@vegastack/skills 0.11.1 → 0.12.0

package/README.md

@@ -13,10 +13,10 @@ npx @vegastack/skills add dev-architect
 |---|---|
 | `skill-maintainer` | Encodes the Agent Skills standards (Claude Code, Codex, Hermes, agentskills.io) for creating, updating, and releasing skills in a skills repo |
 | `skillify` | Turns a feature or workflow into a complete skill conforming to the VegaStack skills contract, or audits an existing one |
-| `dev-architect` | Architecture advisor: the locked stack, recorded rejections, and lean-first principles as evidence-distilled decision tables, dated source-verified platform facts behind a verify-before-you-recommend protocol, reading the `## Architecture` section of `.vegastack/dev.md` |
 | `dev-setup` | Bootstraps any project, greenfield included, for the issue-driven dev workflow: stack-playbook-drafted profile, AGENTS.md section, labels, guards, decision register |
 | `dev-intake` | Turns ideas, brainstorms, and SOWs into agent-ready GitHub issues with recorded user approval |
 | `dev-plan` | Plans an approved issue before any code exists: fresh-grounded questionnaire, strict plan format with Interfaces blocks, the scope ratchet, quick-build inline mode |
+| `dev-architect` | Architecture advisor: the locked stack, recorded rejections, and dated platform facts behind a verify-before-you-recommend protocol |
 | `dev-implement` | Implements an approved issue end to end, dark: preflight, claim, build, test, review, evidence in the issue |
 | `dev-debug` | Reproduce-first bug diagnosis: red command, ranked suspects, regression-test-before-fix |
 | `dev-review` | Independent multi-axis review of finished work: spec/standards/security axes, bounded fix loop, cross-agent Codex mode |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vegastack/skills",
-  "version": "0.11.1",
+  "version": "0.12.0",
   "description": "Installer and verifier for VegaStack Agent Skills (Claude Code, Codex, and Hermes)",
   "license": "MIT",
   "type": "module",

package/skill/dev-architect/references/pinned-facts.md

@@ -6,7 +6,8 @@ verify-before-you-recommend protocol, and the ONLY file in this skill that goes
 itself — the weekly refresh (see refresh/REFRESH.md) re-verifies it. When a recommendation
 leans on a fact older than 60 days, re-verify that one fact against its source first.
 
-All facts below verified 2026-08-12.
+Facts carry their own verification dates — sections verified 2026-08-12 unless a
+bullet says otherwise; Better Auth and EVE re-verified 2026-08-29.
 
 ## Cloudflare
 
@@ -58,27 +59,42 @@ All facts below verified 2026-08-12.
   events/day, 3-day retention; automatic tracing starts billing 2026-10-01; OTLP export
   needs Workers Paid. [developers.cloudflare.com/workers/platform/limits]
 
-## Better Auth (1.6.27, 2026-08-11)
-
-- **1.7.0 is in RC** (rc.5 shipped 2026-08-11, same day as the pinned patch). Stay on
-  1.6.x until 1.7 is stable; queued breaking changes include the MCP plugin restructure
-  (moves to `@better-auth/mcp`) and SAML IdP-initiated default-off. [github.com/better-auth]
+## Better Auth (1.7.2, 2026-08-29)
+
+- **1.7 is stable** — 1.7.0 shipped 2026-08-18, current 1.7.2 (2026-08-26, npm latest).
+  The former 1.6.x hold is retired; adopt 1.7.x via the official migration steps. Notable
+  1.7.0 breaks beyond the bullets below: accounts rekeyed on `(issuer, accountId)` with a
+  migration backfill; `validAudiences` → `resources` + `oauthClientResource`;
+  `experimental.joins` → `advanced.database.joins`; generic OAuth rewritten on OAuth 2.1
+  defaults. [github.com/better-auth releases, verified 2026-08-29]
+- **The MCP plugin lives in `@better-auth/mcp` since 1.7.0** — requires
+  `@better-auth/cimd` and the `jwt()` plugin; `withMcpAuth` → `requireMcpAuth`,
+  `mcpHandler` → `createMcpProtectedRequestHandler`; options are flat, no `oidcConfig`
+  nesting. [releases/tag/v1.7.0]
+- **SAML IdP-initiated sign-in is default-off since 1.7.0** (`saml.allowIdpInitiated`
+  defaults to false); opt back in explicitly only where the IdP flow is required.
+  [releases/tag/v1.7.0, verified 2026-08-29]
 - **The organizations plugin models teams, invitations, and custom RBAC end-to-end**
-  (`teams: { enabled: true }`, `invite-member` with `teamId`, `createAccessControl`).
-  [better-auth.com/docs]
-- **Better Auth ships an apiKey plugin** (docs/plugins/api-key — verified live
-  2026-08-12; an older internal note claiming otherwise was wrong). Default to the plugin
-  for new projects; the flagship platform's native implementation is a recorded project
-  decision, not the house default. The `bearer` plugin covers token session transport
-  (the mobile/Flutter mechanism).
+  (`teams: { enabled: true }`, `inviteMember` with `teamId`, `createAccessControl`) —
+  unchanged in 1.7 (SCIM was decoupled from it; irrelevant unless SCIM is used).
+  [better-auth.com/docs, verified 2026-08-29]
+- **The apiKey plugin is the standalone `@better-auth/api-key` package** (lockstep
+  1.7.2) — import from `@better-auth/api-key`, not `better-auth/plugins` (core's exports
+  no longer carry it). Default to the plugin for new projects; the flagship platform's
+  native implementation is a recorded project decision, not the house default. The
+  `bearer` plugin stays in core and covers token session transport (the mobile/Flutter
+  mechanism). [better-auth.com/docs/plugins/api-key, verified 2026-08-29]
 - **`twoFactor` supports `allowPasswordless: true`** for users without password accounts
-  (passkey/OAuth/magic-link signups).
+  (passkey/OAuth/magic-link signups). Since 1.7.0, `enableTwoFactor` takes and returns a
+  discriminated `method: "otp" | "totp"` (default totp) — pass `method: "otp"` for OTP
+  enrollment.
 
 ## Agents & jobs
 
-- **EVE (`eve` on npm, github.com/vercel/eve) is Vercel's durable-agent framework —
-  v0.33.2, still beta/pre-GA, shipping near-daily.** Filesystem-first agents; every
-  session a durable, resumable workflow. [vercel.com/docs/eve]
+- **EVE (`eve` on npm, github.com/vercel/eve) is Vercel's durable-agent framework — v0.47.3
+  (2026-08-28), still beta/pre-GA, shipping multiple releases per day; pin behavior, not
+  minor versions.** Filesystem-first agents; every session a durable, resumable
+  workflow. [vercel.com/docs/eve]
 - **Self-hosted EVE durability (`@workflow/world-postgres`, stable 4.3.x) explicitly
   requires a long-lived worker process — "not compatible with serverless platforms".**
   The 5.0.0-beta channel exists; don't pin it without a documented reason. Internally it

package/skill/dev-architect/refresh/sources.json

@@ -34,7 +34,7 @@
         "references/data.md"
       ],
       "checksum": "fda2870b95deffce48dca7f3df3707325b1bc4a2d58a17708ee9220bfba5eba1",
-      "retrievedAt": "2026-08-12T14:33:11.062Z"
+      "retrievedAt": "2026-08-29T05:56:59.737Z"
     },
     {
       "id": "CF-R2-PRICING",
@@ -57,7 +57,7 @@
         "references/stack.md"
       ],
       "checksum": "bd5e8d26f7bbf2f92182ad4ac1a59ae9b1d90695120062adaf54c281bd88e81f",
-      "retrievedAt": "2026-08-12T14:33:11.062Z"
+      "retrievedAt": "2026-08-29T05:56:59.737Z"
     },
     {
       "id": "CF-WORKFLOWS-PRICING",
@@ -80,7 +80,7 @@
         "references/ai-agents.md"
       ],
       "checksum": "64e10ca4ced4edc042d12a9a24f2e165ea71cb9481c30ac5f067f2f6c9218cda",
-      "retrievedAt": "2026-08-12T14:33:11.062Z"
+      "retrievedAt": "2026-08-29T05:56:59.737Z"
     },
     {
       "id": "BETTER-AUTH-DOCS",
@@ -103,10 +103,10 @@
         "references/pinned-facts.md",
         "references/security.md"
       ],
-      "currentVersion": "1.6.27",
-      "versionCheckedAt": "2026-08-12T14:33:11.062Z",
-      "checksum": "30edf1b6658a473a00005153a3eafc07de5c3decd6b8f09fc6c32f3a21c4db1c",
-      "retrievedAt": "2026-08-12T14:33:11.062Z"
+      "currentVersion": "1.7.2",
+      "versionCheckedAt": "2026-08-29T05:56:59.737Z",
+      "checksum": "905fef0ef5b216abae2fcb14c7c7ea9b74c4788acc7fd65e8ad72600b13d670f",
+      "retrievedAt": "2026-08-29T05:56:59.737Z"
     },
     {
       "id": "EVE-DOCS",
@@ -129,10 +129,10 @@
         "references/pinned-facts.md",
         "references/ai-agents.md"
       ],
-      "currentVersion": "0.33.2",
-      "versionCheckedAt": "2026-08-12T14:33:11.062Z",
-      "checksum": "a777f9da0cb3966a9c7cc06a3c12be34b2928800b370e966e8b6e0f5a5622915",
-      "retrievedAt": "2026-08-12T14:33:11.062Z"
+      "currentVersion": "0.47.3",
+      "versionCheckedAt": "2026-08-29T05:56:59.737Z",
+      "checksum": "84a499a2bc49274d6736703b0d82b774822c7d5e9d69954a73262eff4af72614",
+      "retrievedAt": "2026-08-29T05:56:59.737Z"
     },
     {
       "id": "WORKFLOW-SDK-POSTGRES",
@@ -155,10 +155,10 @@
         "references/pinned-facts.md",
         "references/ai-agents.md"
       ],
-      "currentVersion": "4.3.3",
-      "versionCheckedAt": "2026-08-12T14:33:11.062Z",
-      "checksum": "3eca56b5ec9668638d4e00b290c157383dfe8ceaaa334de13bb6244b32fa6839",
-      "retrievedAt": "2026-08-12T14:33:11.062Z"
+      "currentVersion": "4.3.5",
+      "versionCheckedAt": "2026-08-29T05:56:59.737Z",
+      "checksum": "d99e33159e2259f8f71d22f2bd19ffbc284ff55e1d8e9916d4930725fb55461a",
+      "retrievedAt": "2026-08-29T05:56:59.737Z"
     },
     {
       "id": "NEXTJS-BLOG",
@@ -181,10 +181,10 @@
         "references/pinned-facts.md",
         "references/web.md"
       ],
-      "currentVersion": "16.3.0",
-      "versionCheckedAt": "2026-08-12T14:33:11.062Z",
-      "checksum": "9d5d2503e2e8aa7ed1c3f0cb972c78e64b2e3aae5f3ad264bb0a79bd179708f0",
-      "retrievedAt": "2026-08-12T14:33:11.062Z"
+      "currentVersion": "16.3.3",
+      "versionCheckedAt": "2026-08-29T05:56:59.737Z",
+      "checksum": "5485cefce17dd80d1062364c597dbef4ebe39b7a59e869458b53d618c4f6f57d",
+      "retrievedAt": "2026-08-29T05:56:59.737Z"
     },
     {
       "id": "PG-BOSS-NPM",
@@ -206,11 +206,11 @@
       "affected": [
         "references/pinned-facts.md"
       ],
-      "currentVersion": "12.27.0",
-      "versionCheckedAt": "2026-08-12T14:33:11.062Z",
+      "currentVersion": "12.28.1",
+      "versionCheckedAt": "2026-08-29T05:56:59.737Z",
       "checksumScope": "http-body",
-      "checksum": "abf4bc2795e2df03181a21dfd29c7b9234c933a9dcafa72b4583d590cad609da",
-      "retrievedAt": "2026-08-12T14:33:41.513Z"
+      "checksum": "6d1863268232526ae87582d9cba6f7ba148d91888409456a033c1f6b7e2f00f4",
+      "retrievedAt": "2026-08-29T05:56:59.737Z"
     },
     {
       "id": "FLUTTER-RELEASES",
@@ -232,8 +232,8 @@
         "references/pinned-facts.md",
         "references/mobile.md"
       ],
-      "checksum": "94f9df6f67615ee05d826995f9709309c5453d0d8e4be11232ca5d463929ed2b",
-      "retrievedAt": "2026-08-12T14:33:11.062Z"
+      "checksum": "833a60e3142d8944af96eb33a6266fb27cdbfedb3f72db9765098f81bdabfa9d",
+      "retrievedAt": "2026-08-29T05:56:59.737Z"
     }
   ]
 }

package/skill/dev-chronicle/SKILL.md

@@ -12,17 +12,19 @@ Nearest neighbors: `dev-implement` writes the entries at hand-back (the write ru
 ## The entry — one per behavior-changing branch
 
 ```markdown
-## DD-MM-YYYY — <title: the change as a human outcome — not a mechanism, not a commit subject> (#<issue>)
+## DD-MM-YYYY — <title: the change as a human outcome — not a mechanism, not a commit subject> ([#<issue>](<issue url>))
+
+- **What:** <2–4 plain sentences: what exists now that didn't, from the operator's point of view>
+- **Why:** <the need that prompted it>
+- **How it went:** <the honest one-liner: smooth / what fought back / what was cut>
+- **Changed:** <the user-visible changes, simple words — sub-bullets or one ·-separated line>
+- **Decisions:** <register lines it produced, or "none">
 
-**What:** <2–4 plain sentences: what exists now that didn't, from the operator's point of view>
-**Why:** <the need that prompted it>
-**How it went:** <the honest one-liner: smooth / what fought back / what was cut>
-**Changed:** <the user-visible changes, simple words — bullets or one ·-separated line>
-**Decisions:** <register lines it produced, or "none">
 — approved by operator (<username>) · built by <agent> · branch <name>
 ```
 
-- Titles name the outcome ("Invoice reminders now chase late payers"), never the mechanism ("add reminderAt column").
+- Titles name the outcome ("Invoice reminders now chase late payers"), never the mechanism ("add reminderAt column"). The issue reference is a full markdown link to `…/issues/<n>` (correct for PRs too — GitHub redirects); a bare `#N` never appears anywhere in an entry, because file views don't auto-link it.
+- The fields are LIST ITEMS and the footer sits after a blank line — single newlines soft-wrap into one paragraph in rendered markdown; bullets are what guarantee a line per field.
 - Prepend — newest first. File missing → create it with a two-line header naming this skill as the format home.
 - **How it went** is where honesty lives: what fought back, what was cut, what surprised. "Smooth" is a fine answer; silence is not.
 - Research issues get an entry only when the findings changed direction; docs/test-only merges get none (ship-gate's excuse flag covers both records at once).

package/skill/dev-implement/SKILL.md

@@ -40,6 +40,8 @@ Honesty over green: a failing test gets fixed at the root or reported as failing
 
 Every behavior-changing branch carries its changelog entry per dev.md's `changelog:` knob (`changesets` → write `.changeset/<slug>.md` directly, never the interactive CLI; `keep-a-changelog` / `pubspec+changelog` → one bullet under `## [Unreleased]`, creating CHANGELOG.md with the `# Changelog` + `## [Unreleased]` skeleton in the same branch when absent; `none` → skip) **and**, when dev.md says `chronicle: on`, its story entry prepended to `.vegastack/chronicle.md` (format: the `dev-chronicle` skill) — both on the branch, landing atomically with the merge. Docs the brief names as affected get updated in the same branch.
 
+A changeset entry's first line is **one plain sentence** naming the change in behavior terms; detail follows after a blank line as sub-bullets, one line each. The published changelog and the release notes that lead with it reproduce the entry verbatim, so a single 1,000-character sentence ships as a wall of text.
+
 ## Verify — the gate function
 
 Before claiming ANY status: **identify** the command that proves it → **run** it fresh and complete → **read** the full output and exit code → only then claim, with the evidence. Tests pass ⇒ a fresh run with 0 failures — never "should pass", never a previous run. Build succeeds ⇒ exit 0. Bug fixed ⇒ the original symptom re-tested. A subagent finished ⇒ you inspected its diff or report file — never its say-so.
@@ -68,7 +70,7 @@ Run the `dev-review` skill per dev.md's `review:` knob — fresh subagent axes b
 Branch: <name> @ <sha7>
 ```
 
-The `**Review:**` line is the one home of surfaced rulings: every ledger `Ruling:` appears there, in the order made. Run `node <path-to-this-skill>/scripts/evidence-check.mjs --file <draft> --json` before posting — exit 2 means the shape is incomplete; fix, don't post. Post it, swap `working` → `for-operator`, stop, and close with the plain-language summary (which repeats, never replaces, the evidence content): what was built, which paths were taken, the rulings, what's worth the operator double-checking.
+The tail's sha stays bare: GitHub auto-links a 7-character sha mid-comment as soon as the commit is on the remote, so the tail becomes a live commit link the moment the branch is pushed — while an explicit `/commit/<sha>` link written at hand-back points at a commit that has not been pushed yet, and 404s. The `**Review:**` line is the one home of surfaced rulings: every ledger `Ruling:` appears there, in the order made. Run `node <path-to-this-skill>/scripts/evidence-check.mjs --file <draft> --json` before posting — exit 2 means the shape is incomplete; fix, don't post. Post it, swap `working` → `for-operator`, stop, and close with the plain-language summary (which repeats, never replaces, the evidence content): what was built, which paths were taken, the rulings, what's worth the operator double-checking.
 
 ## Corrections loop — code and docs move together
 

package/skill/dev-review/assets/review-known-patterns.md.template

@@ -7,24 +7,26 @@ Format, one entry per pattern:
 ```markdown
 ## <short pattern name>
 
-**Pattern:** <what the reviewer keeps flagging, concretely — code shape, file area>
-**Why it's safe here:** <the project fact that makes it a false positive>
-**Still flag if:** <the exception that makes it a real finding after all>
-**Origin:** <date + issue where the dismissal happened — operator (<username>)>
+- **Pattern:** <what the reviewer keeps flagging, concretely — code shape, file area>
+- **Why it's safe here:** <the project fact that makes it a false positive>
+- **Still flag if:** <the exception that makes it a real finding after all>
+- **Origin:** <date + issue where the dismissal happened — operator (<username>)>
 ```
 
+The four fields are LIST ITEMS — this file is read in a repo's file view, where single newlines soft-wrap into one paragraph; bullets are what guarantee a line per field. Appended entries (dev-implement's corrections loop) keep the same shape.
+
 ## Worked examples (replace with real entries)
 
 ### Sequential awaits in setup scripts
 
-**Pattern:** consecutive `await` calls in bootstrap/setup code flagged as a parallelization miss.
-**Why it's safe here:** setup steps have ordering dependencies the reviewer can't see locally (labels before issues, scaffold before wiring).
-**Still flag if:** the awaits are inside a hot request path or a loop over user data.
-**Origin:** seeded example — delete when the first real entry lands.
+- **Pattern:** consecutive `await` calls in bootstrap/setup code flagged as a parallelization miss.
+- **Why it's safe here:** setup steps have ordering dependencies the reviewer can't see locally (labels before issues, scaffold before wiring).
+- **Still flag if:** the awaits are inside a hot request path or a loop over user data.
+- **Origin:** seeded example — delete when the first real entry lands.
 
 ### Direct `gh` CLI calls without a wrapper
 
-**Pattern:** scripts shelling to `gh` flagged as needing an API client abstraction.
-**Why it's safe here:** the workflow standardizes on `gh` for auth and pagination; a wrapper would duplicate it.
-**Still flag if:** arguments are interpolated into a shell string instead of an execFile arg array.
-**Origin:** seeded example — delete when the first real entry lands.
+- **Pattern:** scripts shelling to `gh` flagged as needing an API client abstraction.
+- **Why it's safe here:** the workflow standardizes on `gh` for auth and pagination; a wrapper would duplicate it.
+- **Still flag if:** arguments are interpolated into a shell string instead of an execFile arg array.
+- **Origin:** seeded example — delete when the first real entry lands.

package/skill/dev-setup/references/stack-playbooks.md

@@ -12,7 +12,7 @@ Each playbook fills the same six slots: **detect** (file signals) · **ship draf
   - `ask: tag v<version> and push — the tag triggers the publish pipeline`
   - `guard: tag matches the package version` · `guard: changelog has an entry for the tagged version`
   - `auto: confirm the registry shows the new version; report old → new`
-- **Changelog:** `changesets`. Per behavior-changing branch, dev-implement writes `.changeset/<slug>.md` **directly** — frontmatter `"<package-name>": <patch|minor|major>` (from the brief's version-impact line) plus a one-paragraph summary. `changeset add` (the bare `changeset` prompt) is interactive; never invoke it in a dark run — `changeset version` at release time is the only CLI use. The release changelog is changesets-written — never hand-edited.
+- **Changelog:** `changesets`. Per behavior-changing branch, dev-implement writes `.changeset/<slug>.md` **directly** — frontmatter `"<package-name>": <patch|minor|major>` (from the brief's version-impact line) plus the entry itself, shaped per dev-implement's changelog rule. `changeset add` (the bare `changeset` prompt) is interactive; never invoke it in a dark run — `changeset version` at release time is the only CLI use. The release changelog is changesets-written — never hand-edited.
 - **Version identity:** `package.json` `version`, changesets-managed. Monorepos: identity is per-package; changesets handles multiple packages natively — the guard reads the released package's manifest. A private workspace root carries no *real* version — pin it at `0.0.0` (some tooling, e.g. `npm sbom` purl generation, requires every package to have one) and never bump it; deleting the field outright breaks such tooling.
 - **Guards:** changeset-presence (PR-time) · tag↔version · changelog-entry.
 - **Rollback:** `Rollback is roll-forward: revert on main, release previous-good as a new patch, deprecate the bad version on the registry.`

package/skill/dev-setup/refresh/sources.json

@@ -34,7 +34,7 @@
         "SKILL.md"
       ],
       "checksum": "e989818335ae45abb756df759d4859aa9daa6764393a3e39c46e505f181a33b6",
-      "retrievedAt": "2026-08-27T08:19:24.132Z"
+      "retrievedAt": "2026-08-29T05:57:02.492Z"
     },
     {
       "id": "CC-SKILLS",
@@ -55,8 +55,8 @@
       "affected": [
         "references/harness-facts.md"
       ],
-      "checksum": "8d03177dcc10ffbff5313c43023da15ff1059197c1fff05eb9dba3fe6361c767",
-      "retrievedAt": "2026-08-27T08:19:24.132Z"
+      "checksum": "88007b9a77d7a0881f2367604ab02b8e80abe475f33cfd4e4cf87913c5786ad3",
+      "retrievedAt": "2026-08-29T05:57:02.492Z"
     },
     {
       "id": "CC-TOOLS",
@@ -78,8 +78,8 @@
         "references/harness-facts.md",
         "SKILL.md"
       ],
-      "checksum": "3bdd8429e76be8213e9263103134ac7b6892f4574820e40bf84032a98c5d0aeb",
-      "retrievedAt": "2026-08-27T08:19:24.132Z"
+      "checksum": "21937941459c5909a41ff7d1bac3b7f7bf8d17c6ea3858e6d44a0a90d46a59e5",
+      "retrievedAt": "2026-08-29T05:57:02.492Z"
     },
     {
       "id": "CODEX-AGENTS",
@@ -101,7 +101,7 @@
         "references/harness-facts.md"
       ],
       "checksum": "9eacb3d812b87be4acc1213af58ded35e8f387bcf1589c203bbb452ead0c4774",
-      "retrievedAt": "2026-08-27T08:19:24.132Z"
+      "retrievedAt": "2026-08-29T05:57:02.492Z"
     },
     {
       "id": "CODEX-SKILLS",
@@ -124,7 +124,7 @@
         "SKILL.md"
       ],
       "checksum": "44aa6d490f4567c0b1fb064deab642bfac590f0e721228e0c53fe738db191026",
-      "retrievedAt": "2026-08-27T08:19:24.132Z"
+      "retrievedAt": "2026-08-29T05:57:02.492Z"
     },
     {
       "id": "CC-HOOKS",
@@ -146,8 +146,8 @@
         "references/harness-facts.md",
         "SKILL.md"
       ],
-      "checksum": "936bd443066df08a514972673358e102fd23b80bee9a289d3d53a1ed8aca1a64",
-      "retrievedAt": "2026-08-27T14:41:39.189Z"
+      "checksum": "1a156c294dc35c1f5291e84766e0bd5de3f29d63916a1cdc648ff05f9f20d55a",
+      "retrievedAt": "2026-08-29T05:57:02.492Z"
     },
     {
       "id": "CODEX-HOOKS",
@@ -170,7 +170,7 @@
         "SKILL.md"
       ],
       "checksum": "430f2d85a4791dc695bcdc063193c225343104a342e8adf80a544ab87ae4223d",
-      "retrievedAt": "2026-08-27T14:41:39.189Z"
+      "retrievedAt": "2026-08-29T05:57:02.492Z"
     },
     {
       "id": "CODEX-EXEC",
@@ -192,7 +192,7 @@
         "references/harness-facts.md"
       ],
       "checksum": "df82c4bbf3b5bffca926a244549222c1235154cfba973b9a0bb1d7a0abd28d66",
-      "retrievedAt": "2026-08-27T08:19:24.132Z"
+      "retrievedAt": "2026-08-29T05:57:02.492Z"
     }
   ]
 }

package/skill/dev-status/SKILL.md

@@ -29,8 +29,8 @@ Ready to build (N): - <linked title> — <scope>
 In flight (N): - <linked title> — working, task <x>/<y>, ledger moved <n>d ago
 Stale (N): - <linked title> — working <age>d, ledger silent <n>d → check or reclaim
 Open PRs (N): - <linked title> — checks <green|pending-or-red|no-checks>
-Pending decisions (N): "<gist>" (<linked issue>) — records at that issue's merge
-Last chronicle chapter: <date> — <title>
+Pending decisions (N): "<gist-plain>" (<linked issue>) — records at that issue's merge
+Last chronicle chapter: <date> — <title-plain>
 Next: <the single most valuable operator action, and why>
 ```
 
@@ -38,7 +38,8 @@ Next: <the single most valuable operator action, and why>
 - Sections with zero entries are omitted, not rendered empty. A completely quiet board is one line: "Nothing needs you — <n> issues ready for agents, nothing in flight."
 - `risky` issues get their flag shown inline wherever they appear.
 - **Next** is one line, chosen not computed-looking: the action that unblocks the most (a plan approval blocking several ready issues beats a lone review).
-- <linked title> means a markdown link wrapping the issue/PR title around its URL; numbers ride inside the link, never stand alone.
+- <linked title> means a markdown link this report builds around the issue/PR title and its URL; numbers ride inside the link, never stand alone. That governs the references the board itself makes.
+- `<title-plain>` / `<gist-plain>` are the script's `titlePlain` / `gistPlain` fields — text quoted from elsewhere (a chronicle title, a decision gist) may arrive carrying markdown links, and raw bracket-and-parenthesis markup means nothing in a terminal, so it is quoted with the markup removed rather than relinked.
 
 ## Honesty rules
 

package/skill/dev-status/scripts/status.mjs

@@ -31,6 +31,17 @@ function gh(args) {
   return JSON.parse(out);
 }
 
+// Link markup carries no meaning in a terminal, so the board renders link-free
+// variants alongside the raw fields — and register comparison uses them, so a
+// linked gist still matches its plain register line. URLs containing `)` are not
+// a shape this workflow produces (issue and commit URLs never do).
+const LINK = /\[([^\]]*)\]\((?:[^)]*)\)/g;
+
+export function stripLinks(text) {
+  if (typeof text !== 'string') return '';
+  return text.replace(LINK, '$1');
+}
+
 export function ageDays(iso, now = Date.now()) {
   return Math.floor((now - Date.parse(iso)) / 86_400_000);
 }
@@ -67,6 +78,12 @@ export function ledgerMovedAt(comments) {
   return at;
 }
 
+// Register lines are written plain, proposals may carry links — compare link-free
+// so a recorded decision does not stay "pending" forever on its markup alone.
+function recorded(gist, registerText) {
+  return stripLinks(registerText).includes(stripLinks(gist).slice(0, 60));
+}
+
 // Decision proposals not yet in the register: marker type=decision comments
 // (and evidence **Decision:** lines) whose text isn't in the register file.
 export function pendingDecisions(comments, registerText) {
@@ -75,11 +92,11 @@ export function pendingDecisions(comments, registerText) {
     const type = parseMarker(c.body)?.keys?.type;
     if (type === 'decision') {
       const gist = (c.body.split('\n').find((l) => l.trim() && !l.startsWith('<!--') && !l.startsWith('#')) ?? '').trim();
-      if (gist && !(registerText ?? '').includes(gist.slice(0, 60))) pending.push(gist);
+      if (gist && !recorded(gist, registerText)) pending.push(gist);
     }
     if (type === 'evidence') {
       const m = /\*\*Decision:\*\*\s*([^\n]+)/.exec(c.body);
-      if (m && !/^none\b/i.test(m[1].trim()) && !(registerText ?? '').includes(m[1].trim().slice(0, 60))) pending.push(m[1].trim());
+      if (m && !/^none\b/i.test(m[1].trim()) && !recorded(m[1].trim(), registerText)) pending.push(m[1].trim());
     }
   }
   return pending;
@@ -118,7 +135,7 @@ export function gatherStatus({ repo, staleDays = 3, devMdPath = '.vegastack/dev.
       const moved = ledgerMovedAt(comments);
       issue.ledgerAgeDays = moved ? ageDays(moved, now) : null;
       issue.stale = bucket === knobs.states[3] && (issue.ledgerAgeDays === null || issue.ledgerAgeDays >= staleDays);
-      decisions.push(...pendingDecisions(comments, registerText).map((d) => ({ issue: issue.number, gist: d })));
+      decisions.push(...pendingDecisions(comments, registerText).map((d) => ({ issue: issue.number, gist: d, gistPlain: stripLinks(d) })));
     }
   }
 
@@ -131,7 +148,7 @@ export function gatherStatus({ repo, staleDays = 3, devMdPath = '.vegastack/dev.
   let lastChronicle = null;
   if (existsSync(chroniclePath)) {
     const m = /^## (\d{2}-\d{2}-\d{4}) — (.+)$/m.exec(readFileSync(chroniclePath, 'utf8'));
-    if (m) lastChronicle = { date: m[1], title: m[2] };
+    if (m) lastChronicle = { date: m[1], title: m[2], titlePlain: stripLinks(m[2]) };
   }
 
   return { repo: resolvedRepo, staleDays, board, prs, pendingDecisions: decisions, lastChronicle };

package/skill/skill-maintainer/references/release-ops.md

@@ -23,7 +23,7 @@ profile carries a schema version to validate against.
 
 ## Release flow (tag-driven)
 
-1. Every PR that changes released behavior lands with a changeset — a `.changeset/<slug>.md` written directly, since the `changeset` add prompt is interactive (`bunx changeset version` at release time is the only CLI use) — whose bump follows the table above.
+1. Every PR that changes released behavior lands with a changeset — a `.changeset/<slug>.md` written directly, since the `changeset` add prompt is interactive (`bunx changeset version` at release time is the only CLI use) — whose bump follows the table above and whose shape follows dev-implement's changelog rule.
 2. Maintainer, at release time: `bunx changeset version` (applies changesets to `packages/cli/package.json` and the changelog), then `bun install` so `bun.lock` does not go stale, commit. The release record is `packages/cli/CHANGELOG.md`, changesets-written — never by hand; the root `CHANGELOG.md` is the frozen pre-0.3.0 record pointing there.
 3. Tag the release commit `v<version>`, push the tag.
 4. The release workflow runs on the tag: `bun run check`, tag↔version guard, `npm publish` via trusted publishing (OIDC, token-free, provenance by default; idempotently skipped if already on the registry), SBOM, GitHub release. Never pass `--provenance` explicitly — it conflicts with trusted-publishing config.

package/skill/skill-maintainer/refresh/sources.json

@@ -30,8 +30,8 @@
       "affected": [
         "ref:standards"
       ],
-      "checksum": "1aecfc21328fcf51b456615477d7aebfa05b779c56d75c7721c4fd5f969af8f7",
-      "retrievedAt": "2026-08-08T07:52:08.251Z"
+      "checksum": "f2c589e5fd5e4b4684fdf6567262c24dea6a3b14eca795ab1dca3c4b7a3e1eea",
+      "retrievedAt": "2026-08-29T05:57:04.887Z"
     },
     {
       "id": "CLAUDE-CODE-SKILLS",
@@ -52,8 +52,8 @@
       "affected": [
         "ref:standards"
       ],
-      "checksum": "a2651c4f1a7aa43978c549c9f376c47b738ac53532fecc8168aee0d3b796469a",
-      "retrievedAt": "2026-08-08T07:52:08.251Z"
+      "checksum": "92f9993b6c2cb79be4ecf3d2785c310978d4daf308df6a0d4d076845028b170b",
+      "retrievedAt": "2026-08-29T05:57:04.887Z"
     },
     {
       "id": "CODEX-SKILLS",
@@ -74,8 +74,8 @@
       "affected": [
         "ref:standards"
       ],
-      "checksum": "b7667a87600436ae5d70e414a2a0fcb207e11c8ffdb7a28d93637980f3ff565d",
-      "retrievedAt": "2026-08-08T07:52:08.251Z"
+      "checksum": "e6ede44b27e6195c1920bdfb2f3f15e548f3ba34feeffad3a0cb23c54a0f63b9",
+      "retrievedAt": "2026-08-29T05:57:04.887Z"
     },
     {
       "id": "HERMES-SKILLS",
@@ -96,8 +96,8 @@
       "affected": [
         "ref:standards"
       ],
-      "checksum": "c4ed10a90e9303adb7a80aa5531ea92a1debbe6c4edff588199b123429065893",
-      "retrievedAt": "2026-08-08T07:52:08.251Z"
+      "checksum": "d3cbea81c2c03c6ab480848c79d75d4914109898509344b774428579cc642223",
+      "retrievedAt": "2026-08-29T05:57:04.887Z"
     }
   ]
 }

package/skill/skillify/SKILL.md

@@ -89,7 +89,7 @@ Now that quality is proven:
 
 1. Write unit tests for the deterministic branches of any bundled scripts, plus fixtures. A prose-only skill keeps just its trigger-query fixture.
 2. Write `refresh/sources.json` + `refresh/REFRESH.md` for the volatile facts marked in Phase 2 — or the one-line evergreen waiver.
-3. Finish `README.md` and `agents/openai.yaml`; fill in the wiring TODOs the scaffolder left (README row description, changeset text).
+3. Finish `README.md` and `agents/openai.yaml`; fill in the wiring TODOs the scaffolder left (README row description, changeset text — shaped per dev-implement's changelog rule).
 
 ## Phase 6 — Verify
 

package/skill-integrity.json

@@ -10,18 +10,18 @@
         "references/data.md": "781d3ae7d3bca0b269c123a10013226f3878503dd1224ee526edd102bfc270f0",
         "references/infra.md": "a6d07c5e9ea67788edac7b80742a5588a1f019e387163bfdab531314fb54d009",
         "references/mobile.md": "b6ee481df810f3fd5466487848287ceeb33ac98bf6db0bc2d65c4d6fa397284f",
-        "references/pinned-facts.md": "aefb50040c0a2c4256cef51cc7789e838977ac265e997d4c63a313de422e37f0",
+        "references/pinned-facts.md": "28c07d9258c839290c6e003aa3e33138d809f09f53dc50185357595eb1a1d2a5",
         "references/principles.md": "f8b7e40010a3094bcc3d4d2f285d40430ea9f3a9b554ed0ff54731b7e7754cd4",
         "references/security.md": "e3afe3fc9d223a7e3742ea1d27a91df8f1811729060d3778a6a51fdde5b90764",
         "references/stack.md": "0bc2247865624f06a90b2c35794dacf6bd37220babbc8b2e4b5a47c5cfb2961c",
         "references/web.md": "1a08b96eb93be56f3176d409b2985ab4fc2ffaef870eb8dac4ca2940ad9f084f",
         "refresh/REFRESH.md": "abdc377fcf79afcbd41c96ad51be7b20b4292378c0891ab6b309755459dde715",
-        "refresh/sources.json": "2cfd851090f5a0b661bd88c9bbe62ca3f99b744066817cc1067378520616f68e"
+        "refresh/sources.json": "a82d6873306beb95028f76aae2625043858f3a9fc8ceb59ddc7a2193425ae6ed"
       }
     },
     "dev-chronicle": {
       "files": {
-        "SKILL.md": "115dc19b93fd266d001592a50acfd21ebd7ec38dec774466b7b18226a20abcc4",
+        "SKILL.md": "e43f50fc570992de0766d4e569693babd05cde08d2e1c271c267df6b7552ac89",
         "agents/openai.yaml": "765b12e17b7fce88c53ca0fae735bf0efceb843cc3703b91bc1801ab5cac06b4",
         "references/conventions.md": "815f5189daff1b71b3251b7a57de183a4a387fcdedbd5875e673d5bd3de398fc",
         "refresh/REFRESH.md": "760e66642eec426cd5ab2319613e817adf5bbd7b64c8eaa22dd13497351bf9c1",
@@ -40,7 +40,7 @@
     },
     "dev-implement": {
       "files": {
-        "SKILL.md": "781d8686a763489983d7e9a37ee6817c5e6f41bb794b53d4d72d20abfdc580af",
+        "SKILL.md": "8be83688920875aa16566d20497b2a249a53de6f2fceeae463825154e064e502",
         "agents/openai.yaml": "1abab383deca54d32749fd9156f9a6211fe96e02e0166dc8a16ff8459ac31b74",
         "references/conventions.md": "815f5189daff1b71b3251b7a57de183a4a387fcdedbd5875e673d5bd3de398fc",
         "references/ledger-and-resume.md": "46bd4ad38eb70376d9ad36ac80269abc337c12e692e2b7de6483584f1003346a",
@@ -77,7 +77,7 @@
       "files": {
         "SKILL.md": "00c1b86038ef8497480b440ee490019702013692c8ac5266a8340464745e0cf5",
         "agents/openai.yaml": "3f35d3dc60f179d4ac2526997c4d10173ba3018d06f0dbe77e209ce2978fa702",
-        "assets/review-known-patterns.md.template": "a521aba1e59c44645bbb9f9b6b0fbba3423f694b2e7bbcb1dbabe7d2c8e5756a",
+        "assets/review-known-patterns.md.template": "2fe7dbcc4d0eeac542e7624111130265b2bb4f08806f20dbd2087842cbb22b5c",
         "references/conventions.md": "815f5189daff1b71b3251b7a57de183a4a387fcdedbd5875e673d5bd3de398fc",
         "references/cross-agent.md": "3541715d0563703373ea3d93582119b80356d1cbdee19ce17f958c0f7c914884",
         "references/dispatch-prompts.md": "259e8f468cedb961359bad6d080515d4682a9e5aafd268a192d51454d2842c50",
@@ -94,9 +94,9 @@
         "assets/dev-profile.md.template": "45b2a90fc7aee39e7b975151f1281787d6dd4d3b7d5f9df5b8f282d020a1d7a9",
         "references/conventions.md": "815f5189daff1b71b3251b7a57de183a4a387fcdedbd5875e673d5bd3de398fc",
         "references/harness-facts.md": "2be1d81f6a616d40dc865aaeefaf53c61bc13ade4ba1de8fb406c520bf15be40",
-        "references/stack-playbooks.md": "3586a0f03830a9bfaba2d9373a2e745d2207213923af601bf472849f07a7d9e9",
+        "references/stack-playbooks.md": "f70975d482d5061da16f45662d2fe7a6c2e4cd83c2a91818d5ff0789954f758c",
         "refresh/REFRESH.md": "debda6ab96e899dd7e38309f714e9d65a3fbc53fd8ca68b8156f1348226c87b9",
-        "refresh/sources.json": "3deab13addeff1d8c6aac17955694c914064a9eba89eb4c833163448b2351497"
+        "refresh/sources.json": "1252b43433d8799e9e577542f0898f8f2c83f17e661ca2d3e2d4fa57c8d3689a"
       }
     },
     "dev-ship": {
@@ -112,27 +112,27 @@
     },
     "dev-status": {
       "files": {
-        "SKILL.md": "3d512a6fa30591fc762b11ef4861006defb3ba9ceac03eb77488a15d2489b49c",
+        "SKILL.md": "42d1dfbda5602d68b114060c83cc9f61e14b9059d09a2b436218afdf0f009706",
         "agents/openai.yaml": "72435947f5afef0c8a2c170e987b14fe6057b174318c16b6b538ae8d129791fb",
         "references/conventions.md": "815f5189daff1b71b3251b7a57de183a4a387fcdedbd5875e673d5bd3de398fc",
         "refresh/REFRESH.md": "52aee9bae64d8342e127704d1db282e43ed57c101148727bf10172d6cb975bfa",
         "refresh/sources.json": "a7ba2340964dc70410626087686145b5790a0e763a18ef2c4d9aa37e950f2e04",
-        "scripts/status.mjs": "70c959f46764613d4645b1dce54b05a3800c0b689ee5bd14f807b6150dce3cb7"
+        "scripts/status.mjs": "bc56d0b5d996676cfccb752d9d77d0e9e7d64932741cd39d6a503e9761fbe34d"
       }
     },
     "skill-maintainer": {
       "files": {
         "SKILL.md": "0947155a4e7c87d6f200a1e565013beac8e3093b17e3216d6901a20be863bb21",
         "agents/openai.yaml": "0b89d4e6416cf20b448f5322f3d7433cfde333d2b4a05b42ed53db3759701fb4",
-        "references/release-ops.md": "6ce36667a019339d6586dc9f898398331f2c078b52f88ec4c0f9aae21a4c88c5",
+        "references/release-ops.md": "16515b2c8c33da43a56871f6e62a459184a983cd650e1a91434160336c0ca374",
         "references/standards.md": "3646d0dd0560a87b333f70febf670b093c89b35111132cdb641b763bf184b02f",
         "refresh/REFRESH.md": "3955bff5f0a14c83336a73cdbd07ba18d9398996934af87fac4454206cd14023",
-        "refresh/sources.json": "cf38cdf8123a50ea7ef2d1466a87faa648c12e5bc90d9ee9b6ae45632e7d0800"
+        "refresh/sources.json": "4977152381d53555196ac676f95e61b4eaa301309a17560da5cda722010eb80f"
       }
     },
     "skillify": {
       "files": {
-        "SKILL.md": "378b66998575b8e316190fa2bbe435852fb191448806e2ec8943037e716a9f9d",
+        "SKILL.md": "8469080261cf1911d054fb5b08cdec170566f5fcd07de6fa374d847d1b9d87aa",
         "agents/openai.yaml": "df320cf32a8db06c213f7892844dab810b7e96cfbf32502d25185d4a4167ef87",
         "assets/templates/README.md.template": "68230ada702ad39f5de1f35e838ba590d89ca19b23868d4499353db6034fcc2c",
         "assets/templates/REFRESH.md.template": "ff86afade565d668333e7f6d0432213760fd68a62b8ba22897a8601b74c94ac0",