bigpowers 2.76.1 → 2.76.3

package/.pi/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bigpowers",
-  "version": "2.76.1",
+  "version": "2.76.3",
   "description": "77 skills — 73 agent skills synthesizing 17 years of software engineering discipline into a prescriptive methodology for solo developers",
   "keywords": [
     "pi-package"

package/.pi/prompts/commit-message.md

@@ -37,6 +37,7 @@ description: "Reviews working-tree changes, then drafts a Conventional Commits t
 - [ ] **Scope** is a short noun in parentheses if it helps (e.g. `fix(api): …`).
 - [ ] Breaking changes are explicit (`!` and/or `BREAKING CHANGE:` in the body/footer).
 - [ ] Description is imperative, lowercase start after the prefix, no trailing period in the title line.
+- [ ] **NO `Co-authored-by` or `Co-Authored-By` footers** — P1 rule (CONVENTIONS.md § Git Attribution). All commits must appear as if authored solely by the human user. The git hook and `land-branch.sh` both block these.
 
 ## When not to invent a bump
 

package/.pi/prompts/release-branch.md

@@ -40,9 +40,12 @@ If unsure, prefer **solo-local**.
 ```bash
 <full test command> && <typecheck command> && <lint command>
 git log main...HEAD --oneline | grep -vE "^[a-f0-9]+ (feat|fix|docs|style|refactor|perf|test|build|ci|chore|revert)(\(.+\))?!?: .+$" && echo "❌ Non-conventional commits found" || echo "✅ Commits verified"
+# Block AI agent attribution (P1)
+git log main...HEAD --format="%B" | grep -qiE 'co[- ]authored[- ]by' && echo "❌ Co-authored-by footer found — blocked" || echo "✅ No AI attribution"
 ```
 
 - [ ] All tests pass, no type errors, no lint violations, all commits follow Conventional Commits
+- [ ] **NO `Co-authored-by` or `Co-Authored-By`** in any commit body — P1 rule (CONVENTIONS.md § Git Attribution). `land-branch.sh` blocks the merge if found.
 
 ### 2. Coverage check
 

package/.pi/skills/commit-message/SKILL.md

@@ -38,6 +38,7 @@ description: "Reviews working-tree changes, then drafts a Conventional Commits t
 - [ ] **Scope** is a short noun in parentheses if it helps (e.g. `fix(api): …`).
 - [ ] Breaking changes are explicit (`!` and/or `BREAKING CHANGE:` in the body/footer).
 - [ ] Description is imperative, lowercase start after the prefix, no trailing period in the title line.
+- [ ] **NO `Co-authored-by` or `Co-Authored-By` footers** — P1 rule (CONVENTIONS.md § Git Attribution). All commits must appear as if authored solely by the human user. The git hook and `land-branch.sh` both block these.
 
 ## When not to invent a bump
 

package/.pi/skills/release-branch/SKILL.md

@@ -41,9 +41,12 @@ If unsure, prefer **solo-local**.
 ```bash
 <full test command> && <typecheck command> && <lint command>
 git log main...HEAD --oneline | grep -vE "^[a-f0-9]+ (feat|fix|docs|style|refactor|perf|test|build|ci|chore|revert)(\(.+\))?!?: .+$" && echo "❌ Non-conventional commits found" || echo "✅ Commits verified"
+# Block AI agent attribution (P1)
+git log main...HEAD --format="%B" | grep -qiE 'co[- ]authored[- ]by' && echo "❌ Co-authored-by footer found — blocked" || echo "✅ No AI attribution"
 ```
 
 - [ ] All tests pass, no type errors, no lint violations, all commits follow Conventional Commits
+- [ ] **NO `Co-authored-by` or `Co-Authored-By`** in any commit body — P1 rule (CONVENTIONS.md § Git Attribution). `land-branch.sh` blocks the merge if found.
 
 ### 2. Coverage check
 

package/CHANGELOG.md

@@ -1,3 +1,18 @@
+## [2.76.3](https://github.com/danielvm-git/bigpowers/compare/v2.76.2...v2.76.3) (2026-07-11)
+
+
+### Bug Fixes
+
+* **scripts:** move Co-authored-by feature branch scan after DEFAULT_BRANCH is set ([842dfb3](https://github.com/danielvm-git/bigpowers/commit/842dfb3c8caf710f75b1bc234f3178596d2e78df))
+* **security:** enforce Co-authored-by ban across all commit paths ([b8610cd](https://github.com/danielvm-git/bigpowers/commit/b8610cdb060faebf94b614354c80c052d985c40d))
+
+## [2.76.2](https://github.com/danielvm-git/bigpowers/compare/v2.76.1...v2.76.2) (2026-07-09)
+
+
+### Bug Fixes
+
+* **ci:** add orphan gitlink guard to prevent checkout failures ([#70](https://github.com/danielvm-git/bigpowers/issues/70)) ([4325ae9](https://github.com/danielvm-git/bigpowers/commit/4325ae9fd853defbb37d63c41317278b8882a6be))
+
 ## [2.76.1](https://github.com/danielvm-git/bigpowers/compare/v2.76.0...v2.76.1) (2026-07-09)
 
 

package/hooks/pre-tool-use.sh

@@ -107,6 +107,11 @@ if [[ "$COMMAND" =~ git[[:space:]]+commit ]] || [[ "$COMMAND" =~ git[[:space:]]+
       if [ ${#SUBJECT} -gt 72 ]; then
         deny "BLOCKED: Commit subject line must be 72 characters or less."
       fi
+
+      # Block AI agent attribution (P1 — NEVER Co-authored-by:)
+      if echo "$MSG" | grep -qiE '^co[- ]authored[- ]by:' || echo "$MSG" | grep -qiE '\nco[- ]authored[- ]by:'; then
+        deny "BLOCKED: Commit must not include Co-authored-by: footer. All commits must appear as if authored solely by the human user (CONVENTIONS.md § Git Attribution)."
+      fi
     fi
 
     # Block direct commits to main unless land script is active

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bigpowers",
-  "version": "2.76.1",
+  "version": "2.76.3",
   "description": "73 agent skills synthesizing 17 years of software engineering discipline into a prescriptive methodology for solo developers",
   "main": "index.js",
   "scripts": {

package/scripts/land-branch.sh

@@ -41,6 +41,11 @@ if [ ${#COMMIT_MSG} -gt 72 ]; then
   land_branch_deny "Commit subject line must be 72 characters or less"
 fi
 
+# Block AI agent attribution (P1 — CONVENTIONS.md § Git Attribution)
+if echo "$COMMIT_MSG" | grep -qiE '^co[- ]authored[- ]by:' || echo "$COMMIT_MSG" | grep -qiE '\nco[- ]authored[- ]by:'; then
+  land_branch_deny "Commit must not include Co-authored-by: footer. All commits must appear as if authored solely by the human user."
+fi
+
 # Primary worktree only (.git is a directory, not a gitdir pointer file)
 if [ -f .git ]; then
   land_branch_deny "Run from the primary repository root, not a linked worktree (cd to main repo first)"
@@ -72,6 +77,11 @@ if ! git show-ref --verify --quiet "refs/heads/$FEATURE_BRANCH"; then
   land_branch_deny "Feature branch '$FEATURE_BRANCH' does not exist"
 fi
 
+# Scan all commits in feature branch for Co-authored-by: footers
+if git log "$DEFAULT_BRANCH..$FEATURE_BRANCH" --format="%B" 2>/dev/null | grep -qiE '^co[- ]authored[- ]by:'; then
+  land_branch_deny "Feature branch '$FEATURE_BRANCH' contains Co-authored-by: footer(s). Amend commits to remove all AI agent attribution before landing."
+fi
+
 for protected in main master; do
   if [ "$FEATURE_BRANCH" = "$protected" ]; then
     land_branch_deny "Cannot land protected branch '$FEATURE_BRANCH'"

package/scripts/lib/check-orphan-gitlinks.sh

@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+# check-orphan-gitlinks.sh — fail if git index has gitlinks without .gitmodules URLs
+# story: BUG-2026-07-09T033939-golden-g01-submodule-checkout
+set -euo pipefail
+
+check_orphan_gitlinks() {
+  local repo_root="${1:-.}"
+  local gitlinks orphans=0
+
+  cd "$repo_root"
+
+  while IFS= read -r path; do
+    [[ -z "$path" ]] && continue
+    if [[ ! -f .gitmodules ]] || ! git config -f .gitmodules --get "submodule.${path}.url" >/dev/null 2>&1; then
+      gitlinks+=("$path")
+      orphans=$((orphans + 1))
+    fi
+  done < <(git ls-files -s | awk '$1 == "160000" { $1=$2=$3=""; sub(/^ /, ""); print }')
+
+  if [[ "$orphans" -eq 0 ]]; then
+    echo "no orphan gitlinks"
+    return 0
+  fi
+
+  echo "orphan gitlink(s) without .gitmodules URL:" >&2
+  printf '  %s\n' "${gitlinks[@]}" >&2
+  return 1
+}
+
+if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
+  check_orphan_gitlinks "$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+fi

package/scripts/validate-doctrine.sh

@@ -137,6 +137,17 @@ else
   done
 fi
 
+# ── CI: orphan gitlinks break actions/checkout submodule cleanup ───────────────
+echo "--- [CI] orphan gitlinks ---"
+# shellcheck source=lib/check-orphan-gitlinks.sh
+source "$REPO_ROOT/scripts/lib/check-orphan-gitlinks.sh"
+if check_orphan_gitlinks "$REPO_ROOT" >/dev/null; then
+  doctrine_pass "no orphan gitlinks"
+else
+  doctrine_fail "git index contains gitlink(s) without .gitmodules URL — breaks actions/checkout"
+  check_orphan_gitlinks "$REPO_ROOT" >&2 || true
+fi
+
 # ── CI: trace-stories wrapper smoke (REPO_ROOT must be set under set -u) ───────
 echo "--- [CI] trace-stories wrapper smoke ---"
 if bash "$REPO_ROOT/scripts/trace-stories.sh" --help >/dev/null 2>&1; then

package/skills/commit-message/SKILL.md

@@ -39,6 +39,7 @@ description: Reviews working-tree changes, then drafts a Conventional Commits ti
 - [ ] **Scope** is a short noun in parentheses if it helps (e.g. `fix(api): …`).
 - [ ] Breaking changes are explicit (`!` and/or `BREAKING CHANGE:` in the body/footer).
 - [ ] Description is imperative, lowercase start after the prefix, no trailing period in the title line.
+- [ ] **NO `Co-authored-by` or `Co-Authored-By` footers** — P1 rule (CONVENTIONS.md § Git Attribution). All commits must appear as if authored solely by the human user. The git hook and `land-branch.sh` both block these.
 
 ## When not to invent a bump
 

package/skills/release-branch/SKILL.md

@@ -43,9 +43,12 @@ If unsure, prefer **solo-local**.
 ```bash
 <full test command> && <typecheck command> && <lint command>
 git log main...HEAD --oneline | grep -vE "^[a-f0-9]+ (feat|fix|docs|style|refactor|perf|test|build|ci|chore|revert)(\(.+\))?!?: .+$" && echo "❌ Non-conventional commits found" || echo "✅ Commits verified"
+# Block AI agent attribution (P1)
+git log main...HEAD --format="%B" | grep -qiE 'co[- ]authored[- ]by' && echo "❌ Co-authored-by footer found — blocked" || echo "✅ No AI attribution"
 ```
 
 - [ ] All tests pass, no type errors, no lint violations, all commits follow Conventional Commits
+- [ ] **NO `Co-authored-by` or `Co-Authored-By`** in any commit body — P1 rule (CONVENTIONS.md § Git Attribution). `land-branch.sh` blocks the merge if found.
 
 ### 2. Coverage check
 

package/skills-lock.json

@@ -33,7 +33,7 @@
     },
     "commit-message": {
       "description": "Reviews working-tree changes, then drafts a Conventional Commits title/body and states the semantic-release version bump a single such commit would imply. Also notes which defensive-code categories were touched. Use when the user wants to commit recent work, prepare a Conventional Commits message, or asks for semantic-release / semver-consistent messaging before git commit.",
-      "sha256": "61d7f45ea8ccd085",
+      "sha256": "1ed4ef65d813a84d",
       "path": "skills/commit-messageSKILL.md"
     },
     "compose-workflow": {
@@ -238,7 +238,7 @@
     },
     "release-branch": {
       "description": "Make the merge/PR/keep/discard decision for a feature branch, verify coverage gates, create the PR with gh, and clean up the worktree. Use when a feature is done and ready to ship, or when user says \"release\", \"merge\", or \"open a PR\".",
-      "sha256": "5da46a5b7aa7403f",
+      "sha256": "7e94a540b1dc75c1",
       "path": "skills/release-branchSKILL.md"
     },
     "request-review": {

package/tests/test-no-orphan-gitlinks.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+# story: BUG-2026-07-09T033939-golden-g01-submodule-checkout
+# Regression: orphan gitlinks (160000) without .gitmodules URLs break actions/checkout.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+# shellcheck source=../scripts/lib/check-orphan-gitlinks.sh
+source "$REPO_ROOT/scripts/lib/check-orphan-gitlinks.sh"
+
+# Clean tree must pass.
+if ! output="$(check_orphan_gitlinks "$REPO_ROOT")"; then
+  echo "FAIL: check_orphan_gitlinks failed on clean tree"
+  exit 1
+fi
+if [[ "$output" != "no orphan gitlinks" ]]; then
+  echo "FAIL: unexpected output: $output"
+  exit 1
+fi
+
+# Synthetic orphan: gitlink path with no .gitmodules entry must fail.
+tmpdir="$(mktemp -d)"
+trap 'rm -rf "$tmpdir"' EXIT
+git -C "$tmpdir" init -q
+git -C "$tmpdir" config user.email "test@example.com"
+git -C "$tmpdir" config user.name "test"
+mkdir -p "$tmpdir/sub"
+echo "nested" >"$tmpdir/sub/file.txt"
+git -C "$tmpdir/sub" init -q
+git -C "$tmpdir/sub" add file.txt
+git -C "$tmpdir/sub" commit -qm "nested"
+git -C "$tmpdir" add sub
+if ! check_orphan_gitlinks "$tmpdir" >/dev/null 2>&1; then
+  echo "PASS: synthetic orphan gitlink correctly rejected"
+  exit 0
+fi
+
+echo "FAIL: check_orphan_gitlinks should reject orphan gitlink in synthetic repo"
+exit 1