@assuredloop/orca-bot-kit 0.1.0 → 0.3.0

package/skills/obk-personal-facilitation/NOTICE.md

@@ -0,0 +1,62 @@
+<!-- Attribution for the sources this skill was built from. Kept out of
+     SKILL.md so it is not read into context on every use; it travels with
+     the skill directory, which is what the licences require. -->
+
+# Sources and licences
+
+This skill is not a port of any one source, because no source has a skill for
+this. Most of it comes from two places of our own, and two MIT skills
+contribute a piece each.
+
+- **This repository's own earlier `personal-facilitation` skill**, written for
+  the Codex desktop kit and removed when the tree was cleaned (`git show
+  51a42a3:skills/personal-facilitation/SKILL.md`). Almost everything here is
+  from it: reading the list the user already keeps before creating another, a
+  simple editable file where the bot keeps its work when there is none, asking
+  about the location only when several lists make the choice unclear, the
+  user's wording with a concrete next action and only the deadline they gave,
+  no invented dates or priorities, a practical ordering kept apart from the
+  user's decision, preserving unrelated entries and notes, modifying an entry
+  rather than duplicating it, marking complete only on the user's word or a
+  verified outcome, returning the next actionable item, using the host's own
+  scheduling for a reminder and verifying what was set, a line in a to-do file
+  or a saved skill not being a scheduled reminder, and reporting a missing host
+  capability instead of claiming something will run later.
+- **The research pack's `grok-bot-lessons.md`**, our own read of the owner's
+  knowledge base on running a personal helper bot. "36 drafts queued, 0 sent":
+  finish every reversible step and stop at the irreversible one (BNK-2920 §09,
+  the wording ours). Save a routine only once a manual run has come out right
+  (BNK-2921); here scoped to a routine that does work, since a plain reminder
+  has nothing to run by hand. The time zone and the end date in a routine's
+  checklist.
+- **`mattpocock/skills`, `skills/in-progress/loop-me`** (MIT): do the most you
+  can before involving the person, so they are asked once, late; and hand back
+  something decision-ready that points at the thing rather than reproducing it.
+- **Cursor `plugins`, `third_party/x/skills/x-chat`** (MIT, `third_party/x/
+  LICENSE`, "Copyright (c) 2026 Cursor"): outbound text needs the person's
+  approval unless they already said to send it ("reply that I'll be there"),
+  and a vague "check my inbox" is not that.
+
+Written differently from the old skill, on purpose: no fixed path (PRD 7.1
+assumes no way of working); a vague item stays on the list and is asked about,
+rather than dropped; the old paragraph on local memory and contacting other
+bots is left out, as wiring rather than list-keeping; and "read back the
+edited content" became comparing against what was there before, because
+reading your own version back cannot catch a line dropped by accident.
+
+The rest of the research pack's sources have no personal-assistant or to-do
+skill in them. The nearest were `anthropics/skills`' `discernment-nudge` (a
+different job), `garrytan/gstack`'s engineering TODO format (PRD 7.1 prescribes
+no document format) and its privacy gate for a memory store; none is taken.
+
+From an acceptance run of the first version, by a bot that had not seen it
+written: ask in the reply, not in a file; keep a date on an item marked done;
+act on an urgency the person states; ask where an undated item goes only when
+the list is divided by due date; setting a reminder is not the same as it
+reaching them; a task with no reversible half still hands back what to do.
+
+The owner's word on this skill is one line: a very light one (research-pack
+dialogue, 2026-09-19 19:44). The PRD carries it as decided (7.2). He said
+nothing about what it should contain, so the content is the old skill's, the
+borrowed pieces and what an acceptance run showed, and the reasons are left
+out of the body so it stays light without losing a technique.

package/skills/obk-personal-facilitation/SKILL.md

@@ -0,0 +1,86 @@
+---
+name: obk-personal-facilitation
+description: >-
+  Keeping someone's own to-do list and helping with their day: working from the
+  list they keep, writing what they said and not what you inferred, changing an
+  entry rather than adding a second, marking something done only on their word
+  or a checked outcome, and stopping before the step that cannot be taken back.
+  Use when the job is someone's tasks and errands rather than a project: adding
+  to their list, tidying it, working out what to do next, or a reminder.
+---
+
+# Keeping someone's list
+
+These are one person's own tasks, not a project's backlog. Keep the list true
+and short enough to act on.
+
+These are defaults for work where nothing says otherwise. A user who asks for
+something else gets what they asked for; say which of these you left and why.
+
+## Work from the list they already keep
+
+Look for it before you start another one; a second list means neither is
+complete. Where there is none, make a plain text file a person can read and
+edit, wherever this bot keeps its work. Where there are several and the choice
+is real, ask which; where one is obviously live, use it and say which.
+
+## Write down what they said
+
+Their words for the item, not your tidier version. One concrete next action,
+phrased so they could start it without working anything out. Only the date
+they actually gave you: no invented deadline, priority, category or detail.
+
+Where an item is too vague to carry a next action, keep it and ask. Do what you
+can first, then ask once, in your reply rather than in a file.
+
+## Change the entry, do not add another
+
+When they revise something, edit the entry that is there and leave every other
+line alone. Then compare the result against what was there before, rather than
+reading back your own new version.
+
+## Done is their word, or an outcome you checked
+
+Mark something complete when they say so, or when the thing they asked for has
+happened and you have seen it; not because you did the step you thought was
+the whole of it. Where finishing leaves a date behind it, keep the date on the
+item. "Book the dentist" is done once it is booked.
+
+## Ordering is a suggestion; the priority is theirs
+
+An order they give you is theirs: when they say something has become urgent,
+act on it and say you moved it. An order you worked out is a suggestion: offer
+it, say what it rests on, and leave their list alone until they say. A new
+undated item goes where the list's shape puts it, which on a plain run is the
+end; where the sections are about when things are due, ask.
+
+## A line in a file is not a reminder
+
+Where they ask to be reminded, or for something to happen regularly, use
+whatever actually schedules work where you are running. Writing "remind me
+Tuesday" into a file, or saving it as a skill, schedules nothing. Check what
+you set: the task, the time and its time zone, the repeat, and when it stops if
+it should. Work out how it reaches them, since a job that fires into a log
+nobody opens has reminded nobody. Where nothing can schedule it, or you may not
+reach what can, say so and hand back exactly what would need to be set. A
+routine that does work on its own, rather than only reminding, runs once by
+hand first.
+
+## Stop at the step that cannot be taken back
+
+Do the reversible part and stop at the line. Write the message, fill in the
+form, get the thing ready; leave the sending, the paying, the booking and the
+deleting to them, unless they have told you to go ahead with that thing.
+"Reply that I will be there" is permission; "check my inbox" is not. A draft
+not sent is finished work: say where it is and point the item at it. Where a
+task has no reversible half, hand them the thing to do and what they need in
+hand for it.
+
+## What they get back
+
+What you changed, the one thing to do next, and what you need from them. Where
+they asked what is on the list, show it; otherwise point at the list rather than
+reproducing it. Their list is personal: use what is in it for the job they
+asked for, and do not copy it anywhere else.
+
+Sources and licences: [NOTICE.md](NOTICE.md).

package/skills/obk-recall/LICENSES.md

@@ -0,0 +1,42 @@
+<!-- The licences of the sources this skill was consolidated from. They travel
+     with the skill directory because the licences require it of anyone who
+     distributes the material. NOTICE.md says what was taken from each source;
+     this file carries the permission notices themselves. -->
+
+# Licences of the sources
+
+`obk-recall` consolidates material from the sources named in
+[NOTICE.md](NOTICE.md). Their licences are reproduced below in full.
+
+## MIT
+
+The MIT permission notice below applies to the work of each of these copyright
+holders, and is reproduced with each of their notices. The path after each one
+is the licence file it was read from, in the research pack's source clones.
+
+- **Cursor `plugins`, the pstack plugin**, Copyright (c) 2026 Lauren Tan
+  (`cursor_plugins/pstack/LICENSE`)
+
+```
+MIT License
+
+Copyright (c) 2026 Lauren Tan
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+```

package/skills/obk-recall/NOTICE.md

@@ -0,0 +1,53 @@
+<!-- Attribution for the sources this skill was built from. Kept out of
+     SKILL.md so it is not read into context on every use; it travels with
+     the skill directory, which is what the licences require. -->
+
+# Sources and licences
+
+The skill `obk-recall` was consolidated for this kit from this, MIT, with
+thanks:
+
+- **Cursor pstack**, `recall`, and its `poteto-mode` `session-pickup` playbook:
+  rebuilding recent working context before acting rather than writing a
+  history; classifying and routing first, with one specific prior session being
+  a pickup rather than a recall and an already-supplied state capsule meaning
+  no mining at all, with the pickup itself carried here in short (last
+  messages first, then the decisions, what landed against what was planned,
+  the resume point, nothing finished redone, what was inherited said), since
+  the kit has no separate pickup skill; locking the scope before searching, with "recent" as a real
+  range stated back and never quietly narrowed; ordering candidates by when
+  they were last modified rather than by identifier; searching for the topic
+  first and reading only the matching sessions and only their relevant parts;
+  skipping the current session and the obvious noise; reducing a long
+  transcript elsewhere and keeping only the reduced timeline; the per-session
+  fields (the goal, the decisions, the open threads, the struggles and
+  corrections, the artefacts), each traceable to where it came from; the rule
+  that your own history is not the whole record and that a feature with a long
+  bug tail keeps most of its story elsewhere, so the shared record is swept by
+  default rather than as a judgement call; null results being findings and an
+  unavailable source being said rather than skipped silently; verifying what
+  the mining surfaced against live state, and reading the record itself rather
+  than a trimmed summary when the answer turns on what was actually done; the
+  output contract: a capsule of at most five, one tagged line per thread with
+  an untagged thread counting as not done, at most five recurring problems
+  including a fix that shipped and was reverted, and one concrete next move;
+  cutting detail before cutting threads; citing findings to their source; and
+  sanitising private context before it goes anywhere else. From
+  `session-pickup`: the prior trail is authoritative input, so resist the bias
+  to re-derive it, and a "verify from scratch" pass means treating it as
+  untrustworthy when it is not; and a passing prior self-report is not the
+  proof.
+
+Made generic, which is what the owner asked for. The original names a fixed
+transcript path, a particular set of hosted sources and a parallel fan-out on
+named models; this version has the harness or the project say where a session's
+record lives, uses whatever sources the project actually has, and states a
+missing one as a limit on what could be checked. The privacy rule is kept and
+generalised: another project's history is not read without being asked.
+
+One departure: the original keeps itself from being invoked on its own with
+`disable-model-invocation: true`, which is not portable frontmatter (ADR 0019
+and PRD 7.2: these run on purpose, never automatically). Its description can
+therefore say "before starting or resuming work" safely; ours cannot, so the
+description and the skill both say it runs when it is asked for, and that
+having been away from the work is not itself a trigger.

package/skills/obk-recall/SKILL.md

@@ -0,0 +1,129 @@
+---
+name: obk-recall
+description: >-
+  Rebuilding where a piece of work actually stands: fixing the scope first,
+  reading back over your own history and whatever the project records around
+  the same code, checking what you find against the live state, and handing
+  back a short brief of where things are and what to do next. Run it when you
+  are asked to: "catch me up", "what was I doing with X", "where did I leave
+  off", "get up to speed on this before we start". Not something to do
+  unbidden: being asked to carry on with a task is a request for the task.
+---
+
+# Working out where you left off
+
+You are rebuilding context, not writing history. The output is short and it
+ends in a next action.
+
+This is run when someone asks for it. Having been away from the work is not
+itself a trigger: pick up what you were asked to pick up, and say so if you
+find you have lost the thread. Rebuilding context nobody asked for spends
+their time and their money on your comfort.
+
+These are defaults for work where nothing says otherwise. A user who asks for
+something else gets what they asked for; say which of these you left and why.
+
+## First, decide whether this is the right thing
+
+- **One specific earlier session to continue** needs less than the rest of
+  this. Read its last messages first, then scan back for the decisions. Rebuild
+  what actually landed, set it beside what was planned, and name the point to
+  resume from. Do not redo what it finished. Say what you inherited and where
+  you are picking up.
+- **A summary for someone else to read** is not this either. This is for
+  acting on.
+- **If they have already told you the state** (the branch, the files, what
+  changed), use it. Do not go mining for what you have just been handed.
+
+## Fix the scope before you search
+
+Say it back before you start: how far back, what topic, and whose work. "Recent"
+is a real range. Pick one and name it. Never quietly turn "everything" into
+"the last few", and never widen a narrow question because the search was easy.
+
+Stay inside the work you were asked about. Another project's history is not
+yours to read without being asked, and a bot that wanders into unrelated
+conversations is a problem whatever it finds there.
+
+## Read your own history
+
+Where a session's record lives depends on the harness, and the project or the
+harness will tell you. Find that out rather than guessing at a path.
+
+Then:
+
+- Go by when things were last touched, not by the order names happen to sort
+  in. An identifier is not a date.
+- Search for the topic first, and only read the sessions that match, and only
+  the parts of them that matter. Whole transcripts are long and mostly
+  irrelevant.
+- Skip the session you are in, and the obvious noise: helper runs, test
+  sessions, anything that was not the work.
+- When a transcript is long, reduce it somewhere else and bring back the
+  reduced timeline. Pulling the whole thing into the conversation you are
+  trying to rebuild is self-defeating. If what you sent off never comes back,
+  treat it as a source you could not reach: say so, say what the brief rests on
+  instead, and do not hold the brief waiting on it.
+
+From each one, take: what the work was, what was decided, what was left open,
+where it got stuck or was corrected, and what it produced (branches, changes,
+issues). Note which session each came from, so a claim can be traced.
+
+## Then read what everyone else recorded
+
+Your own history is only half of it, and it is the half most likely to be
+flattering. Where the topic names a feature, a file or an area, also look at
+what the project records around it: what shipped, what was reverted and why,
+what people keep reporting, what is still failing. A thing with a long tail of
+trouble keeps most of its story outside your conversations.
+
+Use whatever the project actually has: its history and its review discussion
+where it keeps them, and a tracker, documents, a chat log, somewhere errors land: some
+projects have them and some do not. Where one is missing, that is a fact
+about what you could check, not a step to pretend you did.
+
+Skip this only when the question is purely about your own activity ("what did
+I do this week"), where your history and the current state are the whole
+answer.
+
+## Check it against what is true now
+
+Whatever the reading turned up (a branch, a change, an issue), go and look at
+its current state rather than trusting the account. A conversation from
+Thursday does not know what happened on Friday. Where the answer hinges on
+what was actually done rather than what was said, read the record itself
+rather than a summary of it. A passing report from the earlier session is not
+the proof; the thing it reported on is.
+
+That is a check on the state, not a licence to do the work again. What the
+earlier sessions worked out and decided is what you are inheriting, and it is
+the best thing you have: take it, and resist the pull to re-derive it because
+you were not there. Re-running a prior investigation to see whether you agree
+treats a trail as untrustworthy when it is not, and spends exactly the time the
+brief exists to save. Where the trail does turn out to be wrong, that is a
+finding to report, not a quiet correction.
+
+Then set what shipped beside what was planned. The difference between the two
+is most of the brief: what is already done comes off the list, and what is left
+names the point to pick up from.
+
+## The brief
+
+Lead with where things stand. Detail below that, or cut.
+
+- **Where it stands.** At most five lines: what this work is and where it has
+  got to.
+- **The threads.** One line each, and each one carries its state plainly:
+  landed, open, in progress on a branch, done but not committed, reverted,
+  planned and not started. A thread with no state named is a thread nobody can
+  act on.
+- **What keeps going wrong.** At most five, and only the recurring ones.
+  Include anything that was fixed and then came back, so the next attempt
+  starts after the last failure rather than before it.
+- **The next move.** One concrete action.
+
+Anything adjacent stays out unless it is in the way. When it grows past a
+screen, cut the detail rather than dropping a thread. Say where each thing
+came from, and take out anything private before it goes anywhere else.
+
+Sources and licences: [NOTICE.md](NOTICE.md).

package/skills/obk-researching/LICENSES.md

@@ -0,0 +1,67 @@
+<!-- The licences of the sources this skill was consolidated from. They travel
+     with the skill directory because the licences require it of anyone who
+     distributes the material. NOTICE.md says what was taken from each source;
+     this file carries the permission notices themselves. -->
+
+# Licences of the sources
+
+`obk-researching` consolidates material from the sources named in
+[NOTICE.md](NOTICE.md). Their licences are reproduced below in full.
+
+## MIT
+
+The MIT permission notice below applies to the work of each of these copyright
+holders, and each notice is reproduced with it:
+
+- **Cursor `plugins`, the pstack plugin**, Copyright (c) 2026 Lauren Tan
+  (`cursor_plugins/pstack/LICENSE`)
+- **`addyosmani/agent-skills`**, Copyright (c) 2025 Addy Osmani
+  (`addyosmani_agent-skills/LICENSE`)
+- **`garrytan/gstack`**, Copyright (c) 2026 Garry Tan
+  (`garrytan_gstack/LICENSE`)
+- **`mattpocock/skills`**, Copyright (c) 2026 Matt Pocock
+  (`mattpocock_skills/LICENSE`)
+- **Cloudflare's security-audit skill**, Copyright (c) 2025-2026 Cloudflare, Inc.
+  (`cloudflare_security-audit-skill/LICENSE`)
+- **`openai/skills`, the notion-research-documentation skill**, Copyright 2025 Notion Labs, Inc.
+  (`openai_skills/skills/.curated/notion-research-documentation/LICENSE.txt`)
+
+Each licence file was read at the path given above.
+
+```
+MIT License
+
+Copyright (c) 2026 Lauren Tan
+Copyright (c) 2025 Addy Osmani
+Copyright (c) 2026 Garry Tan
+Copyright (c) 2026 Matt Pocock
+Copyright (c) 2025-2026 Cloudflare, Inc.
+Copyright 2025 Notion Labs, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+```
+
+## One source read only as a quotation
+
+`tw93/Waza` is not among the clones in the research pack. Its
+`rules/anti-patterns.md` is quoted in the pack's `source-book-2.md`, which
+records the repository as MIT, and what this skill takes from it is the idea of
+labelling a claim by whether it was checked, written in our own words rather
+than copied. No Waza text is reproduced here, and its licence file was not
+available to read.

package/skills/obk-researching/NOTICE.md

@@ -0,0 +1,170 @@
+<!-- Attribution for the sources this skill was built from. Kept out of
+     SKILL.md so it is not read into context on every use; it travels with
+     the skill directory, which is what the licences require. -->
+
+# Sources and licences
+
+The permission notices these licences require are in
+[LICENSES.md](LICENSES.md), beside this file.
+
+The skill `obk-researching` was consolidated for this kit from these, with
+thanks. Each licence below was read from the file named beside it.
+
+- **Cursor `plugins`, `pstack/skills/why/references/`**: MIT,
+  `cursor_plugins/pstack/LICENSE`, "Copyright (c) 2026 Lauren Tan". Three files
+  carry most of this skill.
+  - `epistemics.md`: the tiers a claim can sit in and the rule that every claim
+    sits in one of them; the phrasing that goes with each; the words that carry
+    a citation with them and need one immediately beside them; the words to
+    avoid and why each ("obviously" would not be asked about, "clearly"
+    precedes what is not, "just" hides a difficulty, "I think" turns evidence
+    into opinion); not turning an absence of evidence into evidence of absence; the
+    embedded-hypothesis trap, where the asker's guess is a prompt for
+    investigation rather than a conclusion to validate; surfacing both sides
+    when sources disagree rather than picking the tidier narrative; naming a
+    gap concretely as the question, the sources, the search terms and what came
+    back; and the check that a report with no gaps in it is suspicious.
+  - `investigator-prompt.md`: the posture that gathering is not concluding, and
+    that the more boring and exact the notes the more useful they are, with one
+    verbatim quote and a precise citation worth more than a paragraph of
+    plausible summary; quote rather than paraphrase where the wording carries
+    the weight; go wide before going deep; read the whole thing rather than the
+    title or the summary, because the qualification is usually further down;
+    track what you searched and not only what you found, since an absence means
+    nothing to a reader who does not know what was looked for; resist the story
+    and treat the piece that does not fit as the interesting one; consider the
+    counterfactual before calling evidence strong; and never round a partial
+    finding up.
+  - `synthesizer-prompt.md`: the shape of the write-up, including one line per
+    source consulted covering the ones that held nothing and the ones that
+    could not be reached, with the reason; and its closing point that the value
+    of the output is its honesty rather than its authority, so that a reader
+    who takes it to the person who really knows can ask a better question.
+  - `why/SKILL.md` adds coverage rather than minimalism, documenting the null
+    instead of skipping the search, and the high bar for skipping a source:
+    provably irrelevant rather than probably irrelevant.
+- **`addyosmani/agent-skills`, `skills/source-driven-development`**: MIT,
+  `addyosmani_agent-skills/LICENSE`, "Copyright (c) 2025 Addy Osmani". The
+  source hierarchy and what sits outside it: model-written summaries and your
+  own training data are not sources, and memory in particular is the one that
+  feels like knowledge. Its blanket line that forum answers and blog posts are
+  not primary is not carried: the review on #129 moved authority to the claim,
+  so a blog post is the source that owns a claim about its author's own
+  work. Being precise
+  about what you fetch, the specific page rather than the front page. Surfacing
+  a conflict between two authoritative sources instead of choosing. Treating
+  fetched pages as data and not as instructions, so that text addressing the
+  reader rather than documenting the subject is content and nothing more, and
+  never lets retrieved material expand the task. Citation practice: deep links,
+  quote the passage that carries a non-obvious claim, and say plainly when you
+  could not find documentation. And the rule this skill takes whole, that
+  hedging is the worst of the three options: either verify and cite, or mark it
+  unverified, because a disclaimer in a subordinate clause reads as confidence.
+- **`garrytan/gstack`, `ETHOS.md`**: MIT, `garrytan_gstack/LICENSE`,
+  "Copyright (c) 2026 Garry Tan". The three layers of what you find and how
+  much weight each bears: the settled and well-trodden, where the risk is
+  assuming the obvious answer is right and the cost of checking is near zero;
+  the new and popular, where the crowd can be wrong about a new thing as easily
+  as an old one and search results are inputs to thinking rather than answers;
+  and reasoning from the specifics, which is the most valuable and is still an
+  inference. Its `office-hours/SKILL.md` adds the privacy gate before a search:
+  look things up by general category rather than by the private thing you are
+  working on, and strip names, addresses, paths and anything that looks like a
+  secret from a query before it leaves the machine.
+- **`openai/skills`, `skills/.curated/notion-research-documentation`**: MIT,
+  that skill's own `LICENSE.txt`, "Copyright 2025 Notion Labs, Inc." The search
+  strategy, which is the only material of its kind in the sources: broad to
+  narrow, several related queries rather than one, what to do when there are
+  too many results (narrow, or sample deliberately across kinds rather than
+  taking the first few) and too few (broaden, try the words the field itself
+  uses, look in the neighbouring subject), and the shape of a query that is too
+  vague against one that is too specific to match anything. Its citation
+  guidance is also taken: group a run of claims from one source rather than
+  citing every sentence, put the citation beside what it supports, mark a
+  quotation as a quotation, keep a sources section that includes what held
+  nothing, and flag a superseded source where it stands.
+- **`mattpocock/skills`, `skills/engineering/research`**: MIT,
+  `mattpocock_skills/LICENSE`, "Copyright (c) 2026 Matt Pocock". Twelve lines,
+  one of which the research pack singled out and this skill is built around:
+  follow every claim back to the source that owns it, and go to primary
+  material rather than a secondary write-up of it.
+- **Cloudflare's security-audit skill**: MIT,
+  `cloudflare_security-audit-skill/LICENSE`, "Copyright (c) 2025-2026
+  Cloudflare, Inc." Coverage honesty: never imply that one pass exhausts the
+  subject, and a scoped piece of work presents itself as partial rather than
+  letting silence read as "the rest is fine".
+
+Two things come from the research pack rather than from a repository, and are
+marked here because the difference matters:
+
+- The evidence-label pair `(verified: <command>)` and `(inferred: did not
+  run)`, which `source-book-2.md:139` calls the single best sentence in its
+  whole survey, is quoted there from **tw93/Waza**'s `rules/anti-patterns.md`
+  (recorded as MIT in the same book's source table). Waza is not among the
+  clones in the research pack, so this is taken from the book's verbatim quote
+  rather than from the repository. The label's checkable form is kept as the
+  source has it, because being able to audit the label is the whole of its
+  value; the prose around it is ours. The source applies `inferred` to
+  reasoning from code, so this skill keeps it for an inference and asks for
+  `not checked` where the claim is somebody else's unchecked account.
+- The pack's own reports label each claim by where it came from and whether it
+  was checked, and keep a section of gaps and cautions at the end. That habit,
+  rather than any source, is why this skill treats a claim's support and the
+  report's coverage as two separate things to state.
+
+Made generic, which is what the owner asked for. The pstack originals are about
+code and its history, run named investigator and synthesizer subagents, and map
+seven hosted integrations to fixed categories. This version is about finding
+anything out from whatever sources exist, keeps the confidence labels and the
+null-result discipline in the skill itself, and leaves how the work is divided
+up to whoever is doing it.
+
+Where this overlaps `obk-why`, that is deliberate and allowed by ADR 0019: a
+skill carries what it needs rather than depending on another being loaded.
+`obk-why` anchors in code and its history; this one is about sources, coverage
+and how far a claim can be trusted.
+
+PRD 7.1 decides what this skill is for. The words are the coordinator's
+proposal of three light technique skills, "Find sources, say how each claim is
+supported, and separate fact from inference ... techniques only, no process,
+deeply written", which the owner approved on 2026-09-20 at 19:45:42 ("I agree
+to what you suggest").
+
+## What an acceptance run changed
+
+The skill was run by a bot that had not seen it written, against a real
+question with genuinely mixed evidence: what is actually established about
+people running teams of AI agents, from a research pack that labels its own
+sources. Five things in it come from what that found.
+
+- The three labels say how the writer came by a claim. They do not say how good
+  it is, so a controlled study and a sales page both came out as "someone
+  stated it". The skill now carries how far a claim has travelled as part of
+  that label, which was the single most decision-relevant property in the run
+  and the one the reader had asked for.
+- The skill said an inference should be hedged and then, six lines later, that
+  hedging is the worst of the options. That is a plain contradiction and it is
+  now stated as what it meant: hedge the strength of an inference, label the
+  state of the evidence, and do not do the first in place of the second.
+- Nothing covered a corpus somebody else assembled for another purpose, which
+  matters most when the answer is an absence, and nothing distinguished running
+  out of material from an answer that had settled.
+- The hand-back was shaped for another researcher, so the answer sat underneath
+  the coverage. It is now ordered for whoever asked, and says that where they
+  asked in order to decide, saying what you would do next is part of answering.
+- The list of words to avoid read as a list to police. It is now the check it
+  was meant to be.
+
+## What the re-validation changed (#155)
+
+No silent substitution: an answer about a neighbouring subject is said to be
+one (pstack `why/references/investigator-prompt.md:63`). Checking citations
+before handing over, by spot-check and wherever unsure (its
+`synthesizer-prompt.md:44`). A source's date and
+the period or version a claim covers (`investigator-prompt.md:79`). Other
+explanations that fit, in the hand-back (`synthesizer-prompt.md:78-86`). The
+answer and its strength first, per `rules/talk.md`. Labels on every claim a
+reader would act on rather than every claim, per `rules/evidence.md`. Opening a
+page verifies that it was said, not that it is true. Credits for the
+blast-radius ladder and for retrofitted rationales, which the skill does not
+carry, are removed; a repeated paragraph on who is speaking is merged.