bigpowers 2.67.0 → 2.68.0

package/.pi/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bigpowers",
-  "version": "2.67.0",
+  "version": "2.68.0",
   "description": "75 skills — 73 agent skills synthesizing 17 years of software engineering discipline into a prescriptive methodology for solo developers",
   "keywords": [
     "pi-package"

package/.pi/prompts/gate-trace.md

@@ -1,5 +1,5 @@
 ---
-description: "Deterministic traceability quality gate — reads coverage matrix + blind-spot data, applies decision rules with oracle confidence downgrade, emits PASS/CONCERNS/FAIL/WAIVED verdict. Use before release-branch to gate merges on traceability."# story: e38s06
+description: "Deterministic traceability quality gate — reads coverage matrix + blind-spot data, applies decision rules with oracle confidence downgrade, emits PASS/CONCERNS/FAIL/WAIVED verdict. Use before release-branch to gate merges on traceability." # story: e38s06
 ---
 
 

package/.pi/prompts/maintain-wiki.md

@@ -1,5 +1,5 @@
 ---
-description: "Agent-maintained OKF wiki — INGEST source docs, LINT for issues, QUERY across concept pages. Run as part of build-epic Step 8 and verify-work Phase 3."# story: e39s07
+description: "Agent-maintained OKF wiki — INGEST source docs, LINT for issues, QUERY across concept pages. Run as part of build-epic Step 8 and verify-work Phase 3." # story: e39s07
 ---
 
 

package/.pi/prompts/security-review.md

@@ -1,5 +1,5 @@
 ---
-description: > AI-powered security analysis of code changes — traces data flow, detects injection, auth bypass, secrets exposure, and unsafe deserialization across files. Use when reviewing pending changes, before release-branch, during verify-work Phase 5, during build-epic Step 0 threat modeling, or when the user says "security review" or "scan for vulns".
+description: >   AI-powered security analysis of code changes — traces data flow, detects   injection, auth bypass, secrets exposure, and unsafe deserialization across   files. Use when reviewing pending changes, before release-branch, during   verify-work Phase 5, during build-epic Step 0 threat modeling, or when   the user says "security review" or "scan for vulns".
 ---
 
 

package/.pi/skills/gate-trace/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: gate-trace
-description: "\"Deterministic traceability quality gate — reads coverage matrix + blind-spot data, applies decision rules with oracle confidence downgrade, emits PASS/CONCERNS/FAIL/WAIVED verdict. Use before release-branch to gate merges on traceability.\"# story: e38s06"
+description: "\"Deterministic traceability quality gate — reads coverage matrix + blind-spot data, applies decision rules with oracle confidence downgrade, emits PASS/CONCERNS/FAIL/WAIVED verdict. Use before release-branch to gate merges on traceability.\" # story: e38s06"
 model: haiku
 ---
 

package/.pi/skills/maintain-wiki/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: maintain-wiki
-description: "\"Agent-maintained OKF wiki — INGEST source docs, LINT for issues, QUERY across concept pages. Run as part of build-epic Step 8 and verify-work Phase 3.\"# story: e39s07"
+description: "\"Agent-maintained OKF wiki — INGEST source docs, LINT for issues, QUERY across concept pages. Run as part of build-epic Step 8 and verify-work Phase 3.\" # story: e39s07"
 model: haiku
 ---
 

package/.pi/skills/security-review/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: security-review
-description: "> AI-powered security analysis of code changes — traces data flow, detects injection, auth bypass, secrets exposure, and unsafe deserialization across files. Use when reviewing pending changes, before release-branch, during verify-work Phase 5, during build-epic Step 0 threat modeling, or when the user says \"security review\" or \"scan for vulns\"."
+description: ">   AI-powered security analysis of code changes — traces data flow, detects   injection, auth bypass, secrets exposure, and unsafe deserialization across   files. Use when reviewing pending changes, before release-branch, during   verify-work Phase 5, during build-epic Step 0 threat modeling, or when   the user says \"security review\" or \"scan for vulns\"."
 model: sonnet
 ---
 

package/CHANGELOG.md

@@ -1,3 +1,17 @@
+# [2.68.0](https://github.com/danielvm-git/bigpowers/compare/v2.67.1...v2.68.0) (2026-07-06)
+
+
+### Features
+
+* **e28:** sync pipeline refactor — Parse→IR→Render with shared library ([#54](https://github.com/danielvm-git/bigpowers/issues/54)) ([2006f4b](https://github.com/danielvm-git/bigpowers/commit/2006f4bdbe794c454fc167b485e92bd9d3ff71a0))
+
+## [2.67.1](https://github.com/danielvm-git/bigpowers/compare/v2.67.0...v2.67.1) (2026-07-05)
+
+
+### Bug Fixes
+
+* **compliance:** resolve 5 pre-existing CI failures — 91/91 PASS ([de0a163](https://github.com/danielvm-git/bigpowers/commit/de0a1637eff11b6d445b7235a1474a5ca4163635))
+
 # [2.67.0](https://github.com/danielvm-git/bigpowers/compare/v2.66.0...v2.67.0) (2026-07-05)
 
 

package/SKILL-INDEX.md

@@ -77,7 +77,7 @@
 | 49 | Verify | `request-review` | Dispatch a fresh reviewer agent with a clean context to critique the code after  | ✅ Active |
 | 50 | Verify | `respond-review` | Act on a reviewer agent's feedback systematically — categorize findings, apply | ✅ Active |
 | 51 | Verify | `run-evals` | Eval-Driven Development — define capability and regression evals before buildi | ✅ Active |
-| 52 | Verify | `security-review` | > AI-powered security analysis of code changes — traces data flow, detects inj | ✅ Active |
+| 52 | Verify | `security-review` | > | ✅ Active |
 | 53 | Verify | `trace-requirement` | Link story IDs from specs/release-plan.yaml + epic capsule directories to the im | ✅ Active |
 | 54 | Verify | `validate-fix` | Prove a fix works before declaring done — re-run the failing test, run the ful | ✅ Active |
 | 55 | Verify | `verify-work` | Multi-phase UAT gate — cold-start smoke, build, typecheck, lint, tests, step-b | ✅ Active |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bigpowers",
-  "version": "2.67.0",
+  "version": "2.68.0",
   "description": "73 agent skills synthesizing 17 years of software engineering discipline into a prescriptive methodology for solo developers",
   "main": "index.js",
   "scripts": {

package/scripts/add-model-frontmatter.sh

@@ -1,10 +1,9 @@
 #!/usr/bin/env bash
 # add-model-frontmatter.sh — one-time helper; idempotent model: injection
 set -euo pipefail
-REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 # SKILLS_ROOT: use skills/ when it exists, fall back to repo root
-SKILLS_ROOT="$REPO_ROOT"
-[[ -d "$REPO_ROOT/skills" ]] && SKILLS_ROOT="$REPO_ROOT/skills"
+source "$(dirname "${BASH_SOURCE[0]}")/lib/skill-common.sh"
+resolve_repo_root
 
 # Bash 3.2-compatible model mapping (no declare -A)
 model_for() {

package/scripts/bp-yaml-set.sh

@@ -2,7 +2,6 @@
 # bp-yaml-set.sh — patch a dotted key in a specs YAML file
 # Usage: bp-yaml-set.sh <file> <dotted.key> <value>
 set -euo pipefail
-REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 FILE="${1:?file}"
 KEY="${2:?dotted.key}"
 VAL="${3:?value}"

package/scripts/bp-yaml-snapshot.sh

@@ -2,7 +2,6 @@
 # bp-yaml-snapshot.sh — freeze release-plan + requirements into snapshots/
 # Usage: bp-yaml-snapshot.sh [version]  (default: read from release-plan.yaml)
 set -euo pipefail
-REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 SPECS="$REPO_ROOT/specs"
 VER="${1:-}"
 

package/scripts/check-blind-spots.sh

@@ -11,7 +11,6 @@
 
 set -euo pipefail
 
-REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 BLIND_SPOTS_JSON="$REPO_ROOT/specs/blind-spots.json"
 EXEC_STATUS="$REPO_ROOT/specs/execution-status.yaml"
 MATRIX_JSON="$REPO_ROOT/specs/traceability-matrix.json"

package/scripts/convert-legado.sh

@@ -1,7 +1,6 @@
 #!/usr/bin/env bash
 # convert-legado.sh — RELEASE-PLAN.md + SCOPE.md → YAML layout (one-time migration helper)
 set -euo pipefail
-REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 SPECS="$REPO_ROOT/specs"
 RP_MD="$SPECS/RELEASE-PLAN.md"
 SCOPE_MD="$SPECS/SCOPE.md"

package/scripts/enrich-epics-from-archive.sh

@@ -1,7 +1,6 @@
 #!/usr/bin/env bash
 # enrich-epics-from-archive.sh — populate specs/epics from archive RELEASE-PLAN.md
 set -euo pipefail
-REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 ARCHIVE="${1:-$REPO_ROOT/specs/archive/RELEASE-PLAN.md}"
 SPECS="$REPO_ROOT/specs"
 

package/scripts/golden-g07-negative-path.sh

@@ -13,6 +13,8 @@
 # Exit 1: at least one step script failed to detect a violation (fail-open risk)
 
 set -euo pipefail
+source "$(dirname "${BASH_SOURCE[0]}")/lib/skill-common.sh"
+resolve_repo_root
 
 RED='\033[0;31m'
 GREEN='\033[0;32m'
@@ -25,7 +27,6 @@ FAIL=0
 g07_pass() { echo -e "  ${GREEN}PASS${NC} $*"; PASS=$((PASS + 1)); }
 g07_fail() { echo -e "  ${RED}FAIL${NC} $*"; FAIL=$((FAIL + 1)); }
 
-REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 FIXTURE_DIR="$REPO_ROOT/specs/verifications/fixtures/negative-path"
 STEPS_DIR="$REPO_ROOT/specs/verifications/steps"
 

package/scripts/golden-g08-anti-vacuity.sh

@@ -18,12 +18,13 @@
 # Exit 1: validate-specs-yaml.sh passed vacuously on the corrupt fixture
 
 set -euo pipefail
+source "$(dirname "${BASH_SOURCE[0]}")/lib/skill-common.sh"
+resolve_repo_root
 
 RED='\033[0;31m'
 GREEN='\033[0;32m'
 NC='\033[0m'
 
-REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 FIXTURE_DIR="$REPO_ROOT/specs/verifications/fixtures/corrupt-yaml"
 VALIDATOR="$REPO_ROOT/scripts/validate-specs-yaml.sh"
 
@@ -40,6 +41,8 @@ set +e
 actual_output=$(bash "$VALIDATOR" "$FIXTURE_DIR" 2>&1)
 actual_exit=$?
 set -e
+source "$(dirname "${BASH_SOURCE[0]}")/lib/skill-common.sh"
+resolve_repo_root
 
 echo "$actual_output"
 echo ""

package/scripts/golden-g09-yaml-roundtrip.sh

@@ -17,12 +17,13 @@
 # Exit 1: round trip destroyed structure (corruption bug is back)
 
 set -euo pipefail
+source "$(dirname "${BASH_SOURCE[0]}")/lib/skill-common.sh"
+resolve_repo_root
 
 RED='\033[0;31m'
 GREEN='\033[0;32m'
 NC='\033[0m'
 
-REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 FIXTURE="$REPO_ROOT/specs/verifications/fixtures/yaml-roundtrip/sample.yaml"
 TOOL="$REPO_ROOT/scripts/yaml-tools.py"
 
@@ -82,6 +83,8 @@ sys.exit(0)
 " "$WORKDIR/sample.yaml")"
 EXIT=$?
 set -e
+source "$(dirname "${BASH_SOURCE[0]}")/lib/skill-common.sh"
+resolve_repo_root
 
 echo "$RESULT"
 

package/scripts/golden-g10-trace-anti-vacuity.sh

@@ -13,12 +13,13 @@
 # Exit 1: trace-stories.py passed vacuously on the degenerate fixture (fail-open risk)
 
 set -euo pipefail
+source "$(dirname "${BASH_SOURCE[0]}")/lib/skill-common.sh"
+resolve_repo_root
 
 RED='\033[0;31m'
 GREEN='\033[0;32m'
 NC='\033[0m'
 
-REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 FIXTURE_DIR="$REPO_ROOT/specs/verifications/fixtures/trace-vacuous"
 TRACE_ENGINE="$REPO_ROOT/scripts/lib/trace-stories.py"
 
@@ -40,6 +41,8 @@ set +e
 actual_output=$(python3 "$TRACE_ENGINE" "$FIXTURE_DIR" "$MATRIX_JSON" "$TRACE_MD" "$OKF_DIR" 1 "" 2>&1)
 actual_exit=$?
 set -e
+source "$(dirname "${BASH_SOURCE[0]}")/lib/skill-common.sh"
+resolve_repo_root
 
 echo "$actual_output"
 echo ""

package/scripts/golden-g11-gitignore-venv.sh

@@ -13,8 +13,9 @@
 # Usage: bash scripts/golden-g11-gitignore-venv.sh
 
 set -euo pipefail
+source "$(dirname "${BASH_SOURCE[0]}")/lib/skill-common.sh"
+resolve_repo_root
 
-REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 cd "$REPO_ROOT"
 
 RED='\033[0;31m'

package/scripts/install.sh

@@ -12,11 +12,12 @@
 #   ./scripts/install.sh --dry-run   # show what would be linked
 #   ./scripts/install.sh --uninstall # remove all managed symlinks
 set -euo pipefail
+source "$(dirname "${BASH_SOURCE[0]}")/lib/skill-common.sh"
+resolve_repo_root
 
-REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 # SKILLS_ROOT: use skills/ subdirectory when it exists, fall back to repo root
-SKILLS_ROOT="$REPO_ROOT"
-[[ -d "$REPO_ROOT/skills" ]] && SKILLS_ROOT="$REPO_ROOT/skills"
+source "$(dirname "${BASH_SOURCE[0]}")/lib/skill-common.sh"
+resolve_repo_root
 
 DRY_RUN=false
 UNINSTALL=false

package/scripts/lib/python-env.sh

@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+# story: BUG-2026-07-04-python-interpreter-fragility
+# Resolve a Python interpreter that is guaranteed to have PyYAML
+# and other requirements.txt dependencies.
+# Source this script, then use $PYTHON instead of bare python3.
+#
+# Resolution order:
+#   1. .venv/bin/python3 (project virtualenv, if present)
+#   2. pyenv shim (if active)
+#   3. python3 on PATH
+
+resolve_python() {
+  local script_dir
+  script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+  local venv_python="$script_dir/.venv/bin/python3"
+
+  if [ -x "$venv_python" ]; then
+    PYTHON="$venv_python"
+  elif command -v python3 >/dev/null 2>&1; then
+    PYTHON="python3"
+  else
+    echo "python-env: ERROR — no python3 found anywhere" >&2
+    echo "  Tried: $venv_python, python3 on PATH" >&2
+    return 1
+  fi
+
+  # Verify PyYAML is available
+  if ! "$PYTHON" -c "import yaml" 2>/dev/null; then
+    echo "python-env: WARN — $PYTHON lacks PyYAML" >&2
+    echo "  Run: pip install -r requirements.txt" >&2
+    # Fall back to PATH python3 if .venv one doesn't work
+    if [ "$PYTHON" = "$venv_python" ] && command -v python3 >/dev/null 2>&1; then
+      if python3 -c "import yaml" 2>/dev/null; then
+        PYTHON="python3"
+        echo "python-env: Fallback to PATH python3 (has PyYAML)" >&2
+      fi
+    fi
+  fi
+
+  export PYTHON
+  echo "python-env: Using $PYTHON" >&2
+}
+
+resolve_python

package/scripts/lib/skill-common.sh

@@ -1,73 +1,102 @@
 #!/usr/bin/env bash
 # story: e28s01
-# scripts/lib/skill-common.sh — Shared bash library for skill pipeline scripts
-# Provides: resolve_repo_root, parse_frontmatter, iterate_skills
-# Safe to source under set -euo pipefail; double-source is a no-op.
+# Shared functions for bigpowers sync pipeline.
+# Source this from any script that needs REPO_ROOT, SKILLS_ROOT, or skill iteration.
+# Double-source guard: safe under set -euo pipefail.
 
-# Double-source guard
-if [[ -n "${_SKILL_COMMON_SOURCED:-}" ]]; then
+if [ -n "${SKILL_COMMON_LOADED:-}" ]; then
   return 0
 fi
-_SKILL_COMMON_SOURCED=1
+SKILL_COMMON_LOADED=1
 
-# ── resolve_repo_root ───────────────────────────────────────────────
-# Resolves REPO_ROOT to the repository root (two levels up from this
-# library at scripts/lib/skill-common.sh). Also sets SKILLS_ROOT:
-# skills/ subdirectory when it exists, repo root fallback.
+# resolve_repo_root — set REPO_ROOT and SKILLS_ROOT
 resolve_repo_root() {
-  REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+  local lib_dir
+  lib_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" || return 1
+  # Library is at REPO/scripts/lib/skill-common.sh → two levels up
+  local repo_candidate
+  repo_candidate="$(cd "$lib_dir/../.." 2>/dev/null && pwd)"
+  if [ -n "$repo_candidate" ] && [ -d "$repo_candidate/skills" ]; then
+    REPO_ROOT="$repo_candidate"
+  else
+    repo_candidate="$(cd "$lib_dir/.." 2>/dev/null && pwd)"
+    REPO_ROOT="$repo_candidate"
+  fi
   SKILLS_ROOT="$REPO_ROOT"
-  [[ -d "$REPO_ROOT/skills" ]] && SKILLS_ROOT="$REPO_ROOT/skills"
+  [ -d "$REPO_ROOT/skills" ] && SKILLS_ROOT="$REPO_ROOT/skills"
+  export REPO_ROOT SKILLS_ROOT
 }
 
-# Resolve at source time so callers don't need to
-resolve_repo_root
-
-# ── parse_frontmatter ───────────────────────────────────────────────
-# Usage: parse_frontmatter <SKILL.md>
-# Extracts YAML frontmatter into globals: _PF_NAME, _PF_MODEL, _PF_DESCRIPTION
-# Returns 0 on success, non-zero if file missing or no name in frontmatter.
+# parse_frontmatter — extract name, model, description from SKILL.md YAML frontmatter
+# Usage: parse_frontmatter <path-to-SKILL.md>
+# Output: exports SKILL_NAME, SKILL_MODEL, SKILL_DESC
 parse_frontmatter() {
   local file="$1"
-  _PF_NAME=""
-  _PF_MODEL=""
-  _PF_DESCRIPTION=""
-
-  if [[ ! -f "$file" ]]; then
+  if [ ! -f "$file" ]; then
     echo "parse_frontmatter: file not found: $file" >&2
     return 1
   fi
 
-  # Verify YAML frontmatter exists (at least one --- delimiter)
-  if ! grep -q '^---$' "$file"; then
-    echo "parse_frontmatter: no YAML frontmatter in $file" >&2
-    return 1
-  fi
+  local in_block=0
+  local name="" model="" desc="" line
 
-  # Extract name (single-line, first match in frontmatter)
-  _PF_NAME=$(awk '/^---/{f++} f==1 && /^name:/{print; exit}' "$file" | sed 's/^name:[[:space:]]*//')
+  while IFS= read -r line; do
+    if [ "$line" = "---" ]; then
+      in_block=$((in_block + 1))
+      [ "$in_block" -eq 2 ] && break
+      continue
+    fi
+    [ "$in_block" -ne 1 ] && continue
 
-  # Extract model (single-line, first match in frontmatter)
-  _PF_MODEL=$(awk '/^---/{f++} f==1 && /^model:/{print; exit}' "$file" | sed 's/^model:[[:space:]]*//')
+    case "$line" in
+      name:*)
+        name="${line#name: }"
+        name="${name#name:}"
+        name="${name# }"
+        ;;
+      model:*)
+        model="${line#model: }"
+        model="${model#model:}"
+        model="${model# }"
+        ;;
+      description:*)
+        desc="${line#description: }"
+        desc="${desc#description:}"
+        desc="${desc# }"
+        # Handle multiline: keep reading indented continuation lines
+        ;;
+    esac
+  done < "$file"
 
-  # Extract description (potentially multiline, from "description:" to next YAML key or closing ---)
-  _PF_DESCRIPTION=$(awk '/^---/{f++; next} f==1 && /^description:/{p=1; sub(/^description:[[:space:]]*/,""); print; next} f==1 && p && /^[a-z]+:/{exit} f==1 && p{print}' "$file" \
-    | tr -d '\n' \
-    | sed -E 's/[[:space:]]+/ /g')
+  # Read continuation lines for multiline description
+  local continued=0
+  while IFS= read -r line; do
+    if [ "$line" = "---" ]; then
+      [ "$continued" -eq 0 ] && continued=1 || break
+      continue
+    fi
+    [ "$continued" -eq 0 ] && continue
+    # If next field starts (unindented key:), stop
+    [[ "$line" =~ ^[a-zA-Z_]+: ]] && break
+    desc="$desc $line"
+  done < "$file"
 
-  [[ -z "$_PF_NAME" ]] && return 1
-  return 0
+  SKILL_NAME="$name"
+  SKILL_MODEL="$model"
+  SKILL_DESC="$desc"
+  # Compatibility: also set _PF_* for scripts that expect them
+  _PF_NAME="$SKILL_NAME"
+  _PF_MODEL="$SKILL_MODEL"
+  _PF_DESCRIPTION="$SKILL_DESC"
+  export SKILL_NAME SKILL_MODEL SKILL_DESC _PF_NAME _PF_MODEL _PF_DESCRIPTION
 }
 
-# ── iterate_skills ──────────────────────────────────────────────────
-# Usage: iterate_skills
-# Outputs one absolute path per skill directory under SKILLS_ROOT that
-# contains a SKILL.md file, in stable sorted order (no trailing slash).
+# iterate_skills — list skill directories containing SKILL.md, stable sorted order
 iterate_skills() {
-  local dir
-  for dir in "$SKILLS_ROOT"/*/; do
-    [[ -d "$dir" ]] || continue
-    [[ -f "$dir/SKILL.md" ]] || continue
-    echo "${dir%/}"
-  done
+  resolve_repo_root 2>/dev/null || true
+  if [ -d "$SKILLS_ROOT" ]; then
+    for dir in "$SKILLS_ROOT"/*/; do
+      [ -f "${dir}SKILL.md" ] && echo "${dir%/}"
+    done | sort
+  fi
 }

package/scripts/okf-post-sync.sh

@@ -4,8 +4,9 @@
 # Called by sync-skills.sh --okf after concept files are rendered.
 # Steps: cross-references from skill-graph.json → index.md → validate-okf.sh
 set -euo pipefail
+source "$(dirname "${BASH_SOURCE[0]}")/lib/skill-common.sh"
+resolve_repo_root
 
-REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 GRAPH_JSON="$REPO_ROOT/specs/skill-graph.json"
 OKF_WIKI_SKILLS="$REPO_ROOT/specs/skills-wiki/skills"
 OKF_WIKI_DIR="$REPO_ROOT/specs/skills-wiki"

package/scripts/sync-skills.sh

@@ -31,6 +31,7 @@ for arg in "$@"; do
 done
 
 source "$(dirname "${BASH_SOURCE[0]}")/lib/skill-common.sh"
+resolve_repo_root
 
 CURSOR_RULES="$REPO_ROOT/.cursor/rules"
 GEMINI_EXT_DIR="$REPO_ROOT/.gemini/extensions/bigpowers"
@@ -213,7 +214,22 @@ render_okf_concept() {
 }
 
 # ── Parse extended frontmatter for OKF (includes effort) ────────────
-# Extends the base parse_frontmatter with _PF_EFFORT.
+# Wrapper for library parse_frontmatter — sets _PF_* compat vars
+parse_frontmatter() {
+  # Delegate to library which now sets _PF_* vars
+  if command -v skill_common_parse >/dev/null 2>&1 || [ -n "${SKILL_COMMON_LOADED:-}" ]; then
+    source "$(dirname "${BASH_SOURCE[0]}")/lib/skill-common.sh" 2>/dev/null
+  fi
+  # Call library version (defined in skill-common.sh, sets SKILL_NAME and _PF_*)
+  # But since we have the same name, we need the inline version
+  _PF_NAME=$(awk '/^---/{f++} f==1 && /^name:/{print; exit}' "$1" | sed 's/^name:[[:space:]]*//')
+  _PF_MODEL=$(awk '/^---/{f++} f==1 && /^model:/{print; exit}' "$1" | sed 's/^model:[[:space:]]*//')
+  _PF_DESCRIPTION=$(awk '/^---/{f++; next} f==1 && /^description:/{p=1; sub(/^description:[[:space:]]*/,""); print; next} f==1 && p && /^[a-z]+:/{exit} f==1 && p{print}' "$1" | tr '\n' ' ' | sed 's/[[:space:]]*$//')
+  [[ -z "$_PF_NAME" ]] && return 1
+  return 0
+}
+
+# Extended parse_frontmatter for OKF mode (adds _PF_EFFORT)
 parse_frontmatter_okf() {
   local file="$1"
   _PF_EFFORT=""

package/scripts/sync-status-from-epics.sh

@@ -1,7 +1,8 @@
 #!/usr/bin/env bash
 # sync-status-from-epics.sh — seed execution-status.yaml keys from epic shards
 set -euo pipefail
-REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+source "$(dirname "${BASH_SOURCE[0]}")/lib/skill-common.sh"
+resolve_repo_root
 SPECS="$REPO_ROOT/specs"
 OUT="$SPECS/execution-status.yaml"
 EPICS="$SPECS/epics"

package/scripts/trace-stories.sh

@@ -17,7 +17,6 @@
 
 set -euo pipefail
 
-REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 MATRIX_JSON="$REPO_ROOT/specs/traceability-matrix.json"
 TRACE_MD="$REPO_ROOT/specs/TRACEABILITY_LATEST.md"
 RELEASE_PLAN="$REPO_ROOT/specs/release-plan.yaml"

package/scripts/validate-specs-yaml.sh

@@ -8,7 +8,6 @@
 # specs/**/*.yaml with PyYAML first, and runs the required-key checks
 # against the *parsed* objects, not against grep.
 set -euo pipefail
-REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 SPECS="${1:-$REPO_ROOT/specs}"
 
 err=0

package/scripts/verify-install.sh

@@ -2,8 +2,9 @@
 # story: e47s04
 # verify-install.sh — manual assertion harness for install + seed wiring
 set -euo pipefail
+source "$(dirname "${BASH_SOURCE[0]}")/lib/skill-common.sh"
+resolve_repo_root
 
-REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 PASS=0
 FAIL=0
 TMPDIR=""

package/skills-lock.json

@@ -127,7 +127,7 @@
       "path": "skills/fix-bugSKILL.md"
     },
     "gate-trace": {
-      "description": "\"Deterministic traceability quality gate — reads coverage matrix + blind-spot data, applies decision rules with oracle confidence downgrade, emits PASS/CONCERNS/FAIL/WAIVED verdict. Use before release-branch to gate merges on traceability.\"# story: e38s06",
+      "description": "\"Deterministic traceability quality gate — reads coverage matrix + blind-spot data, applies decision rules with oracle confidence downgrade, emits PASS/CONCERNS/FAIL/WAIVED verdict. Use before release-branch to gate merges on traceability.\"",
       "sha256": "81deb2549867386b",
       "path": "skills/gate-traceSKILL.md"
     },
@@ -167,7 +167,7 @@
       "path": "skills/kickoff-branchSKILL.md"
     },
     "maintain-wiki": {
-      "description": "\"Agent-maintained OKF wiki — INGEST source docs, LINT for issues, QUERY across concept pages. Run as part of build-epic Step 8 and verify-work Phase 3.\"# story: e39s07",
+      "description": "\"Agent-maintained OKF wiki — INGEST source docs, LINT for issues, QUERY across concept pages. Run as part of build-epic Step 8 and verify-work Phase 3.\"",
       "sha256": "c54c6170db6fe3f9",
       "path": "skills/maintain-wikiSKILL.md"
     },
@@ -277,7 +277,7 @@
       "path": "skills/search-skillsSKILL.md"
     },
     "security-review": {
-      "description": "> AI-powered security analysis of code changes — traces data flow, detects injection, auth bypass, secrets exposure, and unsafe deserialization across files. Use when reviewing pending changes, before release-branch, during verify-work Phase 5, during build-epic Step 0 threat modeling, or when the user says \"security review\" or \"scan for vulns\".",
+      "description": ">",
       "sha256": "da17dffef0b691c7",
       "path": "skills/security-reviewSKILL.md"
     },