@slamb2k/mad-skills 2.0.55 → 2.0.57

package/skills/handover/references/handover-template.md

@@ -0,0 +1,89 @@
+# Handover document template
+
+Fill every section that applies. Drop sections that genuinely don't (e.g. no open
+questions). Lead with what unblocks action; a fresh session should be able to make
+its **next move within the first minute** of reading this.
+
+Write concretely. "Fix the bug in the parser" is useless; "`parseImportFile()` in
+`src/import.js:42` throws on empty `days` — needs a guard before the `Object.entries`
+loop" is a handover. Prefer absolute or repo-relative file paths with line numbers.
+
+---
+
+```markdown
+# Handover — <short task title>
+
+**Date:** <YYYY-MM-DD HH:MM>  ·  **Branch:** <git branch>  ·  **Repo:** <path>
+
+## TL;DR
+One or two sentences: what we're doing and what the very next action is.
+
+## Goal / definition of done
+The north star. What does "finished" look like? Include acceptance criteria or
+the user's original ask in their words if it matters.
+
+## Current status
+What's done and working (verified vs assumed — say which). What's the state of the
+tree right now. If something is half-built, say exactly how far it got.
+
+## Next steps
+Ordered, concrete, actionable. The first item should be immediately doable.
+1. ...
+2. ...
+
+## Key files & entry points
+The map. Where the relevant code lives and what each piece does.
+- `path/to/file.ext:line` — what it is / why it matters
+- ...
+
+## Key decisions & rationale
+Choices already made that the next session must respect, and *why* — so it doesn't
+unknowingly relitigate or contradict them.
+- Decided X because Y. Alternative Z was rejected because ...
+
+## Gotchas, dead ends & landmines
+Things that wasted time or will bite again. Approaches already tried that DON'T
+work (so the next session doesn't repeat them). Environment quirks, flaky steps,
+ordering constraints.
+- Tried A → failed because B. Don't retry without addressing B.
+- Watch out for ...
+
+## How to build / test / run
+Exact commands. The next session shouldn't have to rediscover these.
+- Build: `...`
+- Test: `...`
+- Run / verify: `...`
+
+## Open questions & assumptions
+Unresolved decisions awaiting the user, and assumptions made that might be wrong.
+Flag anything the user still needs to answer.
+- [ ] Question: ... (suggested default: ...)
+- Assumption: ... (if wrong, then ...)
+
+## Git state
+- Branch: <branch>  (tracking <remote/branch> or "local-only")
+- Uncommitted changes: <summary of `git status --short`, or "clean">
+- Recent commits:
+  ```
+  <git log --oneline -8>
+  ```
+
+## Context the next session can't infer
+Anything important that isn't in the code, git history, or CLAUDE.md — the stuff
+living only in this conversation. External constraints, user preferences expressed
+mid-session, credentials/access notes (reference, don't paste secrets), URLs,
+ticket numbers, people involved.
+```
+
+---
+
+## Filling guidance
+
+- **Verified vs assumed:** if you ran the test and it passed, say "verified". If you
+  think it works but didn't check, say "assumed — not yet run". A fresh session has
+  no way to tell otherwise and false confidence is expensive.
+- **Link, don't paste:** point to files and line ranges rather than dumping large
+  code blocks. The next session can read them on demand; bloating the handover just
+  refills the context window you're trying to clear.
+- **Keep it skimmable:** headers, short bullets, code spans for paths/commands. A
+  wall of prose defeats the purpose.

package/skills/handover/scripts/handover.sh

@@ -0,0 +1,71 @@
+#!/usr/bin/env bash
+# handover.sh — companion to the `handover` skill.
+#
+#   handover.sh signal <abs_handover_path> [cwd]
+#       Drop a one-shot signal keyed to the current project (cwd) pointing at
+#       the handover document. The next session's SessionStart hook consumes it.
+#
+#   handover.sh load
+#       SessionStart hook entrypoint. Reads the event JSON on stdin; if a signal
+#       exists for this cwd, emits the handover as additionalContext and deletes
+#       the signal (one-shot — a stale HANDOVER.md is never re-injected).
+#
+# The signal is keyed on the working directory, NOT the session id, because the
+# session id changes after /clear. cwd is stable across a clear, so the fresh
+# session finds the signal its predecessor left.
+set -euo pipefail
+
+SIGNAL_DIR="/tmp/claude-handover"
+
+_key() {
+  # Stable, dependency-free hash of a directory path. cksum is POSIX.
+  printf '%s' "$1" | cksum | cut -d' ' -f1
+}
+
+cmd="${1:-load}"
+
+case "$cmd" in
+  signal)
+    handover_path="${2:?usage: handover.sh signal <abs_handover_path> [cwd]}"
+    cwd="${3:-$(pwd)}"
+    mkdir -p "$SIGNAL_DIR"
+    key="$(_key "$cwd")"
+    printf '%s\n' "$handover_path" > "$SIGNAL_DIR/$key.signal"
+    printf 'handover: signal armed for %s -> %s\n' "$cwd" "$handover_path"
+    ;;
+
+  load)
+    input="$(cat)"
+
+    if command -v jq >/dev/null 2>&1; then
+      cwd="$(printf '%s' "$input" | jq -r '.cwd // empty')"
+    else
+      cwd="$(printf '%s' "$input" | sed -n 's/.*"cwd"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -n1)"
+    fi
+    [ -n "$cwd" ] || cwd="$(pwd)"
+
+    key="$(_key "$cwd")"
+    signal="$SIGNAL_DIR/$key.signal"
+    [ -f "$signal" ] || exit 0          # no handover pending — silent no-op
+
+    handover_path="$(head -n1 "$signal")"
+    rm -f "$signal"                      # one-shot: consume the signal
+    [ -f "$handover_path" ] || exit 0    # document vanished — nothing to inject
+
+    content="$(cat "$handover_path")"
+    preamble="The previous session left a handover document at ${handover_path} and signalled that this session should resume from it. Treat it as your primary context for continuing the work. Read any files it references before acting. This is one-shot: do not seek out or re-read handover documents in future sessions unless signalled again."
+
+    if command -v jq >/dev/null 2>&1; then
+      jq -n --arg pre "$preamble" --arg body "$content" \
+        '{hookSpecificOutput:{hookEventName:"SessionStart", additionalContext:($pre + "\n\n---\n\n" + $body)}}'
+    else
+      # Fallback: SessionStart adds raw stdout to context too.
+      printf '%s\n\n---\n\n%s\n' "$preamble" "$content"
+    fi
+    ;;
+
+  *)
+    printf 'handover.sh: unknown command "%s" (expected: signal | load)\n' "$cmd" >&2
+    exit 1
+    ;;
+esac

package/skills/handover/tests/evals.json

@@ -0,0 +1,35 @@
+{
+  "skill": "handover",
+  "cases": [
+    {
+      "name": "explicit slash invocation",
+      "prompt": "/handover",
+      "expect_skill": "handover",
+      "assertions": [
+        "Writes a handover document to HANDOVER.md in the repo root by default",
+        "Arms the one-shot signal via scripts/handover.sh signal with an absolute path",
+        "Tells the user to type /clear to start the fresh session themselves"
+      ]
+    },
+    {
+      "name": "natural language wrap-up",
+      "prompt": "Let's wrap up and start fresh with a clean context window without losing where we are.",
+      "expect_skill": "handover",
+      "assertions": [
+        "Recognizes the intent to reset context while preserving state",
+        "Captures task, status, next steps, key files, decisions, and git state",
+        "Does not attempt to run /clear itself — leaves that to the user"
+      ]
+    },
+    {
+      "name": "committed checkpoint variant",
+      "prompt": "/handover commit",
+      "expect_skill": "handover",
+      "assertions": [
+        "Writes to docs/handovers/HANDOVER-<timestamp>.md instead of the ignored repo-root file",
+        "Does not add the file to .git/info/exclude",
+        "Notes the user will want to commit the checkpoint"
+      ]
+    }
+  ]
+}

package/skills/hoist/SKILL.md

@@ -0,0 +1,89 @@
+---
+name: hoist
+description: >-
+  Generate secure, low-infrastructure release pipelines that publish artifacts
+  directly — language packages (npm, PyPI, crates, RubyGems, NuGet, Go), GitHub
+  Releases with binaries, static sites/Pages, or serverless functions — without
+  building a container image. OIDC/trusted publishing, provenance, idempotent
+  publish guards, and three trigger models (auto-bump with optional approval,
+  tag, manual). The non-container sibling of /dock. Use when releasing a package
+  or app that doesn't ship as a container.
+argument-hint: "--skip-interview, --dry-run, --registry <name>"
+allowed-tools: Bash, Read, Write, Edit, Glob, Grep, AskUserQuestion, Agent
+---
+
+# Hoist - Non-Container Release Pipelines
+
+When this skill is invoked, IMMEDIATELY output the banner below before doing anything else.
+Pick ONE tagline at random — vary your choice each time.
+CRITICAL: Reproduce the banner EXACTLY character-for-character. The first line of the art has 4 leading characters (one invisible braille-blank + 3 spaces) — you MUST preserve them.
+
+```
+{tagline}
+
+⠀   ██╗██╗  ██╗ ██████╗ ██╗███████╗████████╗
+   ██╔╝██║  ██║██╔═══██╗██║██╔════╝╚══██╔══╝
+  ██╔╝ ███████║██║   ██║██║███████╗   ██║
+ ██╔╝  ██╔══██║██║   ██║██║╚════██║   ██║
+██╔╝   ██║  ██║╚██████╔╝██║███████║   ██║
+╚═╝    ╚═╝  ╚═╝ ╚═════╝ ╚═╝╚══════╝   ╚═╝
+```
+
+Taglines:
+- 📦 Up and away — published!
+- 🏗️ Hoisting your release skyward!
+- 🚀 From main to registry in one pull!
+- 🪝 Latched on, lifting off!
+- ⬆️ Straight to the top shelf!
+- 🎁 Wrapped, signed, and shipped!
+- 🛎️ Release, served fresh!
+- 🔖 Tag it and bag it!
+
+## Flags
+- `--skip-interview`: detected + platform-aware defaults
+- `--dry-run`: show generated files without writing
+- `--registry <name>`: force the target registry
+
+## Output Formatting
+(Input box, Pre-flight table, stage headers, status icons — copy the conventions
+from skills/dock/SKILL.md.)
+
+## Pre-flight
+6-column dependency table: git (required, stop), gh (optional for GitHub release
+ops), sync (optional skill, fallback git pull), node/language toolchain (optional,
+detected). Follow the resolution-strategy list format used by other skills.
+
+## Platform Detection
+Detect github vs azdo from the remote URL (same block as skills/dock/SKILL.md).
+
+## Phase 0: Sync
+Invoke /sync (fallback git pull).
+
+## Phase 1: Detection
+Explore subagent using references/interview-guide.md#detection-prompt → DETECTION_REPORT.
+
+## Phase 2: Interview
+Follow references/interview-guide.md#interview-questions. Compile HOIST_CONFIG
+(target, registry/host, trigger model, approval gate, signing).
+
+## Phase 3: Generate
+Read references/release-templates.md and references/hardening.md. Emit the CI
+workflow for the detected target + chosen trigger (secure by default: id-token,
+provenance, idempotent publish guard, concurrency; token exceptions per
+hardening.md). For binaries, add SHA256SUMS + optional signing. Generate
+deploy/SETUP.md from references/setup-guides.md.
+
+## Phase 4: Verify
+Validate workflow YAML. Confirm the generated workflow carries the required
+hardening for its target (OIDC/`id-token: write` or a flagged token secret;
+provenance where supported; the version-exists guard; publish-before-tag).
+--dry-run previews without writing.
+
+## Final Report
+Box report with target, trigger model, generated files, and a 🔐 Required setup
+section pointing at deploy/SETUP.md.
+
+## Integration
+Complements /dock (containers) — pick whichever fits. Runs after /rig; /ship's
+merge can trigger the generated auto-bump release. Only the serverless target may
+reference /keel for cloud identity.

package/skills/hoist/references/hardening.md

@@ -0,0 +1,62 @@
+# Release Hardening Reference
+
+How `/hoist` hardens the release pipelines it generates. Same ethos as `/dock`,
+translated from container promotion to artifact publishing. Secure by default.
+
+## Trusted Publishing (OIDC)
+
+Publish with the CI provider's OIDC identity instead of a stored token, wherever
+the registry supports it:
+
+- **npm** — `permissions: id-token: write` + `npm publish --provenance`. Configure
+  the package's trusted publisher on npmjs.com (repo + workflow). No `NODE_AUTH_TOKEN`.
+- **PyPI** — `pypa/gh-action-pypi-publish` with `id-token: write`; configure a
+  PyPI trusted publisher. No API token.
+- **RubyGems** — trusted publishing via OIDC; configure on rubygems.org.
+- **GitHub Pages** — `id-token: write` + `actions/deploy-pages`.
+- **AWS Lambda** — `aws-actions/configure-aws-credentials` with `role-to-assume`
+  (GitHub OIDC → IAM role). No access keys.
+
+Azure Pipelines uses a **Workload Identity Federation service connection**
+(`azureSubscription`) where cloud auth is needed.
+
+## Provenance & Attestation
+
+- npm: `--provenance` (SLSA provenance attestation).
+- PyPI: `gh-action-pypi-publish` emits attestations by default.
+- Binaries: generate SLSA build provenance and attach it to the release.
+
+## Idempotent Publish Guard
+
+Publish is **check-then-act** and runs **before** any git tag/commit, so a failed
+publish leaves git clean and a re-run is safe (recovery mode):
+
+- npm: `npm view <pkg>@<version> version` — skip publish if it returns.
+- PyPI: query the simple index / `pip index versions`.
+- crates.io: query the index; RubyGems: `gem list -r -e`.
+- GitHub Release: `gh release view vX.Y.Z` — skip if it exists.
+
+Only after a successful (or already-present) publish does the workflow tag +
+create the release. A `concurrency:` group keyed on workflow + ref with
+`cancel-in-progress` prevents overlapping release runs.
+
+## Approval Gate
+
+For the auto-bump-on-merge trigger, optionally run the publish job in a protected
+**environment** so it pauses for human approval before publishing:
+
+- GitHub: `environment: release` on the publish job + required reviewers configured
+  on the `release` environment.
+- Azure: an environment with a manual-approval check.
+
+## Token Exceptions
+
+Registries/platforms without OIDC trusted publishing at authoring time use a
+**scoped token stored as a CI secret** — the documented exception to the
+no-token rule. Flag these in `deploy/SETUP.md`:
+
+- crates.io (`CARGO_REGISTRY_TOKEN`), NuGet (`NUGET_API_KEY`),
+  Cloudflare (`CLOUDFLARE_API_TOKEN`), Vercel (`VERCEL_TOKEN`),
+  Deno Deploy (`DENO_DEPLOY_TOKEN`).
+
+Use the narrowest scope the platform allows (publish-only, single package/project).

package/skills/hoist/references/interview-guide.md

@@ -0,0 +1,28 @@
+# Interview Guide
+
+## Detection Prompt
+
+Scan the repo and return a DETECTION_REPORT (max 20 lines):
+- language/framework
+- manifest(s): package.json / pyproject.toml / Cargo.toml / *.gemspec / *.csproj / go.mod
+- target family: `package` (library) | `binaries` (app shipping executables) |
+  `static` (static-site framework) | `serverless` (function handler)
+- detected registry from manifest metadata (npm/PyPI/crates/RubyGems/NuGet/Go)
+- existing CI: .github/workflows/ , azure-pipelines.yml
+- existing release config
+
+## Interview Questions
+
+Ask only where detection is ambiguous; confirm otherwise.
+
+1. **Target family** — confirm `package` / `binaries` / `static` / `serverless`.
+2. **Registry / host** — the specific index (npm/PyPI/…), GitHub Releases vs
+   Azure artifacts, GitHub Pages vs Azure Static Web Apps, or the serverless
+   provider (Lambda/Cloudflare/Vercel/Deno).
+3. **Trigger model** — auto-bump-on-merge / tag-triggered / manual-dispatch.
+4. **Approval gate** — (auto-bump only) run publish in a protected `release`
+   environment with required reviewers? Default: no.
+5. **Signing** — (binaries) cosign keyless / minisign / none.
+
+`--skip-interview`: use detected defaults + GitHub Releases/Pages, OIDC where
+supported, auto-bump, no approval gate.

package/skills/hoist/references/release-templates.md

@@ -0,0 +1,136 @@
+# Release Pipeline Templates
+
+Canonical, composable hardened release workflows. The generator picks ONE
+trigger block and ONE publish snippet for the detected target, and drops
+unused jobs. Placeholders: `{DEFAULT_BRANCH}`, `{PKG_NAME}`, `{ARTIFACT}`.
+
+## GitHub Actions
+
+### Canonical release workflow
+
+```yaml
+name: Release
+
+on: {} # replaced by ONE trigger block from "### Trigger blocks" below
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: write     # tag + create release
+  id-token: write     # OIDC trusted publishing / keyless signing
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    # environment: release   # uncomment for the optional approval gate (auto-bump)
+    steps:
+      - uses: actions/checkout@v4
+        with: { fetch-depth: 0 }
+
+      # Resolve VERSION per trigger — see "### Trigger blocks".
+      - name: Resolve version
+        id: version
+        run: echo "value=<resolved>" >> "$GITHUB_OUTPUT"
+
+      # Idempotency guard (publish-before-git-write). Example: npm.
+      - name: Skip if already published
+        id: guard
+        run: |
+          if npm view "{PKG_NAME}@${{ steps.version.outputs.value }}" version >/dev/null 2>&1; then
+            echo "exists=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "exists=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Build
+        if: steps.guard.outputs.exists == 'false'
+        run: echo "build {ARTIFACT}"    # replaced by detected build step
+
+      # Publish — ONE snippet from "### Publish snippets by target".
+      - name: Publish
+        if: steps.guard.outputs.exists == 'false'
+        run: npm publish --provenance --access public
+
+      # Tag + release only after successful publish (auto-bump trigger).
+      - name: Tag and release
+        if: steps.guard.outputs.exists == 'false'
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: v${{ steps.version.outputs.value }}
+          generate_release_notes: true
+```
+
+### Trigger blocks
+
+Pick ONE and substitute into `on:` (and adjust the version-resolve step):
+
+```yaml
+# auto-bump on merge to main
+on:
+  push: { branches: [{DEFAULT_BRANCH}] }
+# version-resolve: compute next semver patch (or conventional-commits) in-CI
+
+# tag-triggered
+on:
+  push: { tags: ["v*"] }
+# version-resolve: VERSION = ${GITHUB_REF_NAME#v}
+
+# manual dispatch
+on:
+  workflow_dispatch:
+    inputs: { version: { description: "x.y.z", required: true } }
+# version-resolve: VERSION = ${{ inputs.version }}
+```
+
+### Publish snippets by target
+
+Replace the "Publish" step body:
+
+- **npm:** `npm publish --provenance --access public`
+- **PyPI:** `- uses: pypa/gh-action-pypi-publish@release/v1` (with `id-token: write`; attestations on by default)
+- **RubyGems:** `gem push {ARTIFACT}.gem` (OIDC trusted publishing)
+- **crates.io (token):** `cargo publish` with `CARGO_REGISTRY_TOKEN` secret
+- **NuGet (token):** `dotnet nuget push {ARTIFACT}.nupkg -k $NUGET_API_KEY -s https://api.nuget.org/v3/index.json`
+- **Go:** no publish step — the tag is the release; the module proxy fetches it
+- **Binaries → GitHub Release:** cross-compile matrix → `sha256sum * > SHA256SUMS` → optional `cosign sign-blob`/`minisign` → `softprops/action-gh-release@v2` with `files: dist/*`
+- **Static site → Pages:** `- uses: actions/upload-pages-artifact@v3` then `- uses: actions/deploy-pages@v4` (`id-token: write`)
+- **Serverless (Lambda):** `- uses: aws-actions/configure-aws-credentials@v4` (`role-to-assume`) then `aws lambda update-function-code ...`
+
+## Azure Pipelines
+
+Canonical release pipeline. Cloud auth (Lambda/SWA) uses a Workload Identity
+Federation service connection (`azureSubscription`); package registries use OIDC
+or a scoped token secret per target.
+
+```yaml
+trigger:                      # pick ONE, mirroring the GitHub trigger blocks
+  branches: { include: [{DEFAULT_BRANCH}] }   # auto-bump
+  # tags: { include: ["v*"] }                 # tag-triggered
+# (manual: use the Pipelines UI "Run pipeline" with a version variable)
+
+pool: { vmImage: ubuntu-latest }
+
+stages:
+  - stage: Release
+    jobs:
+      - deployment: Publish
+        environment: release   # optional approval gate (add a manual-approval check)
+        strategy:
+          runOnce:
+            deploy:
+              steps:
+                - script: |
+                    VERSION="<resolved per trigger>"
+                    if npm view "{PKG_NAME}@$VERSION" version >/dev/null 2>&1; then
+                      echo "##vso[task.setvariable variable=exists]true"
+                    else
+                      echo "##vso[task.setvariable variable=exists]false"
+                    fi
+                  displayName: Idempotency guard
+                - script: npm publish --provenance --access public
+                  condition: ne(variables.exists, 'true')
+                  displayName: Publish (npm shown; swap per target)
+                # Cloud targets: wrap deploy in AzureCLI@2 with azureSubscription (WIF).
+```

package/skills/hoist/references/setup-guides.md

@@ -0,0 +1,30 @@
+# Setup Guides
+
+`/hoist` writes `deploy/SETUP.md` into the target repo, tailored to the chosen
+target. Bodies below (substitute `OWNER/REPO`, package name, workflow filename).
+
+## Generated deploy/SETUP.md
+
+### npm / PyPI / RubyGems (trusted publisher — no token)
+- Configure the **trusted publisher** on the registry: reference repo `OWNER/REPO`
+  and the workflow filename (e.g. `.github/workflows/release.yml`).
+- No token to create. The workflow's `id-token: write` does the rest.
+
+### crates.io / NuGet / Cloudflare / Vercel / Deno (Token exception)
+- Create a scoped, publish-only token on the platform.
+- Store it as the named CI secret (`CARGO_REGISTRY_TOKEN` / `NUGET_API_KEY` /
+  `CLOUDFLARE_API_TOKEN` / `VERCEL_TOKEN` / `DENO_DEPLOY_TOKEN`).
+- This is the documented exception to the no-token rule.
+
+### GitHub Pages
+- Repo Settings → Pages → Source: **GitHub Actions**. No token.
+
+### Serverless (AWS Lambda)
+- Create an IAM role trusting the GitHub OIDC provider, condition
+  `sub = repo:OWNER/REPO:ref:refs/heads/main`; grant the lambda update
+  permissions; put the role ARN in `role-to-assume`. Or run `/keel` to
+  provision this.
+
+### Approval gate (optional, auto-bump)
+- Create a `release` environment and add required reviewers so publishing pauses
+  for approval.

package/skills/hoist/tests/evals.json

@@ -0,0 +1,36 @@
+[
+  {
+    "name": "banner-display",
+    "prompt": "/hoist",
+    "assertions": [
+      { "type": "contains", "value": "██" },
+      { "type": "semantic", "value": "Displays an ASCII art banner for the hoist skill before doing anything else" }
+    ]
+  },
+  {
+    "name": "npm-trusted-publishing",
+    "prompt": "/hoist --skip-interview for an npm library",
+    "assertions": [
+      { "type": "semantic", "value": "Uses npm OIDC trusted publishing with no stored NODE_AUTH_TOKEN" },
+      { "type": "semantic", "value": "Publishes with provenance (npm publish --provenance)" },
+      { "type": "semantic", "value": "Guards publish with a version-already-exists check so re-runs are idempotent" }
+    ]
+  },
+  {
+    "name": "binaries-release",
+    "prompt": "/hoist for a Go CLI that ships cross-platform binaries",
+    "assertions": [
+      { "type": "semantic", "value": "Builds cross-platform binaries in a matrix and produces SHA256SUMS checksums" },
+      { "type": "semantic", "value": "Attaches the artifacts to a GitHub Release" }
+    ]
+  },
+  {
+    "name": "auto-bump-approval",
+    "prompt": "/hoist an npm package, auto-bump on merge to main with an approval gate before publishing",
+    "assertions": [
+      { "type": "semantic", "value": "Auto-computes the next version and publishes on merge to the default branch" },
+      { "type": "semantic", "value": "Runs the publish step behind an environment approval gate requiring a human reviewer" },
+      { "type": "semantic", "value": "Generates a deploy/SETUP.md describing the required one-time setup" }
+    ]
+  }
+]

package/skills/manifest.json

@@ -1,6 +1,6 @@
 {
-  "generated": "2026-07-06T02:10:36.483Z",
-  "count": 11,
+  "generated": "2026-07-07T07:32:19.484Z",
+  "count": 13,
   "skills": [
     {
       "name": "brace",
@@ -16,7 +16,7 @@
       "name": "build",
       "directory": "build",
       "description": "Context-isolated feature development pipeline. Takes a detailed design/plan as argument and executes the full feature-dev lifecycle (explore, question, architect, implement, review, ship) inside subagents so the primary conversation stays compact. Use when you have a well-defined plan and want autonomous execution with minimal context window consumption.",
-      "lines": 468,
+      "lines": 532,
       "hasScripts": false,
       "hasReferences": true,
       "hasAssets": false,
@@ -36,7 +36,27 @@
       "name": "dock",
       "directory": "dock",
       "description": ">- Generate container-based release pipelines that build once and promote immutable artifacts through environments (dev → staging → prod). Detects your stack, interviews for infrastructure choices, then outputs deterministic CI/CD files (Dockerfile, workflows, deployment manifests) that run without an LLM. Use when setting up deployment pipelines, containerizing an app, creating release workflows, or connecting CI to container-friendly infrastructure (Azure Container Apps, AWS Fargate, Google Cloud Run, Kubernetes, Dokku, Coolify, CapRover, etc.).",
-      "lines": 432,
+      "lines": 457,
+      "hasScripts": false,
+      "hasReferences": true,
+      "hasAssets": false,
+      "hasTests": true
+    },
+    {
+      "name": "handover",
+      "directory": "handover",
+      "description": "Persist a session handover document and signal the next fresh session to resume from it. Use when the user types /handover, says they want to hand off, checkpoint, wrap up, clear context, or start fresh while preserving state, or asks to carry work into a new session with clean optimised context. Captures everything a brand-new session needs — task, status, next steps, key files, decisions, gotchas, git state — writes it to disk, arms a one-shot signal, and tells the user to /clear so the next session auto-loads it.",
+      "lines": 165,
+      "hasScripts": true,
+      "hasReferences": true,
+      "hasAssets": false,
+      "hasTests": true
+    },
+    {
+      "name": "hoist",
+      "directory": "hoist",
+      "description": ">- Generate secure, low-infrastructure release pipelines that publish artifacts directly — language packages (npm, PyPI, crates, RubyGems, NuGet, Go), GitHub Releases with binaries, static sites/Pages, or serverless functions — without building a container image. OIDC/trusted publishing, provenance, idempotent publish guards, and three trigger models (auto-bump with optional approval, tag, manual). The non-container sibling of /dock. Use when releasing a package or app that doesn't ship as a container.",
+      "lines": 90,
       "hasScripts": false,
       "hasReferences": true,
       "hasAssets": false,