@hybridlabor-api/aos 4.6.6 → 4.7.1

package/.claude/workflows/startcycle-dispatch.mjs

@@ -92,6 +92,42 @@ if (!fs && typeof process !== 'undefined') {
   } catch {}
 }
 
+let archifyContractPromise;
+async function loadArchifyContract() {
+  if (!archifyContractPromise) {
+    archifyContractPromise = (async () => {
+      if (typeof process === 'undefined') return null;
+      try {
+        return await import(new URL('../../lib/aos-archify-contract.mjs', import.meta.url).href);
+      } catch {
+        return null;
+      }
+    })();
+  }
+  return archifyContractPromise;
+}
+
+function readStdinSync() {
+  const chunks = [];
+  const buffer = Buffer.alloc(64 * 1024);
+  const sleeper = new Int32Array(new SharedArrayBuffer(4));
+  for (;;) {
+    let bytes;
+    try {
+      bytes = fs.readSync(0, buffer, 0, buffer.length, null);
+    } catch (error) {
+      if (error?.code === 'EAGAIN' || error?.code === 'EWOULDBLOCK') {
+        Atomics.wait(sleeper, 0, 0, 2);
+        continue;
+      }
+      throw error;
+    }
+    if (bytes === 0) break;
+    chunks.push(Buffer.from(buffer.subarray(0, bytes)));
+  }
+  return Buffer.concat(chunks).toString('utf8');
+}
+
 let inputGoal = null;
 let inputSkills = [];
 let isHookInvocation = false;
@@ -100,7 +136,7 @@ let isHookInvocation = false;
 if (typeof process !== 'undefined' && process.stdin && !process.stdin.isTTY && fs) {
   try {
     let stdinRaw = '';
-    try { stdinRaw = fs.readFileSync(0, 'utf8').trim(); } catch {}
+    try { stdinRaw = readStdinSync().trim(); } catch {}
     if (stdinRaw) {
       isHookInvocation = true;
       let payload = null;
@@ -325,12 +361,54 @@ if (typeof globalThis.agent === 'undefined') {
       return { phase: 'escalated' };
     }
 
+    if (label.startsWith('archify-verify')) {
+      const failVerify = (error) => ({ validateOk: false, deliverOk: false, checksPassed: 0, checkCount: 9, error: String(error).slice(0, 400) });
+      if (!fs || !path || !child_process) return failVerify('archify verify has no process runtime in this environment');
+      const contract = await loadArchifyContract();
+      if (!contract || typeof contract.runArchifyBoundary !== 'function') return failVerify('archify contract unavailable');
+      const repoRoot = process.cwd();
+      const spec = contract.ARCHITECTURE_SPEC_PATH;
+      const html = contract.ARCHITECTURE_HTML_PATH;
+      const localBin = typeof contract.resolveArchifyBin === 'function' ? contract.resolveArchifyBin(repoRoot) : null;
+      const run = (args, options) => child_process.spawnSync(
+        localBin ? process.execPath : 'aos-archify',
+        [...(localBin ? [localBin] : []), ...args],
+        {
+          cwd: options.cwd,
+          encoding: 'utf8',
+          timeout: options.timeoutMs,
+          maxBuffer: options.maxBuffer,
+          shell: false,
+        }
+      );
+      try {
+        const result = await contract.runArchifyBoundary({
+          bin: localBin,
+          cwd: repoRoot,
+          specPath: spec,
+          htmlPath: html,
+          run,
+        });
+        if (!result || result.ok !== true) return failVerify((result && result.error) || 'archify boundary failed');
+        return {
+          validateOk: result.validate?.status === 0,
+          deliverOk: result.deliver?.status === 0,
+          checksPassed: result.receipt?.checksPassed ?? 0,
+          checkCount: result.receipt?.checkCount ?? contract.ARCHITECTURE_CHECK_COUNT ?? 9,
+          error: '',
+        };
+      } catch (error) {
+        return failVerify((error && error.message) || 'archify boundary executor failed');
+      }
+    }
+
     // LLM Agent Steps: runner adapter / graceful execution
     if (child_process) {
       try {
         const agyRes = child_process.spawnSync('agy', ['--print', prompt, '--output-format', 'json', '--print-timeout', '30s'], {
           encoding: 'utf8',
           timeout: 35000,
+          shell: false,
         });
         if (agyRes.status === 0 && agyRes.stdout) {
           const jsonMatch = agyRes.stdout.match(/\{[\s\S]*\}/);
@@ -550,6 +628,38 @@ async function mergeStateD() {
   );
 }
 
+async function verifyArchifyArtifacts() {
+  return await agent(
+    'You are the dedicated /startcycle-graph archify-verify step -- a deterministic check, not a reasoning task. ' +
+      'Working directory is the repository root. Run exactly these two commands in this order, ' +
+      'each as an argument array with no shell and no string interpolation: ' +
+      'first ["validate", "architecture", "production_artifacts/00_architecture.json", "--quality", "showcase", "--json"], ' +
+      'then ["deliver", "architecture", "production_artifacts/00_architecture.json", "production_artifacts/00_architecture.html", "--quality", "showcase", "--json"], ' +
+      'both via the node archify binary at skills/global_config/archify/bin/archify.mjs with a 120 second timeout each. ' +
+      'Only run deliver when validate exits 0. Read at most 65536 bytes of each command output. ' +
+      'Deliver passes only on a showcase receipt with 9 of 9 checks and 0 errors plus sha256 evidence for specification and artifact. ' +
+      'On any non-zero exit, oversized output, or invalid receipt, report failure and preserve the previous HTML artifact untouched -- ' +
+      'never invent success and never write state.artifacts.architecture yourself. ' +
+      'Keep any logged output bounded to 400 characters with home directories and long hashes redacted.\n\n' +
+      'Return only: { "validateOk": boolean, "deliverOk": boolean, "checksPassed": number, "checkCount": number, "error": string }.',
+    {
+      label: `archify-verify-${iteration}`,
+      model: 'haiku',
+      schema: {
+        type: 'object',
+        required: ['validateOk', 'deliverOk', 'checksPassed', 'checkCount', 'error'],
+        properties: {
+          validateOk: { type: 'boolean' },
+          deliverOk: { type: 'boolean' },
+          checksPassed: { type: 'number' },
+          checkCount: { type: 'number' },
+          error: { type: 'string' },
+        },
+      },
+    }
+  );
+}
+
 // ---------------------------------------------------------------------
 // Load the node registry. First thing this run does, per comment block
 // item #4 -- everything below is derived from this, nothing is hardcoded.
@@ -685,20 +795,22 @@ if (mandatorySkillNames.length > 0) {
       'this workflow may be driven from a harness whose directory is not ~/.claude. ' +
       'If this project has its own skills/ directory, also accept skills/<name>/SKILL.md or skills/<container>/<name>/SKILL.md. ' +
       'This is a read-only lookup, not a reasoning task -- do not invent a path that does not exist, and never report a close match as `found`.\n\n' +
-      'For any name that does NOT resolve, list up to five installed skills whose directory names are plausible near-misses ' +
+      'For any name that does NOT resolve, read lib/ecc-store-index.json and list exact available store item names in `store_matches`. ' +
+      'Also list up to five installed skills whose directory names are plausible near-misses ' +
       '(substring, obvious typo, or the same words in another order) in `suggestions`. Read the real directory listing to do this -- ' +
       'suggest only names that actually exist on disk. `--skill=` requires an exact directory name, and a user who mistyped one ' +
       'has no way to discover the right spelling from an error that only says "not found".\n\n' +
-      'Return only: { "found": string[], "missing": string[], "suggestions": string[] }.',
+      'Return only: { "found": string[], "missing": string[], "store_matches": string[], "suggestions": string[] }.',
     {
       label: 'validate-mandatory-skills',
       model: 'haiku',
       schema: {
         type: 'object',
-        required: ['found', 'missing'],
+        required: ['found', 'missing', 'store_matches'],
         properties: {
           found: { type: 'array', items: { type: 'string' } },
           missing: { type: 'array', items: { type: 'string' } },
+          store_matches: { type: 'array', items: { type: 'string' } },
           suggestions: { type: 'array', items: { type: 'string' } },
         },
       },
@@ -706,15 +818,21 @@ if (mandatorySkillNames.length > 0) {
   );
   const missing = skillCheckResult?.missing ?? [];
   if (missing.length > 0) {
+    const storeMatches = skillCheckResult?.store_matches ?? [];
     const near = skillCheckResult?.suggestions ?? [];
-    return await escalate(
-      `--skill named skill(s) that could not be found on this machine: ${missing.join(', ')}. ` +
-        (near.length
-          ? `Did you mean: ${near.join(', ')}? `
-          : 'No installed skill has a similar name. ') +
-        '--skill= takes the exact skill directory name; run /ask-tim to find the one you want. ' +
-        'Refusing to silently proceed without a mandated skill.'
-    );
+    let message = `--skill named skill(s) that could not be found on this machine: ${missing.join(', ')}. `;
+    if (storeMatches.length > 0) {
+      message += `Found in the AOS / ECC Store: ${storeMatches.join(', ')}. ` +
+        `Run: aos store install ${storeMatches.join(' ')} ` +
+        'Then re-run your startcycle command. ';
+    } else if (near.length > 0) {
+      message += `Did you mean: ${near.join(', ')}? `;
+    } else {
+      message += 'No installed or store skill has a similar name. ';
+    }
+    message += '--skill= takes the exact skill directory name; run /ask-tim to find the one you want. ' +
+      'Refusing to silently proceed without a mandated skill.';
+    return await escalate(message);
   }
   mandatorySkills = skillCheckResult?.found ?? mandatorySkillNames;
 }
@@ -738,9 +856,14 @@ while (!approved) {
         : '') +
       `Turn this goal into a system plan with an explicit capability map (module boundaries, ` +
       `dependency direction, build order). Write it to production_artifacts/00_execution_plan.md. ` +
-      `Set state.goal, state.phase = "plan", state.artifacts.plan to that path, and state.mandatory_skills to ${JSON.stringify(mandatorySkills)}. ` +
+      `Author the architecture as Archify architecture JSON to production_artifacts/00_architecture.json, ` +
+      `run aos-archify validate architecture production_artifacts/00_architecture.json --quality showcase --json during repair and ` +
+      `aos-archify deliver architecture production_artifacts/00_architecture.json production_artifacts/00_architecture.html --quality showcase --json once for final acceptance, ` +
+      `link it from the relevant plan component with a url: production_artifacts/00_architecture.html line, ` +
+      `and set state.goal, state.phase = "plan", state.artifacts.plan to the plan path, state.artifacts.architecture to production_artifacts/00_architecture.html only on a passing showcase receipt (9/9 checks, 0 errors), and state.mandatory_skills to ${JSON.stringify(mandatorySkills)}. ` +
+      `On a failed validate/deliver preserve the previous HTML and report deliverOk false instead of proceeding silently. ` +
       `Decide whether the goal needs the Media_EventTech build node (TouchDesigner/show-control/3D/media work) -- most goals don't.\n\n` +
-      `Return only: { "planPath": string, "needsMedia": boolean }.`,
+      `Return only: { "planPath": string, "needsMedia": boolean, "architectureSpec": string, "architectureHtml": string, "deliverOk": boolean }.`,
     {
       label: `architect-${iteration}`,
       agentType: architectNode.agentType,
@@ -748,22 +871,78 @@ while (!approved) {
       schema: {
         type: 'object',
         required: ['planPath', 'needsMedia'],
-        properties: { planPath: { type: 'string' }, needsMedia: { type: 'boolean' } },
+        properties: {
+          planPath: { type: 'string' },
+          needsMedia: { type: 'boolean' },
+          architectureSpec: { type: 'string' },
+          architectureHtml: { type: 'string' },
+          deliverOk: { type: 'boolean' },
+        },
       },
     }
   );
 
   planPath = architectResult?.planPath;
   needsMedia = !!architectResult?.needsMedia;
+  const architectureSpec = architectResult?.architectureSpec || 'production_artifacts/00_architecture.json';
+  const architectureHtml = architectResult?.architectureHtml || 'production_artifacts/00_architecture.html';
+  const deliverOk = architectResult?.deliverOk !== false;
 
   if (!planPath) {
     return await escalate('Architect did not return a plan path.');
   }
+  if (!deliverOk) {
+    iteration++;
+    if (iteration >= MAX_ITERATIONS) {
+      return await escalate(
+        'Archify deliver reported failure at the Architect step; previous HTML preserved.',
+        { planPath }
+      );
+    }
+    lastRejectionReason = 'Archify deliver/validate failed; previous HTML preserved. Repair the spec and deliver again.';
+    continue;
+  }
+  if (architectureSpec !== 'production_artifacts/00_architecture.json' || architectureHtml !== 'production_artifacts/00_architecture.html') {
+    iteration++;
+    if (iteration >= MAX_ITERATIONS) {
+      return await escalate(
+        'Archify boundary rejected untrusted artifact paths; previous HTML preserved.',
+        { planPath }
+      );
+    }
+    lastRejectionReason = 'Archify boundary rejected untrusted artifact paths; previous HTML preserved. Use production_artifacts/00_architecture.json and production_artifacts/00_architecture.html.';
+    continue;
+  }
+  const boundaryResult = await verifyArchifyArtifacts();
+  if (!boundaryResult || boundaryResult.validateOk !== true || boundaryResult.deliverOk !== true) {
+    iteration++;
+    const boundaryError = typeof boundaryResult?.error === 'string' && boundaryResult.error
+      ? boundaryResult.error.slice(0, 400)
+      : 'archify validate/deliver failed';
+    if (iteration >= MAX_ITERATIONS) {
+      return await escalate(
+        `Archify boundary verification failed; previous HTML preserved: ${boundaryError}`,
+        { planPath }
+      );
+    }
+    lastRejectionReason = `Archify boundary verification failed; previous HTML preserved: ${boundaryError}. Repair the spec and deliver again.`;
+    continue;
+  }
+  try {
+    if (fs && fs.existsSync && fs.existsSync(architectureHtml) && child_process) {
+      const canvas = child_process.spawn('aos-plan-canvas', ['open', architectureHtml, '--no-open'], { cwd: process.cwd(), timeout: 15000, stdio: 'ignore', shell: false, detached: true });
+      if (canvas && typeof canvas.on === 'function') canvas.on('error', () => {});
+      if (canvas && typeof canvas.unref === 'function') canvas.unref();
+    }
+  } catch {}
 
   const techLeadResult = await agent(
     `You are acting as the ${techleadNode.label} agent (${techleadNode.personaFile}). ${dispatchNote(techleadNode)}${skillsNote(techleadNode)}\n\n` +
       `Read the plan at ${planPath}. Approve it only if it has an explicit capability map: ` +
       `module boundaries, dependency direction, and build order are all stated, not implicit. ` +
+      `Apply the architecture gate: reject unless ${architectureSpec} and ${architectureHtml} both exist, ` +
+      `the plan links the diagram with a url: ${architectureHtml} line, ` +
+      `and the deliver receipt is a passing showcase receipt (9/9 checks, 0 errors, failure preserves the previous HTML). ` +
       (mandatorySkills.length > 0
         ? `The user also required this run to use the following skill(s) via /startcycle-graph's --skill flag: ${mandatorySkills.join(', ')}. ` +
           `Reject the plan if it does not actually account for them — catching that here costs one planning round, ` +
@@ -818,6 +997,13 @@ if (BUILD_NODES.length === 0) {
 const NODE_ENUM = BUILD_NODES.map((n) => n.id);
 const NODE_NAMES = humanList(NODE_ENUM);
 
+// Live map (agenttrail skill, Trigger B): best-effort, never blocks or fails the run.
+// aos-trail exits on its own when a map for this repo is already running.
+try {
+  child_process?.spawn('aos-trail', [process.cwd(), '--plan', 'production_artifacts/00_execution_plan.md', '--no-open'],
+    { detached: true, stdio: 'ignore', shell: false }).on('error', () => {}).unref();
+} catch { /* no child_process in this runtime: run without the map */ }
+
 let findings = [];
 let reviewedClean = false;
 let nodesToRun = BUILD_NODES; // first pass: everyone applicable
@@ -983,7 +1169,7 @@ while (!reviewedClean) {
 // state.d + merge treatment as the build/review loop above.
 // ---------------------------------------------------------------------
 
-const GATE_KEYS = ['lint', 'typecheck', 'tests', 'a11y', 'seo'];
+const GATE_KEYS = ['lint', 'typecheck', 'tests', 'a11y', 'seo', 'security'];
 const GATE_VALUE_ENUM = ['pass', 'fail', 'skip'];
 let allGatesPass = false;
 let lastGate = null;
@@ -992,7 +1178,7 @@ while (!allGatesPass) {
   const shipResult = await agent(
     `You are acting as the ${shippingNode.label} agent (${shippingNode.personaFile}). ${dispatchNote(shippingNode)}${skillsNote(shippingNode)}\n\n` +
       `Run the automated quality gate against the artifacts from the plan at ${planPath}: lint, typecheck, ` +
-      `tests, a11y, seo. Use the repository's own commands (npm test / pytest / tsc --noEmit / etc -- detect ` +
+      `tests, a11y, seo, security. Use the repository's own commands (npm test / pytest / tsc --noEmit / etc -- detect ` +
       `which apply; use "skip" only for a check that genuinely doesn't apply to this repo, not for one you didn't run). ` +
       `Write production_artifacts/04_release_report.md and update state.gate. ` +
       `If every gate check is 'pass' or 'skip', you must also set state.phase = "ready_to_ship" in state.json.\n\n` +

package/.opencode/agents/architect.md

@@ -5,8 +5,13 @@ model: opus
 ---
 Turns the user's goal (or `/bdbrainstorm` / `/grill-me` output) into a system plan. Reads existing architecture before proposing changes. Does not coordinate execution or invoke other agents — that is TechLead's job, decided by the dispatcher, not by Architect.
 
-**Primary skills:** bdbrainstorm, planning-with-files, concise-planning
+**Primary skills:** bdbrainstorm, planning-with-files, concise-planning, archify
 
 **MCP servers used:** openwiki-skill, memb_mcp
 
-**Output artifact(s):** `production_artifacts/00_execution_plan.md`
+**Output artifact(s):** `production_artifacts/00_execution_plan.md`, `production_artifacts/00_architecture.json`, `production_artifacts/00_architecture.html`
+
+- The plan uses the agenttrail component convention (`## Name {#id}`, `needs:`, `files:`, tasks `- [ ] ... {#id}`).
+- The Architect authors the architecture as Archify `architecture` JSON to `production_artifacts/00_architecture.json`, runs `aos-archify validate architecture <spec> --quality showcase --json` during repair and `aos-archify deliver architecture <spec> production_artifacts/00_architecture.html --quality showcase --json` once for final acceptance, and records `state.artifacts.architecture` only on a passing showcase receipt (9/9 checks, 0 errors). A failed validate/deliver preserves the previous HTML and escalates at the Architect→TechLead boundary.
+- The relevant plan component links the delivered diagram with a `url: production_artifacts/00_architecture.html` line so the live map opens it from the card.
+- Plan-canvas reviews that HTML too via the existing path as fixed argv `aos-plan-canvas open production_artifacts/00_architecture.html --no-open` with `shell: false` from the repo root (no new port, single open, no shell interpolation). A missing or unavailable canvas never invalidates the verified architecture; the `url:` line and the `aos-trail . --plan production_artifacts/00_execution_plan.md --no-open` map stay authoritative.

package/.opencode/agents/techlead.md

@@ -10,3 +10,5 @@ Reviews Architect's plan for a capability map (module boundaries, dependency dir
 **MCP servers used:** memb_mcp
 
 **Output artifact(s):** capability-map approval recorded in `state.json` (no separate markdown file — this is a gate, not a deliverable)
+
+- TechLead rejects the plan when the architecture gate fails: `production_artifacts/00_architecture.json` and `production_artifacts/00_architecture.html` are missing, the `url: production_artifacts/00_architecture.html` link is absent from the plan, or the deliver receipt is not a passing showcase receipt (9/9 checks, 0 errors). A failed receipt preserves the previous HTML and sends the run back to Architect.

package/.opencode/plugins/bdb-aos.js

@@ -7,6 +7,8 @@
  *    unless the user explicitly authorized it with the literal word "GO".
  * 2. chat.message: Ambient memory injection (memB). Injects relevant project & user
  *    memories as ephemeral context from ~/.MemBDB/memb.db via node:sqlite.
+ * 3. tool.execute.before/after: Best-effort live-map telemetry for the AOS
+ *    agenttrail daemon (PreToolUse/PostToolUse, fire-and-forget).
  *
  * Zero external runtime dependencies. Fails open on memory lookup, fails closed
  * on unguarded destructive actions.
@@ -35,6 +37,50 @@ function verifyGoAuthorized(lastPrompt) {
   return trimmed.toUpperCase() === 'GO';
 }
 
+// Best-effort fire-and-forget telemetry for the AOS live map (agenttrail daemon).
+// 300 ms timeout per request, all errors swallowed, never throws. Self-contained
+// on purpose: the plugin must not import from mcps/.
+const pendingArgs = new Map();
+
+async function postTrail(event) {
+  const body = JSON.stringify(event);
+  const ports = process.env.AGENTTRAIL_PORT
+    ? [Number(process.env.AGENTTRAIL_PORT)]
+    : Array.from({ length: 15 }, (_, i) => 5330 + i);
+  await Promise.allSettled(
+    ports.map((port) =>
+      fetch(`http://127.0.0.1:${port}/hook`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body,
+        signal: AbortSignal.timeout(300),
+      }).catch(() => {})
+    )
+  );
+}
+
+function mapTrailToolName(name) {
+  const lower = (name || '').toLowerCase();
+  if (lower === 'edit') return 'Edit';
+  if (lower === 'write') return 'Write';
+  if (lower === 'bash') return 'Bash';
+  if (lower === 'read') return 'Read';
+  return lower ? lower.charAt(0).toUpperCase() + lower.slice(1) : '';
+}
+
+function mapTrailToolInput(args, directory) {
+  const mapped = {};
+  if (args && typeof args === 'object') {
+    if (typeof args.filePath === 'string' && args.filePath) {
+      mapped.file_path = path.resolve(directory, args.filePath);
+    }
+    if (typeof args.command === 'string') {
+      mapped.command = args.command;
+    }
+  }
+  return mapped;
+}
+
 // Extract ambient memory from local memB database
 async function getMembContext(prompt, currentDir) {
   const home = os.homedir();
@@ -133,6 +179,20 @@ export default async function bdbAosPlugin(input) {
     },
 
     'tool.execute.before': async (toolInput, toolOutput) => {
+      // Live-map telemetry first; must never affect the go-gate logic below.
+      try {
+        const tool_name = mapTrailToolName(toolInput.tool);
+        const tool_input = mapTrailToolInput(toolOutput?.args, directory);
+        pendingArgs.set(toolInput.callID, tool_input);
+        postTrail({
+          hook_event_name: 'PreToolUse',
+          session_id: toolInput.sessionID,
+          cwd: directory,
+          agent: 'opencode',
+          tool_name,
+          tool_input,
+        });
+      } catch {}
       const toolName = (toolInput.tool || '').toLowerCase();
       // Intercept bash, terminal, or command execution tools
       if (toolName === 'bash' || toolName === 'terminal' || toolName === 'shell' || toolName === 'exec' || toolName === 'run_command') {
@@ -167,5 +227,20 @@ export default async function bdbAosPlugin(input) {
         }
       }
     },
+
+    'tool.execute.after': async (toolInput) => {
+      try {
+        const tool_input = pendingArgs.get(toolInput.callID);
+        pendingArgs.delete(toolInput.callID);
+        postTrail({
+          hook_event_name: 'PostToolUse',
+          session_id: toolInput.sessionID,
+          cwd: directory,
+          agent: 'opencode',
+          tool_name: mapTrailToolName(toolInput.tool),
+          tool_input,
+        });
+      } catch {}
+    },
   };
 }

package/THIRD_PARTY_NOTICES.md

@@ -99,7 +99,15 @@ browser-internal identifiers private to the served page
 No ECC tests, hooks (`scripts/hooks/plan-canvas-*.js`), or the
 `commands/plan-canvas.md` wrapper were ported.
 
-### License text
+### 3. Store index
+
+The AOS Store exposes selected ECC Markdown capabilities through
+`lib/ecc-store-index.json` at pinned commit
+`e482e579415fde18357cafce70f177ae19fd7f03`. The index contains only
+`skills/**/SKILL.md` and `agents/*.md` metadata. Installation verifies the raw
+Markdown SHA-256 before writing it. Scripts, hooks, rules, and non-entrypoint
+Markdown files are excluded from the Phase 1 store.
+
 
 ```
 MIT License
@@ -231,6 +239,54 @@ redistributable.
 | `CloudAI-X/threejs-skills` | No `LICENSE` file; README claims MIT. | `threejs-skills` |
 | `Shpigford/skills` | Repository returns **404** — deleted, renamed, or made private. Provenance cannot be verified at all. | `readme` |
 
+## tt-a1i/archify
+
+<https://github.com/tt-a1i/archify> — MIT. Copyright (c) 2026 tt-a1i (Archify),
+Copyright (c) 2025 Cocoon AI (based on Cocoon-AI/architecture-diagram-generator, MIT).
+
+`skills/global_config/archify/` is upstream `archify/` at commit `9e35d2b`,
+without `test/`, rendered example HTML, and the remote update check
+(`scripts/check-update.mjs`, `scripts/update-contract.mjs`); AOS pins the version.
+The skill's own `LICENSE` and `THIRD_PARTY_NOTICES.md` ship alongside it.
+
+---
+
+## sodiumsun/agenttrail
+
+<https://github.com/sodiumsun/agenttrail> — MIT.
+
+`skills/global_config/agenttrail/` carries the Map runtime only
+(`bin/agenttrail.mjs`, `public/index.html`) at commit `e4ba2da`, with its
+`LICENSE`. Kitchen is not included. Four patches, each marked `// AOS patch:`:
+a `--plan <path>` flag, a `hook --agent <name>` flag, serving files under
+`production_artifacts/` so a card's relative `url:` opens, and AOS wording in
+the page when `--plan` is set (real plan path, no upstream init/backfill hints).
+
+---
+
+## duriantaco/skylos
+
+<https://github.com/duriantaco/skylos> — Apache-2.0. Copyright duriantaco.
+
+Tracked in `.agents/vendor-manifest.json` at pinned commit
+`0c95b002424453983d5c96708cf7865939745d98`. Diff-based AST and static security
+analyzer feeding the shipping gate, for `bdb-security-audit` and
+`godmode-shipping`.
+
+---
+
+## SnailSploit/claude-red
+
+<https://github.com/SnailSploit/claude-red> — MIT.
+Copyright (c) 2024-2025 SnailSploit / Kai Aizen.
+
+Tracked in `.agents/vendor-manifest.json` at pinned commit
+`739512a8588b28ff3b554e669391c22508602878`. Defensive audit heuristics and
+vulnerability checklists for `bdb-security-audit` and `security-reviewer`;
+the upstream offensive exploit content is stripped and not carried over.
+
+---
+
 ## Note on `mcps/`
 
 Sub-repositories vendored under `mcps/` carry their own `LICENSE` files in