@1aboveio/skills 1.0.20 → 1.0.22

package/skills/engineering/resolve-issues/scripts/next-actions.mjs

@@ -75,27 +75,29 @@
 //                   fetch failed, it prints `sync` instead. A run never finishes on a tree it
 //                   could not read
 //
-// A unit's optional `implementationOwner` is the retained implement-or-fix conversation that outlives
-// the worker slot, recorded from the harness as { runId, sessionId?, cwd?, kind }: `runId` is the
-// attempt to resume, `kind` ("implement" or "fix", default "implement") says which worker owned it,
-// and `sessionId` and `cwd` (the unit's workspace) identify that conversation and its tree. It is
-// independent of `worker`, which records whichever worker is active now, so the owner survives the
-// review phase and a later fix continues the same conversation instead of starting over.
+// A unit's optional `implementationOwner` is the implement-or-fix conversation that outlives the
+// worker slot, recorded from the harness as { sessionId, runId?, cwd?, kind }: `sessionId` is the
+// native conversation to continue, `runId` is its latest attempt, `kind` ("implement" or "fix",
+// default "implement") says which worker owned it, and `cwd` (the unit's workspace) is its tree. It
+// is independent of `worker`, which records whichever worker is active now, so the owner survives
+// the review phase and a later fix continues the same session instead of starting over.
 //
 // Every action that spawns a worker therefore carries the structured continuation the coordinator
-// launches, beside its name: `continuation: "fresh"` for a first start or a new worker, launched
-// normally, with no retention argument (a saved conversation stays continuable by its id;
-// `retain_session: true` is optional protection a caller adds only for a long wait before cleanup).
-// Implement and fix sessions become the unit's owner; `continuation: "owner-resume"` with
-// `owner: { runId, kind, sessionId?, cwd? }` for a fix, a restack, or an unfinished implementation
-// whose owner is still usable (subagent_resume({ id: owner.runId, ... }) returns a new attempt on
-// the same conversation). `workerKind` names the slot the action launches. A review round is
-// always a fresh reviewer: a finished review
-// is never resumed, and a review recorded as an owner is not usable. An owner without a `runId`,
-// with a `kind` outside implement and fix, or whose `cwd` is not the unit's workspace is not usable,
-// so a fresh action reports ownerUnavailable rather than claiming continuity. A `retentionReleased`
-// marker records that optional protection lapsed, so it never makes an owner unusable. A completed
-// worker holds no slot: the owner is a reference, never an occupancy.
+// launches, beside its name. `continuation: "fresh"` is a first start or a new worker, launched
+// normally with no session argument. Implement and fix sessions become the unit's owner;
+// `continuation: "owner-resume"` with `owner: { sessionId, runId?, kind, cwd? }` for a fix, a
+// restack, or an unfinished implementation continues that exact session with
+// subagent_spawn({ session_id: owner.sessionId, prompt }), which returns a new attempt id and keeps
+// the session. An attempt `runId` is never passed as `session_id`. A plan written before that
+// contract may hold only `runId`; it prints `continuation: "owner-recovery"` so the coordinator
+// matches that exact attempt in subagent_list({ all: true }) or a verified receipt, and otherwise
+// replaces it with the retained evidence. `workerKind` names the slot the action launches. A review
+// round is always a fresh reviewer: a finished review is never resumed, and a review recorded as
+// an owner is not usable. An owner with neither a `sessionId` nor a `runId`, with a `kind` outside
+// implement and fix, or whose `cwd` is not the unit's workspace is not usable, so a fresh action
+// reports ownerUnavailable rather than claiming continuity. A `retentionReleased` field on an old
+// plan is inert history: no action reads or reverses it. A completed worker holds no slot: the
+// owner is a reference, never an occupancy.
 //
 // Text output ends with one short line pointing to the skill path. With --resume or --rules it
 // ends with RULES instead, the rules a compaction summary most often drops (in narrow and off
@@ -205,23 +207,27 @@ export function normalizeCapacity(input) {
 const hasWorker = (u) => u.worker !== undefined && u.worker !== null && u.worker !== ''
 const codeDone = (u) => u.stage === 'done'
 
-// A unit's usable implementation owner, normalized to { runId, kind, sessionId?, cwd? }, or null.
-// Usable means it names the attempt to resume (`runId`), its `kind` is an implement or fix worker
-// (never a reviewer: a finished review is never resumed for the next round), and, when both are
-// recorded, its `cwd` is the unit's workspace (a conversation cannot be resumed in another tree).
-// A plan that records nothing here keeps today's behavior: a fresh worker.
+// A unit's saved implementation owner, normalized to { runId?, kind, sessionId?, cwd? }, or null.
+// `sessionId` is the native conversation to continue and `runId` its latest attempt; an owner with
+// a session (and optionally its attempt) is usable, while a legacy owner with only an attempt is
+// recoverable, not usable: the coordinator matches that exact attempt to its session first. Its
+// `kind` must be an implement or fix worker (never a reviewer: a finished review is never resumed
+// for the next round), and, when both are recorded, its `cwd` is the unit's workspace (a
+// conversation cannot be continued in another tree). A plan that records nothing here keeps
+// today's behavior: a fresh worker.
 export function implementationOwnerOf(unit) {
   const saved = unit?.implementationOwner
   if (!saved || typeof saved !== 'object' || Array.isArray(saved)) return null
   if (saved.cwd !== undefined && saved.cwd !== null && typeof saved.cwd !== 'string') return null
   const runId = typeof saved.runId === 'string' ? saved.runId.trim() : ''
   const kind = saved.kind === undefined ? 'implement' : saved.kind
-  if (!runId || !IMPLEMENTATION_OWNER_KINDS.includes(kind)) return null
+  if (!IMPLEMENTATION_OWNER_KINDS.includes(kind)) return null
+  const sessionId = typeof saved.sessionId === 'string' ? saved.sessionId.trim() : ''
+  if (!runId && !sessionId) return null
   const cwd = typeof saved.cwd === 'string' ? saved.cwd.trim() : ''
   const workspace = typeof unit.workspace === 'string' ? unit.workspace.trim() : ''
   if (cwd && workspace && cwd !== workspace) return null
-  const sessionId = typeof saved.sessionId === 'string' ? saved.sessionId.trim() : ''
-  return { runId, kind, ...(sessionId ? { sessionId } : {}), ...(cwd ? { cwd } : {}) }
+  return { ...(runId ? { runId } : {}), kind, ...(sessionId ? { sessionId } : {}), ...(cwd ? { cwd } : {}) }
 }
 
 export function workspaceCleanupSettled(unit) {
@@ -390,14 +396,17 @@ export function nextActions(plan, reviews = {}, capacity, { resume = false, now,
   // A new review round starts fresh even when the preceding session remains available.
   const continuationFor = (u, workerKind) => {
     const owner = workerKind === 'review' ? null : implementationOwnerOf(u)
-    if (owner) return { continuation: 'owner-resume', workerKind, owner }
+    if (owner?.sessionId) return { continuation: 'owner-resume', workerKind, owner }
+    if (owner) return { continuation: 'owner-recovery', workerKind, owner }
     const ownerUnavailable = workerKind !== 'review' && u.implementationOwner != null
       ? 'Saved implementationOwner is malformed, names another role, or does not match the unit workspace; record replacement and retain its evidence.' : undefined
     return { continuation: 'fresh', workerKind, ...(ownerUnavailable ? { ownerUnavailable } : {}) }
   }
   // Appended to an owner-resumed action: the work is the same, so the action keeps its name; only
-  // the launch changes, and it is a resume rather than a second worker for the unit.
-  const ownerNote = (id, owner) => `; launch it as a resume of unit ${id}'s implementation owner: subagent_resume({ id: ${JSON.stringify(owner.runId)}, prompt: <that brief or task> }) returns a new attempt on the same conversation${owner.sessionId ? ` (session ${owner.sessionId})` : ''}${owner.cwd ? ` in ${owner.cwd}` : ''}; record the returned id as implementationOwner.runId and keep the owner through review`
+  // the launch changes, and it continues one saved session rather than starting a second one.
+  const ownerNote = (id, owner) => `; launch it as a continuation of unit ${id}'s implementation owner: subagent_spawn({ session_id: ${JSON.stringify(owner.sessionId)}, prompt: <that brief or task> }) continues that exact session and returns a new attempt id${owner.cwd ? ` in ${owner.cwd}` : ''}; record the returned id as implementationOwner.runId, confirm the receipt's session id is still that conversation, and keep sessionId ${JSON.stringify(owner.sessionId)} (an attempt id is never a session_id), keeping the owner through review`
+  // Appended when a legacy owner saved only its attempt: recover its session before replacing it.
+  const recoveryNote = (id, owner) => `; before replacing unit ${id}'s implementation owner, match its recorded attempt id ${JSON.stringify(owner.runId)} exactly in subagent_list({ all: true }) (the default list covers only this folder) or in the verified spawn receipt; a match that names its session continues with subagent_spawn({ session_id: <that session id>, prompt: <that brief or task> }) and records the returned run id and that sessionId; with no match, launch a fresh replacement from the saved fill with the retained evidence and say why continuity was lost. Never pass ${JSON.stringify(owner.runId)} as session_id`
   const managed = (u) => plan.workspaceLifecycle === 1 || u.lifecycle?.version === 1
   for (const u of units) {
     if (TERMINAL.has(u.status) && hasWorker(u) && (u.status !== 'blocked' || reasonOk(u))) {
@@ -406,7 +415,7 @@ export function nextActions(plan, reviews = {}, capacity, { resume = false, now,
     }
     if (!managed(u) || u.status !== 'succeeded' || !u.workspace) continue
     if (!hasWorker(u) && !workspaceCleanupSettled(u)) {
-      add('cleanup-workspace', u, `unit ${u.id} landed: release any retain_session protection it still holds and record that acknowledgement (implementation.md#settle-session-retention), then record lifecycle.cleanup with state applying and headSha ${u.headSha ?? '(record the delivered HEAD first)'}, then run cleanup-runs.mjs cleanup --run <run> --unit ${u.id} --revision <saved planRevision> --apply --json; inspect and persist the returned lifecycle. A refusal is retained with its reason, never complete; do this before finish and alongside independent units`)
+      add('cleanup-workspace', u, `unit ${u.id} landed: record lifecycle.cleanup with state applying and headSha ${u.headSha ?? '(record the delivered HEAD first)'}, then run cleanup-runs.mjs cleanup --run <run> --unit ${u.id} --revision <saved planRevision> --apply --json; inspect and persist the returned lifecycle. A refusal is retained with its reason, never complete; do this before finish and alongside independent units`)
     }
   }
   const chainReady = []
@@ -704,7 +713,8 @@ export function nextActions(plan, reviews = {}, capacity, { resume = false, now,
     if (!workerKind) continue
     const continuation = continuationFor(byId.get(a.unit), workerKind)
     Object.assign(a, continuation)
-    if (continuation.owner) a.detail += ownerNote(a.unit, continuation.owner)
+    if (continuation.continuation === 'owner-resume') a.detail += ownerNote(a.unit, continuation.owner)
+    if (continuation.continuation === 'owner-recovery') a.detail += recoveryNote(a.unit, continuation.owner)
     if (continuation.ownerUnavailable) a.detail += `; ${continuation.ownerUnavailable}`
   }
   const busy = units.filter(hasWorker).length

package/skills/engineering/resolve-release/SKILL.md

@@ -4,7 +4,7 @@ description: "Slash/explicit-only (/resolve-release). Full GitHub Flow release f
 disable-model-invocation: true
 metadata:
   workflow-role: coordinator
-release-version: 0.50.0
+release-version: 0.50.2
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Resolve release

package/skills/engineering/resolve-release/references/publish.md

@@ -208,10 +208,18 @@ Success is stdout equal to `<nextVersion>`. An `E404` means "not published
 yet" and the watcher continues. Any other npm error is inconclusive — stop
 rather than treating it as unpublished or published.
 
-When a GitHub Actions workflow is the npm publisher, `gh run list` /
-`gh run watch` for the tag SHA is the wait; `npm view` remains the proof the
-artifact exists. A release flow's `registry` is passed as `--registry` to every
-npm command, and its `after-publish` steps run once the artifact is proven.
+When a GitHub Actions workflow is the npm publisher, the run is not the wait and a green run is
+not a publish: `npm view` remains the only proof the artifact exists. If you need the run for
+diagnosis, find it once by commit (`gh run list --commit <mergedSha> --limit 5 --json
+databaseId,headSha,status,conclusion`, and refuse a run whose `headSha` is not `<mergedSha>`),
+then read it with bounded `gh run view <id> --json status,conclusion,jobs` polls and treat a
+**job or step transition** as the signal. `gh run watch` repaints a status line and an elapsed
+clock every 30 seconds, so a step that stopped moving looks exactly like one that is working and
+the step names scroll out of view; a log that grows on every tick is not evidence a publish is
+progressing. Report the slow or stuck step by name, with its URL. (The `github-actions` skill's
+`scripts/watch-run.mjs` does this polling when that skill is installed.) A release flow's
+`registry` is passed as `--registry` to every npm command, and its `after-publish` steps run once
+the artifact is proven.
 
 ## Release flow steps
 

package/skills/engineering/resolve-release/references/workspace-npm.md

@@ -84,10 +84,12 @@ Before each dispatch, check that the workflow's `main` ref still resolves to
 the verified merged SHA and that the version is not already published with a
 different provenance. Dispatch the discovered workflow with its documented
 package input. Record the returned run ID; verify that run's head SHA and input
-identify the approved merge and package. Watch the run in the background, then
-independently verify the exact version in the public registry, its attestation
-resolves to the merged SHA, and its package-scoped tag peels to that SHA. The
-workflow, not the agent, creates package tags/releases. A successful workflow
+identify the approved merge and package. Watch the run's job/step transitions in
+the background (bounded `gh run view --json status,conclusion,jobs` reads: a step
+transition is the signal, a repainted status line is not), then independently
+verify the exact version in the public registry, its attestation resolves to the
+merged SHA, and its package-scoped tag peels to that SHA. The workflow, not the
+agent, creates package tags/releases. A successful workflow
 without registry/provenance/tag proof is not a completed publish. Only then
 dispatch a dependent bundle. If a dispatch fails or an already-published
 version has different provenance, stop; do not overwrite a version or tag.

package/skills/engineering/rush-issues/SKILL.md

@@ -6,7 +6,7 @@ metadata:
   workflow-role: coordinator
 dependencies:
   - resolve-issues
-release-version: 0.50.0
+release-version: 0.50.2
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Rush issues (shortcut of resolve-issues)

package/skills/engineering/rush-release/SKILL.md

@@ -6,7 +6,7 @@ metadata:
   workflow-role: coordinator
 dependencies:
   - resolve-release
-release-version: 0.50.0
+release-version: 0.50.2
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Rush release (shortcut of resolve-release)

package/skills/engineering/test-quality/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: test-quality
 description: "Seven principles for tests that catch real bugs, and an audit that reports weak, redundant, and not-coverage tests without fixing them. Use when writing, changing, or reviewing tests, or when asked whether tests are useful, redundant, over-mocked, flaky, only assert static text, or test config files, or asked to make a slow test suite faster without losing coverage, or when the user asks to write the testing conventions into a repo's CONTRIBUTING.md. NOT defining what a spec must prove (ensure-coverage) or authoring browser tests (e2e-test)."
-release-version: 0.50.0
+release-version: 0.50.2
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Test Quality

package/skills/risk-compliance/compliance-audit/SKILL.md

@@ -2,7 +2,7 @@
 name: compliance-audit
 version: 2.9.0
 description: "Audit operations against financial-compliance checklists (AML/KYC, VARS, PCI-DSS, TPA oversight, onboarding, transaction monitoring). Produces tracker.md (with a tracker.xlsx export) and phase-trail.md with layered validation; cites evidence by original filename. Input: reg-parser or the built-in VARS checklist."
-release-version: 0.50.0
+release-version: 0.50.2
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Compliance Audit

package/skills/risk-compliance/contract-compare/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: contract-compare
 description: "Compare two or more contracts side-by-side for structured diff, gap analysis, and benchmarking. Use when: comparing contracts or agreements, contract diff, compare terms, vendor-vs-vendor, compare our template vs theirs, compliance gap between contracts. NOT for single-contract risk review — use contract-review for that."
-release-version: 0.50.0
+release-version: 0.50.2
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Contract Compare

package/skills/risk-compliance/contract-review/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: contract-review
 description: "Review contracts for legal, commercial, and compliance risks via convert → chunk review → merge → validate (+ optional mandate preprocessing). Use for reviewing, auditing, or checking any contract, agreement, NDA, MSA, or SLA; input a file path (PDF/DOCX/TXT) or pasted text."
-release-version: 0.50.0
+release-version: 0.50.2
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Contract Review

package/skills/risk-compliance/doc-authenticity/SKILL.md

@@ -3,7 +3,7 @@ name: doc-authenticity
 version: 0.4.1
 description: "Screen PDF documents and raster images for fabrication, tampering, Photoshop or other image-editor use, and content validity. Detects file type, runs format-specific authenticity forensics, classifies bank statements, conversation logs, invoices, agreements, and other documents, then applies type-specific validity checks. Produces separate authenticity (NO_EVIDENCE_OF_MODIFICATION / SUSPICIOUS / LIKELY_MODIFIED / INCONCLUSIVE) and validity (VALID / INVALID / INCONCLUSIVE) verdicts. Use whenever a user asks whether a document, screenshot, scan, statement, invoice, contract, chat log, receipt, or payment evidence is genuine, original, edited, Photoshopped, manipulated, fake, or valid."
 disable-model-invocation: true
-release-version: 0.50.0
+release-version: 0.50.2
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Document and Image Authenticity

package/skills/risk-compliance/fraud-detection/SKILL.md

@@ -12,7 +12,7 @@ description: >
   impact, and a business report. Use for fraud, scam, mule, account-takeover,
   chargeback, dispute, transfer, collection, or payout risk analysis even when the
   user does not name this skill.
-release-version: 0.50.0
+release-version: 0.50.2
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Fraud Detection

package/skills/risk-compliance/payment-analysis/SKILL.md

@@ -14,7 +14,7 @@ description: >
   transactions" — even if they do not say payment-analysis. Do NOT use for
   fraud rule discovery (fraud-detection) or TLD / MCC-miscoding
   clusters (tld-detection).
-release-version: 0.50.0
+release-version: 0.50.2
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Payment Analysis

package/skills/risk-compliance/portfolio-payment-analysis/SKILL.md

@@ -5,7 +5,7 @@ description: >
   and investigate selected merchants' authorization, settlement and disputes,
   including descriptor mapping and overlapping exports. Portfolio-level payment
   overviews belong to payment-analysis; fraud rule discovery belongs to fraud-detection.
-release-version: 0.50.0
+release-version: 0.50.2
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Portfolio payment analysis

package/skills/risk-compliance/similar-domain/SKILL.md

@@ -8,7 +8,7 @@ description: >
   links, an entity chain, and a watchlist for the operator's next domains.
   Not transaction data (tld-detection) or fraud rules (fraud-detection).
 disable-model-invocation: true
-release-version: 0.50.0
+release-version: 0.50.2
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Similar Domain

package/skills/risk-compliance/tld-detection/SKILL.md

@@ -6,7 +6,7 @@ description: >
   patterns, with USD and BIN-country currency views, group profiles and priorities.
   Not payment-analysis, fraud-detection, or website research.
 disable-model-invocation: true
-release-version: 0.50.0
+release-version: 0.50.2
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # TLD detection