@caddis/cli 0.4.42 → 0.4.44

package/bundles/antigravity-plugin/plugin.json

@@ -1,5 +1,5 @@
 {
   "name": "caddis",
-  "version": "1.3.128",
+  "version": "1.3.130",
   "description": "caddis — agent-agnostic dev harness as an Antigravity (agy) plugin: TDD skills + commands, single-sourced with the Claude Code plugin."
 }

package/bundles/antigravity-plugin/scripts/caddis_file_lock.py

@@ -14,7 +14,9 @@ from pathlib import Path
 import stat
 import tempfile
 import time
-from typing import BinaryIO, Iterator
+from typing import BinaryIO, Callable, Iterator, TypeVar
+
+_T = TypeVar("_T")
 
 if os.name == "nt":
     import msvcrt
@@ -22,14 +24,53 @@ else:
     import fcntl
 
 
+# Windows refuses os.replace, and even a stat or a read, on a file that another process has open at
+# that instant, with PermissionError (WinError 5). The window is short. Measured 2026-10-03 with one
+# process replacing a file in a loop: 0 of 759 replaces failed alone, and 250 of 908 failed while a second
+# process called resolve() on it. POSIX has no such window, and there a PermissionError is a real,
+# lasting refusal, so it is never retried.
+_RETRY_DENIED = os.name == "nt"
+_DENIED_RETRY_S = 5.0
+
+
+def retry_denied(operation: Callable[[], _T]) -> _T:
+    """Run ``operation``; on Windows retry a transient PermissionError for up to ``_DENIED_RETRY_S`` seconds."""
+    deadline = time.monotonic() + _DENIED_RETRY_S
+    while True:
+        try:
+            return operation()
+        except PermissionError:
+            if not _RETRY_DENIED or time.monotonic() >= deadline:
+                raise
+            time.sleep(0.01)
+
+
+def _plain(path: Path) -> Path:
+    """Drop the Windows extended-length prefix: ``\\\\?\\C:\\x`` and ``C:\\x`` name the same place.
+
+    While another process is creating or replacing a path, ``Path.resolve()`` can return it in the prefixed form
+    while the root resolves to the plain form, and ``is_relative_to`` then says the path escapes the root
+    (measured 2026-10-03: 2 of 60 trials of two writers starting on an empty folder; CI hit it on 2026-10-02).
+    """
+    text = str(path)
+    if text.startswith("\\\\?\\UNC\\"):
+        return Path("\\\\" + text[8:])
+    if text.startswith("\\\\?\\"):
+        return Path(text[4:])
+    return path
+
+
 def _destination(path: Path, root: Path | None) -> Path:
     path = Path(path)
     if ".." in path.parts:
         raise ValueError("destination may not contain parent traversal")
-    resolved = path.resolve()
-    if root is not None and not resolved.is_relative_to(Path(root).resolve()):
+    # Resolve the parent directory, not the file: another writer may be replacing the file right now, and
+    # resolving the file opens it, which can make that writer's os.replace fail. A symlink as the last
+    # component is refused below.
+    resolved = _plain(retry_denied(path.parent.resolve)) / path.name
+    if root is not None and not resolved.is_relative_to(_plain(Path(root).resolve())):
         raise ValueError("destination escapes artifact root")
-    if path.is_symlink():
+    if retry_denied(path.is_symlink):
         raise ValueError("destination may not be a symlink")
     return resolved
 
@@ -37,7 +78,7 @@ def _destination(path: Path, root: Path | None) -> Path:
 def _document_mode(target: Path) -> int:
     """Mode the replaced document should keep: the existing one, else what ``open()`` would give."""
     try:
-        return stat.S_IMODE(target.stat().st_mode)
+        return stat.S_IMODE(retry_denied(target.stat).st_mode)
     except FileNotFoundError:
         # os.umask has no read-only form; the probe is process-wide for one line, so a file
         # another thread creates in that window gets 0o666. caddis writers are single-threaded.
@@ -78,7 +119,7 @@ def locked_path(
     target = _destination(path, root)
     target.parent.mkdir(parents=True, exist_ok=True)
     lock_path = target.with_name(target.name + ".lock")
-    if lock_path.is_symlink():
+    if retry_denied(lock_path.is_symlink):
         raise ValueError("lock file may not be a symlink")
     # O_NOFOLLOW closes the gap between the check above and the open on POSIX.
     flags = os.O_RDWR | os.O_CREAT | getattr(os, "O_NOFOLLOW", 0) | getattr(os, "O_BINARY", 0)
@@ -114,7 +155,7 @@ def atomic_write(path: Path, text: str, *, root: Path | None = None) -> None:
             os.fsync(handle.fileno())
         # NamedTemporaryFile creates 0o600; without this every write would narrow the document.
         os.chmod(temporary, _document_mode(target))
-        os.replace(temporary, target)
+        retry_denied(lambda: os.replace(temporary, target))
         temporary = None  # replaced: that name may now belong to another writer
     finally:
         if temporary is not None:

package/bundles/antigravity-plugin/scripts/caddis_lanes.py

@@ -182,6 +182,7 @@ class GateResult:
     returncode: int
     passed: bool
     tail: str
+    duration_s: float = 0.0
 
 
 @dataclass
@@ -738,6 +739,7 @@ def run_gates(
         with heavy_slot("gates"):
             results = []
             for command in cmds:
+                gate_started = time.monotonic()
                 try:
                     completed = subprocess.run(
                         governed_argv(command),
@@ -756,6 +758,7 @@ def run_gates(
                             returncode=-1,
                             passed=False,
                             tail=f"timed out after {timeout_s}s",
+                            duration_s=time.monotonic() - gate_started,
                         )
                     )
                     continue
@@ -770,6 +773,7 @@ def run_gates(
                         returncode=completed.returncode,
                         passed=passed,
                         tail=output[-2000:],
+                        duration_s=time.monotonic() - gate_started,
                     )
                 )
             return results
@@ -1417,6 +1421,9 @@ def build_prompt(
         "run anything against production.\n"
         "- Do not implement any other phase.\n"
         "- Run every command in the foreground and wait for it to finish. Start no background tasks, watchers or dev servers.\n"
+        "- Test economy: after each step run only the tests for the file or module you changed. Run the full suite "
+        "only for the baseline and once at the end. Do not run a review loop in this lane; the orchestrator reviews. "
+        "Print a progress line every 20 minutes. Never start a second heavy test run while one is still running.\n"
         "Resource budget (enforced by the machine, not by this text):\n"
         f"- You run inside a Windows Job Object: {limits_line}. Exceeding it slows "
         "you down; it does not stop the limit.\n"
@@ -1558,6 +1565,23 @@ def _gate_dict(result: GateResult) -> dict:
         "returncode": result.returncode,
         "passed": result.passed,
         "tail": result.tail,
+        "duration_s": round(result.duration_s, 1),
+    }
+
+
+def _time_split(packet: dict, gates: list[GateResult], review_s: float) -> dict:
+    """Measured seconds the orchestrator can read: the lane run, the gate commands, the review.
+
+    What happens INSIDE the lane (edits versus the lane's own test runs) is not measured: the idle
+    sampler sees process image names every IDLE_SAMPLE_S seconds, not command lines, so it cannot tell a
+    pytest run from any other python process.
+    """
+    return {
+        "lane_s": round(sum(float(lane.get("duration_s") or 0) for lane in packet.get("lanes_tried", [])), 1),
+        "gates_s": round(sum(gate.duration_s for gate in gates), 1),
+        "gate_runs": len(gates),
+        "review_s": round(review_s, 1),
+        "in_lane": "not measured: only process names are visible inside a lane",
     }
 
 
@@ -1597,7 +1621,9 @@ def _run_post_checks(
         packet.pop("_freeze_before", None)
         return "stop", EXIT_NOT_RUN
 
+    review_started = time.monotonic()
     review = run_review(worktree, dict(os.environ))
+    review_s = time.monotonic() - review_started
     pythons = list(before)
     if pythons:
         after = {python: freeze_snapshot(python) for python in pythons}
@@ -1626,6 +1652,7 @@ def _run_post_checks(
             "gates": [_gate_dict(gate) for gate in gates],
             "gates_passed": gates_passed,
             "review": _review_dict(review),
+            "time_split": _time_split(packet, gates, review_s),
             "freeze_unchanged": freeze_unchanged,
             "next": next_step,
         }

package/bundles/antigravity-plugin/scripts/caddis_todo.py

@@ -12,7 +12,7 @@ from pathlib import Path
 
 try:
     import caddis_exit
-    from caddis_file_lock import atomic_write, locked_path
+    from caddis_file_lock import atomic_write, locked_path, retry_denied
     from caddis_frontmatter import parse, split_document
     from caddis_workstreams import _artifact, _name
 except ModuleNotFoundError as exc:
@@ -21,7 +21,7 @@ except ModuleNotFoundError as exc:
     sys.path.insert(0, str(Path(__file__).resolve().parent))
     sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "claude-harness" / "scripts"))
     import caddis_exit
-    from caddis_file_lock import atomic_write, locked_path
+    from caddis_file_lock import atomic_write, locked_path, retry_denied
     from caddis_frontmatter import parse, split_document
     from caddis_workstreams import _artifact, _name
 
@@ -41,15 +41,17 @@ def _path(root: Path, workstream: str | None) -> tuple[Path, Path]:
     if folder.is_symlink() or not folder.resolve().is_relative_to(artifact.resolve()):
         raise ValueError("todo-list path escapes artifact root")
     path = folder / f"{name}.md"
-    if path.is_symlink():  # reads are unlocked, so refuse here as well as in locked_path
+    # Reads are unlocked, so refuse here as well as in locked_path. On Windows a writer replacing the file
+    # makes this probe (and the read below) fail with PermissionError for an instant, so both retry.
+    if retry_denied(path.is_symlink):
         raise ValueError("to-do file may not be a symlink")
     return artifact, path
 
 
 def _read(path: Path, workstream: str | None) -> list[dict]:
-    if not path.exists():
+    if not retry_denied(path.exists):
         return []
-    text = path.read_text(encoding="utf-8")
+    text = retry_denied(lambda: path.read_text(encoding="utf-8"))
     header, body = split_document(text)
     name = workstream or "inbox"
     if header.get("type") != "todo" or header.get("workstream") != name or header.get("status") not in {"current", "done"}:

package/bundles/antigravity-plugin/skills/_registry.md

@@ -36,11 +36,11 @@
 
 | Skill | Path | When to Use |
 |-------|------|-------------|
-| Adopt App | `adopt-app/` | Bring an app that was never scaffolded (POC, server folder, checkout with no remote) up to standard — inventory without running it, pass/gap/question verdicts, ordered plan. Use when the user says "this app was never set up properly", "adopt this POC", "onboard this app", "it just runs from a folder on the server", "bring this up to standard", "what would it take to get this into CI", "nobody knows how this is deployed", or "it started as a prototype and now it is production". |
+| Adopt App | `adopt-app/` | >- |
 | Ci Cd Pipeline | `ci-cd-pipeline/` | CI/CD pipelines for GitHub Actions and Azure DevOps: build and deploy workflows, quality gates, environment promotion and release automation. |
 | Gh Cli | `gh-cli/` | GitHub CLI operations — issues, PRs, releases, and repo management |
 | Git Commit | `git-commit/` | Create well-structured conventional commit messages following Conventional Commits standard. Use when committing changes, preparing PRs, or generating changelogs. |
-| Port To Github | `port-to-github/` | Port an app or repo to GitHub from any source (git server, local folder, UNC share, Windows box over WinRM) — all branches and tags, SHA-verified, CI translated, history kept source-only, deploy cut over with rollback. Use when the user says "move this app to GitHub", "port X to GitHub", "migrate from Gitea", "put this folder on GitHub", "this app only exists on the server", "import the repo from the prod box", "keep binaries / MariaDB / PHP out of the repo", "check the repo only holds source", or "cut the deploy over to GitHub". |
+| Port To Github | `port-to-github/` | >- |
 | Safe Cleanup | `safe-cleanup/` | Use BEFORE deleting a directory tree, scratchpad or git worktree, or "tidying up" generated folders, especially on Windows, where deleting through a junction or symlink destroys its target; and to verify a venv or node_modules survived. |
 | Using Git Worktrees | `using-git-worktrees/` | Use when starting feature work that needs isolation from the current workspace, or before executing an implementation plan: creates an isolated git worktree safely. |
 | Windows Deployment | `windows-deployment/` | Deploy FastAPI + React/Vite apps to Windows Server with NSSM services, IIS or nginx reverse proxy and git-pull. Use for Windows prod deploys, NSSM, reverse proxy setup, dev/prod config, or prod troubleshooting. |
@@ -118,7 +118,7 @@
 |-------|------|-------------|
 | Draw Io | `draw-io/` | draw.io diagram creation, editing, and review. Use for .drawio XML editing, PNG conversion, layout adjustment, and AWS icon usage. |
 | Mermaid Diagrams | `mermaid-diagrams/` | Software diagrams in Mermaid: class, sequence, flowchart, ERD, C4, state, git graph, gantt. Use for domain models, API flows, processes and database schemas. |
-| Particle Art | `particle-art/` | Zero-dependency animated particle art as a React/Next.js component (spring physics, CSS-variable theming, mouse interaction). Use for animated hero art or a living logo, or on "particles that form a shape", "particle animation", "node network", "animated letter/logo/initials", "living letter", "morphing particles", "constellation", "neural net art", "dot field", "stipple portrait", "halftone animation", "ASCII art animation", "background art for my site", or "art that reacts to mouse". |
+| Particle Art | `particle-art/` | >- |
 
 ### Testing
 
@@ -133,7 +133,7 @@
 
 | Skill | Path | When to Use |
 |-------|------|-------------|
-| Advisory Hub | `advisory-hub/` | A long-lived "Hub" session re-derives each phase of a multi-session plan instead of trusting its self-report. Use when the user says "advisory hub", "validate this phase", "phase report", "hub verdict", "advisory context", "who checks the implementing session", "the plan turned out to be wrong", "hand off the hub", "re-derive don't trust", or a long plan with expensive-to-reverse work (a migration, a security change, production data correctness) needs independent checks; not for short features. Hub artefacts, including `hub-NN.spawn.md`, go in `.caddis/advisory-hub-reports/`. |
+| Advisory Hub | `advisory-hub/` | >- |
 | Best Practices | `best-practices/` | >- |
 | Brainstorming | `brainstorming/` | You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation. |
 | Context Curator | `context-curator/` | Compress and prioritize codebase context before handing work to reasoning agents, minimizing token waste while preserving the required decision inputs. |

package/bundles/antigravity-plugin/skills/adopt-app/SKILL.md

@@ -1,6 +1,11 @@
 ---
 name: adopt-app
-description: Bring an app that was never scaffolded (POC, server folder, checkout with no remote) up to standard — inventory without running it, pass/gap/question verdicts, ordered plan. Use when the user says "this app was never set up properly", "adopt this POC", "onboard this app", "it just runs from a folder on the server", "bring this up to standard", "what would it take to get this into CI", "nobody knows how this is deployed", or "it started as a prototype and now it is production".
+description: >-
+  Bring an app that was never scaffolded (POC, server folder, checkout with no remote) up to standard:
+  inventory without running it, pass/gap/question verdicts, ordered plan. Use when the user says "this
+  app was never set up properly", "adopt this POC", "onboard this app", "it just runs from a folder on
+  the server", "what would it take to get this into CI", "nobody knows how this is deployed", or "it
+  started as a prototype and now it is production".
 ---
 
 # adopt-app

package/bundles/antigravity-plugin/skills/advisory-hub/SKILL.md

@@ -1,6 +1,12 @@
 ---
 name: advisory-hub
-description: A long-lived "Hub" session re-derives each phase of a multi-session plan instead of trusting its self-report. Use when the user says "advisory hub", "validate this phase", "phase report", "hub verdict", "advisory context", "who checks the implementing session", "the plan turned out to be wrong", "hand off the hub", "re-derive don't trust", or a long plan with expensive-to-reverse work (a migration, a security change, production data correctness) needs independent checks; not for short features. Hub artefacts, including `hub-NN.spawn.md`, go in `.caddis/advisory-hub-reports/`.
+description: >-
+  A long-lived "Hub" session re-derives each phase of a multi-session plan instead of trusting its
+  self-report. Use when the user says "advisory hub", "validate this phase", "phase report", "hub
+  verdict", "who checks the implementing session", "re-derive don't trust", "hand off the hub", or a
+  long plan with expensive-to-reverse work (migration, security change, production data correctness)
+  needs independent checks; not for short features. Hub artefacts go in
+  `.caddis/advisory-hub-reports/`.
 ---
 
 # Advisory Hub — cross-session phase validation

package/bundles/antigravity-plugin/skills/decide/SKILL.md

@@ -28,7 +28,7 @@ comes out differently.
 ```markdown
 ---
 type: adr
-status: accepted
+status: current
 found: <YYYY-MM-DD>
 ---
 

package/bundles/antigravity-plugin/skills/implement/SKILL.md

@@ -154,6 +154,14 @@ row, visible to any later reader without an Advisory Hub having to catch it live
     `AGENTS.md`. Never write orchestration notes to `.caddis/kb/`.
 7. **Never write a load or stress test into a lane prompt or findings file.** The script refuses
    this wording without `--allow-load`. Only the owner gives that flag.
+7b. **Write test economy into every agent brief, not only the lane prompt.** The script already adds it
+   to its lane prompts. A brief you write yourself (an Agent-tool subagent, a peer session) needs the same
+   five lines: after each step run only the tests for the file or module you changed; run the full suite only
+   for the baseline and once at the end; run no review loop inside the agent (you review); report progress
+   every 20 minutes; never start a second heavy test run while one is still running. **Two parallel agents
+   must not both run full suites.** Measured 2026-10-02 on one shared box: a 2,063-test suite took 2.7 min
+   alone and 6.7 min beside a second test-heavy agent, and one agent's brief (baseline, tests after each of 9
+   module switches, full gates, in-agent review) cost 30-40 of its 59 minutes.
 8. Record these Tracker values:
    - `Model` = the packet's `model`.
    - `Lane` = the lanes tried, joined with ` -> ` and followed by the reason. For example,

package/bundles/antigravity-plugin/skills/particle-art/SKILL.md

@@ -1,7 +1,12 @@
 ---
 name: particle-art
 version: 1.0.0
-description: Zero-dependency animated particle art as a React/Next.js component (spring physics, CSS-variable theming, mouse interaction). Use for animated hero art or a living logo, or on "particles that form a shape", "particle animation", "node network", "animated letter/logo/initials", "living letter", "morphing particles", "constellation", "neural net art", "dot field", "stipple portrait", "halftone animation", "ASCII art animation", "background art for my site", or "art that reacts to mouse".
+description: >-
+  Zero-dependency animated particle art as a React/Next.js component (spring physics, CSS-variable
+  theming, mouse interaction). Use for animated hero art or a living logo, or on "particle animation",
+  "particles that form a shape", "animated letter/logo/initials", "morphing particles",
+  "constellation", "neural net art", "halftone animation", "ASCII art animation", or "art that reacts
+  to mouse".
 ---
 
 # Particle Art Generator

package/bundles/antigravity-plugin/skills/port-to-github/SKILL.md

@@ -1,6 +1,11 @@
 ---
 name: port-to-github
-description: Port an app or repo to GitHub from any source (git server, local folder, UNC share, Windows box over WinRM) — all branches and tags, SHA-verified, CI translated, history kept source-only, deploy cut over with rollback. Use when the user says "move this app to GitHub", "port X to GitHub", "migrate from Gitea", "put this folder on GitHub", "this app only exists on the server", "import the repo from the prod box", "keep binaries / MariaDB / PHP out of the repo", "check the repo only holds source", or "cut the deploy over to GitHub".
+description: >-
+  Port an app or repo to GitHub from any source (git server, local folder, UNC share, Windows box over
+  WinRM): all branches and tags, SHA-verified, CI translated, source-only history, deploy cut over
+  with rollback. Use when the user says "move this app to GitHub", "port X to GitHub", "migrate from
+  Gitea", "this app only exists on the server", "import the repo from the prod box", "keep binaries
+  out of the repo", or "cut the deploy over to GitHub".
 ---
 
 # port-to-github

package/bundles/antigravity-plugin/skills/tech-explainer/SKILL.md

@@ -3,12 +3,11 @@ name: tech-explainer
 context: fork
 description: >-
   Plain-language explainer, with ranked Mermaid diagrams and Simplified Technical English, for a
-  reader who did NOT do the investigation (manager, stakeholder). Use when the user says "explain
-  this to X", "explainer", "write this up for someone non-technical", "plain English", "simplified
-  technical english", "STE", "explain our findings", "write up the benchmark results", "answer my
-  manager's recommendations", "why is it slow — document it", "make a doc with diagrams explaining
-  the stack", or summarises an investigation for a reader who won't read the raw data. Not for build
-  hand-offs (explainer-doc) or READMEs.
+  reader who did NOT do the investigation (manager, stakeholder). Use when the user says "explain this
+  to X", "explainer", "write this up for someone non-technical", "plain English", "STE", "explain our
+  findings", "write up the benchmark results", "why is it slow — document it", or summarises an
+  investigation for a reader who won't read the raw data. Not for build hand-offs (explainer-doc) or
+  READMEs.
 ---
 
 # tech-explainer — make a stranger understand, and able to push back

package/bundles/antigravity-plugin-extras/plugin.json

@@ -1,5 +1,5 @@
 {
   "name": "caddis-extras",
-  "version": "1.3.40",
+  "version": "1.3.41",
   "description": "caddis-extras — the long-tail skills for the Antigravity (agy) caddis plugin; install alongside caddis for the full set."
 }

package/bundles/antigravity-plugin-extras/skills/_registry.md

@@ -22,11 +22,13 @@
 
 | Skill | Path | When to Use |
 |-------|------|-------------|
+| Adopt Rbac | `adopt-rbac/` | >- |
 | Anchor Review | `anchor-review/` | Single-model adversarial review technique — 3-lens analysis with confidence scoring and self-challenge |
 | Api Client Patterns | `api-client-patterns/` | Typed client-side API consumption: fetch wrappers, zod validation, auth injection, TanStack Query (useQuery, useMutation, optimistic updates), tRPC, OpenAPI codegen, pagination. Use when consuming REST or tRPC APIs. |
 | Architecture Design | `architecture-design/` | Design application architecture and system diagrams with layered patterns, Mermaid C4 diagrams, SQL Server data platform, and on-premise deployment considerations. |
 | Backend To Frontend Handoff Docs | `backend-to-frontend-handoff/` | Document a finished backend API for frontend integration. Use when the user says 'create handoff', 'document API', 'frontend handoff', or 'API documentation'. |
 | Caching Patterns | `caching-patterns/` | Caching strategies for Streamlit and FastAPI applications |
+| Case Management | `case-management/` | >- |
 | Code Explainer | `code-explainer/` | Explain code with diagrams, analogies and step-by-step walkthroughs. Use when teaching a codebase or answering "how does this work?" |
 | Cross Review | `cross-review/` | Have a different vendor's model (DeepSeek, GLM, any OpenAI-compatible endpoint) review the current diff. Use after a phase is green and before commit/merge, or for a second opinion on a risky diff. |
 | Llm Application Dev | `llm-application-dev/` | LLM applications: prompt engineering, RAG and LLM integration. Use for AI-powered features, chatbots or LLM automation. |

package/bundles/antigravity-plugin-extras/skills/adopt-rbac/SKILL.md

@@ -0,0 +1,26 @@
+---
+name: adopt-rbac
+description: >-
+  Pointer to the org's RBAC adoption skill. Use for "add RBAC to this app" or "adopt rbac-kit".
+---
+
+# adopt-rbac (pointer)
+
+RBAC adoption depends on organisation-specific things: the shared package and its pin, the auth
+proxy that supplies identity, prod paths, the rollout order. So the real skill lives in the
+organisation's private platform repo, next to the package it describes:
+
+    <PLATFORM_REPO>/.claude/skills/adopt-rbac/SKILL.md
+
+**Find it, read it in full, and follow it.** This pointer only makes it findable from a session
+opened in another repo.
+
+1. If `.github/project-config.md` sets `<PLATFORM_REPO>`, use that checkout.
+2. Otherwise look in the folders next to the current project for one that contains
+   `.claude/skills/adopt-rbac/SKILL.md`.
+3. If the repo is only on the remote, read the file with `gh api` from the platform repo.
+4. If none of these works, stop and ask the user where it is. Do not improvise RBAC from memory:
+   improvised copies drift, and a drifted copy is how a privilege escalation ships.
+
+The skill and the package live in one repo on purpose, so a package change and its skill update
+land in the same PR.

package/bundles/antigravity-plugin-extras/skills/case-management/SKILL.md

@@ -0,0 +1,24 @@
+---
+name: case-management
+description: >-
+  Pointer to the org's case-management blueprint. Use for "add case management".
+---
+
+# case-management (pointer)
+
+The blueprint is drawn from a live, organisation-specific implementation, so it lives in the
+organisation's private platform repo:
+
+    <PLATFORM_REPO>/.claude/skills/case-management/SKILL.md
+
+**Find it, read it in full, and follow it.** This pointer only makes it findable from a session
+opened in another repo. Case management needs RBAC first: see the sibling **adopt-rbac** skill.
+
+1. If `.github/project-config.md` sets `<PLATFORM_REPO>`, use that checkout.
+2. Otherwise look in the folders next to the current project for one that contains
+   `.claude/skills/case-management/SKILL.md`.
+3. If the repo is only on the remote, read the file with `gh api` from the platform repo.
+4. If none of these works, stop and ask the user where it is.
+
+It is a blueprint, not a package yet. When a second app adopts case management, the blueprint
+says to extract the generic half into a `case-kit` package with that app as the first consumer.

package/bundles/codex/.codex/skills/devops/adopt-app/SKILL.md

@@ -1,6 +1,11 @@
 ---
 name: adopt-app
-description: Bring an app that was never scaffolded (POC, server folder, checkout with no remote) up to standard — inventory without running it, pass/gap/question verdicts, ordered plan. Use when the user says "this app was never set up properly", "adopt this POC", "onboard this app", "it just runs from a folder on the server", "bring this up to standard", "what would it take to get this into CI", "nobody knows how this is deployed", or "it started as a prototype and now it is production".
+description: >-
+  Bring an app that was never scaffolded (POC, server folder, checkout with no remote) up to standard:
+  inventory without running it, pass/gap/question verdicts, ordered plan. Use when the user says "this
+  app was never set up properly", "adopt this POC", "onboard this app", "it just runs from a folder on
+  the server", "what would it take to get this into CI", "nobody knows how this is deployed", or "it
+  started as a prototype and now it is production".
 ---
 
 # adopt-app

package/bundles/codex/.codex/skills/devops/port-to-github/SKILL.md

@@ -1,6 +1,11 @@
 ---
 name: port-to-github
-description: Port an app or repo to GitHub from any source (git server, local folder, UNC share, Windows box over WinRM) — all branches and tags, SHA-verified, CI translated, history kept source-only, deploy cut over with rollback. Use when the user says "move this app to GitHub", "port X to GitHub", "migrate from Gitea", "put this folder on GitHub", "this app only exists on the server", "import the repo from the prod box", "keep binaries / MariaDB / PHP out of the repo", "check the repo only holds source", or "cut the deploy over to GitHub".
+description: >-
+  Port an app or repo to GitHub from any source (git server, local folder, UNC share, Windows box over
+  WinRM): all branches and tags, SHA-verified, CI translated, source-only history, deploy cut over
+  with rollback. Use when the user says "move this app to GitHub", "port X to GitHub", "migrate from
+  Gitea", "this app only exists on the server", "import the repo from the prod box", "keep binaries
+  out of the repo", or "cut the deploy over to GitHub".
 ---
 
 # port-to-github

package/bundles/codex/.codex/skills/docs/tech-explainer/SKILL.md

@@ -3,12 +3,11 @@ name: tech-explainer
 context: fork
 description: >-
   Plain-language explainer, with ranked Mermaid diagrams and Simplified Technical English, for a
-  reader who did NOT do the investigation (manager, stakeholder). Use when the user says "explain
-  this to X", "explainer", "write this up for someone non-technical", "plain English", "simplified
-  technical english", "STE", "explain our findings", "write up the benchmark results", "answer my
-  manager's recommendations", "why is it slow — document it", "make a doc with diagrams explaining
-  the stack", or summarises an investigation for a reader who won't read the raw data. Not for build
-  hand-offs (explainer-doc) or READMEs.
+  reader who did NOT do the investigation (manager, stakeholder). Use when the user says "explain this
+  to X", "explainer", "write this up for someone non-technical", "plain English", "STE", "explain our
+  findings", "write up the benchmark results", "why is it slow — document it", or summarises an
+  investigation for a reader who won't read the raw data. Not for build hand-offs (explainer-doc) or
+  READMEs.
 ---
 
 # tech-explainer — make a stranger understand, and able to push back

package/bundles/codex/.codex/skills/media/particle-art/SKILL.md

@@ -1,7 +1,12 @@
 ---
 name: particle-art
 version: 1.0.0
-description: Zero-dependency animated particle art as a React/Next.js component (spring physics, CSS-variable theming, mouse interaction). Use for animated hero art or a living logo, or on "particles that form a shape", "particle animation", "node network", "animated letter/logo/initials", "living letter", "morphing particles", "constellation", "neural net art", "dot field", "stipple portrait", "halftone animation", "ASCII art animation", "background art for my site", or "art that reacts to mouse".
+description: >-
+  Zero-dependency animated particle art as a React/Next.js component (spring physics, CSS-variable
+  theming, mouse interaction). Use for animated hero art or a living logo, or on "particle animation",
+  "particles that form a shape", "animated letter/logo/initials", "morphing particles",
+  "constellation", "neural net art", "halftone animation", "ASCII art animation", or "art that reacts
+  to mouse".
 ---
 
 # Particle Art Generator

package/bundles/codex/.codex/skills/workflow/advisory-hub/SKILL.md

@@ -1,6 +1,12 @@
 ---
 name: advisory-hub
-description: A long-lived "Hub" session re-derives each phase of a multi-session plan instead of trusting its self-report. Use when the user says "advisory hub", "validate this phase", "phase report", "hub verdict", "advisory context", "who checks the implementing session", "the plan turned out to be wrong", "hand off the hub", "re-derive don't trust", or a long plan with expensive-to-reverse work (a migration, a security change, production data correctness) needs independent checks; not for short features. Hub artefacts, including `hub-NN.spawn.md`, go in `.caddis/advisory-hub-reports/`.
+description: >-
+  A long-lived "Hub" session re-derives each phase of a multi-session plan instead of trusting its
+  self-report. Use when the user says "advisory hub", "validate this phase", "phase report", "hub
+  verdict", "who checks the implementing session", "re-derive don't trust", "hand off the hub", or a
+  long plan with expensive-to-reverse work (migration, security change, production data correctness)
+  needs independent checks; not for short features. Hub artefacts go in
+  `.caddis/advisory-hub-reports/`.
 ---
 
 # Advisory Hub — cross-session phase validation

package/bundles/manifest.json

@@ -1,8 +1,8 @@
 {
-  "poolVersion": "1.3.128",
+  "poolVersion": "1.3.130",
   "bundles": {
-    "antigravity-plugin": "1.3.128",
-    "antigravity-plugin-extras": "1.3.40",
+    "antigravity-plugin": "1.3.130",
+    "antigravity-plugin-extras": "1.3.41",
     "codex": "unknown"
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@caddis/cli",
-  "version": "0.4.42",
+  "version": "0.4.44",
   "description": "Install, update and diagnose the caddis dev harness across every coding agent you use (Claude Code, agy/Antigravity, and more).",
   "keywords": [
     "caddis",