@djordje-stojanovic/sigmaskills 0.4.0 → 0.5.0

package/CHANGELOG.md

@@ -4,6 +4,59 @@ All notable changes to [Sigmaskills](https://github.com/Djordje-Stojanovic/Sigma
 
 ## [Unreleased]
 
+## [0.5.0] — 2026-09-29
+
+### Changed
+
+- CI and release jobs use current actions and Node.js. `actions/checkout` is v7.0.1 and `actions/setup-node` is v7.0.0, both pinned by full SHA. The release, registry-sync, and rehearsal jobs run on Node.js 24.21.0, whose bundled npm 11.19 supports trusted publishing, so the extra `npm install -g npm@11.5.1` step is gone. The `package-manager-cache: false` setting is now a valid input, and the runner no longer warns about Node 20 actions. (#69)
+- `.github/dependabot.yml` opens one weekly pull request to keep the `github-actions` pins current. (#69)
+- The bug template has a "Sigma Installer (CLI)" area and optional fields for CLI version, Node.js version, and OS. The pull request template adds `npm test` and CHANGELOG checkboxes and covers the CLI. Every job in `release.yml` and `registry-sync.yml` has `timeout-minutes: 30`. (#69)
+- The six skills now agree with each other. SigmaShip and SigmaBrief both merge the base branch into a pushed branch (no rebase), use `<base>` (default `main`), delete a squash-merged branch with `git branch -D` only after the PR shows merged, define P1 as SigmaReview does, and use the shell native to the executing machine. In a SigmaShip review round, the `CLEAN | FIXED | BLOCKED` report wins over SigmaBrief's format. The grilling skill is called `/grilling` everywhere. SigmaShip says to write the acceptance criteria by hand when `/to-spec`, `/to-tickets`, or `/grilling` are missing. The README lists these optional companion skills from `mattpocock/skills`. (#65)
+- SigmaBrief examples now use its own dispatch format and generic content. (#65)
+- SigmaRefactor and the README no longer name a private repository, and they say `laloc` is optional. (#65)
+- Tests check that `openai.yaml` lists only Codex products (`chatgpt`, `codex`, `atlas`), that every skill name and description follows the Agent Skills limits, and that every relative link and `#anchor` in the skill folders resolves. (#65)
+- Package metadata: `package.json` now has `license` (`MIT`), `bugs`, and `keywords`, so npm shows the license. (#64)
+- Docs and changelog match 0.4.0. The CHANGELOG compare links and the 0.4.0 package-size note are fixed, 0.2.1 is marked as a GitHub Release only, and the 0.2.0 sections follow Keep a Changelog order. The installer guide now covers the Link/Copy page, the `a` key, plain mode with `TERM=dumb` and `--json`, Escape in the destination search, and the hidden aliases (`-g`, `--cwd`, `--list`, `check`). The maintainer guide covers `registry:sync`, `registry:validate`, and the role of `.agents/skills` and `skills-lock.json`. ADRs 0005 and 0006 and the wayfinder label note are corrected. (#64)
+- The Agent Host registry follows `vercel-labs/skills` at `2a286c7`: Pi is now a universal host that reads `.agents/skills` (project) and `~/.agents/skills` (global) instead of `.pi/skills` and `~/.pi/agent/skills`. Existing installs keep their recorded paths. (#78)
+- The generated registry pull request no longer says it "may auto-merge". It says auto-merge only runs when `main` is protected with required checks, and the owner merges by hand otherwise. `main` is not protected, so registry sync pull requests are reviewed and merged by hand. The maintainer guide says so, and ADR 0004 has a status note. (#70)
+
+### Removed
+
+- **BREAKING CHANGE:** Node.js 20 is no longer supported. `package.json` `engines.node` is now `>=22`, and CI no longer runs a Node.js 20 job. Use Node.js 22 or newer. (#70)
+- A private homelab plan that did not belong to this project (`.cursor/plans/`). `.cursor/` is now ignored. (#64)
+- Signal handlers in the install transaction that could never run, the unused `MIGRATABLE_KINDS` list, a `keypress` `removeListener` call that removed nothing, and the lossy `injectCustomContent` helper. (#67)
+
+### Fixed
+
+- `npm run release` works on Windows when Git Bash's `tar` comes first on `PATH`. It lists the tarball by file name inside its folder, because GNU tar reads `C:` in a path as a remote host. It also starts npm through Node instead of a shell, so Node no longer prints the DEP0190 warning.
+- The README no longer claims that every GitHub Release is on npm, and its run section names only real hosts.
+- The release tool keeps release notes exactly as written. Notes with `$&`, `$'`, or `` $` `` are no longer changed when the version is applied, and a changelog with only `## [Unreleased]` now gets its version heading. (#68)
+- Applying a release now adds the new compare link (`[X.Y.Z]: …/compare/vPREV...vX.Y.Z`) and moves `[Unreleased]` to compare from the new tag. The registry patch release does the same. (#68)
+- A registry patch Release now puts its version heading after the whole `[Unreleased]` section. Before, it went right under `## [Unreleased]`, so the owner's unreleased notes ended up under the patch version. (#70)
+- A `.sigma.lock.guard` folder left by a hard kill is now detected. When it is older than one minute, the command stops with a `lock-guard-stale` error that names the folder and says to stop all SigmaSkills processes and remove it. Before, every run failed with a bare `lock-busy` message. The installer does not delete the folder itself, because two processes could both decide it is stale. (#70)
+- The auto-merge check now says no when any required input is missing (head SHA, generated SHA, expected SHA, default-branch SHA, check result, or classification) or when a SHA is not 40-hex. Before, a missing input skipped its check. (#68)
+- Registry automation stops when a `gh`, `npm`, or `git` lookup fails for any reason other than "not found". Before, a network error counted as "no npm versions", "no concurrent run", or "no release", so a version could be reused. (#68)
+- `npm run registry:sync -- --dry-run` now writes nothing, including with `--fetch` (it used to overwrite the fixture). The dead `fetchPinnedSourceSync` branch is gone. Registry validation rejects destinations under `.git`, `.github/workflows`, and `.ssh`, so a new host with such a path needs owner review. (#68)
+- `agents/openai.yaml` no longer lists the invalid product `api` in any skill. Codex could ignore a metadata file with an unknown product. (#65)
+- SigmaBrief now sets `allow_implicit_invocation: false`, so the host no longer starts it on its own. (#65)
+- Two broken `measure.md` links in `sigmareview/references/method.md` now resolve. (#65)
+- The migration error message, its comments, and the installer guide now name 0.3.0 as the last version with the old state layout. 0.4.0 already uses the new layout, so the old advice to run `@0.4.0` failed in the same place. (#64)
+- The README host list names only hosts that exist in the registry. (#64)
+- A project `skills-lock.json` from another tool is never rewritten. When the file is a generic (non-Sigma) lock, `install`, `uninstall`, and `restore` leave it byte-identical, print a notice, and still finish the install, uninstall, or restore. The Sigma lock is only written when the file is missing or already a Sigma lock. (#66)
+- State and purge-journal paths that escape the project, home, or state folder are rejected when they load, with an error that says the path "escapes" its folder. A crafted `../victim` destination in `state.json` can no longer make `uninstall` or `purge` delete a folder outside the project. (#66)
+- `restore` now stops with `occupied-unowned` when a recorded host destination (for example `.claude/skills/<skill>`) holds files Sigma does not own. Before, it deleted those files and put the skill there. (#66)
+- A foreign `.agents/state.json` or `.agents/backups/` from another tool is no longer moved into the private folder or removed. Those two names count as Sigma's old layout only beside a `state.json` that has Sigma's shape. `install` no longer fails on such a project. (#66)
+- Reinstalling over a Sigma-owned link that points to the wrong target now stops with a `wrong-target` error. Before, it printed "Installed" with exit code 0 and left the wrong link in place. (#66)
+- `status`, `update`, and `uninstall` now classify a link that a user added inside a skill the same way, as a local addition. They share one tree walker. Before, `status` and `uninstall` called such a skill clean while `update` called it changed. (#66)
+- `--adopt-* replace` and `--adopt-* export` over a junction or symlink now work. The backup or export holds the folder the link points to, and the backup passes the integrity check. Before, both failed with `EEXIST`. (#66)
+- A project `skills-lock.json` with a newer `schemaVersion` than Sigma supports now stops the command with an error. Before, Sigma read it as version 1 and wrote it back without the newer fields. (#67)
+- Replacing a changed skill (`--adopt-* replace`, `update --outside-edit replace`) keeps the customization block byte for byte. A block that began with a Windows line ending lost one byte before. (#67)
+- A destination folder whose name starts with two dots, such as `..cache/skills`, is accepted. `..`, `../x`, and absolute paths that leave the project or home are still rejected. One shared check now does this everywhere. (#67)
+- `restore` rejects a backup whose metadata names a `canonicalTarget` or a copy destination outside the project or home folder. (#67)
+- The install lock is released when setup code fails right after the lock is taken. Before, a failure there left the lock behind until its owner stopped. (#67)
+- `CI=false` and `CI=0` now mean "not CI" in the interactive installer, the same as in the `purge` check. (#67)
+- When `update` fails on a later skill, it still lists the skills it already updated after the error message. (#67)
+
 ## [0.4.0] — 2026-09-27
 
 ### Added
@@ -20,7 +73,7 @@ All notable changes to [Sigmaskills](https://github.com/Djordje-Stojanovic/Sigma
 - SigmaBrief (`sigmabrief`) accepts SigmaReview reports and SigmaImprove issues as input and groups briefs into waves, so only independent items run in parallel. Every brief now asks for green baseline checks before changes and ends with a fixed report (`DONE`, `DONE_WITH_CONCERNS`, or `BLOCKED`, plus PR, checks, and open questions). `approval: auto` lets agents record their decisions as rulings instead of waiting. A host's native worktree tool is preferred over manual `git worktree`. A new `session` brief hands the current conversation to a fresh agent.
 - The skill picker and `list` now show each skill's short description for people (`short_description` in `agents/openai.yaml`) instead of the agent-facing description cut off mid-word. The picker wraps it onto at most two lines, so narrow terminals show it whole. A skill without that line shows the first sentence of its description. `list --json` still gives the full description. (#39)
 - The installer's private files (state, lock, backups, journals, staging) now live in `.agents/.sigmaskills/` (global: `~/.agents/.sigmaskills/`). The folder ignores itself in Git, so `git add -A` no longer stages `.agents/state.json` or backups. Older projects move there on the next write command; `status` and `--dry-run` still read the old layout and write nothing. `--state-dir` and `SIGMA_STATE_DIR` are unchanged. (#34)
-- The npm package now ships only the user CLI: about 110 KB smaller unpacked and 10 fewer files. Release and registry automation moved to `scripts/` in the repository, and `sigmaskills release` is gone from the published CLI. Maintainers run `npm run release -- <flags>` from a checkout; the checks it makes are unchanged. (#40)
+- The npm package now ships only the user CLI: about 88 KB smaller unpacked (500,482 B instead of 588,522 B) and 3 fewer files (53 instead of 56). Release and registry automation moved to `scripts/` in the repository, and `sigmaskills release` is gone from the published CLI. Maintainers run `npm run release -- <flags>` from a checkout; the checks it makes are unchanged. (#40)
 - Every pull request now rehearses the Release path. A CI job commits the Release identities in a throwaway worktree, then runs the preview, the dispatch checks, and the trusted `validate` and publish steps with a real `npm pack` (`node scripts/release-rehearsal.js`). npm and GitHub lookups, dispatch, and publish are stubbed, so the job needs no secrets. A pull request that breaks packing, such as the `npm pack` JSON bug fixed in 0.2.1, now fails before merge. (#41)
 - CI now runs with a read-only token (`permissions: contents: read`) and pins every action to a full commit SHA, like the Release workflows. (#41)
 - CI now tests Node.js 22 and 24 on Windows, macOS, and Linux. Node.js 20 reached end of life on 2026-04-30, but `engines` stays at `>=20` for this Release so current users on Node.js 20 can still install; one Linux job on Node.js 20 keeps that promise tested. A later Release may raise it. (#41)
@@ -57,8 +110,7 @@ All notable changes to [Sigmaskills](https://github.com/Djordje-Stojanovic/Sigma
 - The installer opens directly to skill selection, keeps destination pages within eight rows, and offers line-based commands in plain terminals. Help preserves cancellation, and short terminals keep focus and controls visible.
 - Package tests compare complete trees and bytes for all five skills, including customized reinstall protection and updates.
 
-
-## [0.2.1] — 2026-08-27
+## [0.2.1] — 2026-08-27 (GitHub Release only)
 
 ### Changed
 
@@ -70,13 +122,8 @@ All notable changes to [Sigmaskills](https://github.com/Djordje-Stojanovic/Sigma
 - Registry Sync no longer fails when a leftover `registry/sync-*` branch still exists: it replaces that generated branch, or reuses a matching open pull request, and still refuses human branches.
 - Release packing reads `npm pack --json` after prepack logs, so publication can rebuild the tarball digest.
 
-
 ## [0.2.0] — 2026-08-20
 
-### Fixed
-
-- `npm test` lists `test/*.test.js` files in a runner script so Node.js 20 CI runs the suite without glob expansion. Registry pin hashing ignores CRLF from Windows checkout so the fixture still matches `contentSha256`.
-
 ### Added
 
 - Safe Agent Host registry additions and description-only changes may auto-merge after required checks and publish a patch Release through the trusted idempotent publication primitive. Destination, ID, alias, detection, platform, membership, removal, and unknown changes still need owner review. Version calculation serializes concurrent runs against live npm and GitHub state. The generated branch is deleted only after verified merge and matching publication. Automation cannot change skills, CLI behavior, unrelated work, human branches, or major/minor Releases, and it never overwrites an existing npm version.
@@ -102,6 +149,9 @@ All notable changes to [Sigmaskills](https://github.com/Djordje-Stojanovic/Sigma
 - Structural regression tests (`npm test`) and GitHub Actions CI so skill registry, README wiring, templates, and SigmaWrite soft-steer invariants cannot silently drift.
 - Root [`AGENTS.md`](AGENTS.md): mandatory work rules and clear-writing rules, project map, and the `KNOWN_SKILLS` + README + CHANGELOG update rule.
 
+### Fixed
+
+- `npm test` lists `test/*.test.js` files in a runner script so Node.js 20 CI runs the suite without glob expansion. Registry pin hashing ignores CRLF from Windows checkout so the fixture still matches `contentSha256`.
 
 ## [0.1.0] — 2026-08-11
 
@@ -139,7 +189,10 @@ Ship high-rigor, installable agent skills (not apps): full-repo audits, performa
 | 2026-08-11 | `5dab832` | Add CHANGELOG and mark v0.1.0 as the first Sigmaskills release |
 | 2026-08-11 | `124a666` | Polish v0.1.0 docs for multi-host install and use |
 
-[Unreleased]: https://github.com/Djordje-Stojanovic/Sigmaskills/compare/v0.2.1...HEAD
+[Unreleased]: https://github.com/Djordje-Stojanovic/Sigmaskills/compare/v0.5.0...HEAD
+[0.5.0]: https://github.com/Djordje-Stojanovic/Sigmaskills/compare/v0.4.0...v0.5.0
+[0.4.0]: https://github.com/Djordje-Stojanovic/Sigmaskills/compare/v0.3.0...v0.4.0
+[0.3.0]: https://github.com/Djordje-Stojanovic/Sigmaskills/compare/v0.2.1...v0.3.0
 [0.2.1]: https://github.com/Djordje-Stojanovic/Sigmaskills/releases/tag/v0.2.1
 [0.2.0]: https://github.com/Djordje-Stojanovic/Sigmaskills/releases/tag/v0.2.0
 [0.1.0]: https://github.com/Djordje-Stojanovic/Sigmaskills/releases/tag/v0.1.0

package/README.md

@@ -2,11 +2,11 @@
 
 **High-rigor Agent Skills for every serious coding agent.**
 
-Portable [Agent Skills](https://agentskills.io/) that install once and run on **Codex**, **Claude Code**, **Cursor**, **Pi**, **OpenCode**, **LAPI**, Reasonix-class TUIs, Kimi/Muse-style hosts, and any tool that reads a `SKILL.md`.
+Portable [Agent Skills](https://agentskills.io/) that install once and run on **Codex**, **Claude Code**, **Cursor**, **Pi**, **OpenCode**, **Reasonix**, **Kimi Code CLI**, and any tool that reads a `SKILL.md`.
 
 | | |
 |---|---|
-| **Release** | [**v0.4.0**](https://github.com/Djordje-Stojanovic/Sigmaskills/releases/tag/v0.4.0) |
+| **Release** | [**v0.5.0**](https://github.com/Djordje-Stojanovic/Sigmaskills/releases/tag/v0.5.0) |
 | **Changelog** | [CHANGELOG.md](CHANGELOG.md) |
 | **License** | [MIT](LICENSE) |
 | **Spec** | [agentskills.io](https://agentskills.io/) |
@@ -91,7 +91,7 @@ A writing voice inspired by **ASD-STE100 Simplified Technical English**. It give
 
 ### SigmaRefactor
 
-Runs a `laloc` scan, reads the five largest maintained files, and explains safe refactoring choices. It waits for your approval before it edits. It keeps behavior, tests, interfaces, and your own changes intact. At the end it reports lines removed apart from lines moved into new modules.
+Counts lines (with `laloc` if you have it, or by itself), reads the five largest maintained files, and explains safe refactoring choices. It waits for your approval before it edits. It keeps behavior, tests, interfaces, and your own changes intact. At the end it reports lines removed apart from lines moved into new modules.
 
 ---
 
@@ -106,7 +106,7 @@ Pick one method. The [installer guide](https://github.com/Djordje-Stojanovic/Sig
 | **Codex** | `$skill-installer install <id> from https://github.com/Djordje-Stojanovic/Sigmaskills` | Codex only |
 | **Manual copy** | `git clone` this repository, then copy `<id>/` into `~/.agents/skills/` | Air-gapped machines and hosts that only watch a folder |
 
-Every [GitHub Release](https://github.com/Djordje-Stojanovic/Sigmaskills/releases) matches the npm package of the same version.
+Every [GitHub Release](https://github.com/Djordje-Stojanovic/Sigmaskills/releases) from 0.2.0 on is also on npm, except 0.2.1.
 
 ---
 
@@ -149,7 +149,7 @@ $sigmarefactor
 </tr>
 </table>
 
-**Claude Code · Cursor · OpenCode · ChatGPT/Codex UI · Reasonix-class · Kimi/Muse · others:** use the skill picker, an `@` or `$` mention, or whatever the product documents for Agent Skills. The folder name is the skill id and the call token.
+**Claude Code · Cursor · OpenCode · ChatGPT/Codex UI · Reasonix · Kimi Code CLI · others:** use the skill picker, an `@` or `$` mention, or whatever the product documents for Agent Skills. The folder name is the skill id and the call token.
 
 | Skill | Typical input | Notes |
 |-------|---------------|-------|
@@ -165,14 +165,17 @@ $sigmarefactor
 | Skill | Needs |
 |-------|--------|
 | All | An agent that can load Agent Skills (`SKILL.md`) |
+| Sigma Installer | Node.js 22 or newer |
 | SigmaReview | Read access to the target repo · GitHub tooling to push a branch or fork and open a PR · execution authority only if you want measured findings |
 | SigmaImprove | Read access to the target · GitHub issue access only if tickets go to GitHub |
 | SigmaShip | Push rights and GitHub tooling (`gh` or connector) to open, merge, and close; the repository's test commands |
 | SigmaBrief | `gh` read access when briefing from issues or PRs · **no** push to the product repo |
 | SigmaWrite | Nothing beyond chat |
-| SigmaRefactor | Read access to the target repository and `laloc` when available |
+| SigmaRefactor | Read access to the target repository · `laloc` is optional; without it the skill counts lines itself |
 
-Where skills mention shells or worktrees, they default to native Windows (PowerShell-friendly; no WSL assumed).
+Skills use the shell native to the machine that runs the agent (PowerShell on Windows, POSIX shell elsewhere). They do not assume WSL.
+
+SigmaShip and SigmaBrief work best with optional companion skills from [mattpocock/skills](https://github.com/mattpocock/skills): `/to-spec` and `/to-tickets` turn an idea into a ticket with acceptance criteria, `/grilling` settles open decisions, and `/tdd` guides test-first work. Without them, the skills fall back to plain steps.
 
 ---
 

package/manifest.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "name": "sigmaskills",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Portable Agent Skills monorepo and first-party Sigma Installer",
   "skills": [
     {

package/package.json

@@ -1,8 +1,19 @@
 {
   "name": "@djordje-stojanovic/sigmaskills",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Portable Agent Skills monorepo and first-party Sigma Installer",
   "type": "module",
+  "license": "MIT",
+  "keywords": [
+    "agent-skills",
+    "skills",
+    "coding-agents",
+    "claude-code",
+    "codex",
+    "cursor",
+    "installer",
+    "cli"
+  ],
   "bin": {
     "sigmaskills": "bin/sigmaskills.js"
   },
@@ -28,12 +39,15 @@
     "type": "git",
     "url": "git+https://github.com/Djordje-Stojanovic/Sigmaskills.git"
   },
+  "bugs": {
+    "url": "https://github.com/Djordje-Stojanovic/Sigmaskills/issues"
+  },
   "publishConfig": {
     "access": "public",
     "provenance": true
   },
   "engines": {
-    "node": ">=20"
+    "node": ">=22"
   },
   "scripts": {
     "prepack": "node ./src/prepack.js",

package/registry/agent-hosts.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "generatedFrom": {
     "repository": "vercel-labs/skills",
-    "pinnedRevision": "7407f3893ad4dceab546ac002c3ef806e4000c73",
+    "pinnedRevision": "2a286c7281e4c94bba8f3632bb1cbffab9a38daf",
     "upstreamFile": "src/agents.ts"
   },
   "hosts": [
@@ -34,7 +34,7 @@
       },
       "attribution": {
         "upstreamFile": "src/agents.ts",
-        "upstreamLine": 807
+        "upstreamLine": 810
       }
     },
     {
@@ -1584,7 +1584,7 @@
       },
       "attribution": {
         "upstreamFile": "src/agents.ts",
-        "upstreamLine": 776
+        "upstreamLine": 779
       }
     },
     {
@@ -1762,16 +1762,16 @@
       "destinations": {
         "project": {
           "kind": "literal",
-          "path": ".pi/skills",
-          "raw": "'.pi/skills'"
+          "path": ".agents/skills",
+          "raw": "'.agents/skills'"
         },
         "global": {
           "kind": "join",
           "base": "home",
           "segments": [
-            ".pi/agent/skills"
+            ".agents/skills"
           ],
-          "raw": "join(home, '.pi/agent/skills')"
+          "raw": "join(home, '.agents/skills')"
         }
       },
       "aliases": [],
@@ -1812,7 +1812,7 @@
       },
       "attribution": {
         "upstreamFile": "src/agents.ts",
-        "upstreamLine": 785
+        "upstreamLine": 788
       }
     },
     {
@@ -1843,7 +1843,7 @@
       },
       "attribution": {
         "upstreamFile": "src/agents.ts",
-        "upstreamLine": 589
+        "upstreamLine": 592
       }
     },
     {
@@ -1870,7 +1870,7 @@
       },
       "attribution": {
         "upstreamFile": "src/agents.ts",
-        "upstreamLine": 794
+        "upstreamLine": 797
       }
     },
     {
@@ -1901,7 +1901,7 @@
       },
       "attribution": {
         "upstreamFile": "src/agents.ts",
-        "upstreamLine": 598
+        "upstreamLine": 601
       }
     },
     {
@@ -1932,7 +1932,7 @@
       },
       "attribution": {
         "upstreamFile": "src/agents.ts",
-        "upstreamLine": 607
+        "upstreamLine": 610
       }
     },
     {
@@ -1963,7 +1963,7 @@
       },
       "attribution": {
         "upstreamFile": "src/agents.ts",
-        "upstreamLine": 616
+        "upstreamLine": 619
       }
     },
     {
@@ -1994,7 +1994,7 @@
       },
       "attribution": {
         "upstreamFile": "src/agents.ts",
-        "upstreamLine": 635
+        "upstreamLine": 638
       }
     },
     {
@@ -2025,7 +2025,7 @@
       },
       "attribution": {
         "upstreamFile": "src/agents.ts",
-        "upstreamLine": 625
+        "upstreamLine": 628
       }
     },
     {
@@ -2056,7 +2056,7 @@
       },
       "attribution": {
         "upstreamFile": "src/agents.ts",
-        "upstreamLine": 653
+        "upstreamLine": 656
       }
     },
     {
@@ -2087,7 +2087,7 @@
       },
       "attribution": {
         "upstreamFile": "src/agents.ts",
-        "upstreamLine": 644
+        "upstreamLine": 647
       }
     },
     {
@@ -2118,7 +2118,7 @@
       },
       "attribution": {
         "upstreamFile": "src/agents.ts",
-        "upstreamLine": 662
+        "upstreamLine": 665
       }
     },
     {
@@ -2149,7 +2149,7 @@
       },
       "attribution": {
         "upstreamFile": "src/agents.ts",
-        "upstreamLine": 672
+        "upstreamLine": 675
       }
     },
     {
@@ -2180,7 +2180,7 @@
       },
       "attribution": {
         "upstreamFile": "src/agents.ts",
-        "upstreamLine": 681
+        "upstreamLine": 684
       }
     },
     {
@@ -2211,7 +2211,7 @@
       },
       "attribution": {
         "upstreamFile": "src/agents.ts",
-        "upstreamLine": 690
+        "upstreamLine": 693
       }
     },
     {
@@ -2242,7 +2242,7 @@
       },
       "attribution": {
         "upstreamFile": "src/agents.ts",
-        "upstreamLine": 699
+        "upstreamLine": 702
       }
     },
     {
@@ -2273,7 +2273,7 @@
       },
       "attribution": {
         "upstreamFile": "src/agents.ts",
-        "upstreamLine": 708
+        "upstreamLine": 711
       }
     },
     {
@@ -2304,7 +2304,7 @@
       },
       "attribution": {
         "upstreamFile": "src/agents.ts",
-        "upstreamLine": 816
+        "upstreamLine": 819
       }
     },
     {
@@ -2335,7 +2335,7 @@
       },
       "attribution": {
         "upstreamFile": "src/agents.ts",
-        "upstreamLine": 717
+        "upstreamLine": 720
       }
     },
     {
@@ -2366,7 +2366,7 @@
       },
       "attribution": {
         "upstreamFile": "src/agents.ts",
-        "upstreamLine": 726
+        "upstreamLine": 729
       }
     },
     {
@@ -2397,7 +2397,7 @@
       },
       "attribution": {
         "upstreamFile": "src/agents.ts",
-        "upstreamLine": 749
+        "upstreamLine": 752
       }
     },
     {
@@ -2428,7 +2428,7 @@
       },
       "attribution": {
         "upstreamFile": "src/agents.ts",
-        "upstreamLine": 735
+        "upstreamLine": 738
       }
     },
     {
@@ -2459,7 +2459,7 @@
       },
       "attribution": {
         "upstreamFile": "src/agents.ts",
-        "upstreamLine": 758
+        "upstreamLine": 761
       }
     },
     {
@@ -2490,7 +2490,7 @@
       },
       "attribution": {
         "upstreamFile": "src/agents.ts",
-        "upstreamLine": 767
+        "upstreamLine": 770
       }
     }
   ]

package/registry/skill-baselines.json

@@ -41,6 +41,16 @@
           "references/brief-method.md": "736a5a1ffe58ce0133f783b52a7b412df7a6d5791b5f88c82da9384a4dfe9a3c",
           "references/prompt-contract.md": "6736c2cd4ae586c072368641ff278c5b4042176179383c67825c830aae66993a"
         }
+      },
+      {
+        "release": "0.4.0",
+        "revision": "9028abf5e3933823c4fdc0c363d7f5b82df7be516a14f50fb94763e600565290",
+        "files": {
+          "SKILL.md": "5b184b4bc9b2daf5a134069b6079118c0b75d03d9dee1b02974d68aa5bfb8b37",
+          "agents/openai.yaml": "b736d2cf2b292c74fe2fd8363056e7832e952f7e34f7b0e1bb99bf4f59e550a4",
+          "references/brief-method.md": "8d072e93fd8e080f64e3a1d3edc7a686cb30b8a6860aab7d746d8dbc4b5f3266",
+          "references/prompt-contract.md": "606b004d7022b7d8305b27566d4eb24771461b937d6917d838c673181251561b"
+        }
       }
     ],
     "sigmaperformance": [
@@ -129,6 +139,17 @@
           "references/report-contract.md": "8ee26d5ec331fa2cc85de2affafa27424cfcf6351374f6c018f2e0c9581b4092",
           "references/review-method.md": "e198141860f93c8305133b1879c728b8e6e5715e444d77923a378344acce1448"
         }
+      },
+      {
+        "release": "0.4.0",
+        "revision": "b23935a26a87d8b9ec0ea49d40d6db3ad5e2e34035d66122b2b01253c11d91ea",
+        "files": {
+          "SKILL.md": "d900e0d033861065542308c966a9e2e2ec5322a70ce2614aba6e8bddb7d9fb07",
+          "agents/openai.yaml": "815cfe6c327fd2266cae19403dabda23539563b19b79f84210bbe22cd5876dda",
+          "references/measure.md": "efd083364caedfce9c5e69a2267209d3317cfa218029b48455e49cdc2f9affe0",
+          "references/method.md": "21b2ac620314550ecae3c791bb0b761625765c1e702cdeb4ea241cc6bca4eb48",
+          "references/report.md": "ebabc522ac35dcfd7538abe4657d4933bf795d5ea20242a968592e0c569e7b41"
+        }
       }
     ],
     "sigmawrite": [
@@ -163,6 +184,14 @@
           "SKILL.md": "8db1872ac240efceec949d6b5e13c651b38e1de7b4c82588375c7dcd8f123cb1",
           "agents/openai.yaml": "2ec4a45be0ff5b4688c4d070a859787cf5f8a70728bdeef0da4393c3c4f75082"
         }
+      },
+      {
+        "release": "0.4.0",
+        "revision": "5d1712a4616cfc558ec6ea0df9bd9e4a1ac0313c81bd4f73c293cedeea0d59a9",
+        "files": {
+          "SKILL.md": "8db1872ac240efceec949d6b5e13c651b38e1de7b4c82588375c7dcd8f123cb1",
+          "agents/openai.yaml": "2ec4a45be0ff5b4688c4d070a859787cf5f8a70728bdeef0da4393c3c4f75082"
+        }
       }
     ],
     "sigmarefactor": [
@@ -174,6 +203,40 @@
           "agents/openai.yaml": "4c86a2c835c0ac1d48a5d0d5e2f425afd05a8e7f22786f637b55176e0d25aa7c",
           "references/scan.md": "b3405a49e605ed0e6181fdfb55f918cea88ea12f140f21e2a5301154655b92f2"
         }
+      },
+      {
+        "release": "0.4.0",
+        "revision": "8664476613208eed3042233f2c2e2968a6cab669cc57009c246d97e6f3abc9ff",
+        "files": {
+          "SKILL.md": "d06de949ce6e0f7aab3c643cf42e47c5487b4adfeddadac08eb61df44c6158a8",
+          "agents/openai.yaml": "4c86a2c835c0ac1d48a5d0d5e2f425afd05a8e7f22786f637b55176e0d25aa7c",
+          "references/scan.md": "b3405a49e605ed0e6181fdfb55f918cea88ea12f140f21e2a5301154655b92f2"
+        }
+      }
+    ],
+    "sigmaimprove": [
+      {
+        "release": "0.4.0",
+        "revision": "de6405f8ef3474e5c9fd9140cb9886aa57149711bf431dab20238e94edefcc55",
+        "files": {
+          "SKILL.md": "118dacdc212f6f359ad9be0564492451bb2dc93f1f03c8af0094994caeff3060",
+          "agents/openai.yaml": "328ec0a8fd03293452d5ddeb3a73c5af0de30c280160fb22914c36dea781cb45",
+          "references/categories.md": "58ad43e0da22b5a67f0bec01abc13760ffa835dec9efc07343b07e8326cba7bd",
+          "references/issue.md": "59300698c9a1d32e1d868173b22dea5fcc7ea7b7ca97198faf688256e5638300",
+          "references/lenses.md": "c5f2982ed1f4330035895dabacef550a5c1b241e0e1a370547b8715f89f3f8b3"
+        }
+      }
+    ],
+    "sigmaship": [
+      {
+        "release": "0.4.0",
+        "revision": "ca92c3ccb9ec16743ea1ddd495705c0eee707340d33bf007a894ccd344a57ea6",
+        "files": {
+          "SKILL.md": "fc64bd7c7a1776dffe431592d1643078214d3f78397623895a9d8850a28792d3",
+          "agents/openai.yaml": "8f756500cdf20eaaf9873a8e30dc3faaf6a81dd264b3fa23d04e981f9b207f76",
+          "references/land.md": "0efe8906abdc68409eecfe04b3eede09a276a347471d1dd11f64391ca7adb590",
+          "references/review-round.md": "daa7f06308bc44b772f47438ae4c740b09785e999a17c54933e6ae4a08f733d0"
+        }
       }
     ]
   }

package/registry/source.json

@@ -1,6 +1,6 @@
 {
   "repository": "vercel-labs/skills",
-  "pinnedRevision": "7407f3893ad4dceab546ac002c3ef806e4000c73",
+  "pinnedRevision": "2a286c7281e4c94bba8f3632bb1cbffab9a38daf",
   "upstreamFile": "src/agents.ts",
-  "contentSha256": "8902f56a121ce4b1a800b3aa04d3f83b7baeaf32e1abf441c0b8eabb3f8f89a5"
+  "contentSha256": "7b86576008f3ea20f9f230ce9da4eb81b2affc08ec019d22f5240f279debbb63"
 }

package/sigmabrief/SKILL.md

@@ -16,15 +16,15 @@ Apply these invariants throughout the run:
 - **Explicit-only.** Invoke this skill only when the user asks for briefs, handoffs, spawn/dispatch prompts, or parallel agent prompts. Never treat ambient chat, implement requests, or audit requests as SigmaBrief work even if the host allows implicit skill invocation.
 - **Brief factory only.** Do not implement, branch, commit, push, or open fix pull requests in the *target* product repository. Do not create `SIGMABRIEF-*.md` or other files there.
 - **One shot for briefing.** When work items are present, research → synthesize → return briefs in chat. Do not pause for taste questions.
-- **Ask at most one question** when no work target can be resolved: which issue URL(s), work statement, or repo for `all open`. Do not run a full grill-me session unless the user explicitly asks SigmaBrief to grill them. Planning depth and the worktree question belong in the *generated* brief for the *executing* agent.
+- **Ask at most one question** when no work target can be resolved: which issue URL(s), work statement, or repo for `all open`. Do not run a full `/grilling` session unless the user explicitly asks SigmaBrief to grill them. Planning depth and the worktree question belong in the *generated* brief for the *executing* agent.
 - **Accept anything actionable:** issue URLs, `#N`, `all open` (optionally filtered), a SigmaReview report or one of its waves, SigmaImprove category issues or chosen entries, features, upgrades, bugs, plain English work, or `this session`, plus optional constraints (`do not merge`, skip N, max agents, `approval: auto`).
 - **Waves before parallelism.** Items that touch the same files, schema, or shared state run one after another in the same lane. Only independent items run in parallel. Honor `Depends on` lines from SigmaReview.
-- **Light research then emit.** Read local standards when present (`CLAUDE.md`, `AGENTS.md`, `README`, `CONTRIBUTING`, LEARNINGS, version pins). For GitHub work, inspect issues and open PRs so an in-flight PR becomes a finish/rebase brief, never a second greenfield. Use the web only when needed.
+- **Light research then emit.** Read local standards when present (`CLAUDE.md`, `AGENTS.md`, `README`, `CONTRIBUTING`, LEARNINGS, version pins). For GitHub work, inspect issues and open PRs so an in-flight PR becomes a finish brief, never a second greenfield. Use the web only when needed.
 - **Simple briefs.** Short fenced `text` blocks. No collision-matrix novels. Still mark overlaps and out-of-scope boundaries when obvious.
-- **Quality gate in every brief:** plan first → (executing agent may use `/grill-me` or focused questions, including worktree yes/no) → wait for plan approval → baseline checks green → execute → validate → update docs only when needed → commit → push → open PR (`Closes #N` when applicable) → **do not merge** → self-review for high quality, docs, validation, and low bug-introduction risk before opening the PR → report back in the fixed format.
+- **Quality gate in every brief:** plan first → (executing agent may use `/grilling` or focused questions, including worktree yes/no) → wait for plan approval → baseline checks green → execute → validate → update docs only when needed → commit → push → open PR (`Closes #N` when applicable) → **do not merge** → self-review for high quality, docs, validation, and low bug-introduction risk before opening the PR → report back in the fixed format.
 - **Approval modes.** `approval: plan` (default) waits for plan approval. `approval: auto` lets the agent decide ambiguities itself, record each decision as a ruling in the PR body, and stop only for irreversible or destructive actions, security-sensitive actions, or side effects outside its branch.
 - **Do not merge. Keep any worktree while the PR is open. Cleanup only after human merge or user cancel/abandon.**
-- **Shell native to the executing machine:** PowerShell commands and Windows sibling paths by default; POSIX when the user or repository says so. Do not assume WSL.
+- **Shell native to the executing machine:** use the shell of the machine that runs the agent: PowerShell and Windows paths on Windows, POSIX shell elsewhere. Do not assume WSL.
 - **No secrets** in briefs. Redact tokens, keys, and credentials from issue bodies or notes.
 
 ## Resolve inputs
@@ -35,7 +35,7 @@ Resolve work items in this order:
 2. Otherwise the current Git repository’s open issues when the user asked for `all open` / dispatch without listing IDs.
 3. Otherwise ask only for the missing work target.
 
-Apply user constraints already present (skip N, do not merge, prefer rebase for PR M, max agents) without re-asking.
+Apply user constraints already present (skip N, do not merge, max agents) without re-asking.
 
 ## Execute
 

package/sigmabrief/agents/openai.yaml

@@ -7,6 +7,5 @@ policy:
   products:
   - chatgpt
   - codex
-  - api
   - atlas
-  allow_implicit_invocation: true
+  allow_implicit_invocation: false

package/sigmabrief/references/brief-method.md

@@ -12,8 +12,8 @@
 
 | Actor | May ask |
 |-------|---------|
-| **SigmaBrief** | At most one question if the work target is missing (`Which issue URL(s), work statement, or repo for all open?`). Full grill-me only if the user explicitly asks SigmaBrief to grill them. |
-| **Executing agent** (in the brief) | Plan first; `/grill-me` or focused questions when trade-offs exist — including whether to create an isolated Windows git worktree. |
+| **SigmaBrief** | At most one question if the work target is missing (`Which issue URL(s), work statement, or repo for all open?`). Full `/grilling` only if the user explicitly asks SigmaBrief to grill them. |
+| **Executing agent** (in the brief) | Plan first; `/grilling` or focused questions when trade-offs exist — including whether to create an isolated git worktree. |
 
 SigmaBrief itself stays thin: research enough to write good simple briefs, then emit.
 
@@ -60,7 +60,7 @@ Assign one prompt type:
 | Type | When |
 |------|------|
 | `greenfield` | No open PR addresses the work |
-| `finish-PR` | Open PR/branch already addresses it — rebase/finish only; never a second implementation |
+| `finish-PR` | Open PR/branch already addresses it — finish only; never a second implementation |
 | `skip` | Already on default branch / fixed / user said skip |
 | `blocked` | Upstream-only or human-gate; smallest workaround or tracking note, no giant fork |
 | `session` | Hand the current conversation to a fresh agent: goal, current state, decisions and their reasons, next step, suggested skills. Link specs, issues, PRs, commits, and files instead of copying them. Redact secrets and personal data. |