@caddis/cli 0.4.52 → 0.4.54

package/bundles/antigravity-plugin/skills/roadmap/assets/value-check.template.py

@@ -0,0 +1,161 @@
+#!/usr/bin/env python3
+"""Value check template: compare figures from an endpoint with an independent source over a fixed past window.
+
+Copy it into the app (for example scripts/check_values.py) so CI and prod checks can run it again.
+
+    python value-check.template.py --base http://localhost:8000 --expected expected.json
+    python value-check.template.py --base http://localhost:8000 --expected expected.json --prove-it-can-fail
+
+Expected file:
+    {"window": {"start": "2026-09-01", "end": "2026-09-30"},
+     "figures": [{"name": "...", "endpoint": "/api/x", "path": "a.b", "expected": 1200,
+                  "source": "where the expected value came from", "population": "who is counted",
+                  "denominator": "what the rate divides by, or none", "tolerance": 0.001, "series": "day"}]}
+
+Rules:
+  - The window must end before today. A moving window ("today") gives a number that changes while you check it.
+  - Every figure names its source, population and denominator.
+  - A "series": "day" figure has ISO date keys that all fall on one weekday. A weekday gap is not a data gap.
+  - --prove-it-can-fail changes the expected values on purpose. The run must then exit 1.
+
+Exit codes: 0 all figures pass, 1 a figure fails, 4 bad input or an HTTP error that is not a figure failure.
+"""
+from __future__ import annotations
+
+import argparse
+import copy
+import datetime as dt
+import json
+import sys
+import urllib.error
+import urllib.parse
+import urllib.request
+
+_MISSING = object()
+
+
+class BadInput(Exception):
+    """The expected file or the request is wrong. Exit 4."""
+
+
+def _parse_date(text: str, what: str) -> dt.date:
+    try:
+        return dt.date.fromisoformat(str(text))
+    except ValueError as exc:
+        raise BadInput(f"{what} is not an ISO date: {text!r}") from exc
+
+
+def validate(spec: dict) -> None:
+    window = spec.get("window") or {}
+    start, end = _parse_date(window.get("start"), "window.start"), _parse_date(window.get("end"), "window.end")
+    if end >= dt.date.today():
+        raise BadInput(f"window.end {end} is not before today ({dt.date.today()}): use a fixed past window")
+    if start > end:
+        raise BadInput("window.start is after window.end")
+    figures = spec.get("figures") or []
+    if not figures:
+        raise BadInput("no figures in the expected file")
+    for fig in figures:
+        name = fig.get("name") or "<unnamed>"
+        for key in ("name", "endpoint", "path", "expected"):
+            if key not in fig or fig[key] in ("", None):
+                raise BadInput(f"figure {name!r} has no {key}")
+        for key in ("source", "population", "denominator"):
+            if not str(fig.get(key, "")).strip():
+                raise BadInput(f"figure {name!r} has an empty {key}: name it")
+        if fig.get("series") == "day":
+            if not isinstance(fig["expected"], dict) or not fig["expected"]:
+                raise BadInput(f"figure {name!r}: a day series needs a non-empty object of date keys")
+            weekdays = {_parse_date(k, f"figure {name!r} key").weekday() for k in fig["expected"]}
+            if len(weekdays) > 1:
+                raise BadInput(f"figure {name!r}: day series keys fall on more than one weekday")
+
+
+def prove_it_can_fail(spec: dict) -> dict:
+    """Return a copy with a wrong expected value, so a correct endpoint must fail."""
+    spec = copy.deepcopy(spec)
+    scalars = [f for f in spec["figures"] if not isinstance(f["expected"], dict)]
+    if scalars:
+        scalars[0]["expected"] = scalars[0]["expected"] + 1
+    series = [f for f in spec["figures"] if isinstance(f["expected"], dict)]
+    if series:
+        series[0]["expected"].pop(next(iter(series[0]["expected"])))  # a missing date must fail the compare
+        series[0]["expected"]["1999-01-04"] = 0  # 1999-01-04 is a Monday; the endpoint has no such key
+    if not scalars and not series:
+        spec["figures"][0]["path"] += ".missing"
+    return spec
+
+
+def fetch(base: str, endpoint: str, window: dict, headers: dict) -> tuple[int, object]:
+    query = urllib.parse.urlencode({"start": window["start"], "end": window["end"]})
+    req = urllib.request.Request(f"{base.rstrip('/')}{endpoint}?{query}", headers=headers)
+    try:
+        with urllib.request.urlopen(req, timeout=30) as resp:
+            return resp.status, json.loads(resp.read().decode("utf-8"))
+    except urllib.error.HTTPError as exc:
+        return exc.code, None
+    except (urllib.error.URLError, TimeoutError, ValueError) as exc:
+        raise BadInput(f"cannot read {endpoint}: {exc}") from exc
+
+
+def dig(data: object, path: str) -> object:
+    for part in path.split("."):
+        if isinstance(data, dict) and part in data:
+            data = data[part]
+        else:
+            return _MISSING
+    return data
+
+
+def same(actual: object, expected: object, tolerance: float) -> bool:
+    if isinstance(expected, dict):
+        if not isinstance(actual, dict):
+            return False
+        return all(k in actual and same(actual[k], v, tolerance) for k, v in expected.items())
+    if isinstance(expected, bool) or isinstance(actual, bool) or not isinstance(expected, (int, float)):
+        return actual == expected
+    return isinstance(actual, (int, float)) and abs(actual - expected) <= tolerance
+
+
+def check(spec: dict, base: str, headers: dict) -> bool:
+    ok = True
+    for fig in spec["figures"]:
+        status, body = fetch(base, fig["endpoint"], spec["window"], headers)
+        actual = dig(body, fig["path"]) if status == 200 else _MISSING
+        passed = actual is not _MISSING and same(actual, fig["expected"], float(fig.get("tolerance", 0)))
+        shown = "missing" if actual is _MISSING else actual
+        if status != 200:
+            shown = f"HTTP {status}"
+        print(f"{'PASS' if passed else 'FAIL'} {fig['name']}: endpoint {shown} vs {fig['source']} {fig['expected']}; "
+              f"population {fig['population']}; denominator {fig['denominator']}")
+        ok = ok and passed
+    return ok
+
+
+def main(argv: list[str] | None = None) -> int:
+    ap = argparse.ArgumentParser(description=__doc__.split("\n")[0])
+    ap.add_argument("--base", required=True, help="origin of the app, for example http://localhost:8000")
+    ap.add_argument("--expected", required=True, help="expected figures JSON file")
+    ap.add_argument("--prove-it-can-fail", action="store_true", help="change the expected values; the run must exit 1")
+    ap.add_argument("--header", action="append", default=[], metavar="K:V", help="extra request header (repeatable)")
+    args = ap.parse_args(argv)
+    try:
+        with open(args.expected, encoding="utf-8") as fh:
+            spec = json.load(fh)
+        validate(spec)
+        headers = {}
+        for h in args.header:
+            key, sep, value = h.partition(":")
+            if not sep:
+                raise BadInput(f"--header needs K:V, got {h!r}")
+            headers[key.strip()] = value.strip()
+        if args.prove_it_can_fail:
+            spec = prove_it_can_fail(spec)
+        return 0 if check(spec, args.base, headers) else 1
+    except (BadInput, OSError, ValueError) as exc:
+        print(f"bad input: {exc}", file=sys.stderr)
+        return 4
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/bundles/antigravity-plugin/skills/ship/SKILL.md

@@ -36,7 +36,7 @@ names, branch, and service identifiers — never assume.
 - Tests: run only if the user says they're needed or a gate explicitly requires them
 - Fix any failures before proceeding. Do not commit broken code.
 
-**2. STAGE + COMMIT** — Stage only the intended files (never `git add -A` blindly):
+**2. STAGE + COMMIT** — Stage only the intended files, by name (never `git add -A`, `git add .` or a folder):
 ```
 git status --short      # confirm what's staged
 git add <specific files>
@@ -48,20 +48,8 @@ Use conventional commits: `fix:`, `feat:`, `chore:`, `refactor:`, `docs:`. Scope
 **2b. CROSS-REVIEW TRIGGER** — `ship` has no review pause at all, which is how sixteen fixes reached production unreviewed in one day.
 
 <!-- shared:cross-review-trigger — keep byte-identical across commands; a test pins it -->
-**Run the trigger, do not eyeball the diff:**
-
-```bash
-python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_gate.py" review-trigger --range <base>...HEAD
-```
-
-Exit **0** — say nothing, carry on. Exit **2** — it prints which rule fired and on which files.
-Run `/caddis:cross-review`, show the findings, and let the user decide. It **never blocks**: this
-picks when to ask for a second opinion, it is not a verdict, and a review gate that blocks a ship
-gets switched off inside a week.
-
-It fires on SQL and repositories, `services/`, caches and refresh jobs, auth and RBAC, or a diff
-over 400 changed lines. No judgement in any of those — deliberately, because judgement is exactly
-what failed.
+Run `python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_gate.py" review-tier --range <base>...HEAD` and review by its tier (rule 3).
+`<base>` is `origin/<default branch>` (on the default branch itself, the commit before this change). Tier 0 or 1-small: no model review. Tier 1: one `/caddis:cross-review`. Tier 2: two reviewers of two other vendors in one round. No `TIER:` line means tier 2.
 <!-- /shared:cross-review-trigger -->
 
 **3. PUSH** — to the repo's default branch (confirm the branch first; don't assume `main`):
@@ -117,9 +105,21 @@ Health:          green ✓ | n/a
 Release tag:     <tag> → <sha> | n/a
 ```
 
+## Programme triggers
+
+Small work that does not meet a trigger skips its block.
+
+**Trigger: Always, when the repo deploys on push.** No merge while a push run on the default branch is in progress. Check `gh run list --branch <default> --event push --status in_progress`; if a run is listed, wait for it. `python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_merge_chain.py"` does this check.
+
+**Trigger: A peer session is known.** A relay or a SessionStart warning names another session on this repo. Before the merge, send each named peer session a message (SendMessage or the peer channel). It is a notice, never a request for permission.
+
+**Trigger: Always, when the repo deploys on push.** After the merge, run `python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_prod_check.py" <sha>` with the repo's profile, `.caddis/prod-check.toml`. The script resolves a short SHA to the full SHA first, or refuses with exit 4. A repo with no profile gets items 1 and 2 only, and the script says so.
+
+**Trigger: Two or more reviewed green PRs wait to merge.** Combine them into one release PR (the global rule of 2026-10-10): merge their branches into one release branch, run the gates once, open one release PR that links the components, then close the components with a link.
+
 ## Rules
 - Never push before preflight gates are green.
-- Never use `git add -A` without reviewing `git status` first.
+- Never `git add -A`, `git add .` or `git add <dir>`, even after reading `git status`: stage named files only (the guard denies the first two).
 - Do not edit a workflow file (`.gitea/workflows/` or `.github/workflows/`) to make a failing gate
   pass — fix the source.
 - Gitea lane: tag-triggered runs after `release_metadata` are expected; verify `deploy_prod` is

package/bundles/antigravity-plugin/skills/ship-merge/SKILL.md

@@ -48,6 +48,12 @@ State plainly, then wait for confirmation:
 This is the one irreversible, outward-facing step. Approval here **does not carry over** to any
 future run — ask every time, even for the same PR five minutes later.
 
+## Programme triggers
+
+Small work that does not meet a trigger skips its block.
+
+**Trigger: Always, when the repo deploys on push.** No merge while a push run on the default branch is in progress. Check `gh run list --branch <default> --event push --status in_progress`; if a run is listed, wait for it. `python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_merge_chain.py"` does this check.
+
 ## Step 3 — Merge
 
 Re-read PR head and merge state before merging (GitHub lane):
@@ -65,8 +71,9 @@ an explicit argument wins. Options: **squash**, **merge-commit**, **rebase-merge
 if detection is inconclusive, say so and use merge-commit (never silently squash someone's history).
 
 Then merge:
-- GitHub: `gh pr merge <pr>` with `--squash` (squash), `--merge` (merge-commit) or `--rebase` (rebase-merge).
-- Gitea: call the Gitea PR merge API with the chosen strategy.
+- GitHub: `gh pr merge <pr> --match-head-commit <head-sha>` (the full SHA) with `--squash` (squash), `--merge`
+  (merge-commit) or `--rebase` (rebase-merge). GitHub refuses the merge if the head moved.
+- Gitea: call the Gitea PR merge API with the chosen strategy and `head_commit_id: <head-sha>`.
 
 Record the merge SHA.
 
@@ -93,8 +100,11 @@ attempt a silent re-deploy — and **skip cleanup** (Step 6).
 ## Step 6 — Branch cleanup — only after a confirmed-green deploy
 
 **Only after** Step 5 is green:
-- Delete the **remote** feature branch; delete the **local** feature branch.
-- Switch to the default branch and fast-forward it to the merge commit.
+- Run `git status --short`. If it shows changes you did not make, do not switch, stash, reset or commit:
+  leave them, report them, and stop cleanup here.
+- `git fetch --prune`, then switch to the default branch and fast-forward it to the merge commit.
+- Delete the **remote** feature branch; delete the **local** feature branch (for a squash merge, compare
+  the branch tree with the merged tree first, not ancestry).
 - Drop the `backup/<branch>-preship` ref `/ship-pr` created.
 
 If deploy validation failed: **skip cleanup** entirely and say so — never delete a branch whose
@@ -113,7 +123,7 @@ Cleanup:       remote branch ✗ deleted / local ✗ deleted / backup ref droppe
 ## Rules
 - Never merge without: green required checks **and** the explicit human deploy-confirm.
 - Never delete a branch before its deploy is validated green.
-- Never `git add -A` without reviewing `git status`; never edit a workflow file to make a gate pass.
+- Never `git add -A`, `git add .` or `git add <dir>`, even after reading `git status`: stage named files only (the guard denies the first two). Never edit a workflow file to make a gate pass.
 - Local-only lane: no PR, no merge — refuse and point at `/ship`.
 
 ## Skill reference

package/bundles/antigravity-plugin/skills/ship-pr/SKILL.md

@@ -40,6 +40,37 @@ are uncommitted.)
 - Fix failures first. **Never open a PR over red preflight** — a PR that arrives red wastes the
   reviewer it exists to serve.
 
+## Step 2b — Tidy check on this PR's files (before the PR exists)
+
+Finished plans close in the PR that finishes them (`/caddis:implement` step 4b). Check that this
+PR did, on the files it touches only:
+
+```bash
+python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_tidy.py" --repo-root . --check --commit-range origin/<default>..HEAD
+```
+
+(`<default>` is the default branch from Step 0. Falls back to `scripts/caddis_tidy.py` from a
+source checkout; skip this step if the script is missing or the repo has no `.caddis/`.)
+
+- Exit **0** — carry on.
+- Exit **1** — **stop; do not open the PR.** Show each `CHECK VIOLATION` or `ERROR` line.
+  - `plan <path>: tracker done, status <s>` — run
+    `caddis_tidy.py --repo-root . --apply --only <path>`, `git add` the moved plan by name,
+    commit, and run this step again.
+  - `plan <path>: tracker done, but done/<name> already exists (rename one of them)` — `--apply`
+    cannot fix this; it changes nothing while the name is taken. Rename the plan or the old
+    `done/` copy with `git mv`, commit, and run this step again.
+  - Any other violation — fix that file's frontmatter, commit, and run this step again.
+  - `ERROR: uncommitted changes in files this range touched: <paths>; commit them first` — the
+    check reads the committed files the PR ships, so commit (or discard) those changes first.
+  - `ERROR: cannot read commit range <range>: <git error>`, or `commit range has an empty side`
+    — the range is wrong, not the files. Fix the range: name both sides, and use the remote and
+    default branch this repo really has (for example `upstream/master..HEAD`; check with
+    `git remote` and Step 0). No violation list is printed with an `ERROR`, so nothing was
+    checked yet.
+- Only files this branch changed are checked, so problems already on the default branch never
+  block an unrelated PR. The owner's fleet report (`caddis-fleet-tidy.ps1`) lists those.
+
 ## Step 3 — Scope-guard pre-check (before the PR exists)
 
 - If the repo has a **named scope-guard workflow** (e.g. a Gitea `pr-scope-guard` that blocks PRs
@@ -53,20 +84,8 @@ are uncommitted.)
 ## Step 3b — Cross-review trigger (before anything is pushed)
 
 <!-- shared:cross-review-trigger — keep byte-identical across commands; a test pins it -->
-**Run the trigger, do not eyeball the diff:**
-
-```bash
-python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_gate.py" review-trigger --range <base>...HEAD
-```
-
-Exit **0** — say nothing, carry on. Exit **2** — it prints which rule fired and on which files.
-Run `/caddis:cross-review`, show the findings, and let the user decide. It **never blocks**: this
-picks when to ask for a second opinion, it is not a verdict, and a review gate that blocks a ship
-gets switched off inside a week.
-
-It fires on SQL and repositories, `services/`, caches and refresh jobs, auth and RBAC, or a diff
-over 400 changed lines. No judgement in any of those — deliberately, because judgement is exactly
-what failed.
+Run `python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_gate.py" review-tier --range <base>...HEAD` and review by its tier (rule 3).
+`<base>` is `origin/<default branch>` (on the default branch itself, the commit before this change). Tier 0 or 1-small: no model review. Tier 1: one `/caddis:cross-review`. Tier 2: two reviewers of two other vendors in one round. No `TIER:` line means tier 2.
 <!-- /shared:cross-review-trigger -->
 
 > **Why this is mechanical and not "consider a review here".** a fleet app shipped four
@@ -107,7 +126,8 @@ scope-guard check when present:
   ```bash
   python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_lanes.py" ci-watch --pr <pr>
   ```
-  Exit codes: **0** pass → continue; **1** fail → read `FAILING:` and the gh output, classify, apply the minimum source fix, then re-push (through Step 4's safety if history must change); **3** could not tell → stop and report, do not merge.
+  `RESULT: pass` means every check of the PR's head commit is complete and green; `HEAD:` names that commit.
+  Exit codes: **0** pass → continue; **1** fail → read `FAILING:` and the gh output, classify, apply the minimum source fix, then re-push (through Step 4's safety if history must change); **3** could not tell (also: a check still unfinished, or the head's checks unreadable) → run `ci-watch` again; if it stays 3, stop and report, do not merge.
   Fallback when `caddis_lanes.py` is not available: watch in-session with `gh pr checks <pr> --watch` / `gh run watch` (`gh-cli` skill).
 On a red check, classify the failure and apply the minimum **source** fix, then re-push (through
 Step 4's safety if history must change).
@@ -126,7 +146,7 @@ human-confirmed door.
 
 ## Rules
 - **Never merges, never deploys** — no merge action exists in this command, by design.
-- Never `git add -A` without reviewing `git status` first.
+- Never `git add -A`, `git add .` or `git add <dir>`, even after reading `git status`: stage named files only (the guard denies the first two).
 - Never force-push without a `backup/*-preship` recovery ref; force pushes are `--force-with-lease` only.
 - Never edit a workflow file (`.gitea/workflows/`, `.github/workflows/`) to make a gate pass — fix the source.
 - Local-only lane: refuse + point at `/ship`. On the default branch: stop + point at `/ship`.

package/bundles/antigravity-plugin/skills/spawn-session/SKILL.md

@@ -9,9 +9,7 @@ Use this when a session is long enough that its own recall has become the risk.
 `/caddis:handoff` for that case: `/handoff` writes down what you remember, and **what you remember
 is the failure mode.**
 
-**Sibling, not duplicate, of `/caddis:spawn-hub`.** `spawn-hub` hands over a validation ROLE;
-this hands over the WORK. Both run on `scripts/caddis_spawn.py`, so a fix to the machinery lands in
-both.
+It runs on `scripts/caddis_spawn.py`.
 
 ## The failure this exists to catch
 
@@ -333,9 +331,9 @@ Use a read-only agent that can open files and run commands (`caddis:anchor` fits
 verdict, record it, and fix any handover document it proves wrong. On a runtime with no subagents,
 grade in a fresh session and say so. Never grade from a nearly-full context.
 
-**ALIVE until `handshake close`; not WRITING, with two named exceptions.** `/caddis:spawn-hub`
-carries a single-writer rule, because two sessions committed to one repo concurrently and one's work
-landed inside the other's commit. Here it has exactly two exceptions: your own handover artefacts,
+**ALIVE until `handshake close`; not WRITING, with two named exceptions.** The single-writer rule
+exists because two sessions committed to one repo concurrently and one's work landed inside the
+other's commit. It has exactly two exceptions: your own handover artefacts,
 and a document a verdict proves wrong. **Commit and push each one before you reply.** Never hold an
 uncommitted change while the child is live, because a checkout on its side can take it with no copy
 anywhere.
@@ -404,8 +402,6 @@ immediately.
 **REJECT exists because a confidently wrong successor is more dangerous than a confused one.** In
 this project the failure has never been *"I don't know"* — it has been a fluent wrong answer.
 
-The vocabulary matches `/caddis:validate-phase` on purpose: same discipline, different object.
-
 **Two REJECTs on one spawn means the HANDOVER is at fault, not the successor. Regenerate it** rather
 than coaching the child through it.
 

package/bundles/antigravity-plugin/warm_start_agy.py

@@ -76,9 +76,7 @@ def freshness_lines(root: str) -> list[str]:
 
 def is_headless() -> bool:
     """True when no human is watching — a run given its task explicitly needs no resume pointer."""
-    if str(os.environ.get("CADDIS_HEADLESS", "")).strip().lower() in _TRUTHY:
-        return True
-    return bool(os.environ.get("DOCKET_PLAN") or os.environ.get("DOCKET_BRANCH"))
+    return str(os.environ.get("CADDIS_HEADLESS", "")).strip().lower() in _TRUTHY
 
 
 def _first_existing(paths: list[str]) -> str:

package/bundles/antigravity-plugin-extras/plugin.json

@@ -1,5 +1,5 @@
 {
   "name": "caddis-extras",
-  "version": "1.3.42",
+  "version": "1.3.43",
   "description": "caddis-extras — the long-tail skills for the Antigravity (agy) caddis plugin; install alongside caddis for the full set."
 }

package/bundles/antigravity-plugin-extras/skills/_registry.md

@@ -53,6 +53,7 @@
 | Changelog Generator | `changelog-generator/` | Create user-facing changelogs and release notes from git commit history, grouping changes and rewriting technical commits in plain language. |
 | Deploy Local | `deploy-local/` | Local deployment loop for Gitea-hosted projects: commit on dev, push, watch the golden CI/build/deploy workflow, check prod, and fix lint/test/pipeline failures until the deploy is healthy. |
 | Monorepo | `monorepo/` | Turborepo and pnpm workspaces: turbo.json tasks, remote caching, shared packages, affected-only CI, apps/ vs packages/ layout, and pitfalls like circular deps, version drift and hoisting. |
+| Runner Move | `runner-move/` | >- |
 | Safe Cleanup | `safe-cleanup/` | Use BEFORE deleting a directory tree, scratchpad or git worktree, or "tidying up" generated folders, especially on Windows, where deleting through a junction or symlink destroys its target; and to verify a venv or node_modules survived. |
 | Update Readme | `update-readme/` | Detect feature commits and update README sections (Features, API, Usage) to match, then stage only the README. Use when features, routes or components were added. |
 
@@ -61,7 +62,6 @@
 | Skill | Path | When to Use |
 |-------|------|-------------|
 | Architecture Document | `architecture-document/` | Generate enterprise HLD and LLD documents from the living Architecture.md, as DOCX (editable) or PPTX (executive summary). |
-| Data Lineage | `data-lineage/` | Generates End-to-End Data Lineage and Telemetry Specifications linking UI pages, API routes, database datasets, and ETL/SP producers for watch-sight observability. |
 | Doc Coauthoring | `doc-coauthoring/` | Structured workflow for co-authoring documentation: transfer context, refine by iteration, test it on readers. Use when the user is writing docs, proposals, technical specs or decision docs. |
 | Documentation Analyzer | `documentation-analyzer/` | Analyze a codebase, explain what the code does, and generate documentation such as README files. |
 | Hld | `hld/` | Generate High-Level Design (HLD) Markdown and convert it to Confluence Storage Format XHTML with PlantUML diagrams and legends. |
@@ -135,7 +135,6 @@
 | File Organizer | `file-organizer/` | Organize files and folders by context: find duplicates, suggest better structures, automate cleanup. |
 | Game Changing Features | `game-changing-features/` | Find 10x product opportunities and high-leverage features. Use when the user mentions '10x', says 'what would make this 10x better', 'product strategy', or 'what should we build next'. |
 | Golden Nuggets | `golden-nuggets/` | Extract durable tribal knowledge ('gold nuggets') from a codebase or changed files and route each to an instruction file, runbook, hub or CI review inbox. Use after a feature, fix, sprint, incident or release. |
-| Golden Plan | `golden-plan/` | Use when the user asks for a comprehensive multi-phase plan (full-stack, UI + backend), says 'create a plan for building X', 'plan this project', 'I need a detailed plan', 'build plan', 'implementation plan', or attaches a mockup and asks how to build it. Produces an evidence-gated plan with self-contained phase prompts and validation gates. |
 | Intent Writer | `intent-writer/` | Structure freetext ideas, backlog items, or vague requirements into a formal Intent Document that preserves user intent across the entire agent pipeline chain. |
 | Receiving Code Review | `receiving-code-review/` | Use when receiving code review feedback, before implementing it, especially if it seems unclear or wrong: verify with technical rigor, no performative agreement or blind implementation. |
 | Setup Project Ai | `setup-project-ai/` | Install or refresh the agent-agnostic harness in a project: AGENTS.md rules with CLAUDE.md shims, subagents, commands and settings. Use when setting up AI resources on a project, or the user says 'set up the harness', 'setup-project-ai', 'generate CLAUDE.md', 'onboard this project to Claude Code / Codex / agy', or runs /setup-project-ai. |

package/bundles/antigravity-plugin-extras/skills/agent-orchestration/SKILL.md

@@ -7,7 +7,7 @@ description: "Blueprint for orchestrating the agent pipeline from spec to planni
 
 ## Purpose
 
-Codify the **Advisory Hub** methodology: a repeatable workflow where the human operator drives a multi-agent pipeline from raw specification to production-ready code. This skill captures the exact sequence, decision points, and artefacts that emerged from real feature delivery so any future session can follow the same playbook.
+Codify the **operator-led orchestration** methodology: a repeatable workflow where the human operator drives a multi-agent pipeline from raw specification to production-ready code. This skill captures the exact sequence, decision points, and artefacts that emerged from real feature delivery so any future session can follow the same playbook.
 
 ---
 
@@ -22,7 +22,7 @@ Codify the **Advisory Hub** methodology: a repeatable workflow where the human o
 
 ## Core Concepts
 
-### Advisory Hub Mode
+### Operator-Led Mode
 
 The operator (human) acts as **orchestrator**. Agents act as an **advisory board** — each specialised, none acting unilaterally. The operator:
 
@@ -33,7 +33,7 @@ The operator (human) acts as **orchestrator**. Agents act as an **advisory board
 
 ```
 ┌─────────────────────────────────────────────────────────┐
-│                   ADVISORY HUB                          │
+│                 OPERATOR-LED PIPELINE                   │
 │                                                         │
 │   Operator ◄──► PRD Agent        (requirements)        │
 │   Operator ◄──► Architect Agent  (design decisions)     │
@@ -226,7 +226,7 @@ Score each identified risk:
 
 ### Stage 3: Mid-Flight Absorption (When Needed)
 
-**Agent:** Planner agent (or operator + Advisory Hub)
+**Agent:** Planner agent (or the operator)
 
 **Purpose:** Handle changes that arrive after the plan is created but before or during implementation. This is inevitable in real projects.
 
@@ -548,7 +548,7 @@ Full command/billing decision table: `docs/guide/multi-model-workflow.md`.
 ```
 Operator opens new chat:
 
-"I have a feature spec in <file>. Let's use the Advisory Hub approach:
+"I have a feature spec in <file>. Let's use the operator-led pipeline:
 1. Read the spec
 2. Triage quick wins (H1–H3)
 3. Implement quick wins and commit

package/bundles/antigravity-plugin-extras/skills/cross-review/SKILL.md

@@ -88,7 +88,7 @@ smaller chunks; don't just raise `--max-diff-chars` without knowing the endpoint
 - **0 — REVIEW: CLEAN** → no blocking issues. Proceed.
 - **1 — REVIEW: BLOCKING** → the reviewer found blocking issues. **Read the printed findings, then FIX
   each blocking item** (or, if you judge one a false positive, state explicitly why it's safe to ignore).
-  Re-run once. A second BLOCKING goes to the owner (rule 3).
+  Fix it, then re-review only the fix diff. After 3 rounds, ask the owner (rule 3).
 - **4 — error** → no verdict parsed, a git failure, or an endpoint/parse failure. Read stderr; do not
   treat this as CLEAN — investigate.
 - **3 — misconfigured** → `REVIEW_API_KEY` is unset. Set it (see Prerequisites) and re-run.
@@ -96,7 +96,10 @@ smaller chunks; don't just raise `--max-diff-chars` without knowing the endpoint
 ## Three rules: one attempt, one review
 1. **Think before you send.** Before a task goes to any coder, write its edge cases and check the facts it depends on (one query or one file read).
 2. **Run it before review.** The coder runs the same checks as CI (name the exact commands in the task). Then run the change once on real data.
-3. **Review once.** Use whatever reviewer is available. Stop at the first CLEAN. After two blocking reviews, ask the owner.
+3. **Review by tier.** Run `python "${CLAUDE_PLUGIN_ROOT}/scripts/caddis_gate.py" review-tier --range <base>...HEAD` (add `--plan <plan> --phase <N>` inside a plan; no `TIER:` line means tier 2).
+   Tier 0: gates only. Tier 1-small: your self-check only. Tier 1: one review by another vendor; stop at
+   the first CLEAN. Tier 2: two reviewers of two other vendors, in one round. Fix blocking findings only;
+   park the rest. Re-review only the fix diff, and only when the fix changed logic. After 3 rounds, ask the owner.
 
 A diff over the batch ceiling is split into batches. Each batch prompt lists every file in the
 change, so a batch does not report the others as missing.