@1aboveio/skills 1.0.16 → 1.0.17

package/skills/engineering/resolve-issues/references/shared-modules.md

@@ -37,9 +37,56 @@ Owner: the harness agent catalog. The workflow names four **roles** — implemen
 explorer, diagnoser (escalation), reviewer — and the harness decides which model
 fills each one and how that role is launched on this host. The shared bridge is
 [`harness-runtime/agent-catalog.mjs`](../../harness-runtime/agent-catalog.mjs);
-this skill owns no ladder, no tier ranking, and no model list. Write this turn's
-host evidence to a temporary JSON file first (any writable path; the run directory
-does not exist yet at step 1):
+this skill owns no ladder, no tier ranking, and no model list.
+
+### Native Pi preflight
+
+When Pi advertises `agents_catalog` and role-based spawning, use the live catalog
+for a run with no task model/effort override or separately declared authoritative
+host preference. Check those inputs before selecting this path: an unpinned task
+can still have `hostPreferences`. The native catalog resolves roles against this
+session's model registry and effort support; a second, caller-built inventory is
+unnecessary.
+
+1. Call `agents_catalog` with `action: "list"`, then `action: "inspect"` for
+   `developer`, `explorer`, and `reviewer`. Inspect all three even when the explorer
+   will not run. The diagnoser uses the same developer role.
+2. Require each inspection's live `launchable: yes` and `availability: available`,
+   with its actual resolved model and effort. `definitionValid` and
+   `catalogLaunchable` alone establish only definition validity, not runtime
+   availability. A missing or blocked live decision stops preflight with that
+   diagnostic; saved defaults do not replace it.
+3. Record the catalog revision and each role's **actual** model and effort as run
+   metadata. A tier fallback can differ from the displayed default. Use the
+   developer result for implementer and diagnoser. Require the reviewer's actual
+   model id to differ from the implementer's, regardless of effort; otherwise
+   stop and report the conflict without choosing a replacement.
+   Save each fill in `selections` as `source: "native-catalog"`, `role`, `id`
+   (actual model), `key` (`id@effort` when effort is present), `effort` (actual
+   effort), `launch: { role }`, `instructions`
+   from the inspection, and the observed `catalogRevision`. Retain the native
+   inspection as `selection` evidence, including requested/actual values and
+   availability. This is native provenance, not a fabricated portable
+   `selection` object or `catalogDigest`.
+4. Record the later launch by role (`{ role: "developer" }`, `{ role: "explorer" }`, or
+   `{ role: "reviewer" }`), adding the task brief and authorized workspace/tool
+   controls. The native catalog applies its live instructions and defaults again
+   at admission. Record actual launch provenance if it differs from preflight.
+
+This completes model preflight; continue to the provisional target without
+running `preflight-models.mjs` or manufacturing `available[]`. Worker capacity is
+a separate scheduling input, not model evidence. An explicit task model or effort
+override or authoritative host model/effort preference still needs validation for
+that exact request: use the portable path below when the native inspection cannot
+validate it and preserve its structured launch fields. Keep the request; an
+unresolved request does not authorize a default launch.
+
+### Portable preflight
+
+For a host without native role resolution, or a task override or authoritative
+host preference requiring portable validation, write observed host capabilities
+to a temporary JSON file (any writable path; the run directory does not exist yet
+at step 1):
 
 ```json
 { "available": [{ "model": "provider/model", "nativeModel": "host-id", "supportedEfforts": ["medium", "high"] }],
@@ -54,7 +101,7 @@ a field you cannot observe is left out, and the bridge never completes one.
 
 | Field | Meaning |
 |---|---|
-| `available[]` | This turn's models. `nativeModel` is required for a harness whose slots are launched by a bare host id (Codex); pass the ids the spawn primitive advertises, unchanged. `supportedEfforts` is the host's verified list per model. |
+| `available[]` | This turn's models. Each entry needs verified `supportedEfforts`; IDs alone from configuration or `discover-models.mjs` do not supply effort support. `nativeModel` is required for a harness whose slots are launched by a bare host id (Codex); pass the advertised mapping unchanged. |
 | `launchCapabilities` | The launch controls this host exposes: `model`, `effort`, `instructions`, each a boolean. All three must be stated; omission is not "probably true". A native id and an effort say what the catalog chose, never that the adapter can set it. |
 | `hostPreferences` | This host's own role preferences, keyed by **role** (`developer`, `explorer`, `reviewer`), each `{ model?, effort? }`. Below a task override and above the role default: it is how a host says "this machine runs the developer role on this model". |
 | `fallbackToForeground` | Set `true` only when this host may use the foreground model as a fallback. Pi always may; another harness must opt in. Absent, no foreground fallback happens for it. |
@@ -115,6 +162,13 @@ pick, never fall back to the skill-owned catalog, and never let the reviewer sha
 the implementer's model id: the catalog enforces independence, and re-picking a
 replacement here would silently break it.
 
+`capabilities-missing` describes incomplete resolver input, not proof that the
+host cannot launch workers. Check the supplied file and this turn's native
+capability source before declaring a harness limitation. Repair an omitted field
+from verified evidence and retry preflight; if that evidence is unavailable,
+report the exact missing input. Never derive effort ranges from a selected role
+default or use free worker slots as a model inventory.
+
 **No fallback is invented.** The catalog substitutes only an available model from
 the same tier's configured `candidates`, and never for an explicit request: an
 unavailable pin or host preference blocks rather than sliding to a neighbour, and

package/skills/engineering/resolve-issues/references/task-plan.md

@@ -1,6 +1,6 @@
 # Task plan
 
-Draft the plan in preflight, before exploration, and update it on every
+Draft the plan in preflight, before the assessment, and update it on every
 worker and stage transition.
 
 ## Initialize the run
@@ -92,7 +92,7 @@ Fleet `status`: `pending`, `in-flight`, `succeeded`, `failed`,
 | `attempt`, `retries`, `escalations` | Attempt number; cycle counts; escalation-model attempts |
 | `worker`, `workerSince`, `clock` | Slot identifier of any worker running for the unit (implementer, reviewer, fix), `null` when none; when that worker started (ISO time, for [stuck-worker checks](expire.md#waits)); attempt and cumulative wall time |
 | `workerKind` | `implement`, `fix`, or `review`, set with `worker`; the [live-capacity scheduler](implementation.md#live-capacity) (`next-actions.mjs`) prints `worker-kind` for any other kind or none. An infrastructure diagnosis or a test-first worker is a `fix` worker. The explorer is the `explore` fleet row's worker, never a unit's; a merge-queue watcher is not a worker |
-| `estimatedLines` | Explorer estimate |
+| `estimatedLines` | Preflight assessment estimate |
 | `sizeCheck` | Measures, `verdict` (the size check's per-unit verdict; `stop` means held), scope and proof verdicts, split or verification path; `runWhole: true` once a recommendation to run a held unit whole is accepted |
 | `note` | SHA, expiry reason code, failure and response, or blocker; for active debugging, the immediate acceptance checkpoint, baseline/result link and next distinguishing test ([delivery progress](../SKILL.md#delivery-progress)) |
 | `pr`, `headSha`, `reviewedHead` | PR URL, current HEAD (recorded from the implementer's first pushed commit on, so the draft PR opens early), last HEAD whose verdict was `pass` (reviewed or carried) |
@@ -123,10 +123,14 @@ rehydrate read it, and `next-actions.mjs` exits 2 without it), `planRevision`, `
 (`owner/name#N` or an issue URL; any other name turns off the issue-tree sync),
 exploration path, `decisions`, `standingOrders`, `schedulerMode` (`full`, `narrow`, or `off`), timestamps, and `excluded` (issues in the
 tree that are deliberately not units, each `{issue, reason}`: release or
-approval gates, and rollups the explorer found empty). A run resumed from an
+approval gates, and rollups the assessment found empty). A run resumed from an
 older wave run keeps `merged` (unit ids merged by earlier runs).
 
-`selections` records each slot's fill as `preflight-models.mjs` returned it —
+`selections` records each slot's fill from the selected
+[model-preflight path](shared-modules.md#model-slots). A native Pi fill records
+`source: "native-catalog"`, `role`, actual `id`, `key` and `effort`, `launch: { role }`,
+inspected `instructions`, `catalogRevision` and the retained native inspection
+as `selection`. A portable fill is what `preflight-models.mjs` returned —
 `id`, `key`, `effort`, `role`, `launch`, `instructions`, `selection`, and the
 `catalogDigest` it was resolved under — beside the explicit task or host override
 that produced it, when one did
@@ -162,10 +166,10 @@ to another launch or rewrite them.
 A plan saved before `selections` holds model ids and efforts and nothing saying
 who chose them. Read such a value as evidence of what ran, never as a pin: do
 not pass it as an explicit Pi model or effort. Before launching new workers,
-rerun `preflight-models.mjs` for this host ([preflight.md](preflight.md#1-model-slots))
+repeat this host's model-preflight path ([preflight.md](preflight.md#1-model-slots))
 with only the overrides the run can evidence — a `standingOrders` line, a
 human-authored decision, or an explicit override in the invocation, never an
-agent recommendation or stored metadata alone — and record the fills it returns
+agent recommendation or stored metadata alone — and record its resolved fills
 as `selections`. When an override's provenance, or a launch control the current
 host must advertise, cannot be established, block the new launch and name what
 is missing: report the code and reason and start nothing, rather than guessing a
@@ -173,6 +177,15 @@ pin. Workers already running or finished keep their configuration and history.
 A resume asks no model question; a human who changes one does so as a separate
 task input, recorded as a decision and resolved the same way.
 
+For `source: "native-catalog"`, recheck current task overrides and authoritative
+host preferences on resume. With neither, repeat live native inspection rather
+than demanding a portable `catalogDigest` or running the portable script. A newly
+declared preference or override returns through the exact-request validation path;
+do not replay role-only defaults in its place. Keep
+the old inspection as historical evidence; refresh preflight selection metadata
+without rewriting any worker's actual launch history. A native inspection is not
+an override, and its saved model and effort never become launch arguments.
+
 ### Standing orders
 
 **`standingOrders` are the run's only constraints.** A numbered list, one
@@ -212,14 +225,20 @@ Example: someone files #61 under epic #12 mid-run; the next resume prints
 - A failed fetch keeps the saved tree; a partial one never drops a unit or
   changes dependencies. A failed fetch before finishing never finishes:
   `next-actions.mjs` with [live capacity](implementation.md#live-capacity) prints `sync` until a fetch reads the tree.
-- `set-deps` only adds; a dependency the explorer recorded stays.
+- At start and resume, fetch current spec and existing unit issue bodies from
+  their source and compare their criteria with the saved requirements, decisions,
+  contracts and relevant guidance. The tree fetch updates membership and links,
+  not issue bodies; unchanged sync output does not establish unchanged criteria.
+  Reassess affected units under [assessment reuse](exploration.md#reuse-first),
+  or reassess when the prior inputs cannot be established, before scheduling them.
+- `set-deps` only adds; a dependency recorded in findings stays.
 - `cycle`: units depend on, or are chained on, each other, so none can move.
   Remove the link that is not a real dependency (on GitHub and in the plan);
   for a `stacksOn` loop, restack the unit it names onto the target.
 - `blocked-outside`: put the blocker into the tree (as a sibling of the
   waiting issue) or remove the link; never leave a unit waiting on an issue
   the run cannot see.
-- A rollup the explorer finds empty goes to `excluded` with "nothing left:
+- A rollup the assessment finds empty goes to `excluded` with "nothing left:
   close it", and into the handback.
 - A unit that depends on an `excluded` issue waits for a human: it stays
   `pending` (not started), `next-actions.mjs` with [live capacity](implementation.md#live-capacity) gives it no action, and
@@ -230,7 +249,7 @@ Example: someone files #61 under epic #12 mid-run; the next resume prints
 ## Scope changes
 
 Record a new requirement as a decision, update the affected criteria,
-continue the explorer on affected and new units, rerun the size check, and
+reassess affected and new units using [owner routing](exploration.md#choose-the-owner), rerun the size check, and
 show the board. Put the change in in-flight units' next brief; never copy
 files into a running workspace. Add new units as rows and schedule them
 normally.
@@ -313,7 +332,8 @@ text board. Keep the board and file in agreement. Never show an unsaved transiti
 
 ## Board
 
-Show the first board before the explorer spawn, as a record.
+Show the first board before the preflight assessment, as a record. The fleet
+`explore` row tracks that assessment, with a worker only when one is delegated.
 
 ```text
 resolve-issues  rev 12  workers 2  elapsed 18m  delivery stack

package/skills/engineering/resolve-issues/scripts/findings-reuse.mjs

@@ -66,7 +66,7 @@ export function findingsReuse({ prior, units, head = 'HEAD' }) {
   let baseKnown = typeof prior?.base === 'string' && prior.base.trim() !== ''
   let changed = []
   if (baseKnown) {
-    try { changed = git(['diff', '--name-only', prior.base, headSha]).split('\n').filter(Boolean) } catch { baseKnown = false }
+    try { changed = git(['diff', '--name-only', '--no-renames', prior.base, headSha]).split('\n').filter(Boolean) } catch { baseKnown = false }
   }
   const ids = units?.length ? units : Object.keys(prior?.units ?? {})
   return { base: prior?.base ?? null, head: headSha, ...decideReuse(prior, ids, changed, baseKnown) }

package/skills/engineering/resolve-issues/scripts/next-actions.mjs

@@ -16,8 +16,8 @@
 //                   GitHub call. Sync after the run files an issue
 //   unblock         a unit marked blocked without a reason from BLOCK_REASONS
 //                   (`blockedReason`), or human-decision without `humanItem` (1-5) and
-//                   `humanNeed`: reopen it now; and on --resume, every blocked unit:
-//                   reopen it with fresh limits; its next step follows. A note never keeps a
+//                   `humanNeed`: reopen it now; on --resume, reopen prior blocks with fresh
+//                   limits except a current size stop without accepted runWhole. A note never keeps a
 //                   unit blocked. A complete review at the unit's HEAD that holds a P0/P1 but
 //                   wrote no fix brief and awaits no GitHub reviewer (a handback) gets a
 //                   fresh full round, so review-verdict hands it back again only if its
@@ -122,7 +122,7 @@ import { BLOCKING } from './review-verdict.mjs'
 export const WORKER_KINDS = Object.freeze(['implement', 'fix', 'review'])
 export const SKILL_PATH = join(dirname(dirname(fileURLToPath(import.meta.url))), 'SKILL.md')
 // Printed after every text call, and by rehydrate.mjs after a compaction.
-export const RULES = 'Per unit, run only implement, fix, and review workers, recorded as workerKind: no planning, architecture, product, or setup workers. Exploration continues the run\'s one explorer, on the fleet explore row. You coordinate: never edit product code. In full mode take every step from next-actions.mjs; in every mode the run ends only when it reports done. A HEAD after a passing review is carried; any other new HEAD takes the tier rereview-scope.mjs picks, never yours. Decide before you defer: a question a worker or review raises is answered and recorded, then the unit continues; retrying or deferring never answers it. Never block on the human: take the automatic answer and keep going. Fix the root cause, never only its symptom. Before each scheduling pass, refresh subagent_settings and pass its snapshot with --capacity-json; do not reuse a run-start budget or subtract workflow workers again.'
+export const RULES = 'Per unit, run only implement, fix, and review workers, recorded as workerKind: no planning, architecture, product, or setup workers. You own preflight findings; use an optional explorer on the fleet explore row only for concrete planning unknowns (exploration.md). You coordinate: never edit product code. In full mode take every step from next-actions.mjs; in every mode the run ends only when it reports done. A HEAD after a passing review is carried; any other new HEAD takes the tier rereview-scope.mjs picks, never yours. Decide before you defer: a question a worker or review raises is answered and recorded, then the unit continues; retrying or deferring never answers it. Never block on the human: take the automatic answer and keep going. Fix the root cause, never only its symptom. Before each scheduling pass, refresh subagent_settings and pass its snapshot with --capacity-json; do not reuse a run-start budget or subtract workflow workers again.'
 export const DEFAULT_QUIET_MINUTES = 45
 // The reasons a unit may stay blocked (expire.md#reason-codes). Waiting on another unit, an
 // infrastructure or external blocker (a tree issue the unit waits on), and a size hold in a rush
@@ -205,15 +205,15 @@ export function nextActions(plan, reviews = {}, capacity, { resume = false, now,
   if (!Array.isArray(saved) || saved.length === 0) throw new NextActionsError('task plan has no units')
   const excluded = excludedIds(plan)
   const gates = (u) => (u.dependsOn ?? []).map(String).filter((d) => excluded.has(d))
-  // In a rush run, a size-held unit is split, never deferred: it gets `split` until the sync
-  // drops it (split into sub-issues) or a rerun size check clears it.
+  // A current size stop survives resume. Rush splits it; a normal run may hand it back.
   const shortcut = plan.skill === 'rush-issues'
-  const sizeHeld = (u) => shortcut && (u.sizeCheck?.verdict ?? u.sizeCheck?.scope) === 'stop' && u.sizeCheck?.runWhole !== true && !codeDone(u)
+  const heldForSize = (u) => (u.sizeCheck?.verdict ?? u.sizeCheck?.scope) === 'stop' && u.sizeCheck?.runWhole !== true && !codeDone(u)
     && !hasWorker(u) && u.status !== 'succeeded' && u.status !== 'cancelled' && gates(u).length === 0
     && !excluded.has(String(u.id))
+  const sizeHeld = (u) => shortcut && heldForSize(u)
   const reasonOk = (u) => BLOCK_REASONS.includes(u.blockedReason) && !(shortcut && u.blockedReason === 'size-hold')
     && (u.blockedReason !== 'human-decision' || namesHumanItem(u))
-  const reopen = (u) => (resume || !reasonOk(u)) && u.status === 'blocked' && !hasWorker(u) && gates(u).length === 0 && !sizeHeld(u)
+  const reopen = (u) => (resume || !reasonOk(u)) && u.status === 'blocked' && !hasWorker(u) && gates(u).length === 0 && !heldForSize(u)
   // `stack` and `chain` both open a child's PR once its parents' PRs are open; only the PR base differs.
   if (plan.deliveryMode !== undefined && !['stack', 'chain', 'wait'].includes(plan.deliveryMode)) throw new NextActionsError(`deliveryMode must be stack, chain, or wait: ${JSON.stringify(plan.deliveryMode)}`)
   const chain = plan.deliveryMode === 'chain'

package/skills/engineering/resolve-issues/scripts/plan-sync.mjs

@@ -139,7 +139,7 @@ export function planSync(plan, tree) {
     const { deps } = wants(key)
     const id = idFor(key, repo)
     const rollup = (node.children ?? []).length > 0
-    add('add-unit', id, `add unit ${id} for ${key} "${node.title}"${deps.length ? ` with dependsOn [${deps.join(', ')}]` : ''}: fetch its issue into the run, continue the explorer for it, rerun the size check${rollup ? '; every sub-issue is closed, so the explorer records what is left or that nothing is (then hand back "close it")' : ''}`, { issue: key, dependsOn: deps })
+    add('add-unit', id, `add unit ${id} for ${key} "${node.title}"${deps.length ? ` with dependsOn [${deps.join(', ')}]` : ''}: fetch its issue into the run, assess it using exploration.md's owner routing, rerun the size check${rollup ? '; every sub-issue is closed, so record what is left or that nothing is (then hand back "close it")' : ''}`, { issue: key, dependsOn: deps })
   }
   for (const [key, u] of byKey) {
     if (DONE.has(u.status)) continue

package/skills/engineering/resolve-issues/scripts/size-check.mjs

@@ -30,7 +30,8 @@
 // (ok, warn, hold, stop, or exploration-unfinished); 2 for a bad plan or command.
 // `exploration-unfinished` (printed as `{ verdict, reason }`) means findings that are unreadable,
 // not version 2, or missing a planned unit, its `slice`, its `proof`, or its `estimatedLines`;
-// only the explorer fixes it. --exit-verdict restores the old exit codes for one release
+// complete the preflight findings using exploration.md's owner routing.
+// --exit-verdict restores the old exit codes for one release
 // (deprecated): 0 for ok/warn, 4 for hold, 1 for stop, 3 for exploration-unfinished.
 
 import { readFileSync } from 'node:fs'
@@ -78,7 +79,7 @@ export const FINDINGS_VERSION = 2
 
 export class SizeCheckError extends Error {}
 
-// Unfinished exploration: the explorer, not the orchestrator, fixes it.
+// Unfinished assessment; keep the exported error and verdict compatible with saved runs.
 export class ExplorationUnfinished extends SizeCheckError {}
 
 function unitsOf(plan) {
@@ -262,9 +263,9 @@ function environmentChecks(units, byUnit) {
 // ---- The whole check ----
 
 // A unit counts as explored once its entry carries a valid `slice`, `proof`,
-// and `estimatedLines`; the explorer's scaffold (an empty entry per unit) does not pass.
+// and `estimatedLines`; a scaffold (an empty entry per unit) does not pass.
 function findingsUnitsOf(findings, units) {
-  const unfinished = (why) => new ExplorationUnfinished(`exploration unfinished: ${why}; continue the explorer`)
+  const unfinished = (why) => new ExplorationUnfinished(`exploration unfinished: ${why}; complete the preflight findings`)
   if (findings?.version !== FINDINGS_VERSION) throw unfinished(`findings version is ${JSON.stringify(findings?.version)}, expected ${FINDINGS_VERSION}`)
   const byUnit = findings.units
   if (!byUnit || typeof byUnit !== 'object' || Array.isArray(byUnit)) throw unfinished('findings has no units map')
@@ -481,7 +482,7 @@ if (isMainModule(import.meta.url)) {
     process.exitCode = opts.exitVerdict ? EXIT[result.verdict] : 0
   } catch (error) {
     if (error instanceof ExplorationUnfinished) {
-      // Unfinished exploration is an answer (the explorer continues), not a failure of the script.
+      // Incomplete findings are an answer, not a failure of the script.
       process.stdout.write(`${JSON.stringify({ verdict: 'exploration-unfinished', reason: error.message }, null, 2)}\n`)
       process.exitCode = process.argv.includes('--exit-verdict') ? 3 : 0
     } else {

package/skills/engineering/resolve-release/SKILL.md

@@ -4,7 +4,7 @@ description: "Slash/explicit-only (/resolve-release). Full GitHub Flow release f
 disable-model-invocation: true
 metadata:
   workflow-role: coordinator
-release-version: 0.48.0
+release-version: 0.48.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Resolve release

package/skills/engineering/rush-issues/SKILL.md

@@ -6,7 +6,7 @@ metadata:
   workflow-role: coordinator
 dependencies:
   - resolve-issues
-release-version: 0.48.0
+release-version: 0.48.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Rush issues (shortcut of resolve-issues)

package/skills/engineering/rush-release/SKILL.md

@@ -6,7 +6,7 @@ metadata:
   workflow-role: coordinator
 dependencies:
   - resolve-release
-release-version: 0.48.0
+release-version: 0.48.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Rush release (shortcut of resolve-release)

package/skills/engineering/test-quality/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: test-quality
 description: "Seven principles for tests that catch real bugs, and an audit that reports weak, redundant, and not-coverage tests without fixing them. Use when writing, changing, or reviewing tests, or when asked whether tests are useful, redundant, over-mocked, flaky, only assert static text, or test config files, or asked to make a slow test suite faster without losing coverage, or when the user asks to write the testing conventions into a repo's CONTRIBUTING.md. NOT defining what a spec must prove (ensure-coverage) or authoring browser tests (e2e-test)."
-release-version: 0.48.0
+release-version: 0.48.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Test Quality

package/skills/risk-compliance/compliance-audit/SKILL.md

@@ -2,7 +2,7 @@
 name: compliance-audit
 version: 2.9.0
 description: "Audit operations against financial-compliance checklists (AML/KYC, VARS, PCI-DSS, TPA oversight, onboarding, transaction monitoring). Produces tracker.md (with a tracker.xlsx export) and phase-trail.md with layered validation; cites evidence by original filename. Input: reg-parser or the built-in VARS checklist."
-release-version: 0.48.0
+release-version: 0.48.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Compliance Audit

package/skills/risk-compliance/contract-compare/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: contract-compare
 description: "Compare two or more contracts side-by-side for structured diff, gap analysis, and benchmarking. Use when: comparing contracts or agreements, contract diff, compare terms, vendor-vs-vendor, compare our template vs theirs, compliance gap between contracts. NOT for single-contract risk review — use contract-review for that."
-release-version: 0.48.0
+release-version: 0.48.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Contract Compare

package/skills/risk-compliance/contract-review/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: contract-review
 description: "Review contracts for legal, commercial, and compliance risks via convert → chunk review → merge → validate (+ optional mandate preprocessing). Use for reviewing, auditing, or checking any contract, agreement, NDA, MSA, or SLA; input a file path (PDF/DOCX/TXT) or pasted text."
-release-version: 0.48.0
+release-version: 0.48.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Contract Review

package/skills/risk-compliance/doc-authenticity/SKILL.md

@@ -3,7 +3,7 @@ name: doc-authenticity
 version: 0.4.1
 description: "Screen PDF documents and raster images for fabrication, tampering, Photoshop or other image-editor use, and content validity. Detects file type, runs format-specific authenticity forensics, classifies bank statements, conversation logs, invoices, agreements, and other documents, then applies type-specific validity checks. Produces separate authenticity (NO_EVIDENCE_OF_MODIFICATION / SUSPICIOUS / LIKELY_MODIFIED / INCONCLUSIVE) and validity (VALID / INVALID / INCONCLUSIVE) verdicts. Use whenever a user asks whether a document, screenshot, scan, statement, invoice, contract, chat log, receipt, or payment evidence is genuine, original, edited, Photoshopped, manipulated, fake, or valid."
 disable-model-invocation: true
-release-version: 0.48.0
+release-version: 0.48.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Document and Image Authenticity

package/skills/risk-compliance/fraud-detection/SKILL.md

@@ -12,7 +12,7 @@ description: >
   impact, and a business report. Use for fraud, scam, mule, account-takeover,
   chargeback, dispute, transfer, collection, or payout risk analysis even when the
   user does not name this skill.
-release-version: 0.48.0
+release-version: 0.48.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Fraud Detection

package/skills/risk-compliance/payment-analysis/SKILL.md

@@ -14,7 +14,7 @@ description: >
   transactions" — even if they do not say payment-analysis. Do NOT use for
   fraud rule discovery (fraud-detection) or TLD / MCC-miscoding
   clusters (tld-detection).
-release-version: 0.48.0
+release-version: 0.48.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Payment Analysis

package/skills/risk-compliance/portfolio-payment-analysis/SKILL.md

@@ -5,7 +5,7 @@ description: >
   and investigate selected merchants' authorization, settlement and disputes,
   including descriptor mapping and overlapping exports. Portfolio-level payment
   overviews belong to payment-analysis; fraud rule discovery belongs to fraud-detection.
-release-version: 0.48.0
+release-version: 0.48.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Portfolio payment analysis

package/skills/risk-compliance/similar-domain/SKILL.md

@@ -8,7 +8,7 @@ description: >
   links, an entity chain, and a watchlist for the operator's next domains.
   Not transaction data (tld-detection) or fraud rules (fraud-detection).
 disable-model-invocation: true
-release-version: 0.48.0
+release-version: 0.48.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Similar Domain

package/skills/risk-compliance/tld-detection/SKILL.md

@@ -6,7 +6,7 @@ description: >
   patterns, with USD and BIN-country currency views, group profiles and priorities.
   Not payment-analysis, fraud-detection, or website research.
 disable-model-invocation: true
-release-version: 0.48.0
+release-version: 0.48.1
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # TLD detection