@ecology91/skills 0.1.2 → 0.1.4

package/README.md

@@ -9,29 +9,29 @@ Developing real applications is hard. Approaches like GSD, BMAD, and Spec-Kit tr
 
 These skills are designed to be small, easy to adapt, and composable. They work with any model. They're based on decades of engineering experience. Hack around with them. Make them your own. Enjoy.
 
-## Quickstart For opencode
+## Quickstart
 
-1. Install the skills into opencode from the fork repo:
+1. Install the skills globally from the fork repo (via [skills.sh](https://skills.sh)):
 
 ```bash
-npx skills@latest add ecology9191/skills -a opencode
+npx skills@latest add ecology9191/skills -g
 ```
 
-2. Or install the published npm package directly:
+2. Or install from a git checkout or the published npm package:
 
 ```bash
 npx --package @ecology91/skills ecology91-skills
 ```
 
-3. For local development on this repo, link the checked-out skills into opencode's global skills directory:
+From a git checkout this symlinks into `~/.agents/skills` so edits in the repo are live. From the published package it copies files instead.
 
-```bash
-./scripts/link-skills.sh
-```
+3. Force a copy install from a checkout with `--copy`.
+
+OpenCode auto-loads `~/.agents/skills` alongside its own config tree, so one global install works across harnesses.
 
-4. Quit and restart opencode so it reloads the skill list.
+4. Quit and restart your agent so it reloads the skill list.
 
-5. Run `/setup-agent-skills` in opencode. It will:
+5. Run `/setup-agent-skills` in your coding agent. It will:
    - Ask you which issue tracker you want to use (GitHub, GitLab, Beads, `.scratch`, or another workflow)
    - Ask you what labels you apply to issues when you triage them (`/triage` uses labels)
    - Ask you where you want to save any docs we create
@@ -156,7 +156,7 @@ Skills I use daily for code work.
 - **[tdd](./skills/engineering/tdd/SKILL.md)** — Test-driven development with a red-green-refactor loop. Builds features or fixes bugs one vertical slice at a time.
 - **[to-issues](./skills/engineering/to-issues/SKILL.md)** — Break any plan, spec, or PRD into independently-grabbable issues on the project issue tracker using vertical slices.
 - **[to-prd](./skills/engineering/to-prd/SKILL.md)** — Turn the current conversation context into a PRD and submit it to the project issue tracker. No interview — just synthesizes what you've already discussed.
-- **[to-qa](./skills/engineering/to-qa/SKILL.md)** — Create a local QA To Do session from completed child work under an explicit parent issue.
+- **[to-qa](./skills/engineering/to-qa/SKILL.md)** — Create a local QA To Do session from completed source work under an explicit issue, including older non-parent Beads issues.
 - **[zoom-out](./skills/engineering/zoom-out/SKILL.md)** — Tell the agent to zoom out and give broader context or a higher-level perspective on an unfamiliar section of code.
 - **[prototype](./skills/engineering/prototype/SKILL.md)** — Build a throwaway prototype to flesh out a design — either a runnable terminal app for state/business-logic questions, or several radically different UI variations toggleable from one route.
 

package/bin/install.mjs

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { execFileSync } from "node:child_process";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
@@ -7,46 +8,87 @@ import { fileURLToPath } from "node:url";
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const buckets = ["engineering", "productivity", "misc"];
 const args = new Set(process.argv.slice(2));
+const destRoot = path.join(os.homedir(), ".agents", "skills");
+const isGitCheckout = fs.existsSync(path.join(root, ".git"));
+const link =
+  args.has("--link") || (isGitCheckout && !args.has("--copy"));
 
 if (args.has("--help") || args.has("-h")) {
-  console.log(`Usage: npx @ecology91/skills [--dry-run]\n\nCopies promoted skills into ~/.config/opencode/skills.`);
+  console.log(`Usage: npx @ecology91/skills [--dry-run] [--copy] [--link]
+
+Install promoted skills into ~/.agents/skills.
+
+From a git checkout, symlinks by default so local edits are picked up live.
+From the published npm package, copies by default.
+
+  --link  Force symlinks (runs scripts/link-skills.sh)
+  --copy  Force copies instead of symlinks`);
   process.exit(0);
 }
 
 const dryRun = args.has("--dry-run");
-const destRoot = path.join(os.homedir(), ".config", "opencode", "skills");
 
-function copySkill(src, dest) {
-  if (dryRun) {
-    console.log(`would install ${path.basename(src)} -> ${dest}`);
-    return;
+function collectSkills() {
+  const skills = [];
+
+  for (const bucket of buckets) {
+    const bucketDir = path.join(root, "skills", bucket);
+    if (!fs.existsSync(bucketDir)) continue;
+
+    for (const entry of fs.readdirSync(bucketDir, { withFileTypes: true })) {
+      if (!entry.isDirectory()) continue;
+
+      const src = path.join(bucketDir, entry.name);
+      if (!fs.existsSync(path.join(src, "SKILL.md"))) continue;
+
+      skills.push([src, path.join(destRoot, entry.name)]);
+    }
   }
 
-  fs.rmSync(dest, { recursive: true, force: true });
-  fs.mkdirSync(path.dirname(dest), { recursive: true });
-  fs.cpSync(src, dest, { recursive: true, force: true });
-  console.log(`installed ${path.basename(src)} -> ${dest}`);
+  return skills;
 }
 
-const skills = [];
-
-for (const bucket of buckets) {
-  const bucketDir = path.join(root, "skills", bucket);
-  if (!fs.existsSync(bucketDir)) continue;
+function installCopy(skills) {
+  if (!dryRun) fs.mkdirSync(destRoot, { recursive: true });
 
-  for (const entry of fs.readdirSync(bucketDir, { withFileTypes: true })) {
-    if (!entry.isDirectory()) continue;
+  for (const [src, dest] of skills) {
+    if (dryRun) {
+      console.log(`would install ${path.basename(src)} -> ${dest}`);
+      continue;
+    }
 
-    const src = path.join(bucketDir, entry.name);
-    if (!fs.existsSync(path.join(src, "SKILL.md"))) continue;
+    fs.rmSync(dest, { recursive: true, force: true });
+    fs.mkdirSync(path.dirname(dest), { recursive: true });
+    fs.cpSync(src, dest, { recursive: true, force: true });
+    console.log(`installed ${path.basename(src)} -> ${dest}`);
+  }
+}
 
-    skills.push([src, path.join(destRoot, entry.name)]);
+function installLink(skills) {
+  if (dryRun) {
+    for (const [src, dest] of skills) {
+      console.log(`would link ${path.basename(src)} -> ${dest} (${src})`);
+    }
+    return;
   }
+
+  execFileSync("bash", [path.join(root, "scripts/link-skills.sh")], {
+    stdio: "inherit",
+  });
 }
 
-if (!dryRun) fs.mkdirSync(destRoot, { recursive: true });
+const skills = collectSkills();
 
-for (const [src, dest] of skills) copySkill(src, dest);
+if (link) {
+  installLink(skills);
+  console.log(
+    `${dryRun ? "Checked" : "Linked"} ${skills.length} skills to ~/.agents/skills.`,
+  );
+} else {
+  installCopy(skills);
+  console.log(
+    `${dryRun ? "Checked" : "Installed"} ${skills.length} skills to ~/.agents/skills.`,
+  );
+}
 
-console.log(`${dryRun ? "Checked" : "Installed"} ${skills.length} skills for opencode.`);
-console.log("Restart opencode to reload the skill list.");
+console.log("Restart your agent (opencode, Cursor, etc.) to reload the skill list.");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ecology91/skills",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "opencode agent skills for real engineering workflows.",
   "license": "MIT",
   "type": "module",
@@ -35,5 +35,13 @@
   ],
   "publishConfig": {
     "access": "public"
+  },
+  "scripts": {
+    "typecheck": "node --check bin/install.mjs && node --check scripts/verify-package-files.mjs",
+    "test": "node bin/install.mjs --dry-run --copy",
+    "link-skills": "./scripts/link-skills.sh",
+    "build": "node scripts/verify-package-files.mjs",
+    "validate:fast": "npm run typecheck && npm run test",
+    "validate": "npm run validate:fast && npm run build"
   }
 }

package/scripts/link-skills.sh

@@ -1,11 +1,11 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-# Links promoted skills in the repository to opencode's global skills
-# directory, so they can be used from any opencode project.
+# Links promoted skills in the repository to ~/.agents/skills so they are
+# available globally across agent harnesses (opencode, Cursor, etc.).
 
 REPO="$(cd "$(dirname "$0")/.." && pwd)"
-DEST="$HOME/.config/opencode/skills"
+DEST="$HOME/.agents/skills"
 
 # If the destination is a symlink that resolves into this repo, we'd end up
 # writing the per-skill symlinks back into the repo's own skills/ tree. Detect

package/scripts/verify-package-files.mjs

@@ -0,0 +1,17 @@
+#!/usr/bin/env node
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const pkg = JSON.parse(fs.readFileSync(path.join(root, "package.json"), "utf8"));
+
+for (const entry of pkg.files) {
+  const target = path.join(root, entry);
+  if (!fs.existsSync(target)) {
+    console.error(`Missing packaged path: ${entry}`);
+    process.exit(1);
+  }
+}
+
+console.log(`Verified ${pkg.files.length} packaged paths.`);

package/skills/engineering/README.md

@@ -11,6 +11,6 @@ Skills I use daily for code work.
 - **[tdd](./tdd/SKILL.md)** — Test-driven development with a red-green-refactor loop. Builds features or fixes bugs one vertical slice at a time.
 - **[to-issues](./to-issues/SKILL.md)** — Break any plan, spec, or PRD into independently-grabbable issues on the project issue tracker using vertical slices.
 - **[to-prd](./to-prd/SKILL.md)** — Turn the current conversation context into a PRD and submit it to the project issue tracker.
-- **[to-qa](./to-qa/SKILL.md)** — Create a local QA To Do session from completed child work under an explicit parent issue.
+- **[to-qa](./to-qa/SKILL.md)** — Create a local QA To Do session from completed source work under an explicit issue, including older non-parent Beads issues.
 - **[zoom-out](./zoom-out/SKILL.md)** — Tell the agent to zoom out and give broader context or a higher-level perspective on an unfamiliar section of code.
 - **[prototype](./prototype/SKILL.md)** — Build a throwaway prototype to flesh out a design — either a runnable terminal app for state/business-logic questions, or several radically different UI variations toggleable from one route.

package/skills/engineering/grill-with-docs/CONTEXT-FORMAT.md

@@ -10,7 +10,7 @@
 ## Language
 
 **Order**:
-{A concise description of the term}
+{A one or two sentence description of the term}
 _Avoid_: Purchase, transaction
 
 **Invoice**:
@@ -20,27 +20,13 @@ _Avoid_: Bill, payment request
 **Customer**:
 A person or organization that places orders.
 _Avoid_: Client, buyer, account
-
-## Relationships
-
-- An **Order** produces one or more **Invoices**
-- An **Invoice** belongs to exactly one **Customer**
-
-## Example dialogue
-
-> **Dev:** "When a **Customer** places an **Order**, do we create the **Invoice** immediately?"
-> **Domain expert:** "No — an **Invoice** is only generated once a **Fulfillment** is confirmed."
-
-## Flagged ambiguities
-
-- "account" was used to mean both **Customer** and **User** — resolved: these are distinct concepts.
 ```
 
 ## Rules
 
 - **Be opinionated.** When multiple words exist for the same concept, pick the best one and list the others as aliases to avoid.
 - **Flag conflicts explicitly.** If a term is used ambiguously, call it out in "Flagged ambiguities" with a clear resolution.
-- **Keep definitions tight.** One sentence max. Define what it IS, not what it does.
+- **Keep definitions tight.** One or two sentences max. Define what it IS, not what it does.
 - **Show relationships.** Use bold term names and express cardinality where obvious.
 - **Only include terms specific to this project's context.** General programming concepts (timeouts, error types, utility patterns) don't belong even if the project uses them extensively. Before adding a term, ask: is this a concept unique to this context, or a general programming concept? Only the former belongs.
 - **Group terms under subheadings** when natural clusters emerge. If all terms belong to a single cohesive area, a flat list is fine.

package/skills/engineering/improve-codebase-architecture/HTML-REPORT.md

@@ -0,0 +1,123 @@
+# HTML Report Format
+
+The architectural review is rendered as a single self-contained HTML file in the OS temp directory. Tailwind and Mermaid both come from CDNs. Mermaid handles graph-shaped diagrams reliably; hand-built divs and inline SVG handle the more editorial visuals (mass diagrams, cross-sections). Mix the two — don't lean on Mermaid for everything, it'll start to look generic.
+
+## Scaffold
+
+```html
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <title>Architecture review — {{repo name}}</title>
+    <script src="https://cdn.tailwindcss.com"></script>
+    <script type="module">
+      import mermaid from "https://cdn.jsdelivr.net/npm/mermaid@11/dist/mermaid.esm.min.mjs";
+      mermaid.initialize({ startOnLoad: true, theme: "neutral", securityLevel: "loose" });
+    </script>
+    <style>
+      /* small custom layer for things Tailwind doesn't cover cleanly:
+         dashed seam lines, hand-drawn-feeling arrow heads, etc. */
+      .seam { stroke-dasharray: 4 4; }
+      .leak { stroke: #dc2626; }
+      .deep { background: linear-gradient(135deg, #0f172a, #1e293b); }
+    </style>
+  </head>
+  <body class="bg-stone-50 text-slate-900 font-sans">
+    <main class="max-w-5xl mx-auto px-6 py-12 space-y-12">
+      <header>...</header>
+      <section id="candidates" class="space-y-10">...</section>
+      <section id="top-recommendation">...</section>
+    </main>
+  </body>
+</html>
+```
+
+## Header
+
+Repo name, date, and a compact legend: solid box = module, dashed line = seam, red arrow = leakage, thick dark box = deep module. No introduction paragraph — straight into the candidates.
+
+## Candidate card
+
+The diagrams carry the weight. Prose is sparse, plain, and uses the glossary terms ([LANGUAGE.md](LANGUAGE.md)) without ceremony.
+
+Each candidate is one `<article>`:
+
+- **Title** — short, names the deepening (e.g. "Collapse the Order intake pipeline").
+- **Badge row** — recommendation strength (`Strong` = emerald, `Worth exploring` = amber, `Speculative` = slate), plus a tag for the dependency category (`in-process`, `local-substitutable`, `ports & adapters`, `mock`).
+- **Files** — monospaced list, `font-mono text-sm`.
+- **Before / After diagram** — the centrepiece. Two columns, side by side. See patterns below.
+- **Problem** — one sentence. What hurts.
+- **Solution** — one sentence. What changes.
+- **Wins** — bullets, ≤6 words each. e.g. "Tests hit one interface", "Pricing logic stops leaking", "Delete 4 shallow wrappers".
+- **ADR callout** (if applicable) — one line in an amber-tinted box.
+
+No paragraphs of explanation. If the diagram needs a paragraph to be understood, redraw the diagram.
+
+## Diagram patterns
+
+Pick the pattern that fits the candidate. Mix them. Don't make every diagram look the same — variety is part of the point.
+
+### Mermaid graph (the workhorse for dependencies / call flow)
+
+Use a Mermaid `flowchart` or `graph` when the point is "X calls Y calls Z, and look at the mess." Wrap it in a Tailwind-styled card so it doesn't feel parachuted in. Style with classDef to colour leakage edges red and the deep module dark. Sequence diagrams work well for "before: 6 round-trips; after: 1."
+
+```html
+<div class="rounded-lg border border-slate-200 bg-white p-4">
+  <pre class="mermaid">
+    flowchart LR
+      A[OrderHandler] --> B[OrderValidator]
+      B --> C[OrderRepo]
+      C -.leak.-> D[PricingClient]
+      classDef leak stroke:#dc2626,stroke-width:2px;
+      class C,D leak
+  </pre>
+</div>
+```
+
+### Hand-built boxes-and-arrows (when Mermaid's layout fights you)
+
+Modules as `<div>`s with borders and labels. Arrows as inline SVG `<line>` or `<path>` elements positioned absolutely over a relative container. Reach for this when you want the "after" diagram to feel like one thick-bordered deep module with greyed-out internals — Mermaid won't render that with the right weight.
+
+### Cross-section (good for layered shallowness)
+
+Stack horizontal bands (`h-12 border-l-4`) to show layers a call passes through. Before: 6 thin layers each doing nothing. After: 1 thick band labelled with the consolidated responsibility.
+
+### Mass diagram (good for "interface as wide as implementation")
+
+Two rectangles per module — one for interface surface area, one for implementation. Before: interface rectangle is nearly as tall as the implementation rectangle (shallow). After: interface rectangle is short, implementation rectangle is tall (deep).
+
+### Call-graph collapse
+
+Before: a tree of function calls rendered as nested boxes. After: the same tree collapsed into one box, with the now-internal calls shown faded inside it.
+
+## Style guidance
+
+- Lean editorial, not corporate-dashboard. Generous whitespace. Serif optional for headings (`font-serif` works well with stone/slate).
+- Colour sparingly: one accent (emerald or indigo) plus red for leakage and amber for warnings.
+- Keep diagrams ~320px tall so before/after sits comfortably side by side without scrolling.
+- Use `text-xs uppercase tracking-wider` for module labels inside diagrams — they should read as schematic, not as UI.
+- The only scripts are the Tailwind CDN and the Mermaid ESM import. The report is otherwise static — no app code, no interactivity beyond Mermaid's own rendering.
+
+## Top recommendation section
+
+One larger card. Candidate name, one sentence on why, anchor link to its card. That's it.
+
+## Tone
+
+Plain English, concise — but the architectural nouns and verbs come straight from [LANGUAGE.md](LANGUAGE.md). Concision is not an excuse to drift.
+
+**Use exactly:** module, interface, implementation, depth, deep, shallow, seam, adapter, leverage, locality.
+
+**Never substitute:** component, service, unit (for module) · API, signature (for interface) · boundary (for seam) · layer, wrapper (for module, when you mean module).
+
+**Phrasings that fit the style:**
+
+- "Order intake module is shallow — interface nearly matches the implementation."
+- "Pricing leaks across the seam."
+- "Deepen: one interface, one place to test."
+- "Two adapters justify the seam: HTTP in prod, in-memory in tests."
+
+**Wins bullets** name the gain in glossary terms: *"locality: bugs concentrate in one module"*, *"leverage: one interface, N call sites"*, *"interface shrinks; implementation absorbs the wrappers"*. Don't write *"easier to maintain"* or *"cleaner code"* — those terms aren't in the glossary and don't earn their place.
+
+No hedging, no throat-clearing, no "it's worth noting that…". If a sentence could be a bullet, make it a bullet. If a bullet could be cut, cut it. If a term isn't in [LANGUAGE.md](LANGUAGE.md), reach for one that is before inventing a new one.

package/skills/engineering/improve-codebase-architecture/SKILL.md

@@ -44,20 +44,30 @@ Then use the Agent tool with `subagent_type=Explore` to walk the codebase. Don't
 
 Apply the **deletion test** to anything you suspect is shallow: would deleting it concentrate complexity, or just move it? A "yes, concentrates" is the signal you want.
 
-### 2. Present candidates
+### 2. Present candidates as an HTML report
 
-Present a numbered list of deepening opportunities. For each candidate:
+Write a self-contained HTML file to the OS temp directory so nothing lands in the repo. Resolve the temp dir from `$TMPDIR`, falling back to `/tmp` (or `%TEMP%` on Windows), and write to `<tmpdir>/architecture-review-<timestamp>.html` so each run gets a fresh file. Open it for the user — `xdg-open <path>` on Linux, `open <path>` on macOS, `start <path>` on Windows — and tell them the absolute path.
+
+The report uses **Tailwind via CDN** for layout and styling, and **Mermaid via CDN** for diagrams where a graph/flow/sequence reliably communicates the structure. Mix Mermaid with hand-crafted CSS/SVG visuals — use Mermaid when relationships are graph-shaped (call graphs, dependencies, sequences), and hand-built divs/SVG when you want something more editorial (mass diagrams, cross-sections, collapse animations). Each candidate gets a **before/after visualisation**. Be visual.
+
+For each candidate, the same template as before, but rendered as a card:
 
 - **Files** — which files/modules are involved
 - **Problem** — why the current architecture is causing friction
 - **Solution** — plain English description of what would change
-- **Benefits** — explained in terms of locality and leverage, and also in how tests would improve
+- **Benefits** — explained in terms of locality and leverage, and how tests would improve
+- **Before / After diagram** — side-by-side, custom-drawn, illustrating the shallowness and the deepening
+- **Recommendation strength** — one of `Strong`, `Worth exploring`, `Speculative`, rendered as a badge
+
+End the report with a **Top recommendation** section: which candidate you'd tackle first and why.
 
 **Use CONTEXT.md vocabulary for the domain, and [LANGUAGE.md](LANGUAGE.md) vocabulary for the architecture.** If `CONTEXT.md` defines "Order," talk about "the Order intake module" — not "the FooBarHandler," and not "the Order service."
 
-**ADR conflicts**: if a candidate contradicts an existing ADR, only surface it when the friction is real enough to warrant revisiting the ADR. Mark it clearly (e.g. _"contradicts ADR-0007 — but worth reopening because…"_). Don't list every theoretical refactor an ADR forbids.
+**ADR conflicts**: if a candidate contradicts an existing ADR, only surface it when the friction is real enough to warrant revisiting the ADR. Mark it clearly in the card (e.g. a warning callout: _"contradicts ADR-0007 — but worth reopening because…"_). Don't list every theoretical refactor an ADR forbids.
+
+See [HTML-REPORT.md](HTML-REPORT.md) for the full HTML scaffold, diagram patterns, and styling guidance.
 
-Do NOT propose interfaces yet. Ask the user: "Which of these would you like to explore?"
+Do NOT propose interfaces yet. After the file is written, ask the user: "Which of these would you like to explore?"
 
 ### 3. Grilling loop
 

package/skills/engineering/to-qa/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: to-qa
-description: Create a local QA To Do session from completed child work under an explicit parent issue. Use when user runs `/to-qa <parent issue>` or asks to turn completed issue work into QA checks.
+description: Create a local QA To Do session from completed work under an explicit source issue, including older non-parent Beads issues. Use when user runs `/to-qa <issue>` or asks to turn completed issue work into QA checks.
 compatibility: opencode
 metadata:
   workflow: sandcastle-ralph-qa
@@ -8,16 +8,18 @@ metadata:
 
 # To QA
 
-Use this skill when the user runs `/to-qa <parent issue>`.
+Use this skill when the user runs `/to-qa <issue>`.
+
+For Beads, the issue can be a parent with child work, an older cumulative issue, a discovered-from source issue, or a completed standalone issue with no parent-child structure. For structured `.scratch`, the issue is normally a parent with child files.
 
 This skill reads completed implementation work from the configured issue tracker and writes a local QA session to QA To Do. It does not mutate tracker issues, pass/fail state, checklist items, evidence, archive state, or deletion state.
 
 ## Required Inputs
 
-- An explicit parent issue reference from the user.
+- An explicit source issue reference from the user.
 - The current repository path.
-- A configured issue tracker workflow in `docs/agents/issue-tracker.md`, or explicit child issue references from the user.
-- Completed implementation child work only.
+- A configured issue tracker workflow in `docs/agents/issue-tracker.md`, or explicit source issue references from the user.
+- Completed implementation source work only.
 - Access to the `qa-to-do` MCP server.
 
 ## Supported Paths
@@ -25,19 +27,20 @@ This skill reads completed implementation work from the configured issue tracker
 - Prefer `qa-to-do.run_to_qa_parent` for normal `/to-qa` usage.
 - Use `qa-to-do.qa_session_create` only when you have manually built a complete, validated QA session payload.
 - `run_to_qa_parent` currently automates Beads and structured `.scratch` trackers.
+- The `parentIssueId` MCP field is legacy-named. For Beads, pass the requested source issue ID even when it is cumulative or standalone rather than a literal parent.
 - For GitHub, GitLab, or custom trackers, use the repo-documented parent/child convention to gather completed child work, then call `qa_session_create` with a concrete QA session payload.
 
 ## Workflow
 
-1. Inspect the explicit parent issue in the current repo.
-2. Read `docs/agents/issue-tracker.md` to understand how this repo identifies child work for a parent issue.
-3. Find completed source work only: closed/completed/done Beads child issues, structured `.scratch` child files, or another repo-documented completed-child convention.
+1. Inspect the explicit source issue in the current repo.
+2. Read `docs/agents/issue-tracker.md` to understand how this repo identifies completed source work.
+3. Find completed source work only: closed/completed/done Beads child issues, discovered-from issues, older cumulative or standalone Beads issues, structured `.scratch` child files, or another repo-documented convention.
 4. Exclude open, blocked, incomplete, or unrelated work and keep those exclusions as warnings for the final report.
 5. Prefer acceptance criteria, QA notes, and source issue evidence over changed-file inference when creating checks.
 6. Read commits, changed files, and implementation context only as needed to make checks concrete and human-verifiable.
 7. Create QA checks with title, runnable steps, expected result, source issue ID, source evidence, stable ID, and fingerprint.
 8. Call the `qa-to-do` MCP server to create the QA session.
-9. Report the session title, source parent, item count, and warnings.
+9. Report the session title, source issue, item count, and warnings.
 
 ## MCP Usage
 
@@ -45,7 +48,7 @@ For Beads or structured `.scratch` repos, call `qa-to-do.run_to_qa_parent` with:
 
 ```json
 {
-  "parentIssueId": "<parent issue id>",
+  "parentIssueId": "<requested issue id>",
   "repoPath": "<absolute repo path>",
   "repoName": "<optional repo name>",
   "tracker": "auto"
@@ -54,17 +57,19 @@ For Beads or structured `.scratch` repos, call `qa-to-do.run_to_qa_parent` with:
 
 Set `tracker` to `beads` or `scratch` only when the repo or user explicitly requires one. Use `auto` by default.
 
-If `run_to_qa_parent` reports that no supported tracker was detected, multiple trackers require a choice, or no completed child work exists, stop and report the issue clearly. Do not invent QA checks from unrelated closed work.
+If `run_to_qa_parent` reports that no supported tracker was detected, multiple trackers require a choice, or no completed source work exists, stop and report the issue clearly. Do not invent QA checks from unrelated closed work. Do not fail only because a Beads issue has no parent-child children; older Beads issues may be cumulative or standalone.
 
 When manually calling `qa_session_create`, the payload must include only completed source work and must preserve source evidence. Do not use it to mutate existing QA To Do state.
 
 ## Beads Guidance
 
 - If the repo uses Beads and local automation is available, prefer `run_to_qa_parent` with `tracker: "auto"` or `tracker: "beads"`.
-- If you must inspect Beads manually, fetch the full child set with `bd list --parent <parent-id> --status all --json --limit 0`.
-- Include only child issues whose status is closed, completed, or done according to the repo's Beads vocabulary.
-- Read included children with `bd show <child-id> --json` and `bd comments <child-id> --json` when extra evidence is needed.
+- If you must inspect Beads manually, start with `bd show <issue-id> --json`, then fetch parent-child candidates with `bd list --parent <issue-id> --status all --json --limit 0` when the repo supports parent structure.
+- If no parent-child children exist, fetch the full Beads issue set with `bd list --status all --json --limit 0`, look for completed `discovered-from` dependencies that point to the requested issue, then fall back to the requested issue itself when it is closed, completed, or done.
+- Include only source issues whose status is closed, completed, or done according to the repo's Beads vocabulary.
+- Read included source issues with `bd show <issue-id> --json` and `bd comments <issue-id> --json` when extra evidence is needed.
 - Look for related implementation commits only when issue evidence is not enough to write a concrete QA check.
+- Do not require parent-child relationships for Beads; older Sandcastle/RALPH Beads may be cumulative or standalone.
 - Do not create, update, label, comment on, close, or claim Beads issues during `/to-qa`.
 
 ## Scratch Guidance
@@ -77,9 +82,9 @@ When manually calling `qa_session_create`, the payload must include only complet
 ## Rules
 
 - Do not create checks from open, blocked, incomplete, review-only, or unrelated work.
-- Do not create checks from parent PRD text alone; checks must trace to completed implementation child work.
+- Do not create checks from planning or PRD text alone; checks must trace to completed implementation source work.
 - If there is no completed source work, fail clearly and do not create a session.
-- If `docs/agents/issue-tracker.md` does not explain how to find completed children for the parent issue, ask the user for explicit child issue references.
+- If `docs/agents/issue-tracker.md` does not explain how to find completed source work and Beads cumulative/standalone fallback does not apply, ask the user for explicit source issue references.
 - Do not write vague checks like "verify implementation" or "works as expected".
 - Do not mutate pass/fail/skip/edit/archive/delete state through MCP.
 - Do not file, close, claim, label, comment on, or update tracker issues during `/to-qa`.

package/skills/productivity/handoff/SKILL.md

@@ -4,10 +4,12 @@ description: Compact the current conversation into a handoff document for anothe
 argument-hint: "What will the next session be used for?"
 ---
 
-Write a handoff document summarising the current conversation so a fresh agent can continue the work. Save it to a path produced by `mktemp -t handoff-XXXXXX.md` (read the file before you write to it).
+Write a handoff document summarising the current conversation so a fresh agent can continue the work. Save to the temporary directory of the user's OS - not the current workspace.
 
-Suggest the skills to be used, if any, by the next session.
+Include a "suggested skills" section in the document, which suggests skills that the agent should invoke.
 
 Do not duplicate content already captured in other artifacts (PRDs, plans, ADRs, issues, commits, diffs). Reference them by path or URL instead.
 
+Redact any sensitive information, such as API keys, passwords, or personally identifiable information.
+
 If the user passed arguments, treat them as a description of what the next session will focus on and tailor the doc accordingly.