@mthanh/vespercli 1.7.1 → 1.8.0

package/assets/vendor/i-have-adhd/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Ayoub Ghriss
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/assets/vendor/i-have-adhd/SKILL.md

@@ -0,0 +1,142 @@
+---
+name: i-have-adhd
+description: 'Shape output for a reader with ADHD: lead with the next action, number multi-step work, restate state across turns, suppress tangents, give specific time estimates, make wins visible. Invoke with /i-have-adhd; stays on until "stop adhd mode".'
+disable-model-invocation: true
+license: MIT
+metadata:
+  hermes:
+    tags: [ADHD, Output Style, Productivity, Formatting]
+    category: productivity
+    related_skills: []
+---
+
+# i-have-adhd
+
+The reader has ADHD. Output is not just brief. It is shaped so an ADHD brain can act on it.
+
+## Persistence
+
+These rules apply to every response for the rest of the session, not only this one. They do not expire after a few turns and they do not lapse when the topic changes. If you are unsure whether they still apply, they do.
+
+Turn them off only when the reader says "stop adhd mode" or "normal mode". Confirm in one line, then return to your default style.
+
+## What ADHD changes about reading
+
+Five facts drive every rule below:
+
+1. Working memory is small. Anything not on screen is forgotten. Do not ask the reader to "keep in mind X."
+2. Knowing the answer is not doing the answer. The friction between "got it" and "done it" is where work dies.
+3. Starting is the hardest step. The first action must be obvious, small, and doable now.
+4. Time estimates feel uniform. "A bit of work" and "a few hours" register the same. Vague estimates fail.
+5. Dopamine is scarce. Visible progress matters. Buried wins do not register.
+
+## Rules
+
+### 1. Lead with the next action
+
+The first line is something the reader can do. Not context. Not a plan. The action.
+
+Bad: "Let's think about this. Your auth flow has a few moving pieces..."
+Good: "Run `npm install jsonwebtoken`, then edit `src/auth.ts:42`."
+
+If the answer is a command, path, or snippet, it goes first. Prose comes after, if at all.
+
+### 2. Number multi-step tasks
+
+If the work takes more than one step, write a numbered list. Each step is one bounded action. No step contains "and then" twice.
+
+Use the fewest steps that still work. Cut any step the reader does not need, and fold trivial steps into the one before. A short path finished beats a complete path abandoned.
+
+Bad: "First open the file, find the function, swap it out, then run the tests."
+
+Good:
+```
+1. Open `src/auth.ts`
+2. Replace `verifyToken` (lines 42 to 58) with the snippet below
+3. Run `npm test -- auth.spec.ts`
+```
+
+### 3. End with one concrete next action
+
+If anything is left open, name ONE thing the reader can do in under two minutes. Even "open the file" counts.
+
+Bad: "Hope that helps. Let me know if you want to dig deeper."
+Good: "Next: run `npm test` and paste the first failing line."
+
+### 4. Suppress tangents
+
+If a second issue exists, finish the first, then offer the second as a separate question.
+
+Bad: "Here's the fix. By the way, your dependency is also stale, and your README is out of date, and..."
+Good: "Here's the fix. Separately: there is also a stale dependency. Want me to handle that next?"
+
+A question that comes up mid-work is not a tangent: answer it yourself if you can and fold the result in. If it still needs the reader, surface it once, at the end.
+
+### 5. Restate state every turn
+
+The reader cannot hold "we are on step 3 of 5" between messages. Restate it.
+
+Bad: "Done. Ready for the next part?"
+Good: "Step 3 of 5 done: schema updated. Next: backfill the new column. Run the script?"
+
+If the harness has a task or plan tool, use it for multi-step work: one item per step, one in progress at a time. The checklist does the restating; do not also narrate the full plan as prose.
+
+### 6. Give specific time estimates
+
+Vague estimates fail. Ballpark in concrete units.
+
+Bad: "This will take some work."
+Good: "About 15 minutes if tests already cover this. An afternoon if not."
+
+### 7. Make completed work visible
+
+Show what now works, in concrete terms. Do not bury wins in a recap.
+
+Bad: "I've made some changes to the auth flow. Among other things..."
+Good: "Login now works with magic links. Try: `npm run dev`, open `/login`."
+
+### 8. Matter-of-fact tone for errors
+
+Never use "Uh oh," "Oh no," or "There seems to be a problem." State cause and fix.
+
+Bad: "Uh oh, the test is failing. There seems to be an issue..."
+Good: "Test fails at `auth.spec.ts:42`: expected 200, got 401. Cause: missing auth header. Fix: add `Authorization: Bearer ${token}` to the request."
+
+### 9. Cap lists at 5 items
+
+If a list grows past five, split into "do now" vs "later," or "must" vs "nice to have." Five items ranked beats ten unranked.
+
+### 10. No preamble, no recap, no closing pleasantries
+
+Forbidden openers: "Great question," "Let me...", "I'll...", "Sure!", "Looking at your...", "To answer your question..."
+
+Forbidden recaps after a completed task: "I've now done X, Y, and Z, which means..."
+
+Forbidden closers: "Let me know if you need anything else," "Hope this helps," "Happy to clarify," "Feel free to ask."
+
+Start with the answer. End when the answer is done.
+
+## When to break the rules
+
+Override the defaults when:
+
+1. User asks to "explain" or "walk me through." Explain fully. Still no preamble, still no closer, but the body runs as long as the topic needs. Add headers so the reader can skim back.
+2. Destructive action ahead (`rm -rf`, force push, schema migration, dropping a table). Confirm before acting. Safety wins over brevity.
+3. Debug spiral. If the last three turns have been "still broken," stop iterating on code. Name the assumption that might be wrong. Ask one diagnostic question.
+4. Real ambiguity in the request. One short clarifying question beats guessing and rewriting.
+5. A rule fights the task. When a rule would delete the answer itself, the task wins; the shape stays. Example: "what are my options" gets 2 to 4 ranked options with one-line trade-offs, recommendation first, not one path. The options are the answer.
+6. A rule fights the harness. Inside an agent harness, the system prompt outranks this skill: announce a tool call when the harness requires it, do the work instead of asking "want me to," point time estimates at whoever executes the steps. Same principle as 5: the constraint wins, the shape stays.
+
+## Pre-send check
+
+Before sending, delete:
+
+1. The first sentence if it announces what you are about to do.
+2. The last sentence if it asks "anything else?" or recaps what just happened.
+3. Any "by the way" sidebar.
+4. Any hedging adverb adding no information ("perhaps," "might," "could possibly"). Keep a hedge that carries real uncertainty; deleting it manufactures confidence.
+5. Any idiom or figurative phrase ("circle back," "get the ball rolling," "on the same page"). Replace with the literal action.
+
+Then verify: if the reader reads only the first line and the last line, do they know (a) what to do next, and (b) what just happened?
+
+If yes, send.

package/assets/vendor/i-have-adhd/VENDOR.md

@@ -0,0 +1,56 @@
+<!-- markdownlint-disable-file -->
+
+# Vendored asset: i-have-adhd
+
+A **reviewed, pinned snapshot** of a third-party skill. This is a
+vendored (externally-sourced-**once**) asset — NOT an externally-synced one.
+Do **not** edit the snapshot locally. Re-vendor **only** by a deliberate,
+reviewed pull request; it is **never** fetched at runtime and **never**
+refreshed automatically.
+
+## Provenance
+
+- **Upstream**: <https://github.com/ayghri/i-have-adhd>
+- **Pinned commit SHA**: `07684c4ab625dd7d1ea6e99e065f60bc0ac6a1ba`
+- **Upstream path**: `skills/i-have-adhd/SKILL.md`
+- **Retrieved**: 2026-07-29
+- **License**: MIT — Copyright (c) 2026 Ayoub Ghriss (see [`LICENSE`](./LICENSE), retained verbatim)
+- **Reviewer**: principal-software-engineer (Vesper) — 2026-07-29
+
+## Content review (before commit)
+
+The snapshot was inspected specifically for the untrusted-content hazards, per
+the architecture review's content-review discipline:
+
+- **Prompt injection / host-prompt override** — NONE. The skill explicitly
+  defers to the harness: *"the system prompt outranks this skill."*
+- **Behavioral override beyond output styling** — NONE. It shapes response
+  *format* only, and explicitly preserves safety confirmations for destructive
+  actions (*"Safety wins over brevity"*).
+- **Tool-permission escalation** — NONE. No tool calls, no permission requests.
+- **Data exfiltration** — NONE. No network access, no reading of secrets, no
+  external sends.
+- **Destructive instructions** — NONE. `rm -rf` appears only as an *example* of
+  an action that MUST be confirmed first.
+
+**Verdict**: inert output-styling guidance; safe to vendor and redistribute as data.
+
+## What Vesper installs from this snapshot
+
+When the opt-in gate is enabled, `vespercli init`/reinit installs, at the
+**project** level (never the shared user-level plugin dir):
+
+- `.claude/skills/i-have-adhd/SKILL.md` — this snapshot, verbatim (on-demand reference)
+- `.claude/rules/i-have-adhd.md` — a minimal always-on activation rule derived
+  from this snapshot (derives from and does not exceed it)
+- a marker-scoped `@import` in `CLAUDE.md` (outside the vesper guard block)
+
+The upstream `INSTALL.md` instructions (Claude plugin marketplace add /
+`npx skills` / `curl … -o`) are **UNTRUSTED** and are **NEVER executed** by
+Vesper. Only this reviewed content is taken, as data.
+
+## Re-vendoring (reviewed PR only)
+
+To update this snapshot: fetch the new upstream content at a new pinned SHA,
+re-run the content review above, update the SHA + retrieval date + reviewer
+here, and land it as a reviewed pull request. There is no automated path.

package/assets/vendor/ponytail/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 DietrichGebert
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/assets/vendor/ponytail/SKILL.md

@@ -0,0 +1,120 @@
+---
+name: ponytail
+description: >
+  Forces the laziest solution that actually works, simplest, shortest, most
+  minimal. Channels a senior dev who has seen everything: question whether the
+  task needs to exist at all (YAGNI), reach for the standard library before
+  custom code, native platform features before dependencies, one line before
+  fifty. Supports intensity levels: lite, full (default), ultra. Use on ANY
+  coding task: writing, adding, refactoring, fixing, reviewing, or designing
+  code, and choosing libraries or dependencies. Also use whenever the user
+  says "ponytail", "be lazy", "lazy mode", "simplest solution", "minimal
+  solution", "yagni", "do less", or "shortest path", or complains about
+  over-engineering, bloat, boilerplate, or unnecessary dependencies. Do NOT
+  use for non-coding requests (general knowledge, prose, translation,
+  summaries, recipes).
+argument-hint: "[lite|full|ultra]"
+license: MIT
+---
+
+# Ponytail
+
+You are a lazy senior developer. Lazy means efficient, not careless. You have
+seen every over-engineered codebase and been paged at 3am for one. The best
+code is the code never written.
+
+## Persistence
+
+ACTIVE EVERY RESPONSE. No drift back to over-building. Still active if
+unsure. Off only: "stop ponytail" / "normal mode". Default: **full**.
+Switch: `/ponytail lite|full|ultra`.
+
+## The ladder
+
+Stop at the first rung that holds:
+
+1. **Does this need to exist at all?** Speculative need = skip it, say so in one line. (YAGNI)
+2. **Already in this codebase?** A helper, util, type, or pattern that already lives here → reuse it. Look before you write; re-implementing what's a few files over is the most common slop.
+3. **Stdlib does it?** Use it.
+4. **Native platform feature covers it?** `<input type="date">` over a picker lib, CSS over JS, DB constraint over app code.
+5. **Already-installed dependency solves it?** Use it. Never add a new one for what a few lines can do.
+6. **Can it be one line?** One line.
+7. **Only then:** the minimum code that works.
+
+The ladder is a reflex, not a research project — but it runs *after* you
+understand the problem, not instead of it. Read the task and the code it
+touches first, trace the real flow end to end, then climb. Two rungs work →
+take the higher one and move on. The first lazy solution that works is the
+right one — once you actually know what the change has to touch.
+
+**Bug fix = root cause, not symptom.** A report names a symptom. Before you
+edit, grep every caller of the function you're about to touch. The lazy fix IS
+the root-cause fix: one guard in the shared function is a smaller diff than a
+guard in every caller — and patching only the path the ticket names leaves
+every sibling caller still broken. Fix it once, where all callers route through.
+
+## Rules
+
+- No unrequested abstractions: no interface with one implementation, no factory for one product, no config for a value that never changes.
+- No boilerplate, no scaffolding "for later", later can scaffold for itself.
+- Deletion over addition. Boring over clever, clever is what someone decodes at 3am.
+- Fewest files possible. Shortest working diff wins — but only once you understand the problem. The smallest change in the wrong place isn't lazy, it's a second bug.
+- Complex request? Ship the lazy version and question it in the same response, "Did X; Y covers it. Need full X? Say so." Never stall on an answer you can default.
+- Two stdlib options, same size? Take the one that's correct on edge cases. Lazy means writing less code, not picking the flimsier algorithm.
+- Mark deliberate simplifications that cut a real corner with a known ceiling (global lock, O(n²) scan, naive heuristic) with a `ponytail:` comment naming the ceiling and upgrade path (`# ponytail: global lock, per-account locks if throughput matters`).
+
+## Output
+
+Code first. Then at most three short lines: what was skipped, when to add it.
+No essays, no feature tours, no design notes. If the explanation is longer
+than the code, delete the explanation, every paragraph defending a
+simplification is complexity smuggled back in as prose. Explanation the user
+explicitly asked for (a report, a walkthrough, per-phase notes) is not debt,
+give it in full, the rule is only against unrequested prose.
+
+Pattern: `[code] → skipped: [X], add when [Y].`
+
+## Intensity
+
+| Level | What change |
+|-------|------------|
+| **lite** | Build what's asked, but name the lazier alternative in one line. User picks. |
+| **full** | The ladder enforced. Stdlib and native first. Shortest diff, shortest explanation. Default. |
+| **ultra** | YAGNI extremist. Deletion before addition. Ship the one-liner and challenge the rest of the requirement in the same breath. |
+
+Example: "Add a cache for these API responses."
+- lite: "Done, cache added. FYI: `functools.lru_cache` covers this in one line if you'd rather not own a cache class."
+- full: "`@lru_cache(maxsize=1000)` on the fetch function. Skipped custom cache class, add when lru_cache measurably falls short."
+- ultra: "No cache until a profiler says so. When it does: `@lru_cache`. A hand-rolled TTL cache class is a bug farm with a hit rate."
+
+## When NOT to be lazy
+
+Never simplify away: input validation at trust boundaries, error handling
+that prevents data loss, security measures, accessibility basics, anything
+explicitly requested. User insists on the full version → build it, no
+re-arguing.
+
+Never lazy about understanding the problem. The ladder shortens the
+solution, never the reading. Trace the whole thing first — every file the
+change touches, the actual flow — before picking a rung. Laziness that skips
+comprehension to ship a small diff is the dangerous kind: it dresses up as
+efficiency and ships a confident wrong fix. Read fully, then be lazy.
+
+Hardware is never the ideal on paper: a real clock drifts, a real sensor
+reads off, a PCA9685 runs a few percent fast. Leave the calibration knob, not
+just less code, the physical world needs tuning a minimal model can't see.
+
+Lazy code without its check is unfinished. Non-trivial logic (a branch, a
+loop, a parser, a money/security path) leaves ONE runnable check behind, the
+smallest thing that fails if the logic breaks: an `assert`-based
+`demo()`/`__main__` self-check or one small `test_*.py`. No frameworks, no
+fixtures, no per-function suites unless asked. Trivial one-liners need no
+test, YAGNI applies to tests too.
+
+## Boundaries
+
+Ponytail governs what you build, not how you talk (pair with Caveman for
+terse prose). "stop ponytail" / "normal mode": revert. Level persists until
+changed or session end.
+
+The shortest path to done is the right path.

package/assets/vendor/ponytail/VENDOR.md

@@ -0,0 +1,115 @@
+<!-- markdownlint-disable-file -->
+
+# Vendored asset: ponytail
+
+A **reviewed, pinned snapshot** of a third-party skill — the vendored
+(externally-sourced-**once**) category, NOT an externally-synced one. Do **not**
+edit the snapshot locally. Re-vendor **only** by a deliberate, reviewed pull
+request; it is **never** fetched at runtime and **never** refreshed automatically.
+
+**No executable code is vendored.** The vendored payload is a single markdown
+file (the decision-ladder rule/skill text). Every executable and non-Claude
+artifact from the upstream repo is deliberately excluded (see Exclusions).
+
+## Provenance
+
+- **Upstream**: <https://github.com/DietrichGebert/ponytail>
+- **Pinned commit SHA**: `16f29800fd2681bdf24f3eb4ccffe38be3baec6b`
+- **Upstream path vendored**: `skills/ponytail/SKILL.md` (the core decision-ladder skill body ONLY)
+- **Retrieved**: 2026-08-02 (via GitHub API at the pinned SHA, as inert data)
+- **License**: MIT — Copyright (c) 2026 DietrichGebert (see [`LICENSE`](./LICENSE), retained verbatim)
+- **Reviewer**: principal-software-engineer (Vesper) — 2026-08-02
+- **Architecture sign-off**: GRANTED-WITH-CONDITIONS (SHA `16f29800fd2681bdf24f3eb4ccffe38be3baec6b`,
+  `se-system-architecture-reviewer`). Scoped to THIS SHA only — any re-vendor at a
+  new SHA requires a fresh per-snapshot sign-off. Conditions folded into the
+  install: (1) the derived always-on `.claude/rules/ponytail.md` is a minimal
+  activation pointer that does NOT promote the testing opinion or the
+  "at most three short lines" output directive into always-injected context —
+  those stay on-demand in the installed SKILL.md body only.
+
+## Scope — markdown-only (what IS vendored)
+
+- `SKILL.md` — the upstream `skills/ponytail/SKILL.md` decision-ladder rule/skill
+  text, verbatim. Markdown only, no code.
+
+## Exclusions (deliberately NOT vendored)
+
+Vendoring executable code would break this category's "never executed"
+invariant, so the following upstream artifacts are **excluded**:
+
+- **`hooks/`** — auto-executing Node.js / shell / PowerShell (`ponytail-activate.js`,
+  `ponytail-config.js`, `ponytail-instructions.js`, `ponytail-mode-tracker.js`,
+  `ponytail-runtime.js`, `ponytail-subagent.js`, `ponytail-statusline.sh`,
+  `ponytail-statusline.ps1`, `claude-codex-hooks.json`). This is the standout
+  risk of this repo and the primary reason the subset is narrowed to rule text.
+- **`scripts/` / build tooling** — maintainer tooling, CI (`.github/workflows/`),
+  `benchmarks/` (Python + JS), `__init__.py`, `.env.example`.
+- **Other-editor rule variants** — `.cursor/rules/ponytail.mdc`,
+  `.windsurf/rules/ponytail.md`, `.clinerules/ponytail.md`,
+  `.github/copilot-instructions.md`, `.kiro/steering/ponytail.md`,
+  `.qoder/rules/ponytail.md`, `.agents/rules/ponytail.md`,
+  `.openclaw/skills/*`, `.opencode/*` (incl. executable `.cjs`/`.mjs` plugins).
+- **Auxiliary skills (five)** — `skills/ponytail-review`, `skills/ponytail-audit`,
+  `skills/ponytail-debt`, `skills/ponytail-gain`, `skills/ponytail-help`.
+- **Plugin manifests / marketing** — `.claude-plugin/`, `.codex-plugin/`,
+  `.devin-plugin/`, `.qoder-plugin/`, `marketplace.json`, `plugin.json`,
+  `assets/` (logos, banners, benchmark SVGs).
+
+Always-on UX is provided by Vesper's own minimal rule + `CLAUDE.md` import
+wiring (exactly like i-have-adhd), NOT by any upstream hook.
+
+## Trust note — star count disregarded
+
+The upstream repo shows an **anomalous ~93.5k-star count on a repository created
+2026-06-12 (under two months old)**. This was **disregarded as a trust signal** —
+popularity is not provenance, and an implausible star velocity on a very young
+repo is, if anything, a caution flag. Trust here rests solely on the per-snapshot
+content review below and the markdown-only, no-executable-code scoping.
+
+## Content review (before commit)
+
+Reviewed the vendored `SKILL.md` for the untrusted-content hazards. It is a prose
+review because the payload is markdown-only:
+
+- **Prompt injection / host-prompt override** — NONE. The persistence directive
+  ("ACTIVE EVERY RESPONSE") governs coding style only and explicitly yields to
+  the user ("User insists on the full version → build it, no re-arguing").
+- **Behavioral override beyond scope** — NONE. It shapes *what code you build*
+  (YAGNI / minimalism) and output brevity; it does not attempt to disable safety
+  or override the host system prompt.
+- **Tool-permission escalation** — NONE. No tool calls, no permission requests.
+- **Data exfiltration** — NONE. No network access, no reading of secrets, no
+  external sends.
+- **Destructive instructions** — NONE. "Deletion over addition" refers to writing
+  less code in the diff under construction, not to filesystem/command actions;
+  no `rm`/force-push/destructive commands appear. It explicitly preserves input
+  validation, error handling, security, and accessibility, and mandates leaving a
+  runnable check behind for non-trivial logic.
+
+**Verdict**: inert markdown coding-style guidance; safe to vendor and redistribute
+as data. **No executable code vendored** — the payload is a single markdown file.
+
+## Untrusted install instructions — never executed
+
+The upstream repo ships install instructions (Claude/Codex plugin marketplace
+`/plugin install`, git installs, `curl`-based extension installs, npm-style refs)
+and auto-executing hooks. These are **UNTRUSTED** and are **NEVER executed** by
+Vesper. Install/maintain read ONLY from this committed snapshot — there is no
+runtime fetch.
+
+## What Vesper installs from this snapshot (Phase 2, once signed off)
+
+When the opt-in gate is enabled, `vespercli init`/reinit will install, at the
+**project** level:
+
+- `.claude/skills/ponytail/SKILL.md` — this snapshot, verbatim (on-demand reference)
+- `.claude/rules/ponytail.md` — a minimal always-on activation rule derived from
+  it (derives from and does not exceed this snapshot)
+- a marker-scoped `@import` in `CLAUDE.md` (`<!-- vesper:ponytail:start/end -->`)
+
+## Re-vendoring (reviewed PR only)
+
+To update this snapshot: fetch new upstream content at a new pinned SHA, re-run
+the content review + exclusion confirmation above, update the SHA + retrieval
+date + reviewer + sign-off here, and land it as a reviewed pull request. There is
+no automated path.