@1aboveio/skills 1.0.14 → 1.0.16

package/skills/app-dev/data-catalog/scripts/persist-conventions-core.mjs

@@ -13,6 +13,12 @@
 // A section sits between `conventions:<id>` markers, so a re-run replaces only
 // that block and keeps everything else, including other skills' sections.
 // Nothing is written without --write: the user triggers the write, not an agent.
+//
+// The guide pointer and a skill's task-entry loader are independent. A link to
+// CONTRIBUTING.md says where the policy lives; it does not load the skill that applies
+// it. So a repo whose AGENTS.md (or regular CLAUDE.md) already names the guide still
+// gets the loader, and a repo that already loads the skill keeps its own rule.
+// engineering's init.mjs reuses `withTaskEntries` for its own two loaders.
 
 import fs from 'node:fs'
 import path from 'node:path'
@@ -20,6 +26,8 @@ import path from 'node:path'
 export const CONTRIBUTING_FILE = 'CONTRIBUTING.md'
 const MENTIONS_CONTRIBUTING = /(?:^|[^\w-])CONTRIBUTING\.md/
 
+const TASK_ENTRY = 'task-entry'
+
 export const AGENTS_SECTION = [
   '## Contributing',
   '',
@@ -69,26 +77,218 @@ export function renderClaude(current) {
   return `${current.replace(/\s*$/, '')}\n\n${AGENTS_SECTION}`
 }
 
-export function persist(repoRoot, section, { write = false } = {}) {
-  const block = sectionBlock(section)
-  const plan = [
-    [CONTRIBUTING_FILE, (text) => renderConventions(text, section.id, block)],
-    ['AGENTS.md', renderAgents],
-    ['CLAUDE.md', renderClaude],
+export function taskEntryMarkers(id) {
+  return [`<!-- conventions:${id}-${TASK_ENTRY}:start -->`, `<!-- conventions:${id}-${TASK_ENTRY}:end -->`]
+}
+
+// Pure: the managed loader block. A short rule in an entrypoint; the conventions it
+// points at stay in CONTRIBUTING.md.
+export function taskEntryBlock({ id, title, body }) {
+  const [start, end] = taskEntryMarkers(id)
+  const recovery = body.includes('After context loss') ? '' : '\nAfter context loss, reload this skill\'s rules before continuing.'
+  return `${start}\n## ${title}\n\n${body.trim()}${recovery}\n${end}\n`
+}
+
+const escape = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+function withoutExamples(text) {
+  let fence = null
+  let comment = false
+  const active = text.split('\n').map(line => {
+    if (fence) {
+      const match = /^ {0,3}(`{3,}|~{3,})/.exec(line)
+      if (match && match[1][0] === fence[0] && match[1].length >= fence.length
+        && line.slice(match[0].length).trim() === '') fence = null
+      return ''
+    }
+    let masked = ''
+    let cursor = 0
+    while (cursor < line.length) {
+      const marker = line.indexOf(comment ? '-->' : '<!--', cursor)
+      const end = marker < 0 ? line.length : marker
+      masked += comment ? ' '.repeat(end - cursor) : line.slice(cursor, end)
+      if (marker < 0) break
+      const length = comment ? 3 : 4
+      masked += ' '.repeat(length)
+      cursor = marker + length
+      comment = !comment
+    }
+    const match = /^ {0,3}(`{3,}|~{3,})/.exec(masked)
+    if (match) { fence = match[1]; return '' }
+    return /^(?: {4}|\t|\s*>)/.test(line) ? '' : line
+  }).join('\n')
+  if (fence) throw new Error('unclosed Markdown code fence; repair guidance before setup')
+  if (comment) {
+    throw new Error('unclosed HTML comment; repair guidance before setup')
+  }
+  return active
+}
+
+// Keep code-form skill names, but not inline examples containing whole instructions.
+const visible = (text) => withoutExamples(text).replace(/<!--[\s\S]*?-->/g, '')
+  .replace(/(`+)([^`]*?)\1/g, (span, _ticks, content) => /\s/.test(content) ? '' : span)
+
+function hasHeading(text, title) {
+  return new RegExp(`^#{1,6}\\s+${escape(title)}\\s*$`, 'm').test(visible(text))
+}
+
+// A hand-written equivalent ("read and apply the `test-quality` skill") already loads
+// the skill, so the managed block would repeat it. A guide link never matches.
+function loadsSkill(text, skill, contexts = []) {
+  const name = escape(skill)
+  const instruction = new RegExp(`\\b(?:read|load|apply|use|follow)\\s+(?:and\\s+(?:apply|read)\\s+)?(?:(?:the|installed)\\s+){0,2}(?:\`${name}\`|${name}\\s+skills?\\b)`, 'i')
+  return visible(text).split(/\n\s*\n/).some(paragraph =>
+    instruction.test(paragraph)
+    && (!contexts.length || contexts.every(word => new RegExp(`\\b${escape(word)}\\b`, 'i').test(paragraph))))
+}
+
+// Pure: `{ text, conflicts }` — each loader's block added once, where it is missing.
+// An equivalent existing rule is preserved; malformed markers and an unmanaged section
+// under the same heading are reported instead of written over.
+export function withTaskEntries(current, loaders = []) {
+  let text = current
+  const conflicts = []
+  for (const loader of loaders) {
+    const body = visible(text)
+    const denied = new RegExp(`\\b(?:do not|don't|never|must not)\\s+(?:(?:automatically|ever)\\s+)?(?:read|load|apply|use|follow)\\b[^.\\n]{0,120}\\b${escape(loader.skill)}\\b`, 'i')
+    if (denied.test(body)) {
+      conflicts.push(`an existing rule forbids loading "${loader.skill}"; reconcile it before setup`)
+      continue
+    }
+    const restricted = new RegExp(`\\b${escape(loader.skill)}\\b[^.\\n]{0,100}\\bonly\\s+(?:when|if)\\s+(?:explicitly|the user)`, 'i')
+    if (restricted.test(body)) {
+      conflicts.push(`an existing explicit-only rule restricts "${loader.skill}"; reconcile it before setup`)
+      continue
+    }
+    if (loader.contexts?.length && visible(text).split(/\n\s*\n/).some(paragraph =>
+      loadsSkill(paragraph, loader.skill) && /\b(?:for|during)\b[^.\n]{0,80}\bonly\s*[,;:]/i.test(paragraph))) {
+      conflicts.push(`an existing task-only rule restricts "${loader.skill}"; reconcile it before setup`)
+      continue
+    }
+    const [start, end] = taskEntryMarkers(loader.id)
+    const active = withoutExamples(text)
+    const starts = active.split(start).length - 1
+    const ends = active.split(end).length - 1
+    if (starts || ends) {
+      // Already written: a re-run leaves the block as it is rather than refreshing it.
+      if (starts !== 1 || ends !== 1 || active.indexOf(start) > active.indexOf(end)) {
+        conflicts.push(`malformed "${loader.title}" markers; repair them by hand`)
+      } else if (!loadsSkill(active.slice(active.indexOf(start), active.indexOf(end)), loader.skill, loader.contexts)) {
+        conflicts.push(`the preserved "${loader.title}" block has no applicable skill loader; reconcile it before setup`)
+      }
+      continue
+    }
+    if (loadsSkill(text, loader.skill, loader.contexts)) continue
+    if (hasHeading(text, loader.title)) {
+      conflicts.push(`an existing "${loader.title}" section needs manual reconciliation; no competing block added`)
+      continue
+    }
+    text = `${text.replace(/\s*$/, '')}\n\n${taskEntryBlock(loader)}`
+  }
+  return { text, conflicts }
+}
+
+function indexEntries(section) {
+  const loaders = section.loader ? [section.loader] : []
+  return [
+    { name: 'AGENTS.md', render: renderAgents, loaders },
+    // A regular CLAUDE.md that already points at AGENTS.md inherits that file's loaders.
+    { name: 'CLAUDE.md', render: renderClaude, loaders, reachesAgents: true },
   ]
-  return plan.map(([name, render]) => {
-    const file = path.join(repoRoot, name)
-    if (fs.lstatSync(file, { throwIfNoEntry: false })?.isSymbolicLink()) return { file: name, action: 'unchanged' }
-    const current = fs.existsSync(file) ? fs.readFileSync(file, 'utf8') : null
-    const next = render(current)
-    const action = current == null ? 'create' : next === current ? 'unchanged' : 'update'
+}
+
+function reachesSelectedAgents(text, repoRoot, file) {
+  const body = visible(text)
+  const expected = path.join(repoRoot, 'AGENTS.md')
+  const canonical = name => fs.existsSync(name) ? fs.realpathSync(name) : path.resolve(name)
+  const affirmative = body.split('\n').filter(line => !/\b(?:do not|don't|never|must not)\b/i.test(line)).join('\n')
+  const references = [...affirmative.matchAll(/\[[^\]]*\]\((?:<([^>]+)>|([^\s)]+))\)/g)]
+    .map(match => match[1] ?? match[2])
+  for (const match of affirmative.matchAll(/\b(?:read|load|follow|see|consult)\s+`?((?:[^\s`]+\/)?AGENTS\.md)`?/gi)) {
+    references.push(match[1])
+  }
+  return references.some(ref => {
+    if (/^[a-z][a-z\d+.-]*:|^\/\//i.test(ref)) return false
+    try {
+      const target = path.resolve(path.dirname(file), decodeURIComponent(ref.split(/[?#]/)[0]))
+      return canonical(target) === canonical(expected)
+    } catch { return false }
+  })
+}
+
+function apply(repoRoot, entries, write) {
+  repoRoot = fs.realpathSync(repoRoot)
+  const readText = file => new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(fs.readFileSync(file))
+  const plannedContent = new Map()
+  const plan = entries.map((entry) => {
+    const file = path.join(repoRoot, entry.name)
+    if (fs.lstatSync(file, { throwIfNoEntry: false })?.isSymbolicLink()) {
+      let conflicts = []
+      try {
+        const target = fs.realpathSync(file)
+        const relative = path.relative(repoRoot, target)
+        if (relative === '..' || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
+          conflicts = ['linked entrypoint is outside the selected project; verify its task loader separately']
+        } else {
+          const current = plannedContent.get(target) ?? readText(file)
+          const checked = withTaskEntries(current, entry.loaders)
+          conflicts = checked.conflicts
+          if (checked.text !== current && !(entry.reachesAgents && reachesSelectedAgents(current, repoRoot, target))) {
+            conflicts.push('linked entrypoint lacks the task loader; explicit reconciliation is required')
+          }
+        }
+      } catch { conflicts = ['linked entrypoint could not be verified; setup is partial'] }
+      return { file: entry.name, action: 'unchanged', conflicts }
+    }
+    const current = fs.existsSync(file) ? readText(file) : null
+    const base = entry.render(current)
+    let next = base
+    let conflicts = []
+    if (base !== LINK_TO_AGENTS) {
+      const applied = withTaskEntries(base, entry.loaders)
+      const inherits = entry.reachesAgents && reachesSelectedAgents(current ?? '', repoRoot, file)
+      next = inherits ? base : applied.text
+      conflicts = applied.conflicts
+    }
     if (next === LINK_TO_AGENTS) {
-      if (write) fs.symlinkSync('AGENTS.md', file)
-      return { file: name, action: 'link' }
+      return { file: entry.name, action: 'link', conflicts, next }
+    }
+    const action = current == null ? 'create' : next === current ? 'unchanged' : 'update'
+    if (current !== null && action !== 'unchanged' && fs.statSync(file).nlink > 1) {
+      conflicts.push('hard-linked guidance cannot be changed without exclusive ownership')
     }
-    if (write && action !== 'unchanged') fs.writeFileSync(file, next)
-    return { file: name, action }
+    plannedContent.set(file, next)
+    return { file: entry.name, action, conflicts, next }
   })
+  const blocked = plan.some(entry => entry.conflicts.length)
+  if (write && !blocked) {
+    for (const entry of plan.filter(entry => entry.action !== 'unchanged')) {
+      const file = path.join(repoRoot, entry.file)
+      fs.accessSync(entry.action === 'create' || entry.action === 'link' ? repoRoot : file, fs.constants.W_OK)
+    }
+    for (const entry of plan) {
+      const file = path.join(repoRoot, entry.file)
+      if (entry.next === LINK_TO_AGENTS) fs.symlinkSync('AGENTS.md', file)
+      else if (entry.action !== 'unchanged') fs.writeFileSync(file, entry.next)
+    }
+  }
+  return plan.map(({ next: _next, ...entry }) => ({
+    ...entry, action: blocked && entry.action !== 'unchanged' ? 'blocked' : entry.action,
+  }))
+}
+
+export function persist(repoRoot, section, { write = false } = {}) {
+  const block = sectionBlock(section)
+  const entries = [
+    { name: CONTRIBUTING_FILE, render: (text) => renderConventions(text, section.id, block), loaders: [] },
+    ...indexEntries(section),
+  ]
+  return apply(repoRoot, entries, write)
+}
+
+// The index half alone: for a section that is already present, only the guide pointer
+// and the task-entry loader are due.
+export function persistIndex(repoRoot, section, { write = false } = {}) {
+  return apply(repoRoot, indexEntries(section), write)
 }
 
 // `section` = { id, owner, title, body }. Exit 0 on success, 2 on a usage error.
@@ -107,12 +307,22 @@ export function runCli(argv, section, { cwd = process.cwd(), log = console.log }
     log(`persist-conventions: not a directory: ${repoRoot}`)
     return 2
   }
-  const results = persist(repoRoot, section, { write })
-  const done = { create: 'created', link: 'linked to AGENTS.md', update: 'updated', unchanged: 'unchanged' }
-  for (const r of results) log(`  ${r.file}: ${write || r.action === 'unchanged' ? done[r.action] : `would ${r.action}`}`)
-  const changed = results.filter((r) => r.action !== 'unchanged').length
+  let results
+  try { results = persist(repoRoot, section, { write }) }
+  catch (error) { log(`persist-conventions: setup refused: ${error.message}`); return 2 }
+  const done = { create: 'created', link: 'linked to AGENTS.md', update: 'updated', unchanged: 'unchanged', blocked: 'blocked' }
+  const conflicts = []
+  for (const r of results) {
+    for (const conflict of r.conflicts ?? []) conflicts.push(`${r.file}: ${conflict}`)
+    log(`  ${r.file}: ${write || r.action === 'unchanged' ? done[r.action] : `would ${r.action}`}`)
+  }
+  const changed = results.filter((r) => !['unchanged', 'blocked'].includes(r.action)).length
   log(write
     ? `persist-conventions: ${section.title}: ${changed} file(s) written, ${results.length - changed} unchanged`
     : `persist-conventions: ${section.title}: preview only, ${changed} file(s) would change; re-run with --write to write`)
-  return 0
+  if (conflicts.length) {
+    for (const conflict of conflicts) log(`  conflict: ${conflict}`)
+    log(`persist-conventions: ${section.title}: ${conflicts.length} conflict(s); no files written; reconcile before setup`)
+  }
+  return conflicts.length ? 2 : 0
 }

package/skills/app-dev/data-catalog/scripts/persist-conventions.mjs

@@ -1,6 +1,7 @@
 // persist-conventions — the data catalog conventions as the
 // `## Data catalog conventions` section of a repo's CONTRIBUTING.md (../SKILL.md,
-// First use in a repo). Previews unless --write.
+// First use in a repo). Previews unless --write. --write also adds the skill's
+// task-entry loader to AGENTS.md (and to a regular CLAUDE.md that does not reach it).
 //
 //   node persist-conventions.mjs [--repo-root <dir>] [--write]
 import fs from 'node:fs'
@@ -12,6 +13,16 @@ const SECTION = {
   owner: 'data-catalog',
   title: 'Data catalog conventions',
   body: fs.readFileSync(fileURLToPath(new URL('../references/data-catalog-conventions.md', import.meta.url)), 'utf8'),
+  loader: {
+    id: 'data-catalog',
+    skill: 'data-catalog',
+    title: 'Data catalog task entry',
+    body: [
+      "When adding, renaming, removing, or changing the meaning of a table's output",
+      'column, or reviewing a table script, read and apply the installed `data-catalog`',
+      "skill. The repository's catalog rules stay in its contributor guide.",
+    ].join('\n'),
+  },
 }
 
 process.exitCode = runCli(process.argv.slice(2), SECTION)

package/skills/app-dev/data-quality/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: data-quality
 description: "Check a published warehouse table's data against its data-catalog definitions with read-only SELECTs: columns never filled or stuck at one value, counts below zero, ratios outside 0–1, declared values that never appear and undeclared values that do. Then classify each finding as a wrong definition, wrong code, or wrong data. Use when asked whether a table's data is right, to profile or sanity-check a dwd/ads table, to find dead or constant columns, to check a column's values against its documented list, after a pipeline change ships, or when a data-catalog definition and the data might disagree. NOT for validating a Spark change before it ships (pyspark canary and reconciliation), writing definitions (data-catalog), or monitoring dashboards."
-release-version: 0.46.0
+release-version: 0.48.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Data quality

package/skills/app-dev/ios-foundation/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: ios-foundation
 description: "Set up and prove an Expo / React Native native iOS workspace from an assigned or fresh isolated workspace to a manual Login smoke on an owned iOS Simulator: isolated workspace and private caches, Xcode/runtime/CocoaPods preflight, frozen install with `pod install --deployment`, platform-scoped prebuild, an ad-hoc-signed Debug simulator build, a private simulator by exact UDID, Metro on a free port, a disposable PostgreSQL backend with owned cleanup, and the evidence record (setup proof only; feature work reports the smoke result). Use for 'set up iOS', 'build the iOS app', 'run the app on the iOS simulator', 'add iOS to the React Native app', 'prove the iOS build', or when a pod install, xcodebuild, simulator boot, Metro connection or Keychain session fails. NOT for Android (android-development), signing, TestFlight or App Store release, or general workflow YAML (github-actions)."
-release-version: 0.46.0
+release-version: 0.48.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # iOS foundation

package/skills/app-dev/monorepo/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: monorepo
 description: Turborepo architecture for shared packages, pnpm workspaces, DAL boundaries, and pipelines.
-release-version: 0.46.0
+release-version: 0.48.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Turborepo Monorepo Architecture

package/skills/app-dev/nextjs-fullstack/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: nextjs-fullstack
 description: "Build or debug Next.js App Router features with React 19 — pages/layouts/route handlers, Server/Client Components, Server Actions, forms, middleware, DAL, strict TypeScript, Zod — plus our conventions: nuqs URL state, SWR cache, Skeleton/Progress + Sonner feedback, drag-and-drop upload, the portal app shell, list pages as filter/sort/paginate tables. shadcn component mechanics: see the shadcn skill."
-release-version: 0.46.0
+release-version: 0.48.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Next.js 16 Fullstack Development

package/skills/app-dev/prisma-setup/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: prisma-setup
 description: Use when adding or debugging Prisma with PostgreSQL, Next.js, or Turborepo, including schema.prisma, prisma.config.ts, client generation, migrations, seeds, relations, adapters, and DAL/database-layer setup. Triggers on phrases like "Prisma schema", "prisma migrate", "schema.prisma", "seed the database", "PrismaClient error", "relation issue", or "database layer".
-release-version: 0.46.0
+release-version: 0.48.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Prisma v7 Setup Guide

package/skills/app-dev/pyspark/SKILL.md

@@ -12,7 +12,7 @@ description: >
   Connect, spark-submit, Hudi commits, backfills, validate-only canaries,
   cluster reconciliation, or Spark event-log profiling — including warehouse
   job timeouts, empty Hudi writes, or EMR/Dataproc performance regressions.
-release-version: 0.46.0
+release-version: 0.48.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # PySpark

package/skills/app-dev/python-backend/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: python-backend
 description: "Python backend architecture for FastAPI, Tortoise ORM, Pydantic Settings, loguru, and uv. Also: uv.lock installs in CI/Docker via a proxy or mirror (`uv sync --frozen` bypasses it), slow uv installs on runners, relocking."
-release-version: 0.46.0
+release-version: 0.48.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Python Backend Conventions

package/skills/app-dev/shadcn/SKILL.md

@@ -2,7 +2,7 @@
 name: shadcn
 description: "Add or debug shadcn/ui in a React/Next.js project: components.json, shadcn init/add, presets, registries, Tailwind styling, base/radix/aria composition, component fixes, and list-index pages — where the default is the DiceUI data table with filter/sort/pagination in the URL via nuqs, not a bare shadcn Table."
 allowed-tools: Bash(npx shadcn@latest *), Bash(pnpm dlx shadcn@latest *), Bash(bunx --bun shadcn@latest *)
-release-version: 0.46.0
+release-version: 0.48.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # shadcn/ui

package/skills/app-dev/zod-v4/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: zod-v4
 description: Zod v4 schema conventions and v3 migration for errors, validators, objects, enums, records, and async parsing.
-release-version: 0.46.0
+release-version: 0.48.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Zod v3 to v4 Migration

package/skills/cicd/cloud-build/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: cloud-build
 description: "Build or debug Cloud Build pipelines for Cloud Run: cloudbuild.yaml, triggers, Artifact Registry, builds, migrations, deploys, secrets, VPC, notifications. Use cloud-deploy for staged promotion. NOT for GitHub Actions PR checks (github-actions)."
-release-version: 0.46.0
+release-version: 0.48.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Cloud Build Direct Deploy to Cloud Run

package/skills/cicd/cloud-debug/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: cloud-debug
 description: "Debug Cloud Build or Deploy failures: builds, deployments, health checks, and pipeline errors. Inputs: service, build ID, region. NOT for GitHub Actions runs (github-actions) or runtime errors in a running service (app-debug)."
-release-version: 0.46.0
+release-version: 0.48.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Cloud Build & Cloud Deploy Debug Skill

package/skills/cicd/cloud-deploy/SKILL.md

@@ -5,7 +5,7 @@ description: >
   CI/CD pipelines with staged promotion, verification gates, or GitFlow branching.
   Also use when debugging Cloud Deploy pipeline failures. NOT for simple single-container
   deploys — use cloud-build instead.
-release-version: 0.46.0
+release-version: 0.48.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Cloud Deploy + Skaffold + Kustomize for Cloud Run

package/skills/cicd/docker/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: docker
 description: Docker/Podman container architecture and build patterns. Read when designing or reviewing containerization, Dockerfile structure, multi-stage builds, PyPI mirror support, or docker-compose setup for Python/uv projects, and when a Dockerfile's dependency install misses the layer cache on every build (build args such as a commit SHA or version declared too early) or an image build is slow in CI.
-release-version: 0.46.0
+release-version: 0.48.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Docker Build Patterns

package/skills/cicd/github-actions/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: github-actions
 description: "Author, review, audit, profile, optimize, or debug GitHub Actions workflows (.github/workflows/*.yml): run-history audits, job and step timing, resource bottlenecks, before/after comparisons, conditional CI by changed path, the one required gate check, PR and merge-queue lanes, sharding, workers, caching, self-hosted runners, timeouts, concurrency, permissions and action pinning, post-deploy verification, npm publishing. Use for 'set up CI', 'CI is slow', 'profile CI', 'optimize our pipeline', 'audit CI for redundant or wasted jobs', 'why is this check stuck expected or never started', 'harden this workflow', or 'browser not found on the runner'. NOT for pushing, opening, or merging a PR, or writing CI conventions into CONTRIBUTING.md (github-flow), queue rules or a check unmet inside Mergify (mergify), Playwright config and specs (e2e-test), cloudbuild.yaml or Cloud Run deploys (cloud-build), or which gates a repo must prove (ensure-coverage)."
-release-version: 0.46.0
+release-version: 0.48.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # GitHub Actions

package/skills/cicd/github-flow/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: github-flow
 description: "Deliver a change after the commit: push, open a PR, wait for checks, and merge to main through the repo's flow (direct push, pull request, or merge queue). Use whenever you commit or finish a change, when CONTRIBUTING.md has a Delivery section, and for asks like 'commit this', 'push it', 'open a PR', 'ship it', 'land it', 'get it merged'. Also: declare a repo's delivery flow, or write the CI conventions and Delivery section into CONTRIBUTING.md on request. NOT for writing workflow YAML (github-actions), Mergify config or a stuck queued PR (mergify), cutting a release (resolve-release), or PRs that resolve-issues or rush-issues deliver."
-release-version: 0.46.0
+release-version: 0.48.0
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # GitHub Flow
@@ -114,6 +114,15 @@ node "$SKILL_DIR/scripts/persist-conventions.mjs" --flow <flow> ... --write
 - Adds a pointer to `AGENTS.md` unless it names `CONTRIBUTING.md`; creates missing files.
 - Creates a missing `CLAUDE.md` as a symlink to `AGENTS.md`. Adds the pointer to a regular
   `CLAUDE.md` that names neither file. Leaves a symlinked `CLAUDE.md` alone.
+- Also adds one `## Delivery task entry` rule to `AGENTS.md`, between
+  `conventions:delivery-task-entry` markers, whichever section it writes: after a commit, or when
+  asked to push, open a PR, or merge, read and apply this skill. The rule is scoped to that task
+  and grants nothing: the user's request and the repo's declared policy still decide how far to go,
+  and `resolve-issues`/`rush-issues` deliver their own PRs. It is checked separately from the guide
+  pointer, so an `AGENTS.md` or regular `CLAUDE.md` that already links `CONTRIBUTING.md` still gets
+  it. An entrypoint that already loads the skill, a `CLAUDE.md` that points at `AGENTS.md`, or an
+  unmanaged section with that heading is preserved and reported rather than duplicated; a re-run
+  changes nothing.
 - Report each file's result line. Committing the files is a change of its own: deliver it with this skill.
 
 ## Related skills