039fc2fa05558e63cae157e0bcb75ea81627d68",
+      "contentDigest": "414606c12207509b0d9207b0021dbb29bcb1689ca7d7486496ab2bc6a1dfecfc",
       "digestExcludes": []
     },
     {
@@ -473,7 +473,7 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "d973f6bb977f4cba06e26afa42a54bbaa90d29001086c87a83d84f335df590d4",
+      "contentDigest": "274f5ac6be3224dfdafaa4264cfa0ed223e3b98cf3cbd2c083b6c85314a92791",
       "digestExcludes": []
     },
     {
@@ -486,7 +486,7 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "43d2be290e65e536f0b9ff21087cce81c337158948edbdf901c609d3e73b9b0b",
+      "contentDigest": "a6efa258db14db8a4cab8600bcbdc2563c61531a51a486508ed42da70824be86",
       "digestExcludes": []
     },
     {
@@ -499,7 +499,7 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "73163c04711d6901162bd3cdb3a847db2845e8e51dbd53169ad13e7d2817f45c",
+      "contentDigest": "869bf4214b7e80e4968e4488f2f6ad4a944b2393a343ad40157e45f694457814",
       "digestExcludes": []
     },
     {
@@ -512,13 +512,13 @@
         "repository": "1aboveio/ai",
         "revision": "main"
       },
-      "contentDigest": "9086b011f69d48e264c00241c6c1864e04678f791f575625cff2e788a2b58163",
+      "contentDigest": "bc78899c2a745aedee9f547a16b8c2be2ffab8a128695b033991802d033db303",
       "digestExcludes": [
         "coherence/workflow.json"
       ]
     }
   ],
-  "releaseIdentity": "986e36012356e16fd54d77f0844860cd5ed9c4cac6f18ef1d3d540a3697dcfdf",
+  "releaseIdentity": "fed4e4c161cf525a08eee89fb30ba578ec21962b2d4cb9c9226fc61146fe4225",
   "lifecycleAuthority": "native-skills-cli",
   "repairRecipe": {
     "id": "engineering-workflow-dependency-first",

package/skills/engineering/ensure-coverage/SKILL.md

@@ -2,7 +2,7 @@
 name: ensure-coverage
 description: "Define or audit behavior-first test criteria — ACs, required test levels, mock/integration/E2E policy — across three axes: breadth (Coverage Ledger), depth (over-mocking), presentation (perceivability of browser surfaces). NOT judging whether a single test is any good (test-quality), authoring browser tests (e2e-test), reviewing a PR (better-review), or delivering issues (resolve-issues)."
 disable-model-invocation: true
-release-version: 0.45.0
+release-version: 0.45.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Ensure Coverage

package/skills/engineering/golden-path/SKILL.md

@@ -3,7 +3,7 @@ name: golden-path
 description: "Golden-path E2E: the short list of user journeys whose failure blocks a release, kept in a repo as one contract (golden-paths.json) with a generated GOLDEN_PATHS.md and a generated GitHub Actions workflow, and run against a local build or a deployed URL for an ALIVE/DEAD verdict. Use to set golden paths up in a repo ('init golden paths', 'add golden-path CI'), to migrate an older smoke.manifest.json or a hand-built smoke setup ('audit', 'migrate smoke'), to add, change, or remove a golden path, to ask 'is the build alive?' or run them before a PR or release, or when a change touches a flow listed in GOLDEN_PATHS.md. NOT for writing the Playwright specs themselves (e2e-test), deciding what a change must prove (ensure-coverage), or general workflow YAML (github-actions)."
 dependencies:
   - e2e-test
-release-version: 0.45.0
+release-version: 0.45.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Golden path

package/skills/engineering/harness-runtime/SKILL.md

@@ -3,7 +3,7 @@ name: harness-runtime
 description: Internal import-only library shared by first-party engineering packages. Not a workflow skill; never select or invoke it as a user capability.
 disable-model-invocation: true
 user-invocable: false
-release-version: 0.45.0
+release-version: 0.45.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Harness Runtime

package/skills/engineering/resolve-issues/SKILL.md

@@ -8,7 +8,7 @@ dependencies:
   - better-review
   - golden-path
   - harness-runtime
-release-version: 0.45.0
+release-version: 0.45.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Resolve issues

package/skills/engineering/resolve-release/SKILL.md

@@ -4,7 +4,7 @@ description: "Slash/explicit-only (/resolve-release). Full GitHub Flow release f
 disable-model-invocation: true
 metadata:
   workflow-role: coordinator
-release-version: 0.45.0
+release-version: 0.45.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Resolve release

package/skills/engineering/rush-issues/SKILL.md

@@ -6,7 +6,7 @@ metadata:
   workflow-role: coordinator
 dependencies:
   - resolve-issues
-release-version: 0.45.0
+release-version: 0.45.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Rush issues (shortcut of resolve-issues)

package/skills/engineering/rush-release/SKILL.md

@@ -6,7 +6,7 @@ metadata:
   workflow-role: coordinator
 dependencies:
   - resolve-release
-release-version: 0.45.0
+release-version: 0.45.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Rush release (shortcut of resolve-release)

package/skills/engineering/test-quality/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: test-quality
 description: "Seven principles for tests that catch real bugs, and an audit that reports weak, redundant, and not-coverage tests without fixing them. Use when writing, changing, or reviewing tests, or when asked whether tests are useful, redundant, over-mocked, flaky, only assert static text, or test config files, or asked to make a slow test suite faster without losing coverage, or when the user asks to write the testing conventions into a repo's CONTRIBUTING.md. NOT defining what a spec must prove (ensure-coverage) or authoring browser tests (e2e-test)."
-release-version: 0.45.0
+release-version: 0.45.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Test Quality

package/skills/risk-compliance/compliance-audit/SKILL.md

@@ -2,7 +2,7 @@
 name: compliance-audit
 version: 2.9.0
 description: "Audit operations against financial-compliance checklists (AML/KYC, VARS, PCI-DSS, TPA oversight, onboarding, transaction monitoring). Produces tracker.md (with a tracker.xlsx export) and phase-trail.md with layered validation; cites evidence by original filename. Input: reg-parser or the built-in VARS checklist."
-release-version: 0.45.0
+release-version: 0.45.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Compliance Audit

package/skills/risk-compliance/contract-compare/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: contract-compare
 description: "Compare two or more contracts side-by-side for structured diff, gap analysis, and benchmarking. Use when: comparing contracts or agreements, contract diff, compare terms, vendor-vs-vendor, compare our template vs theirs, compliance gap between contracts. NOT for single-contract risk review — use contract-review for that."
-release-version: 0.45.0
+release-version: 0.45.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Contract Compare

package/skills/risk-compliance/contract-review/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: contract-review
 description: "Review contracts for legal, commercial, and compliance risks via convert → chunk review → merge → validate (+ optional mandate preprocessing). Use for reviewing, auditing, or checking any contract, agreement, NDA, MSA, or SLA; input a file path (PDF/DOCX/TXT) or pasted text."
-release-version: 0.45.0
+release-version: 0.45.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Contract Review

package/skills/risk-compliance/doc-authenticity/SKILL.md

@@ -3,7 +3,7 @@ name: doc-authenticity
 version: 0.4.1
 description: "Screen PDF documents and raster images for fabrication, tampering, Photoshop or other image-editor use, and content validity. Detects file type, runs format-specific authenticity forensics, classifies bank statements, conversation logs, invoices, agreements, and other documents, then applies type-specific validity checks. Produces separate authenticity (NO_EVIDENCE_OF_MODIFICATION / SUSPICIOUS / LIKELY_MODIFIED / INCONCLUSIVE) and validity (VALID / INVALID / INCONCLUSIVE) verdicts. Use whenever a user asks whether a document, screenshot, scan, statement, invoice, contract, chat log, receipt, or payment evidence is genuine, original, edited, Photoshopped, manipulated, fake, or valid."
 disable-model-invocation: true
-release-version: 0.45.0
+release-version: 0.45.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Document and Image Authenticity

package/skills/risk-compliance/fraud-detection/SKILL.md

@@ -12,7 +12,7 @@ description: >
   impact, and a business report. Use for fraud, scam, mule, account-takeover,
   chargeback, dispute, transfer, collection, or payout risk analysis even when the
   user does not name this skill.
-release-version: 0.45.0
+release-version: 0.45.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Fraud Detection

package/skills/risk-compliance/payment-analysis/SKILL.md

@@ -14,7 +14,7 @@ description: >
   transactions" — even if they do not say payment-analysis. Do NOT use for
   fraud rule discovery (fraud-detection) or TLD / MCC-miscoding
   clusters (tld-detection).
-release-version: 0.45.0
+release-version: 0.45.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Payment Analysis

package/skills/risk-compliance/portfolio-payment-analysis/SKILL.md

@@ -5,7 +5,7 @@ description: >
   and investigate selected merchants' authorization, settlement and disputes,
   including descriptor mapping and overlapping exports. Portfolio-level payment
   overviews belong to payment-analysis; fraud rule discovery belongs to fraud-detection.
-release-version: 0.45.0
+release-version: 0.45.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Portfolio payment analysis

package/skills/risk-compliance/similar-domain/SKILL.md

@@ -8,7 +8,7 @@ description: >
   links, an entity chain, and a watchlist for the operator's next domains.
   Not transaction data (tld-detection) or fraud rules (fraud-detection).
 disable-model-invocation: true
-release-version: 0.45.0
+release-version: 0.45.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Similar Domain

package/skills/risk-compliance/tld-detection/SKILL.md

@@ -6,7 +6,7 @@ description: >
   patterns, with USD and BIN-country currency views, group profiles and priorities.
   Not payment-analysis, fraud-detection, or website research.
 disable-model-invocation: true
-release-version: 0.45.0
+release-version: 0.45.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # TLD detection