@ikon85/agent-workflow-kit 0.36.0 → 0.36.2

package/.agents/skills/kit-update/SKILL.md

@@ -54,6 +54,10 @@ release contain the same artifact.
    data, infer an external fact, or manufacture `pending`/`not-applicable` to
    make a capability appear ready.
 
+   File identity includes the package-declared mode as well as bytes. A
+   mode-only Core delta is an update and must be applied transactionally; it
+   must not survive preview as `unchanged` only to fail candidate verification.
+
    Readiness-schema adoption also keeps the Claude and Codex instruction
    surfaces compatible. When exactly one applicable instruction surface has a
    non-empty `## Prod` section and another has no such section, the staged
@@ -112,7 +116,9 @@ release contain the same artifact.
    request, but the latter still needs a sanitized exact preview and separate
    explicit approval before any remote command. For a project-specific edit, recommend
    `npx @ikon85/agent-workflow-kit@latest own <path> --as=explicit-fork` so
-   future updates treat that path as an independent fork. A generic experiment
+   future updates treat that path as an independent fork. `own` snapshots the
+   path's current local bytes as the explicit-fork ledger identity, including
+   when it follows an already-detected local edit. A generic experiment
    retained only until it returns upstream uses
    `npx @ikon85/agent-workflow-kit@latest contribute start <path>`. Prepare its
    bounded local artifact, when the route report permits it, with `contribute prepare <path>

package/.claude/skills/kit-update/SKILL.md

@@ -54,6 +54,10 @@ release contain the same artifact.
    data, infer an external fact, or manufacture `pending`/`not-applicable` to
    make a capability appear ready.
 
+   File identity includes the package-declared mode as well as bytes. A
+   mode-only Core delta is an update and must be applied transactionally; it
+   must not survive preview as `unchanged` only to fail candidate verification.
+
    Readiness-schema adoption also keeps the Claude and Codex instruction
    surfaces compatible. When exactly one applicable instruction surface has a
    non-empty `## Prod` section and another has no such section, the staged
@@ -112,7 +116,9 @@ release contain the same artifact.
    request, but the latter still needs a sanitized exact preview and separate
    explicit approval before any remote command. For a project-specific edit, recommend
    `npx @ikon85/agent-workflow-kit@latest own <path> --as=explicit-fork` so
-   future updates treat that path as an independent fork. A generic experiment
+   future updates treat that path as an independent fork. `own` snapshots the
+   path's current local bytes as the explicit-fork ledger identity, including
+   when it follows an already-detected local edit. A generic experiment
    retained only until it returns upstream uses
    `npx @ikon85/agent-workflow-kit@latest contribute start <path>`. Prepare its
    bounded local artifact, when the route report permits it, with `contribute prepare <path>

package/.claude/skills/to-issues/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: to-issues
-description: Break a Feature or Program plan, spec, or PRD into independently-grabbable issues on the project issue tracker. This is the single public Planning facade: explicit Feature identity uses tracer-bullet decomposition; explicit Program identity delegates to the internal graph engine.
+description: "Break a Feature or Program plan, spec, or PRD into independently-grabbable issues on the project issue tracker. This is the single public Planning facade: explicit Feature identity uses tracer-bullet decomposition; explicit Program identity delegates to the internal graph engine."
 ---
 
 <!-- project-extension:protocol-v1:start -->

package/README.md

@@ -445,6 +445,16 @@ the old way. Decision record:
 
 ## Release notes
 
+### 0.36.2
+
+- changed: `.claude/skills/to-issues/SKILL.md`
+
+### 0.36.1
+
+- changed: `.agents/skills/kit-update/SKILL.md`
+- changed: `.claude/skills/kit-update/SKILL.md`
+- changed: `src/lib/manifest.mjs`
+
 ### 0.36.0
 
 - added: `.agents/skills/setup-workflow/contribution-routing.md`

package/agent-workflow-kit.package.json

@@ -1,5 +1,5 @@
 {
-  "kitVersion": "0.36.0",
+  "kitVersion": "0.36.2",
   "files": [
     {
       "path": ".agents/skills/ask-matt/SKILL.md",
@@ -377,7 +377,7 @@
       "ownerSkill": "kit-update",
       "surface": "codex",
       "installRole": "consumer",
-      "sha256": "e00b50698ac5f03caaf8b389ad478789ce43bfa01c01d180557e001a8c46d20c",
+      "sha256": "ea34bd16072783325c263b4afc4eefc39f0aabdbb53731b84500b46db69ef2c1",
       "mode": 420,
       "origin": "kit"
     },
@@ -1699,7 +1699,7 @@
       "ownerSkill": "kit-update",
       "surface": "claude",
       "installRole": "consumer",
-      "sha256": "e00b50698ac5f03caaf8b389ad478789ce43bfa01c01d180557e001a8c46d20c",
+      "sha256": "ea34bd16072783325c263b4afc4eefc39f0aabdbb53731b84500b46db69ef2c1",
       "mode": 420,
       "origin": "kit"
     },
@@ -2207,7 +2207,7 @@
       "ownerSkill": "to-issues",
       "surface": "claude",
       "installRole": "consumer",
-      "sha256": "dee58a06620f21ccdd753e6d575cc5006ce67236ec43c77c4439d4552cca8e94",
+      "sha256": "7cc957d9883ac205904df9fc3ba2d29e7f13661b6511b355f56115ac992e2a09",
       "mode": 420,
       "origin": "kit"
     },
@@ -2883,7 +2883,7 @@
       "path": "src/lib/manifest.mjs",
       "kind": "script",
       "installRole": "consumer",
-      "sha256": "a1a01efa6bca0fc5ed2fcac1d2434d6c013f5e528adecfc63a597b9d52475e15",
+      "sha256": "f2920f2b25a700be080fbba122a809bf509080673b806aaab2b0c773c8d8267f",
       "mode": 420,
       "origin": "kit"
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ikon85/agent-workflow-kit",
-  "version": "0.36.0",
+  "version": "0.36.2",
   "description": "Portable AI-agent workflow skills (plan → execute → land → learn) for Claude Code & Codex — grilling, TDD, diagnosis, two-axis code review, cross-model Codex review, design & domain-modeling, plus a skill router (ask-matt). npx init/update/diff/uninstall.",
   "type": "module",
   "bin": {

package/scripts/test_skill_frontmatter_lint.py

@@ -74,6 +74,8 @@ def parse_scalar(value: str) -> str:
         if len(value) < 2 or not value.endswith("'"):
             raise FrontmatterError("unterminated single-quoted scalar")
         return value[1:-1].replace("''", "'")
+    if ": " in value:
+        raise FrontmatterError("mapping values are not allowed in a plain scalar")
     return value.split(" #", 1)[0].strip()
 
 
@@ -193,6 +195,12 @@ class ValidatorBehaves(unittest.TestCase):
         md = self._tmp_skill('---\nname: demo\ndescription: "Use „x" then y, z"\n---\nbody\n')
         self.assertTrue(any("does not parse" in p for p in validate(md)))
 
+    def test_plain_scalar_colon_followed_by_space_is_flagged(self):
+        md = self._tmp_skill(
+            "---\nname: demo\ndescription: This is invalid YAML: mapping-like text.\n---\nbody\n"
+        )
+        self.assertTrue(any("does not parse" in p for p in validate(md)))
+
     def test_name_dir_mismatch_is_flagged(self):
         md = self._tmp_skill("---\nname: wrong\ndescription: ok\n---\nbody\n")
         self.assertTrue(any("but directory is 'demo'" in p for p in validate(md)))

package/src/commands/own.mjs

@@ -3,6 +3,7 @@ import { validateConsumerFile } from '../lib/consumerPath.mjs';
 import {
   CONSUMER_MANIFEST_NAME, readManifest, withOrigin, writeManifest,
 } from '../lib/manifest.mjs';
+import { sha256File } from '../lib/hash.mjs';
 
 /** Mark one tracked consumer file as kit- or consumer-owned. */
 export async function setOwnership({ consumerRoot, path, origin, ownershipState }) {
@@ -12,8 +13,13 @@ export async function setOwnership({ consumerRoot, path, origin, ownershipState
   const manifestPath = join(consumerRoot, CONSUMER_MANIFEST_NAME);
   const manifest = await readManifest(manifestPath);
   if (!manifest) throw new Error('not initialised — run `init` first');
-  const next = withOrigin(manifest, path, origin, ownershipState);
+  const validatedOwnership = withOrigin(manifest, path, origin, ownershipState);
   await validateConsumerFile(consumerRoot, path);
+  const installedSha256 = origin === 'consumer'
+    ? await sha256File(join(consumerRoot, path)) : undefined;
+  const next = installedSha256
+    ? withOrigin(manifest, path, origin, ownershipState, installedSha256)
+    : validatedOwnership;
   await writeManifest(manifestPath, next);
   return { path, origin, ownershipState: origin === 'consumer'
     ? (ownershipState ?? 'explicit-fork') : undefined };

package/src/lib/manifest.mjs

@@ -95,7 +95,9 @@ export function indexByPath(manifest, key) {
 }
 
 /** Return a manifest with one tracked entry moved to the requested ownership state. */
-export function withOrigin(manifest, path, origin, ownershipState = 'explicit-fork') {
+export function withOrigin(
+  manifest, path, origin, ownershipState = 'explicit-fork', installedSha256,
+) {
   if (![KIT_ORIGIN, CONSUMER_ORIGIN].includes(origin)) {
     throw new Error(`invalid manifest origin: ${origin}`);
   }
@@ -119,7 +121,12 @@ export function withOrigin(manifest, path, origin, ownershipState = 'explicit-fo
       if (ownershipState !== 'explicit-fork') {
         throw new Error(`invalid consumer ownership state: ${ownershipState}`);
       }
-      return { ...entry, origin, ownershipState };
+      return {
+        ...entry,
+        ...(installedSha256 ? { installedSha256 } : {}),
+        origin,
+        ownershipState,
+      };
     }),
   };
 }

package/src/lib/updateReconcile.mjs

@@ -1,4 +1,4 @@
-import { access, readFile, rm } from 'node:fs/promises';
+import { access, lstat, readFile, rm } from 'node:fs/promises';
 import { join } from 'node:path';
 import { sha256File } from './hash.mjs';
 import { lineDiff, writeAtomic } from './atomicWrite.mjs';
@@ -141,7 +141,9 @@ export async function reconcile({ kitRoot, consumerRoot, decide = () => false, d
       continue;
     }
     const userEdited = current !== prior.installedSha256;
-    const upstreamChanged = file.sha256 !== prior.installedSha256;
+    const currentMode = (await lstat(dest)).mode & 0o777;
+    const upstreamChanged = file.sha256 !== prior.installedSha256
+      || currentMode !== file.mode;
     if (!userEdited && upstreamChanged) {
       if (!dryRun) await writeAtomic(dest, await readFile(join(kitRoot, file.path)), file.mode);
       nextInstalled.push(entry(file, file.sha256));