@cleocode/skills 2026.10.2 → 2026.10.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cleocode/skills",
-  "version": "2026.10.2",
+  "version": "2026.10.4",
   "description": "CLEO skill definitions - bundled with CLEO monorepo",
   "main": "index.js",
   "types": "index.d.ts",

package/skills/ct-codebase-mapper/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: ct-codebase-mapper
-version: 2.1.0
+version: 2.1.1
 description: Orient in an unfamiliar or large codebase with CLEO's code-intelligence graph (cleo nexus) and project map (cleo map). Use before planning or editing unfamiliar code, for brownfield onboarding, to find what a change would break, or to map a project's structure, communities and execution flows. Triggers on "map the codebase", "understand this project", "what calls X", "what would break", "brownfield analysis", "project structure".
 protocol: null
 dependencies: []
@@ -17,13 +17,13 @@ triggers:
   - project structure
   - blast radius
 metadata:
-  version: 2.1.0
+  version: 2.1.1
   tier: on-demand
   install: harness
   covers:
     - packages/cleo/src/cli/commands/nexus.ts
     - packages/cleo/src/cli/commands/map.ts
-  lastReviewed: 2026-09-29
+  lastReviewed: 2026-10-02
   stability: stable
 ---
 
@@ -50,6 +50,12 @@ Queries auto-refresh up to 25 stale files; beyond that they warn
 rebuilds). An empty or stale index gives confident-looking but incomplete
 answers — say which you relied on.
 
+Project-scoped queries use the declared portable project id. `--project-id`
+may name that id or a recorded, unambiguous legacy alias; an alias warns
+`W_NEXUS_LEGACY_PROJECT_ID`. A foreign or colliding id is refused: run the
+query from the intended checkout. Moving a checkout retains its id and graph;
+never derive a replacement id from the new path or re-analyze solely for a move.
+
 ## 2. Survey the project
 
 ```bash

package/skills/ct-release-orchestrator/SKILL.md

@@ -7,7 +7,7 @@ adrRefs:
   - ADR-063
   - ADR-065
 metadata:
-  version: 3.0.2
+  version: 3.0.3
   tier: on-demand
   install: harness
   covers:
@@ -15,7 +15,7 @@ metadata:
     - packages/core/src/validation/protocols/protocols-markdown/release.md
     - packages/cleo/src/cli/commands/release.ts
   loomStage: release
-  lastReviewed: 2026-09-28
+  lastReviewed: 2026-10-03
   stability: stable
 ---
 
@@ -34,7 +34,7 @@ Owns the canonical 4-verb release pipeline established by SPEC-T9345 and finalis
 | Step | Verb / Workflow | Owns transition | Notes |
 |-----:|------------------|------------------|-------|
 | 1 | `cleo release plan <ver> --epic <id>` | _(none)_ → `planned` | Builds the Release Plan envelope; auto-writes `CHANGELOG.md` (T10105 closes the silent-skip gap) |
-| 2 | `cleo release open <ver>` | `planned` → `pr-opened` | Dispatches `release-prepare.yml`; the workflow cuts the branch + opens the PR |
+| 2 | `cleo release open <ver>` | `planned` → `pr-opened` | Dispatches `release-prepare.yml` with the plan's sha256 once the plan is verified on the default branch, plus the verified preflight skips; the workflow cuts the branch + opens the PR |
 | 3 | _(GHA)_ `release-prepare.yml` → PR merge | `pr-opened` → `pr-merged` | Owned by CI; verify via `cleo release pr-status <ver>` |
 | 4 | `git tag -a v<ver> -m "Release v<ver>" && git push origin v<ver>` | `pr-merged` → `tag-pushed` | Explicit tag after the release PR merges — `auto-tag-on-release-merge.yml` is retired (T10434, ADR-087); the tag push triggers `release.yml` |
 | 5 | `cleo release reconcile <ver>` | `tag-pushed` → `published` | Backfills 11 provenance tables; idempotent |
@@ -67,8 +67,11 @@ Use the explicit verbs. **Do not** invoke `cleo release ship` — it was deleted
 # 1. Plan — build the canonical Release Plan envelope.
 cleo release plan v2026.6.0 --epic T10099
 
-# 2. Open — dispatch release-prepare workflow.
-cleo release open v2026.6.0
+# 2. Open — dispatch release-prepare workflow. When the plan reached main
+#    through a release-plan PR (branch protection), open it with
+#    --no-commit-plan: the plan on main is verified (read from there if this
+#    checkout lacks it) and dispatched by its sha256 (T13050).
+cleo release open v2026.6.0 --no-commit-plan
 
 # 3. (Optional) Poll PR + CI status while the workflow runs.
 cleo release pr-status v2026.6.0
@@ -108,7 +111,7 @@ Exit codes (canonical):
 | Pattern | Problem | Solution |
 |---------|---------|----------|
 | Running `cleo release ship` | The verb was deleted in T10103 — the command will exit with `Unknown command`. | Use `cleo release plan` + `cleo release open`. | <!-- cleo-cmd: negative-example: release ship -->
-| Manually invoking `gh workflow run release-prepare.yml` | Bypasses the plan envelope; `releases.status` stays at `planned`. | Always go through `cleo release open <ver>` — it tracks state in the `releases` table. |
+| Manually invoking `gh workflow run release-prepare.yml` | Bypasses the plan envelope; `releases.status` stays at `planned`; a hand dispatch also drops the verified `skip-tests` / `verified-sha` inputs, so the whole Linux and macOS suites run again (v2026.10.3 lost ~45 min). | Always go through `cleo release open <ver>` (`--no-commit-plan` after a plan PR) — it tracks state in the `releases` table and forwards the preflight skips. |
 | Tagging before the release PR merges, or `git push --tags` | Tags an unmerged commit, or pushes every local tag. | Tag the merged release commit and push that one tag: `git push origin v<ver>`. |
 | Hand-editing `CHANGELOG.md` for the new version | Drift between the changeset directory and the changelog. | `cleo release plan` always auto-writes the section (T10105). Use `cleo changeset add` to author entries. |
 | Pasting one verb into another's workflow file | Multi-step orchestration belongs in `ship-e2e-smoke`. | Use `cleo release ship-e2e-smoke … --execute` for end-to-end validation. |

package/skills/ct-task-executor/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: ct-task-executor
 description: General implementation task execution for completing assigned CLEO tasks by following instructions and producing concrete deliverables. Handles coding, configuration, documentation work with quality verification against acceptance criteria and progress reporting. Use when executing implementation tasks, completing assigned work, or producing task deliverables. Triggers on implementation tasks, general execution needs, or task completion work.
-version: 2.7.7
+version: 2.7.8
 protocol: implementation
 adrRefs:
   - ADR-070
@@ -17,7 +17,7 @@ compatibility:
   - gemini-cli
 license: MIT
 metadata:
-  version: 2.7.7
+  version: 2.7.8
   tier: core
   install: harness
   covers:
@@ -28,7 +28,7 @@ metadata:
     - packages/core/src/validation/protocols/cant/implementation.cant
     - packages/core/src/validation/protocols/protocols-markdown/implementation.md
   loomStage: implementation
-  lastReviewed: 2026-10-01
+  lastReviewed: 2026-10-03
   stability: stable
 ---
 

package/skills/ct-task-executor/references/evidence-and-gates.md

@@ -107,6 +107,29 @@ pnpm vitest run path/to/changed.test.ts --reporter=json --outputFile=/tmp/vitest
 cleo verify T### --gate testsPassed --evidence "test-run:/tmp/vitest-out.json"
 ```
 
+The report must carry one of these counter sets (gh#1804, T13136). The first
+set whose total is a number is read:
+
+| Runner | Total | Passed | Failed | Skipped / todo |
+|---|---|---|---|---|
+| vitest `--reporter=json`, jest `--json` | `numTotalTests` | `numPassedTests` | `numFailedTests` | `numPendingTests`, `numTodoTests` |
+| a runner's summary output (bun test, tsx --test) | `total` | `passed` | `failed` | `skipped`, `todo` |
+| node --test summary | `tests` | `pass` | `fail`, `cancelled` | `skipped`, `todo` |
+
+For example, `{"total":43,"passed":42,"failed":0,"skipped":1}`. Every count
+must be a non-negative integer, and passed + failed + skipped/todo must equal
+the total. A failure under any key (`numFailedTests`, `failed`, `fail`,
+`cancelled`, `failures`, `errors`) refuses, whichever set supplied the total.
+`exit` / `exitCode` must be a number, and a non-zero one is refused, as is a
+report with no passed test. A report without a counter set, or with counts that
+are not integers or do not add up, is refused with `E_EVIDENCE_INVALID`, and
+the message names the keys or the arithmetic. A `test-run:` atom proves only
+what its file says, so never write one by hand: `tool:test` and `ci:<pr>` are
+what prove the run. Only a vitest/jest report lists the test files
+it ran (`testResults`). In a workspace, a targeted report must cover every
+affected package that has tests, so a summary report with no file list is
+refused there: record `tool:test-affected` or `tool:test` instead.
+
 ### `decision:<decision-id>`
 
 A BRAIN decision ID (e.g., `D-arch-001`) or an `AGT-*` provenance ID.

package/skills/manifest.json

@@ -302,7 +302,7 @@
     },
     {
       "name": "ct-codebase-mapper",
-      "version": "2.1.0",
+      "version": "2.1.1",
       "description": "Orient in an unfamiliar or large codebase with CLEO's code-intelligence graph (cleo nexus) and project map (cleo map). Use before planning or editing unfamiliar code, for brownfield onboarding, to find what a change would break, or to map a project's structure, communities and execution flows. Triggers on \"map the codebase\", \"understand this project\", \"what calls X\", \"what would break\", \"brownfield analysis\", \"project structure\".",
       "path": "skills/ct-codebase-mapper",
       "tier": 1,
@@ -1150,7 +1150,7 @@
     },
     {
       "name": "ct-release-orchestrator",
-      "version": "3.0.2",
+      "version": "3.0.3",
       "description": "Orchestrates the canonical 4-verb release pipeline introduced by SPEC-T9345: cleo release plan, then cleo release open, then PR + GHA tag workflow, then cleo release reconcile. The deprecated cleo release ship monolith was deleted in T10103 — do not invoke it. Use ship-e2e-smoke to validate the full pipeline end-to-end (dry-run by default). The full verb-to-state map is in docs/release/verb-matrix.md. Use when shipping a new version, validating the release pipeline end-to-end, or promoting a completed epic to released status.",
       "path": "skills/ct-release-orchestrator",
       "tier": 1,
@@ -1472,7 +1472,7 @@
     },
     {
       "name": "ct-task-executor",
-      "version": "2.7.7",
+      "version": "2.7.8",
       "description": "General implementation task execution for completing assigned CLEO tasks by following instructions and producing concrete deliverables. Handles coding, configuration, documentation work with quality verification against acceptance criteria and progress reporting. Use when executing implementation tasks, completing assigned work, or producing task deliverables. Triggers on implementation tasks, general execution needs, or task completion work.",
       "path": "skills/ct-task-executor",
       "tier": 0,