@djordje-stojanovic/sigmaskills 0.2.0

package/CHANGELOG.md

@@ -0,0 +1,77 @@
+# Changelog
+
+All notable changes to [Sigmaskills](https://github.com/Djordje-Stojanovic/Sigmaskills) are documented here.
+
+## [Unreleased]
+
+## [0.2.0] — 2026-08-20
+
+### Fixed
+
+- `npm test` lists `test/*.test.js` files in a runner script so Node.js 20 CI runs the suite without glob expansion. Registry pin hashing ignores CRLF from Windows checkout so the fixture still matches `contentSha256`.
+
+### Added
+
+- Safe Agent Host registry additions and description-only changes may auto-merge after required checks and publish a patch Release through the trusted idempotent publication primitive. Destination, ID, alias, detection, platform, membership, removal, and unknown changes still need owner review. Version calculation serializes concurrent runs against live npm and GitHub state. The generated branch is deleted only after verified merge and matching publication. Automation cannot change skills, CLI behavior, unrelated work, human branches, or major/minor Releases, and it never overwrites an existing npm version.
+- Release-candidate qualification packs the published tarball and proves install, adoption, status, update, unsafe resolution, restore, uninstall, uninstall-all, and purge on that artifact. Unknown newer state schemas fail without mutation; supported migrations keep ownership and backup references. The package allowlist, Skill Revisions, and publication preflight agree. Bundled install, status, uninstall, and restore stay offline. CI runs the suite on Windows, macOS, and Linux for Node.js 20+.
+- Guarded Agent Host registry automation fetches a pinned upstream revision as data, runs converter code only from an exact trusted default-branch SHA, and opens a tightly scoped pull request limited to `registry/agent-hosts.json`, `registry/source.json`, and the pinned upstream fixture. Semantic classification allows only validated new hosts and description-only changes; path, ID, alias, detection, platform, membership, removal, and unknown changes stay blocked. Generated pull requests record the upstream commit, full semantic diff, validation evidence, and blocked reasons. Forks, human branches, stale heads, moved default branches, failed checks, and concurrent runs cannot be auto-authorized. This automation does not auto-merge, publish npm, close unrelated issues or pull requests, or delete unrelated branches.
+- The Sigma Installer `release` command prepares one immutable publication preview from the accepted source commit and, after `--expected-commit`, `--expected-version`, and `--expected-digest`, dispatches the trusted GitHub workflow that rebuilds that commit, verifies the artifact, and publishes matching git tag, GitHub Release, and npm provenance under `latest`. `--yes` is not authority. Missing npm reservation, trusted publisher, protected `release` environment, or a conflicting version/tag/Release fails closed. Partial success is retried without overwriting versions or duplicating Releases. Ordinary merges never publish.
+- The Sigma Installer `purge` command removes all Sigma-owned active content, customizations, locks, state, journals, and backups in one explicit Project or Global scope: it prints an exact ownership plan, requires the typed phrase `purge SigmaSkills` (or `--confirm-purge` with that phrase), and does not treat `--yes`, CI, non-TTY, or JSON as authority. Purge never infers ownership from folder names. Unowned occupants stop the command. Durable journaling and reversible quarantine keep the ownership manifest until owned trees are moved; interrupted cleanup leaves recoverable quarantined state.
+- The Sigma Installer `uninstall --all` command composes Uninstall Review across every recorded Sigma skill in one explicit Project or Global scope: there is no review-skipping fast path; the aggregate plan lists every skill, owned destination, canonical dependency, state change, and retained backup; keep choices leave shared state intact; changed skills default to backup so snapshots stay restorable; project and global scopes stay isolated; cancellation or failure writes a durable recovery journal and restores the failed skill; human, dry-run, and JSON results report removed, retained, skipped, and failed skills.
+- The Sigma Installer `uninstall` command runs Uninstall Review per selected skill: clean skills offer remove or keep; changed, customized, or malformed skills offer backup-and-remove, keep, export, or permanent-delete-current. The preview lists every path, method, scope, and remaining canonical dependency. Execution revalidates leaves, deletes a link itself never its target, keeps canonical content while dependents remain, leaves older backups on permanent delete, and writes state only after filesystem commit. Missing, stale, unowned, divergent, and wrong-target cases stop without partial ownership.
+- The Sigma Installer `restore` command returns the latest retained backup for a skill: the preview names Release, Skill Revision, creation date, verified size, scope, canonical target, and affected links or copies; content and metadata are integrity-checked and staged before any live write; a successful restore makes the displaced tree the new one-step backup; identical content is a no-op; missing, truncated, tampered, schema-incompatible, insufficient-space, stale-ownership, occupied-unowned, and failed Windows fallback cases write nothing.
+- The Sigma Installer `update` command diagnoses missing, duplicate, reversed, nested, and malformed customization markers, blocks automatic update for that skill, shows exact proposed repair bytes when a unique mechanical repair exists, and requires `--malformed-markers skip|repair|replace`. Repair never infers marker boundaries; skip leaves the skill while others continue; replace backs up then clean-installs. Combined outside drift keeps all content until both resolutions are explicit, and failure paths write nothing partial.
+- The Sigma Installer `update` command classifies outside-customization edits, shows local-only and concurrent effects, and lets a user skip, export, or approve a whole-skill replace with an integrity-checked private backup. Skip leaves that skill unchanged; export uses a planned path, refuses collisions, and removes partial output; a prior backup is kept until the new tree and metadata commit, and cleanup failure may retain two backups with recorded debt.
+- The Sigma Installer `update` command replaces selected whole skills with the Release bundled in the running CLI: it groups changed and unchanged skills, shows changelog and whole-skill diffs, preserves Skill Customization bytes exactly, updates the canonical copy and its links or matching copies together, and stops without mutation on unknown state schemas, missing bundled revisions, or unsafe drift.
+- The Sigma Installer `status` command reports managed Project and Global Installation state and drift without writing files or contacting the network: live hashes and link checks classify clean copies, valid Skill Customization, outside edits, missing or extra resources, malformed markers, missing destinations, stale state, broken or wrong-target links, and copy disagreement.
+- The Sigma Installer hardens Emberforge for real terminals: the accepted warm LAPI palette stays, layouts reflow below 76 columns, `?` opens keyboard help, reduced-motion/`NO_COLOR`/CI/JSON/non-TTY modes drop animation, truecolor through ASCII fallbacks keep safety copy, and the cursor restores after success, failure, interrupt, EOF, and exceptions.
+- The Sigma Installer protects Global Installation with two confirmations, sandboxed user-home paths, schema-versioned global state, and the same adoption rules as Project Installation: `--global` plus `--yes` are required to write; CI, TTY, JSON, and Agent Host detection never imply that authority.
+- The Sigma Installer migrates changed, duplicate, older, pre-marker, and unverified Sigma-looking trees with explicit replace, skip, or export choices: known legacy provenance requires a bundled baseline, a complete private backup is committed before replace, valid customization is preserved, and malformed markers are not guessed.
+- The Sigma Installer adopts exact current official copies and valid links in place: valid Sigma state, then exact bundled Skill Revision, then resolved link target. Generic `skills-lock.json` entries never imply Sigma ownership.
+- The Sigma Installer recommended link method: Windows directory junctions and macOS/Linux symbolic links to the canonical `.agents/skills` copy, with an explicit copy alternative, informed copy fallback, and ownership records for canonical dependencies.
+- The Sigma Installer Project Installation destination picker: every bundled Agent Host stays searchable, only `.agents/skills` is selected by default, host-specific destinations require an explicit choice, and ownership state records each managed copy.
+- The first npm package is `@djordje-stojanovic/sigmaskills` because the unscoped name is too close to an existing package. The installed command remains `sigmaskills`.
+- The Sigma Installer's interactive Project Installation through plain `npx @djordje-stojanovic/sigmaskills`, with manifest-driven multi-skill selection, exact destination confirmation, cancellation-safe prompts, and no-color, static, and narrow-terminal modes.
+- Structural regression tests (`npm test`) and GitHub Actions CI so skill registry, README wiring, templates, and SigmaWrite soft-steer invariants cannot silently drift.
+- Root [`AGENTS.md`](AGENTS.md): mandatory work rules and clear-writing rules, project map, and the `KNOWN_SKILLS` + README + CHANGELOG update rule.
+
+
+## [0.1.0] — 2026-08-11
+
+First public release. Portable [Agent Skills](https://agentskills.io/) for Codex, Pi, Claude Code, Cursor, and compatible hosts.
+
+### Idea
+
+Ship high-rigor, installable agent skills (not apps): full-repo audits, performance investigation, parallel-agent briefing, and clear technical writing voice — each with a tight operating contract and `npx skills add` / Codex `$skill-installer` install paths.
+
+### Skills
+
+- **SigmaReview** (`sigmareview`) — One-shot full-repository engineering audit; single findings Markdown report opened as a report-only PR; no runtime code changes.
+- **SigmaPerformance** (`sigmaperformance`) — Calibrated, audit-only performance investigation; measured and mechanically proven bottlenecks; single report PR; no runtime-source edits by default.
+- **SigmaBrief** (`sigmabrief`) — Prompt factory: turns issues/work into paste-ready agent briefs; chat-only; does not implement or open product fix PRs.
+- **SigmaWrite** (`sigmawrite`) — STE-inspired clear technical English for explanations; soft steers (not hard numbered rules); pasteable system-prompt block; chat style only.
+
+### Repository
+
+- MIT license and root README with multi-host install/run/output contracts (Codex, Claude Code, Cursor, Pi, OpenCode, LAPI-style paths, and Agent Skills–compatible TUIs).
+- GitHub Issue Forms + PR template (from github-issue-kit), tailored to Agent Skills / prompts / templates work.
+- Packaged GitHub Release **v0.1.0** with source zip of all skills.
+
+### Commits since inception
+
+| Date | Commit | Summary |
+|------|--------|---------|
+| 2026-07-11 | `1867a70` | Publish SigmaReview skill |
+| 2026-07-11 | `ddca5b7` | Publish SigmaReview source files |
+| 2026-07-12 | `2343d5b` | Add SigmaPerformance skill |
+| 2026-07-29 | `71b2c09` | Add SigmaBrief prompt-factory skill |
+| 2026-07-29 | `462d291` | Merge PR #1 (`feat/sigmabrief`) |
+| 2026-08-10 | `8dcf2b4` | Add GitHub issue forms and PR template from github-issue-kit |
+| 2026-08-10 | `3ef4cd8` | Tailor GitHub issue forms and PR template to SigmaSkills |
+| 2026-08-11 | `9631834` | Add SigmaWrite skill for STE-inspired clear technical English |
+| 2026-08-11 | `5dab832` | Add CHANGELOG and mark v0.1.0 as the first Sigmaskills release |
+| 2026-08-11 | `124a666` | Polish v0.1.0 docs for multi-host install and use |
+
+[Unreleased]: https://github.com/Djordje-Stojanovic/Sigmaskills/compare/v0.2.0...HEAD
+[0.2.0]: https://github.com/Djordje-Stojanovic/Sigmaskills/releases/tag/v0.2.0
+[0.1.0]: https://github.com/Djordje-Stojanovic/Sigmaskills/releases/tag/v0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Djordje Stojanovic
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,342 @@
+# SigmaSkills
+
+**High-rigor Agent Skills for every serious coding agent.**
+
+Portable [Agent Skills](https://agentskills.io/) that install once and run on **Codex**, **Claude Code**, **Cursor**, **Pi**, **OpenCode**, **LAPI**, Reasonix-class TUIs, Kimi/Muse-style hosts, and any tool that reads a `SKILL.md`.
+
+| | |
+|---|---|
+| **Release** | [**v0.2.0**](https://github.com/Djordje-Stojanovic/Sigmaskills/releases/tag/v0.2.0) |
+| **Changelog** | [CHANGELOG.md](CHANGELOG.md) |
+| **License** | [MIT](LICENSE) |
+| **Spec** | [agentskills.io](https://agentskills.io/) |
+
+```text
+  Σ  review     →  one findings report, one PR, no runtime edits
+  Σ  performance→  calibrated bottlenecks, one report PR
+  Σ  brief      →  paste-ready agent briefs, chat only
+  Σ  write      →  clear STE-inspired technical English
+```
+
+---
+
+## Quick start
+
+Start the first-party Sigma Installer in a project:
+
+```bash
+npx @djordje-stojanovic/sigmaskills
+```
+
+Select any set of skills. By default the installer writes only to `.agents/skills/<id>` and lists every Agent Host that reads that universal destination. Host-specific directories such as `.claude/skills` or `.pi/skills` stay unselected until you choose them. Selected host destinations use Windows directory junctions or macOS/Linux symbolic links to the canonical copy; `--copy` writes an independent managed copy instead. Link failure reports the exact cause and offers copy — the installer never changes method silently. Exact current official copies and valid links are adopted in place without rewriting skill bytes. Changed, older, pre-marker, and unverified Sigma-looking trees are classified with a file diff and provenance confidence; replace commits a private backup first, skip leaves the tree, and export writes a collision-safe copy. Pre-marker extra content is never guessed into the customization block; malformed markers stop unless you pass an explicit `--adopt-malformed` choice. The confirmation plan shows every full destination path and method. Press `g` in the skill picker for Global Installation: an immediate scope warning appears, then a second confirmation repeats every Agent Host, resolved path, method, overwrite effect, and backup action. Non-interactive Global writes need both `--global` and `--yes`; CI, TTY, JSON, and Agent Host detection never imply that authority. To install one skill without the interactive interface:
+
+```bash
+npx @djordje-stojanovic/sigmaskills install sigmawrite --project .
+npx @djordje-stojanovic/sigmaskills install sigmawrite --project . --destination .claude/skills
+npx @djordje-stojanovic/sigmaskills install sigmawrite --project . --destination .claude/skills --copy
+npx @djordje-stojanovic/sigmaskills install sigmawrite --global --dry-run
+npx @djordje-stojanovic/sigmaskills install sigmawrite --global --yes
+```
+
+Then invoke with your host’s normal skill syntax (`$sigmawrite`, `/skill:sigmawrite`, skill picker, …).
+
+---
+
+## The skills
+
+| Skill | Id | Job | Output |
+|-------|-----|-----|--------|
+| **SigmaReview** | `sigmareview` | One-shot full-repo engineering audit | One findings MD + report-only PR |
+| **SigmaPerformance** | `sigmaperformance` | Calibrated performance investigation | One report MD + report-only PR |
+| **SigmaBrief** | `sigmabrief` | Prompt factory for parallel / single agents | Chat briefs only |
+| **SigmaWrite** | `sigmawrite` | Clear STE-inspired technical English | Chat writing voice |
+
+### SigmaReview
+
+A single agent walks an entire repository — correctness, completeness, architecture, data and concurrency, reliability, security, performance, tests, dependencies, delivery, operations, and domain-specific engineering. Speculative findings are rejected. Exactly **one** evidence-rich Markdown report is published as a **report-only** pull request. Runtime code is never changed.
+
+### SigmaPerformance
+
+Maps real user journeys, then separates **measured** and **mechanically proven** bottlenecks from measurement-required opportunities. Publishes one structured report PR. Runtime sources stay untouched unless calibration explicitly says otherwise.
+
+### SigmaBrief
+
+Turns GitHub issues, features, upgrades, bugs, or plain work statements into short, copy-pastable briefs for other agents. Light research → dispatch list → fenced briefs → **stop**. Does not implement work or open product fix PRs. Default brief arc: plan → optional grill-me (including Windows worktree) → approve → execute → validate → PR for review (**do not merge**).
+
+**User-triggered only.** Do not treat Brief as ambient chat decoration.
+
+### SigmaWrite
+
+Writing voice inspired by **ASD-STE100 Simplified Technical English** — soft steers, not hard numbered rules. High-quality, still-technical explanations a sharp outsider can follow. Hard bans on gibberish and invented words. Includes a pasteable system-prompt block inside `SKILL.md`. Not certified STE; no dictionary ship.
+
+---
+
+## Install
+
+### Sigma Installer: Project Installation (recommended)
+
+Run `npx @djordje-stojanovic/sigmaskills` with no command. The Sigma Installer's Emberforge interface reads the Skill Pack catalog from `manifest.json` and the bundled Agent Host registry. Project Installation selects only the universal `.agents/skills/` destination by default, expands every Agent Host that reads it, and leaves host-specific destinations unselected until you choose them. Search remains available for every supported Agent Host, including hosts that are not detected. Exact current official copies and valid links are recorded as managed without rewriting skill bytes. Escape, EOF, Ctrl+C, or a rejected confirmation exits without writing.
+
+The Emberforge screens keep the accepted warm LAPI palette and do not mix in Prismgrid or Monolith. Layouts reflow below 76 columns and wrap long paths. Keyboard-only controls cover focus, search, selection, confirmation, cancellation, and `?` help. `--no-color`, `--static`, `--narrow`, `--json`, `NO_COLOR`, `CI`, `REDUCED_MOTION=1`, `PREFERS_REDUCED_MOTION=reduce`, redirected output, and non-TTY sessions disable animation and decorative color. Truecolor, 256-color, 16-color, and ASCII fallbacks stay readable and still show safety copy. The cursor and raw mode restore after success, failure, interrupt, EOF, and exceptions.
+
+Use `--no-color`, `--static`, or `--narrow` when the terminal needs those modes. Use `--project <path>` to select another project root.
+
+### Sigma Installer: Global Installation
+
+Project Installation stays the default. In the interactive installer, `g` selects Global Installation and shows a scope warning immediately. The final confirmation repeats every selected Agent Host, exact resolved path, method, overwrite or delete effect, and backup action. Cancel at either prompt leaves prior user-level state unchanged.
+
+Non-interactive mutation requires both `--global` and `--yes`. `--dry-run` shows those confirmation requirements and the full impact without writing. Unknown newer global state schemas fail closed; supported migrations keep ownership, hashes, methods, and backup references. Exact and changed existing copies use the same adoption path as Project Installation.
+
+### Sigma Installer: status
+
+`npx @djordje-stojanovic/sigmaskills status` is read-only. It reports Project Installation state by default, or Global Installation with `--global`. Human and `--json` output name the scope, installed and running Release, Skill Revisions, Agent Hosts, methods, exact paths, and ownership. Classification uses live per-file hashes and `lstat`/link checks. Valid Skill Customization is drift, not corruption. Drift discovery still exits `0`; command failures exit `1`. Status does not migrate, repair, write state or destinations, rewrite `skills-lock.json`, or contact the network.
+
+### Sigma Installer: update
+
+`npx @djordje-stojanovic/sigmaskills update --dry-run` groups changed and unchanged skills, shows the bundled changelog and whole-skill file diffs, and writes nothing. `--yes` updates every changed skill when none are blocked; `--skill <id>` (repeatable) selects complete skills only. Valid Skill Customization bytes between the markers are copied onto the new official `SKILL.md` exactly. Edits outside that block are classified as local-only or concurrent with upstream; `--dry-run` names those cases and the overwrite or delete effects. `--outside-edit replace|skip|export` is required before mutation: replace takes a complete integrity-checked private backup first, skip leaves that skill and its state untouched while other skills continue, and export copies the prior tree to a planned path and refuses collisions. Missing, duplicate, reversed, nested, or otherwise malformed customization markers block automatic update for that skill and are never guessed into a customization boundary. `--dry-run` shows the marker shape, exact proposed repair bytes when a unique mechanical repair exists, and the resulting replacements or deletions. `--malformed-markers skip|repair|replace` is required before mutation: skip leaves that skill unchanged while others continue, repair writes only an approved exact repair, and replace takes a complete private backup then installs a clean official copy. Malformed markers plus outside drift keep all content until both `--malformed-markers` and `--outside-edit` are explicit. Cancellation, invalid repair, editor failure, backup failure, or transaction failure writes nothing partial. The latest valid backup stays until the new tree and backup metadata commit; cleanup failure may keep two backups and record cleanup debt. The canonical `.agents/skills/<id>` copy owns customization; links and matching managed copies follow it. Unknown newer state schemas, missing bundled Skill Revisions, broken links, and copy disagreement stop without mutation. Updates use the same transactional install path and refresh state only after commit. Project Installation is the default; Global Installation needs `--global` and `--yes`.
+
+### Sigma Installer: restore
+
+`npx @djordje-stojanovic/sigmaskills restore --skill <id> --dry-run` shows the latest retained backup: Release and Skill Revision when known, creation date, verified size, scope, canonical target, and affected links or copies. `--yes` stages and integrity-checks the backup before any live write. On success the displaced current tree becomes the new one-step backup. Restoring identical content is a no-op and does not rotate backups. A removed skill can return from portable ownership metadata without claiming unrelated paths. Missing, truncated, tampered, schema-incompatible, insufficient-space, stale-ownership, occupied-unowned, and failed Windows fallback cases stop with the prior live tree and retained backup intact. Project Installation is the default; Global Installation needs `--global` and `--yes`.
+
+### Sigma Installer: uninstall
+
+`npx @djordje-stojanovic/sigmaskills uninstall --skill <id> --dry-run` runs Uninstall Review for each selected skill. `npx @djordje-stojanovic/sigmaskills uninstall --all --dry-run` composes that same Uninstall Review across every recorded Sigma skill in one explicit Project or Global scope. There is no review-skipping fast path. The aggregate plan lists every skill, owned destination, canonical dependency, planned state change, and retained backup. Clean skills offer `--clean remove|keep`. Changed, customized, or malformed skills offer `--changed backup|keep|export|delete`. Uninstall-all defaults to `--changed backup` so backups remain restorable. `--yes` applies those choices: remove deletes only revalidated Sigma-owned paths; backup snapshots the current tree then removes it; export copies the current tree to `--export-dir` then removes managed paths; delete removes current content and leaves any older retained backup; keep writes nothing. Keep choices leave shared state and canonical dependency graphs intact. Execution rechecks each leaf with `lstat` and deletes a link itself, never its resolved target. Canonical content stays until recorded dependents are gone. Project uninstall-all never writes Global Installation; global uninstall-all never scans projects. For selected uninstall, missing paths, stale state, unowned replacements, divergent managed copies, and wrong-target links stop without a partial ownership change. For uninstall-all, those cases skip that skill, continue the rest, and report it as skipped. Interruption or failure leaves a durable recovery journal in installer state (`uninstall-journal.json`) and restores the failed skill so no active partial links remain. Human, dry-run, and JSON results report removed, retained, skipped, and failed skills. State and lock update only after filesystem operations commit. Project Installation is the default; Global Installation needs `--global` and `--yes`.
+
+### Sigma Installer: purge
+
+`npx @djordje-stojanovic/sigmaskills purge --dry-run` lists the exact ownership plan for one Project or Global scope: revalidated Sigma-owned trees, links or junctions, copies, backups, staging, journals, and relevant locks. Purge never infers ownership from folder names. `--yes`, CI, non-TTY, and JSON are not authority. Apply with the typed phrase `purge SigmaSkills`, or non-interactively with `--confirm-purge "purge SigmaSkills"`. Unexpected unowned occupants stop the command and stay untouched. Cross-filesystem deletes journal first and quarantine owned trees before the ownership manifest is removed. An interrupted cleanup leaves recoverable quarantined state rather than active partial links. Retry with the same confirmation phrase finishes the purge. Project purge never writes Global Installation; global purge never scans projects.
+
+### Sigma Installer: Agent Host registry automation
+
+The `registry-sync.yml` workflow fetches one pinned `vercel-labs/skills` revision as data and runs converter code only from the exact default-branch SHA in `EXPECTED_HEAD`. Generated changes are limited to `registry/agent-hosts.json`, `registry/source.json`, and `test/fixtures/vercel-skills/src/agents.ts`. New hosts must pass safe-root, traversal, collision, overlap, control-character, and platform checks. Only a generated pull request from that trusted workflow, with an exact allowlisted diff, the validated head SHA, current protected `main`, and all required checks may auto-merge. Validated additions and description-only edits can then publish a patch Release through the same idempotent trusted publication primitive as owner Releases. Path, ID, alias, detection, platform, membership, removal, unknown fields, and validation failures stay blocked for owner review. Version calculation serializes concurrent runs and reconciles npm and GitHub before the patch. The generated branch is deleted only after verified merge and matching npm/GitHub completion. Automation cannot change skills, CLI behavior, unrelated issues or pull requests, human branches, or major/minor Releases, and it never overwrites an existing npm version. Configure an npm trusted publisher for `registry-sync.yml` in addition to `release.yml`.
+
+### Sigma Installer: release
+
+`npx @djordje-stojanovic/sigmaskills release --dry-run` calculates the next semantic version and complete change set from the accepted source commit, then prints one publication preview: commit, version, required tests, tarball contents and SHA-256 digest, Skill Revisions, git tag, GitHub Release, npm package, and `latest` dist-tag. Ordinary merges never publish. `--yes`, CI, and informal text cannot dispatch. `--write-identities` writes matching `package.json`, `manifest.json`, and `CHANGELOG.md` identities so the owner can commit them. Dispatch requires `--expected-commit`, `--expected-version`, and `--expected-digest` that match that rebuilt preview. The trusted `release.yml` workflow independently checks out the approved commit, re-runs tests, rebuilds the tarball, and verifies those values before the publish job. Validation stays `contents: read`. Only the final job receives `id-token: write`, `contents: write`, and the protected `release` environment, with actions pinned by commit SHA. Missing npm reservation, trusted publisher, environment protection, or a conflicting version, tag, or GitHub Release fails closed with setup guidance. Matching npm provenance or an existing GitHub Release at the same commit is skipped rather than overwritten or duplicated.
+
+### Cross-host alternative
+
+The cross-agent [skills](https://github.com/vercel-labs/skills) CLI detects Codex, Claude Code, Cursor, OpenCode, Pi, and dozens more:
+
+```bash
+# Everything, all detected agents, global
+npx skills add Djordje-Stojanovic/Sigmaskills --all -g -y
+
+# One skill at a time
+npx skills add Djordje-Stojanovic/Sigmaskills --skill sigmareview -g
+npx skills add Djordje-Stojanovic/Sigmaskills --skill sigmaperformance -g
+npx skills add Djordje-Stojanovic/Sigmaskills --skill sigmabrief -g
+npx skills add Djordje-Stojanovic/Sigmaskills --skill sigmawrite -g
+
+# Pin to specific hosts
+npx skills add Djordje-Stojanovic/Sigmaskills --skill sigmawrite -g -a cursor -a claude-code -a codex -a opencode -a pi
+
+# List what this repo ships (no install)
+npx skills add Djordje-Stojanovic/Sigmaskills --list
+```
+
+Full GitHub URL also works:
+
+```bash
+npx skills add https://github.com/Djordje-Stojanovic/Sigmaskills --skill sigmabrief -g
+```
+
+### Codex
+
+```text
+$skill-installer install sigmareview from https://github.com/Djordje-Stojanovic/Sigmaskills
+$skill-installer install sigmaperformance from https://github.com/Djordje-Stojanovic/Sigmaskills
+$skill-installer install sigmabrief from https://github.com/Djordje-Stojanovic/Sigmaskills
+$skill-installer install sigmawrite from https://github.com/Djordje-Stojanovic/Sigmaskills
+```
+
+### Manual / universal copy
+
+When a host only watches a skills folder (Pi, LAPI mirrors, custom TUIs, air-gapped boxes):
+
+**POSIX**
+
+```bash
+git clone https://github.com/Djordje-Stojanovic/Sigmaskills.git
+mkdir -p ~/.agents/skills
+cp -R Sigmaskills/sigmareview ~/.agents/skills/sigmareview
+cp -R Sigmaskills/sigmaperformance ~/.agents/skills/sigmaperformance
+cp -R Sigmaskills/sigmabrief ~/.agents/skills/sigmabrief
+cp -R Sigmaskills/sigmawrite ~/.agents/skills/sigmawrite
+```
+
+**Windows (PowerShell)**
+
+```powershell
+git clone https://github.com/Djordje-Stojanovic/Sigmaskills.git
+New-Item -ItemType Directory -Force -Path "$HOME\.agents\skills" | Out-Null
+Copy-Item -Recurse Sigmaskills\sigmareview   "$HOME\.agents\skills\sigmareview"
+Copy-Item -Recurse Sigmaskills\sigmaperformance "$HOME\.agents\skills\sigmaperformance"
+Copy-Item -Recurse Sigmaskills\sigmabrief    "$HOME\.agents\skills\sigmabrief"
+Copy-Item -Recurse Sigmaskills\sigmawrite    "$HOME\.agents\skills\sigmawrite"
+```
+
+Point other hosts at the same folders (or copy again) as needed:
+
+| Host family | Typical skills path |
+|-------------|---------------------|
+| Universal / Codex-style | `~/.agents/skills/<id>/` |
+| Cursor | `~/.cursor/skills/<id>/` or project `.agents/skills/` |
+| Claude Code | `~/.claude/skills/<id>/` |
+| Pi / LAPI-style | `~/.pi/agent/skills/<id>/` |
+| OpenCode | `~/.config/opencode/skills/<id>/` |
+| Codex | `~/.codex/skills/<id>/` |
+
+Release zip: download [**Sigmaskills-v0.2.0**](https://github.com/Djordje-Stojanovic/Sigmaskills/releases/tag/v0.2.0) and copy the four skill folders into the path your agent reads.
+
+### Optional: SigmaWrite as system prompt
+
+Open [`sigmawrite/SKILL.md`](sigmawrite/SKILL.md), copy the **Paste as system prompt** block into host instructions when you want the voice always on — without editing this repo’s release contract.
+
+---
+
+## Run
+
+Use your host’s skill syntax. Examples:
+
+<table>
+<tr>
+<td width="50%">
+
+**Codex**
+
+```text
+$sigmareview https://github.com/owner/repo
+$sigmaperformance https://github.com/owner/repo
+$sigmabrief https://github.com/owner/repo/issues/12
+$sigmabrief all open
+$sigmawrite
+```
+
+</td>
+<td width="50%">
+
+**Pi / skill-slash hosts**
+
+```text
+/skill:sigmareview https://github.com/owner/repo
+/skill:sigmaperformance https://github.com/owner/repo
+/skill:sigmabrief https://github.com/owner/repo/issues/12
+/skill:sigmabrief all open
+/skill:sigmawrite
+```
+
+</td>
+</tr>
+</table>
+
+**Claude Code · Cursor · OpenCode · ChatGPT/Codex UI · Reasonix-class · Kimi/Muse · others**  
+Use the skill picker, `@` / `$` skill mention, or whatever that product documents for Agent Skills. Folder name = skill id = invocation token.
+
+| Skill | Typical invoke | Notes |
+|-------|----------------|-------|
+| `sigmareview` | repo URL | Needs push/fork rights for the report PR |
+| `sigmaperformance` | repo URL | Starts with two short calibration batches, then runs |
+| `sigmabrief` | issue URL · `#N` · `all open` · plain work | Explicit only — not ambient |
+| `sigmawrite` | (no args) | Session writing voice until you turn it off |
+
+---
+
+## Output contracts
+
+### SigmaReview
+
+- File: `SIGMAREVIEW-FINDINGS-YYYY-MM-DD.md`
+- One dedicated branch + **report-only** PR
+- Prioritized, confidence-gated findings with exact evidence
+- Implementation-ready remediation and verification steps
+- Full repository coverage ledger
+- **No** source fixes, dependency installs, app execution, subagents, or auxiliary repo artifacts
+
+### SigmaPerformance
+
+- File: `SIGMAPERFORMANCE-REPORT-YYYY-MM-DD.md`
+- One dedicated **report-only** PR
+- **M1** measured · **M2** mechanically proven bottlenecks
+- **M3** measurement-required opportunities, failed experiments, unverified boundaries (accounted separately)
+- Structured future SigmaOptimize handoff
+- Default single-agent; bounded subagents only via explicit calibration opt-in
+- **No** runtime-source changes or temp measurement junk in the repo diff
+
+### SigmaBrief
+
+- Chat-only dispatch list + paste-ready fenced `text` briefs  
+  (**no** `SIGMABRIEF-*.md` in the product repo)
+- Types: greenfield · finish-PR · skip · blocked
+- Executing briefs: plan first · optional grill-me · **do not merge** · self-review before PR
+- Isolation on → agent-created Windows `git worktree`; cleanup only after human merge or abandon
+- Never implements the work or opens product fix PRs
+
+### SigmaWrite
+
+- Chat writing style only (no report file, no PR)
+- Soft STE-inspired steers + hard bans (gibberish / invented words / talking down / renaming code)
+- Optional pasteable system-prompt block in `SKILL.md`
+- Does not override another skill’s rigid output contract
+
+---
+
+## Requirements
+
+| Skill | Needs |
+|-------|--------|
+| All | Agent that can load Agent Skills (`SKILL.md`) |
+| SigmaReview · SigmaPerformance | Read access to the target repo · authenticated GitHub tooling to push a branch or fork + open a PR |
+| SigmaPerformance | Authority / safety boundary chosen in calibration |
+| SigmaBrief | `gh` read when briefing from issues/PRs · **no** push to the product repo |
+| SigmaWrite | Nothing beyond chat — optional paste into system instructions |
+
+Windows-native defaults where skills mention shells or worktrees (PowerShell-friendly; do not assume WSL).
+
+---
+
+## Repo layout
+
+```text
+Sigmaskills/
+├── AGENTS.md                 Agent working contract
+├── README.md · CHANGELOG.md · LICENSE · package.json
+├── test/                     Structural regression tests (npm test)
+├── .github/                  Issue forms · PR template · CI
+├── sigmareview/              SKILL.md · agents/ · references/
+├── sigmaperformance/         SKILL.md · agents/ · references/
+├── sigmabrief/               SKILL.md · agents/ · references/
+└── sigmawrite/               SKILL.md · agents/
+```
+
+Each top-level folder is one installable skill. `name` in frontmatter = folder name = `--skill` id.
+
+Agents working in this repo should read [`AGENTS.md`](AGENTS.md).
+
+---
+
+## Testing
+
+Zero-dependency Node tests guard the beauty: skill registry, `SKILL.md` frontmatter, `agents/openai.yaml`, README install/run wiring, CHANGELOG, issue templates, agent docs, and SigmaWrite’s soft-steer contract.
+
+```bash
+npm test
+```
+
+CI runs the same suite on Windows, macOS, and Linux for Node.js 20 and 22, on every pull request and every push to `main`. Those jobs cover real junctions or symbolic links, copy fallback, shell differences, and an isolated temp filesystem.
+
+When you **add or rename a skill**, update `KNOWN_SKILLS` in [`test/repo-invariants.test.js`](test/repo-invariants.test.js) in the same change as README and CHANGELOG — otherwise CI fails on purpose. That rule also lives in [`AGENTS.md`](AGENTS.md).
+
+---
+
+## Contributing & issues
+
+Use the issue chooser: [New issue](https://github.com/Djordje-Stojanovic/Sigmaskills/issues/new/choose)  
+Bug · Feature · Improvement · Docs — written for skills, prompts, and templates (not unrelated product apps).
+
+---
+
+## License
+
+[MIT](LICENSE) © Djordje Stojanovic

package/bin/sigmaskills.js

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+import { runCli } from '../src/cli.js';
+
+const exitCode = await runCli(process.argv.slice(2));
+if (exitCode !== 0) {
+  process.exit(exitCode);
+}

package/manifest.json

@@ -0,0 +1,28 @@
+{
+  "schemaVersion": 1,
+  "name": "sigmaskills",
+  "version": "0.2.0",
+  "description": "Portable Agent Skills monorepo and first-party Sigma Installer",
+  "skills": [
+    {
+      "id": "sigmareview",
+      "title": "SigmaReview",
+      "needsReferences": true
+    },
+    {
+      "id": "sigmaperformance",
+      "title": "SigmaPerformance",
+      "needsReferences": true
+    },
+    {
+      "id": "sigmabrief",
+      "title": "SigmaBrief",
+      "needsReferences": true
+    },
+    {
+      "id": "sigmawrite",
+      "title": "SigmaWrite",
+      "needsReferences": false
+    }
+  ]
+}

package/package.json

@@ -0,0 +1,42 @@
+{
+  "name": "@djordje-stojanovic/sigmaskills",
+  "version": "0.2.0",
+  "description": "Portable Agent Skills monorepo and first-party Sigma Installer",
+  "type": "module",
+  "bin": {
+    "sigmaskills": "bin/sigmaskills.js"
+  },
+  "files": [
+    "bin",
+    "src",
+    "registry/agent-hosts.json",
+    "registry/source.json",
+    "registry/schema.json",
+    "registry/skill-baselines.json",
+    "manifest.json",
+    "sigmareview",
+    "sigmaperformance",
+    "sigmabrief",
+    "sigmawrite",
+    "README.md",
+    "LICENSE",
+    "CHANGELOG.md"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Djordje-Stojanovic/Sigmaskills.git"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "prepack": "node ./src/prepack.js",
+    "test": "node scripts/run-tests.js",
+    "registry:sync": "node ./src/registry/sync.js",
+    "registry:validate": "node ./test/registry-validate-cli.mjs"
+  }
+}