@cleocode/skills 2026.9.19 → 2026.9.21

package/skills/ct-orchestrator/SKILL.md

@@ -2,8 +2,10 @@
 name: ct-orchestrator
 description: "Pipeline-aware orchestration skill for managing complex workflows through subagent delegation. Use when the user asks to \"orchestrate\", \"orchestrator mode\", \"run as orchestrator\", \"delegate to subagents\", \"coordinate agents\", \"spawn subagents\", \"multi-agent workflow\", \"context-protected workflow\", \"agent farm\", \"HITL orchestration\", \"pipeline management\", or needs to manage complex workflows by delegating work to subagents while protecting the main context window. Enforces ORC-001 through ORC-009 constraints. Provider-neutral — works with any AI agent runtime."
 metadata:
-  version: 2.8.0
-  lastReviewed: 2026-09-19
+  version: 4.0.0
+  tier: core
+  install: harness
+  lastReviewed: 2026-09-28
   stability: stable
 ---
 
@@ -229,6 +231,23 @@ On an idle host every ready task is `admitted` and behaviour is unchanged.
 ### 4. Report to Human
 
 After each wave or on request: what completed, blockers needing HITL, next actions.
+Report only when work is done or a decision is needed; no routine status chatter.
+
+## Asking the Owner (HITL ask tool)
+
+Whenever the owner must answer, decide, approve or choose ANYTHING, ask through
+the ask tool (`AskUserQuestion` in Claude Code, or the provider equivalent from
+CAAMP's `PROVIDER_ASK_TOOLS`) with concrete, detailed, selectable options. Never
+ask inside a response, and never bury a question or decision in prose. Each option
+states what happens and its trade-offs, with the recommended option first.
+
+- **Subagent relay.** Subagents never ask the human (most harnesses deny them the
+  ask tool). A subagent that needs a decision returns `blocked` with
+  `{question, options[{label, description}], recommended}` in its manifest entry;
+  you, the orchestrator, put that question to the owner via your ask tool, then
+  re-spawn or continue with the answer.
+- **Fallback.** When your harness has no ask tool, emit one LAFS `hitl.request`
+  envelope `{question, options[{label, description}], recommended}` and stop.
 
 ## Handoff Chain Protocol
 

package/skills/ct-provenance-keeper/SKILL.md

@@ -1,6 +1,11 @@
 ---
 name: ct-provenance-keeper
 description: "Generates in-toto v1 attestations, SLSA-level provenance records, SBOMs (CycloneDX or SPDX), and sigstore/cosign signatures for published artifacts. Invoked by ct-artifact-publisher as a delegation for signing and attestation. Records the full commit, then build, then artifact, then attestation, then registry chain in .cleo/releases.json and rejects publishes whose digest does not match the attestation. Triggers when artifact-publish reaches the provenance step or when a release needs SLSA L2+ attestation."
+metadata:
+  version: 1.0.0
+  tier: on-demand
+  install: harness
+  stability: stable
 ---
 
 # Provenance Keeper

package/skills/ct-release-orchestrator/SKILL.md

@@ -9,6 +9,8 @@ adrRefs:
   - ADR-065
 metadata:
   version: 3.0.0
+  tier: on-demand
+  install: harness
   lastReviewed: 2026-05-22
   stability: stable
 ---

package/skills/ct-research-agent/SKILL.md

@@ -2,7 +2,6 @@
 name: ct-research-agent
 description: Multi-source research and investigation combining web search, documentation lookup via Context7, and codebase analysis. Synthesizes findings into actionable recommendations with proper citation and task traceability. Use when conducting research, investigating best practices, gathering technical information, or analyzing existing implementations. Triggers on research tasks, investigation needs, or information discovery requests.
 version: 2.0.0
-tier: 2
 core: false
 category: recommended
 protocol: research
@@ -20,6 +19,11 @@ compatibility:
   - windsurf
   - gemini-cli
 license: MIT
+metadata:
+  version: 2.0.0
+  tier: on-demand
+  install: harness
+  stability: stable
 ---
 
 # Research Context Injection

package/skills/ct-skill-creator/SKILL.md

@@ -2,6 +2,11 @@
 name: ct-skill-creator
 description: Guide for creating effective skills. This skill should be used when users want to create a new skill (or update an existing skill) that extends Claude's capabilities with specialized knowledge, workflows, or tool integrations.
 license: MIT
+metadata:
+  version: 1.0.0
+  tier: internal
+  install: internal
+  stability: deprecated
 ---
 
 # Skill Creator

package/skills/ct-skill-validator/SKILL.md

@@ -3,6 +3,11 @@ name: ct-skill-validator
 description: Validates an existing skill folder against the full CLEO standard and ecosystem. Use when auditing skills for structural compliance, verifying a skill fits into the CLEO ecosystem and constitution, running quality A/B evals, or preparing a skill for distribution. Runs a 3-phase validation loop — structural, ecosystem fit, and quality eval — then presents all findings as an HTML report opened in the user's browser. Iterates until all required phases pass.
 disable-model-invocation: true
 allowed-tools: Bash(python *)
+metadata:
+  version: 1.0.0
+  tier: internal
+  install: internal
+  stability: deprecated
 ---
 
 # CLEO Skill Validator

package/skills/ct-spec-writer/SKILL.md

@@ -2,7 +2,6 @@
 name: ct-spec-writer
 description: Technical specification writing using RFC 2119 language for clear, unambiguous requirements. Creates protocol specifications, technical requirements, API specifications, and architecture documents with testable requirements and compliance criteria. Use when writing specifications, defining protocols, documenting requirements, or creating API contracts. Triggers on specification tasks, protocol definition needs, or requirement documentation.
 version: 2.1.0
-tier: 2
 core: false
 category: recommended
 protocol: specification
@@ -20,6 +19,11 @@ compatibility:
   - windsurf
   - gemini-cli
 license: MIT
+metadata:
+  version: 2.1.0
+  tier: on-demand
+  install: harness
+  stability: stable
 ---
 
 # Specification Writer Context Injection

package/skills/ct-stickynote/SKILL.md

@@ -3,7 +3,6 @@ name: ct-stickynote
 description: Quick ephemeral sticky notes for project-wide capture before formal classification
 version: 1.0.0
 category: productivity
-tier: 0
 protocol: null
 tags: [sticky, notes, capture, quick, ephemeral]
 triggers: [note, sticky, jot, capture]
@@ -11,6 +10,11 @@ compatibility: [claude-code, gemini-cli, codex-cli, opencode]
 dependencies: []
 sharedResources: []
 license: MIT
+metadata:
+  version: 1.0.0
+  tier: internal
+  install: internal
+  stability: deprecated
 ---
 
 # Sticky Notes Skill

package/skills/ct-task-executor/SKILL.md

@@ -1,12 +1,7 @@
 ---
 name: ct-task-executor
 description: General implementation task execution for completing assigned CLEO tasks by following instructions and producing concrete deliverables. Handles coding, configuration, documentation work with quality verification against acceptance criteria and progress reporting. Use when executing implementation tasks, completing assigned work, or producing task deliverables. Triggers on implementation tasks, general execution needs, or task completion work.
-version: 2.2.0
-metadata:
-  version: 2.2.0
-  lastReviewed: 2026-09-19
-  stability: stable
-tier: 2
+version: 2.7.0
 core: true
 category: core
 protocol: implementation
@@ -26,7 +21,9 @@ compatibility:
 license: MIT
 metadata:
   version: 2.7.0
-  lastReviewed: 2026-09-18
+  tier: core
+  install: harness
+  lastReviewed: 2026-09-19
   stability: stable
 ---
 

package/skills/ct-task-executor/references/common-failures.md

@@ -43,8 +43,8 @@ not in the worktree's branch.
 (persistent shell state was not reset between tool calls), or
 deliberately followed an absolute path from a prior session's notes.
 
-**Fix.** The spawn prompt's `FIRST ACTION: cd <path>` MUST be the first
-command. All subsequent paths SHOULD be absolute within the worktree.
+**Fix.** The spawn prompt's FIRST ACTION guard, `cd '<path>' || exit 1`
+(single-quoted, so it survives spaces), MUST start every Bash call. All subsequent paths SHOULD be absolute within the worktree.
 If unsure, prefix with `git rev-parse --show-toplevel` first.
 
 ## Cherry-Pick Instead of Merge

package/skills/ct-task-executor/references/evidence-and-gates.md

@@ -140,6 +140,7 @@ cleo memory observe "..." --title "..."
 | — | `E_EVIDENCE_INSUFFICIENT` | Gate atom kind doesn't match required | See gate-atom table above |
 | — | `E_EVIDENCE_TESTS_FAILED` | `tool:test` exit non-zero | Fix failing tests first |
 | — | `E_EVIDENCE_TOOL_FAILED` | Lint/typecheck/etc exit non-zero | Fix source and re-run |
+| — | `E_EVIDENCE_TOOL_VACUOUS` | Tool exited 0 but provably checked nothing (`tsc` without `-b` on a references-only tsconfig) | Add a covering `typecheck` script (e.g. `tsc -b`) or set `typecheck.command` in `.cleo/project-context.json` |
 | — | `E_EVIDENCE_STALE` | Files or commit changed after verify | Re-verify before complete |
 | — | `E_EVIDENCE_INVALID_DECISION` | Decision ID not found in BRAIN | Use `cleo memory decision-find` |
 | — | `E_FLAG_REMOVED` | Tried `cleo complete --force` | `--force` removed per ADR-051 |

package/skills/ct-validator/SKILL.md

@@ -2,7 +2,6 @@
 name: ct-validator
 description: Compliance validation for verifying systems, documents, or code against requirements, schemas, or standards. Performs schema validation, code compliance checks, document validation, and protocol compliance verification with detailed pass/fail reporting. Use when validating compliance, checking schemas, verifying code standards, or auditing protocol implementations. Triggers on validation tasks, compliance checks, or quality verification needs.
 version: 2.0.0
-tier: 2
 core: false
 category: recommended
 protocol: validation
@@ -20,6 +19,11 @@ compatibility:
   - windsurf
   - gemini-cli
 license: MIT
+metadata:
+  version: 2.0.0
+  tier: on-demand
+  install: harness
+  stability: stable
 ---
 
 # Validator Context Injection