@cleocode/skills 2026.10.8 → 2026.10.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cleocode/skills",
-  "version": "2026.10.8",
+  "version": "2026.10.9",
   "description": "CLEO skill definitions - bundled with CLEO monorepo",
   "main": "index.js",
   "types": "index.d.ts",

package/skills/ct-cleo/SKILL.md

@@ -2,7 +2,7 @@
 name: ct-cleo
 description: CLEO task management protocol - session, task, and workflow guidance. Use when managing tasks, sessions, or multi-agent workflows with the CLEO CLI protocol.
 metadata:
-  version: 2.24.10
+  version: 2.24.11
   tier: core
   install: harness
   covers:
@@ -153,7 +153,7 @@ Unattributed mutations warn on stderr; `session status` / `briefing` label a gue
 | Find work | `cleo next` → `cleo focus <id>` |
 | Search tasks | `cleo find "query"` |
 | Complete task | `cleo verify T### --gate ... --evidence "..."` → `cleo complete T###` |
-| Run typed gates without recording | `cleo verify T### --run` |
+| Run typed gates (the only command that executes them; writes read the cache) | `cleo verify T### --run [--req A,B]` |
 | Save memory | `cleo memory observe "..." --title "..."` |
 | Spawn subagent | `cleo orchestrate spawn <taskId> --tier 2` |
 | Create a Saga | `cleo saga create --title "..." --acceptance "..."` |

package/skills/ct-codebase-mapper/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: ct-codebase-mapper
-version: 2.2.0
+version: 2.2.1
 description: Orient in an unfamiliar or large codebase with CLEO's code-intelligence graph (cleo nexus) and project map (cleo map). Use before planning or editing unfamiliar code, for brownfield onboarding, to find what a change would break, or to map a project's structure, communities and execution flows. Triggers on "map the codebase", "understand this project", "what calls X", "what would break", "brownfield analysis", "project structure".
 protocol: null
 dependencies: []
@@ -17,13 +17,13 @@ triggers:
   - project structure
   - blast radius
 metadata:
-  version: 2.2.0
+  version: 2.2.1
   tier: on-demand
   install: harness
   covers:
     - packages/cleo/src/cli/commands/nexus.ts
     - packages/cleo/src/cli/commands/map.ts
-  lastReviewed: 2026-10-10
+  lastReviewed: 2026-10-11
   stability: stable
 ---
 
@@ -102,6 +102,11 @@ caller, so an empty footprint alone never establishes that a change is safe.
 When a symbol name is ambiguous, pass the qualified candidate the command
 returns and confirm against the source.
 
+On a stale index, `impact` and `context` refresh it inline only when the last
+analysis recorded a cost that bounds the run; otherwise they answer from the
+stale index and say so. `--no-refresh` (or `CLEO_NEXUS_AUTO_REFRESH=false`)
+always answers from the index as it stands.
+
 ## 5. Across projects: where each one lives, and its state
 
 ```bash

package/skills/ct-dev-workflow/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: ct-dev-workflow
 description: Development workflow orchestration for task-driven development with atomic commits, conventional commit messages, and systematic release processes. Enforces task traceability, branch discipline, smart test scope selection, and GitHub Actions integration. Use when committing code, creating releases, managing branches, or following contribution protocols. Triggers on commit operations, release preparation, or workflow compliance needs.
-version: 3.1.9
+version: 3.1.16
 protocol: contribution
 dependencies: []
 sharedResources:
@@ -14,23 +14,34 @@ compatibility:
   - gemini-cli
 license: MIT
 metadata:
-  version: 3.1.9
+  version: 3.1.16
   tier: core
   install: harness
   covers:
     - .github/workflows/release-prepare.yml
+    - packages/cleo/src/cli/commands/hook.ts
     - packages/core/src/init.ts
     - packages/cleo/src/cli/commands/init.ts
-    - packages/core/src/hooks.ts
     - packages/core/src/git/hooks-install.ts
+    - packages/core/src/hooks.ts
     - packages/core/templates/git-hooks/**
     - packages/contracts/src/git-hooks.ts
-  lastReviewed: 2026-10-10
+  lastReviewed: 2026-10-11
   stability: stable
 ---
 
 # Development Workflow Context Injection
 
+Opt-in unified-hook releases use the numbered `vYYYY.MM.N-canary.N` channel
+through the normal release plan/open and OIDC workflow. The release-preparation
+workflow accepts this channel explicitly; publication stays on `canary` and does
+not advance to `latest`. Preserve registry retries and installed-package soak
+checks. Stable promotion needs the separately retained, source-bound live harness
+and hosted VidaPeps pilot evidence; missing or unavailable verification holds it.
+The stable target may follow the canary base when npm has already advanced, but
+every receipt must still bind to the exact canary and implementation digest.
+Reject backward targets and prerelease targets; use the normal stable pipeline.
+
 Before editing, inspect focus/briefing authority and coverage. Missing evidence
 means UNKNOWN impact; current static coverage does not prove every runtime caller.
 Task start, verification, completion, and handoff expose assessed coverage. Preserve
@@ -74,7 +85,7 @@ Every commit MUST be traceable to a CLEO task. This ensures:
 
 ---
 
-## Git Hook Delivery (T13349)
+## Git hook compatibility (T13349)
 
 Init, upgrade and explicit Git hook installation share the ownership-aware installer.
 Resolve the effective hook directory through Git, including `core.hooksPath` and
@@ -89,14 +100,15 @@ paths inside the checkout. Use `cleo init --git-hooks-only --allow-tracked-hooks
 reviewing the tracked destination; this opt-in still preserves foreign and
 customized hooks. Init warnings carry the exact opt-in command.
 
-The standalone pre-push template enforces task IDs from Git ref-update stdin.
-Shared project-runner integration belongs to the unified hooks feature and must
-ship with its implemented CLI verb. Verify nested checkout paths, linked
+The pre-push wrapper spools Git stdin once for task IDs and shared project checks.
+It probes CLEO_PROJECT_HOOK_V1 before invoking the implemented CLI adapter;
+missing or incompatible runners warn and allow. Verify nested checkout paths, linked
 worktrees, custom hook paths, historical release bodies and corrupt receipts
 with focused Git fixtures before changing this delivery path.
 
 ---
 
+
 ## Task Tracking Integration
 
 ### Before Any Work
@@ -485,3 +497,31 @@ cleo complete T1550
 6. **Use tags for releases** - GitHub Actions handles the rest
 7. **One logical change** per commit (atomic)
 8. **Conventional commit format** with task reference
+
+## Shared project hooks and managed Git delivery
+
+Provider delivery receives canonical SDK file reads and Git discovery through a contracts port.
+Adapters do not acquire a runtime dependency on core for these utilities.
+
+Project business rules live in tracked `.cleo/hooks.json`; generated provider entries
+are delivery outputs. Until the hooks-v1 stable promotion, a stable build is inert (T13557):
+`cleo hook sync --activate` refuses with `E_HOOKS_V1_UNRELEASED`, existing receipts report
+`unreleased` and never run (a required `--ci` check fails), and `--disable` still works; a
+`-canary.N` build or the promotion's `cleo.releasedFeatures` stamp opens the gate
+(`core/src/hooks/release-gate.ts`). Preview with `cleo hook sync --dry-run`; explicit local activation
+uses `cleo hook sync --activate` and binds definitions, handlers and dependencies to
+current hashes. Source drift requires reactivation. Agent project checks are advisory;
+Git applies project verdicts. Native harness trust remains separately unverified.
+Inspect with `cleo doctor hooks`; `--fix` never activates definitions or grants trust.
+`cleo hook sync --disable` disables execution and removes only verified managed entries.
+CI uses `cleo hook check <id> --ci --candidate <sha>` or an explicit JSON `--input` file;
+CLEO infrastructure failure is an unavailable check, never successful CI evidence.
+Launcher faults allow locally regardless of checker error policy. File inputs and
+provider records use bounded regular-file reads; FIFOs are rejected. Unsupported
+provider bindings remain unsupported in delivery summaries, including mixed bindings.
+
+Init, upgrade and inspection share the commit-msg, pre-commit and pre-push installer.
+Git determines effective hooksPath and the common directory, including linked worktrees.
+Exact known template hashes or local receipts authorize refresh; a marker alone does
+not. Customized and foreign hooks are preserved even on forced refresh and report an
+integration snippet. Rollback is guarded by the installed-content hash.

package/skills/ct-orchestrator/SKILL.md

@@ -2,13 +2,13 @@
 name: ct-orchestrator
 description: "Pipeline-aware orchestration skill for managing complex workflows through subagent delegation. Use when the user asks to \"orchestrate\", \"orchestrator mode\", \"run as orchestrator\", \"delegate to subagents\", \"coordinate agents\", \"spawn subagents\", \"multi-agent workflow\", \"context-protected workflow\", \"agent farm\", \"HITL orchestration\", \"pipeline management\", or needs to manage complex workflows by delegating work to subagents while protecting the main context window. Enforces ORC-001 through ORC-009 constraints. Provider-neutral — works with any AI agent runtime."
 metadata:
-  version: 4.0.12
+  version: 4.0.13
   tier: core
   install: harness
   covers:
     - packages/cleo/src/cli/commands/orchestrate.ts
     - packages/core/src/orchestration/spawn-prompt.ts
-  lastReviewed: 2026-10-10
+  lastReviewed: 2026-10-11
   stability: stable
 ---
 
@@ -148,6 +148,8 @@ cleo orchestrate spawn T1586 --json
 
 Returns: resolved prompt with base protocol + conditional protocol + task context + all `{{TOKEN}}` placeholders filled.
 
+The spawn provisions the worker's worktree, and its `pnpm install` is admitted through the heavy queue or deferred to the worker; the envelope's `install.status` says which. `cleo orchestrate spawn T1586 --no-install` provisions without installing, and the envelope names the command the worker runs instead (T13524).
+
 ### Step 2: Execute (Provider-Specific)
 
 **Claude Code** (Agent tool):

package/skills/ct-release-orchestrator/SKILL.md

@@ -7,7 +7,7 @@ adrRefs:
   - ADR-063
   - ADR-065
 metadata:
-  version: 3.2.1
+  version: 3.2.4
   tier: on-demand
   install: harness
   covers:
@@ -15,7 +15,7 @@ metadata:
     - packages/core/src/validation/protocols/protocols-markdown/release.md
     - packages/cleo/src/cli/commands/release.ts
   loomStage: release
-  lastReviewed: 2026-10-09
+  lastReviewed: 2026-10-11
   stability: stable
 ---
 
@@ -23,6 +23,21 @@ metadata:
 
 ## Overview
 
+Independent opt-in canaries use `--channel canary` with a numbered
+`vYYYY.MM.N-canary.N` version. The OIDC workflow publishes this version only
+to `canary`, verifies registry convergence and soaks the installed package.
+It never continues to `latest`. Stable promotion is a separate normal release;
+use `--hooks-v1-promotion` on the stable promotion plan; ordinary releases and
+hotfixes are exempt. The promotion gate runs before GitHub Release creation.
+That plan also makes `scripts/mark-hotfix-release.mjs` stamp
+`cleo.releasedFeatures: ["hooks-v1"]` into `@cleocode/core`, which opens the
+hooks-v1 runtime gate on the stable build (T13557); stable candidates without it
+prove the runtime inert. Remove `hooks-v1` from `UNRELEASED_HOOK_FEATURES` in a
+normal PR after the promotion, before the next stable release.
+The unified-hooks pilot must first supply hosted VidaPeps CI, read-only database
+verification and live harness evidence bound to the exact canary source digest.
+Source changes require fresh pilot evidence. Do not move npm tags manually.
+
 Owns the canonical 4-verb release pipeline established by SPEC-T9345 and finalised when T9540 deleted the legacy `start` / `verify` / `publish` verbs (and the 12-step `releaseShip` monolith) plus T10103 deleted the deprecated `ship` shim. The current verb surface is documented in `docs/release/verb-matrix.md` — that file is the SSoT for verb-to-state mapping. This skill is the agent-facing entry point and references the matrix instead of redefining it.
 
 ## Core Principle

package/skills/ct-task-executor/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: ct-task-executor
 description: General implementation task execution for completing assigned CLEO tasks by following instructions and producing concrete deliverables. Handles coding, configuration, documentation work with quality verification against acceptance criteria and progress reporting. Use when executing implementation tasks, completing assigned work, or producing task deliverables. Triggers on implementation tasks, general execution needs, or task completion work.
-version: 2.8.2
+version: 2.8.3
 protocol: implementation
 adrRefs:
   - ADR-070
@@ -17,7 +17,7 @@ compatibility:
   - gemini-cli
 license: MIT
 metadata:
-  version: 2.8.2
+  version: 2.8.3
   tier: core
   install: harness
   covers:
@@ -136,8 +136,10 @@ A database or service started for a test run must not outlive it. A `docker run`
 ### Post-Execution
 
 1. **Verify against criteria** - Check each acceptance criterion. `cleo verify <id> --run`
-   executes the typed gates; `--run --req REQ-A,REQ-B` runs only those gates and leaves
-   the other gates' cached passes as they are. A typed gate whose command is wrong (an
+   is the only command that executes the typed gates; evidence writes, `cleo done` and
+   `cleo complete` read the cached passes and execute nothing (pass `--run-typed` to opt
+   in). `--run --req REQ-A,REQ-B` runs only those gates and leaves the other gates'
+   cached passes as they are. A typed gate whose command is wrong (an
    absolute path into a removed worktree, say) is fixed in place with
    `cleo req replace <id> <REQ-ID> --gate '<json>'`. Prefer a repo-relative command and
    `cwd`; a locked stage also needs `--reason`. Then verify that gate again.

package/skills/manifest.json

@@ -226,7 +226,7 @@
     },
     {
       "name": "ct-cleo",
-      "version": "2.24.10",
+      "version": "2.24.11",
       "description": "CLEO task management protocol - session, task, and workflow guidance. Use when managing tasks, sessions, or multi-agent workflows with the CLEO CLI protocol.",
       "path": "skills/ct-cleo",
       "tier": 0,
@@ -302,7 +302,7 @@
     },
     {
       "name": "ct-codebase-mapper",
-      "version": "2.2.0",
+      "version": "2.2.1",
       "description": "Orient in an unfamiliar or large codebase with CLEO's code-intelligence graph (cleo nexus) and project map (cleo map). Use before planning or editing unfamiliar code, for brownfield onboarding, to find what a change would break, or to map a project's structure, communities and execution flows. Triggers on \"map the codebase\", \"understand this project\", \"what calls X\", \"what would break\", \"brownfield analysis\", \"project structure\".",
       "path": "skills/ct-codebase-mapper",
       "tier": 1,
@@ -566,7 +566,7 @@
     },
     {
       "name": "ct-dev-workflow",
-      "version": "3.1.9",
+      "version": "3.1.16",
       "description": "Development workflow orchestration for task-driven development with atomic commits, conventional commit messages, and systematic release processes. Enforces task traceability, branch discipline, smart test scope selection, and GitHub Actions integration. Use when committing code, creating releases, managing branches, or following contribution protocols. Triggers on commit operations, release preparation, or workflow compliance needs.",
       "path": "skills/ct-dev-workflow",
       "tier": 0,
@@ -1001,7 +1001,7 @@
     },
     {
       "name": "ct-orchestrator",
-      "version": "4.0.12",
+      "version": "4.0.13",
       "description": "Pipeline-aware orchestration skill for managing complex workflows through subagent delegation. Use when the user asks to \\\"orchestrate\\\", \\\"orchestrator mode\\\", \\\"run as orchestrator\\\", \\\"delegate to subagents\\\", \\\"coordinate agents\\\", \\\"spawn subagents\\\", \\\"multi-agent workflow\\\", \\\"context-protected workflow\\\", \\\"agent farm\\\", \\\"HITL orchestration\\\", \\\"pipeline management\\\", or needs to manage complex workflows by delegating work to subagents while protecting the main context window. Enforces ORC-001 through ORC-009 constraints. Provider-neutral — works with any AI agent runtime.",
       "path": "skills/ct-orchestrator",
       "tier": 0,
@@ -1168,7 +1168,7 @@
     },
     {
       "name": "ct-release-orchestrator",
-      "version": "3.2.1",
+      "version": "3.2.4",
       "description": "Orchestrates the canonical 4-verb release pipeline introduced by SPEC-T9345: cleo release plan, then cleo release open, then PR + GHA tag workflow, then cleo release reconcile. The deprecated cleo release ship monolith was deleted in T10103 — do not invoke it. Use ship-e2e-smoke to validate the full pipeline end-to-end (dry-run by default). The full verb-to-state map is in docs/release/verb-matrix.md. Use when shipping a new version, validating the release pipeline end-to-end, or promoting a completed epic to released status.",
       "path": "skills/ct-release-orchestrator",
       "tier": 1,
@@ -1490,7 +1490,7 @@
     },
     {
       "name": "ct-task-executor",
-      "version": "2.8.2",
+      "version": "2.8.3",
       "description": "General implementation task execution for completing assigned CLEO tasks by following instructions and producing concrete deliverables. Handles coding, configuration, documentation work with quality verification against acceptance criteria and progress reporting. Use when executing implementation tasks, completing assigned work, or producing task deliverables. Triggers on implementation tasks, general execution needs, or task completion work.",
       "path": "skills/ct-task-executor",
       "tier": 0,