bigpowers 2.79.0 → 2.80.0

package/.pi/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bigpowers",
-  "version": "2.79.0",
+  "version": "2.80.0",
   "description": "80 skills — 73 agent skills synthesizing 17 years of software engineering discipline into a prescriptive methodology for solo developers",
   "keywords": [
     "pi-package"

package/CHANGELOG.md

@@ -1,3 +1,17 @@
+# [2.80.0](https://github.com/danielvm-git/bigpowers/compare/v2.79.1...v2.80.0) (2026-07-23)
+
+
+### Features
+
+* **e54s01:** freeze skill catalog baseline snapshot ([0df0fff](https://github.com/danielvm-git/bigpowers/commit/0df0fff86fc48794a2343ae4b2c421835bc5c58c))
+
+## [2.79.1](https://github.com/danielvm-git/bigpowers/compare/v2.79.0...v2.79.1) (2026-07-23)
+
+
+### Bug Fixes
+
+* **e53:** close migration-readiness gaps — code-injection, expiry semantics, fail-open gate ([4042c62](https://github.com/danielvm-git/bigpowers/commit/4042c62f5ccac9790596f81aac5aaebd1235c763))
+
 # [2.79.0](https://github.com/danielvm-git/bigpowers/compare/v2.78.1...v2.79.0) (2026-07-23)
 
 

package/CONVENTIONS.md

@@ -364,11 +364,15 @@ referencing the old name don't break immediately.
    renaming or merging a skill. It replaces `skills/<old-name>/SKILL.md` with a stub
    pointing at the new name/location, preserves the old skill's `# story: eNNsNN` tags
    for traceability, and registers the mapping in `specs/tombstones.yaml` (old name,
-   new name/target, creation timestamp, and the `bigpowers_version` at creation time).
+   new name/target, creation timestamp, and the `created_at_version` at creation time).
 2. Run `bash scripts/validate-tombstones.sh` to confirm every registered tombstone's
-   stub still resolves, and to flag any tombstone whose `created_at_version` differs
-   from the current release — that stub has served its one-release transition window
-   and should be removed.
+   stub still resolves, and to flag any tombstone whose `created_at_version` is in a
+   different minor/major release train (major.minor) than the current version — that
+   stub has served its one-release transition window and should be removed. Patch-only
+   bumps within the same minor version don't count as a new release: this repo ships
+   via semantic-release on every merge to main, so comparing full semver strings would
+   expire a tombstone within minutes of creation instead of giving consumers a real
+   migration window.
 3. **Required alongside the first real use of `tombstone-skill.sh`:** update
    `docs/references/model-profiles.md`'s skill-count annotations. A tombstone stub is
    still a `skills/*/SKILL.md` file — it increments the live skill count the same as

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bigpowers",
-  "version": "2.79.0",
+  "version": "2.80.0",
   "description": "73 agent skills synthesizing 17 years of software engineering discipline into a prescriptive methodology for solo developers",
   "main": "index.js",
   "scripts": {

package/scripts/lib/completeness-critic.sh

@@ -33,12 +33,25 @@ if [[ -f specs/traceability-matrix.json ]]; then
   # not-yet-built siblings (which have no code tags by definition until their
   # own turn) and not unrelated epics (which may be plan-worked-to-build-ready
   # but not yet kicked off).
-  ACTIVE_STORY="$(grep '^active_story:' specs/state.yaml 2>/dev/null | awk '{print $2}')"
-  if [[ -n "$ACTIVE_STORY" ]]; then
-    UNDONE="$(jq --arg s "$ACTIVE_STORY" \
-      '[.stories[]? | select(.id == $s and .status != "done" and ((.links // []) | map(select(.method == "explicit_tag")) | length) == 0)] | length' \
+  # `|| true` guards the whole pipe under `set -o pipefail`: a state.yaml
+  # with no active_story line makes grep exit 1, which would otherwise kill
+  # this script outright (no WARNING, no summary line) instead of falling
+  # through to the empty-ACTIVE_STORY branch below.
+  ACTIVE_STORY="$(grep '^active_story:' specs/state.yaml 2>/dev/null | awk '{print $2}' || true)"
+  if [[ -z "$ACTIVE_STORY" ]]; then
+    classify WARNING "specs/state.yaml has no active_story set — zero-tag check skipped, not a pass"
+  else
+    STORY_EXISTS="$(jq --arg s "$ACTIVE_STORY" \
+      '[.stories[]? | select(.id == $s)] | length' \
       specs/traceability-matrix.json 2>/dev/null || echo 0)"
-    (( UNDONE > 0 )) && classify BLOCKER "active story $ACTIVE_STORY has zero explicit story-tag links"
+    if [[ "$STORY_EXISTS" -eq 0 ]]; then
+      classify WARNING "active_story $ACTIVE_STORY not found in specs/traceability-matrix.json — zero-tag check skipped, not a pass"
+    else
+      UNDONE="$(jq --arg s "$ACTIVE_STORY" \
+        '[.stories[]? | select(.id == $s and .status != "done" and ((.links // []) | map(select(.method == "explicit_tag")) | length) == 0)] | length' \
+        specs/traceability-matrix.json 2>/dev/null || echo 0)"
+      (( UNDONE > 0 )) && classify BLOCKER "active story $ACTIVE_STORY has zero explicit story-tag links"
+    fi
   fi
   COVERAGE="$(jq -r '.summary.coverage_percent // .coverage_percent // empty' specs/traceability-matrix.json 2>/dev/null)"
   if [[ -n "$COVERAGE" && "$COVERAGE" != "null" ]]; then

package/scripts/snapshot-catalog-baseline.sh

@@ -0,0 +1,104 @@
+#!/usr/bin/env bash
+# story: e54s01
+# snapshot-catalog-baseline.sh — freeze the live skill catalog into a dated,
+# immutable YAML baseline for e56's reclassification diff.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$SCRIPT_DIR/lib/skill-common.sh"
+source "$SCRIPT_DIR/lib/python-env.sh"
+
+resolve_repo_root
+cd "$REPO_ROOT"
+
+DRY_RUN=false
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --dry-run) DRY_RUN=true; shift ;;
+    -h|--help) echo "Usage: bash scripts/snapshot-catalog-baseline.sh [--dry-run]"; exit 0 ;;
+    *) echo "Unknown flag: $1" >&2; exit 2 ;;
+  esac
+done
+
+DATE_STR="$(date +%Y-%m-%d)"
+COMMIT_HASH="$(git rev-parse HEAD 2>/dev/null || echo unknown)"
+OUT_FILE="$REPO_ROOT/specs/tech-architecture/CATALOG-BASELINE-${DATE_STR}.yaml"
+
+# unquote_source_desc — strip a source frontmatter's own surrounding quotes
+# and unescape its inner \" , or re-quoting double-escapes the description.
+unquote_source_desc() {
+  local desc="$1"
+  if [[ "$desc" == \"*\" ]]; then
+    desc="${desc#\"}"
+    desc="${desc%\"}"
+    desc="${desc//\\\"/\"}"
+  fi
+  echo "$desc"
+}
+
+# emit_skill_row — print one skill's YAML row to stdout; appends any missing-
+# field warning line for that skill to $WARN_FILE (a plain file, since this
+# function runs inside a command-substitution subshell and can't mutate the
+# caller's shell variables).
+emit_skill_row() {
+  local skill_md="$1" name phase model effort desc desc_escaped
+  name="$(basename "$(dirname "$skill_md")")"
+  parse_frontmatter_okf "$skill_md" || true
+
+  phase="$(awk '/^---/{f++} f==1 && /^phase:/{print; exit}' "$skill_md" | sed 's/^phase:[[:space:]]*//')"
+  model="${_PF_MODEL:-}"
+  effort="${_PF_EFFORT:-}"
+  desc="${_PF_DESCRIPTION:-}"
+
+  [[ -z "$phase" ]] && phase="null"
+  [[ -z "$model" ]] && { model="null"; echo "  - \"${name}: missing model field\"" >> "$WARN_FILE"; }
+  [[ -z "$effort" ]] && { effort="null"; echo "  - \"${name}: missing effort field\"" >> "$WARN_FILE"; }
+  [[ -z "$desc" ]] && desc="null"
+
+  desc="$(unquote_source_desc "$desc")"
+  desc_escaped="${desc//\"/\\\"}"
+
+  echo "  - name: \"${name}\"\n    path: \"skills/${name}/SKILL.md\"\n    phase: ${phase}\n    effort: ${effort}\n    model: ${model}\n    description: \"${desc_escaped}\"\n"
+}
+
+WARN_FILE="$(mktemp)"
+trap 'rm -f "$WARN_FILE"' EXIT
+
+ROWS=""
+COUNT=0
+
+for skill_md in "$SKILLS_ROOT"/*/SKILL.md; do
+  [[ -f "$skill_md" ]] || continue
+  ROWS="${ROWS}$(emit_skill_row "$skill_md")"
+  COUNT=$((COUNT + 1))
+done
+
+WARNINGS="$(cat "$WARN_FILE")"
+WARN_COUNT="$(grep -c '^  -' "$WARN_FILE" || true)"
+
+if $DRY_RUN; then
+  echo "${COUNT} skills scanned"
+  echo "${WARN_COUNT} warnings"
+  [[ -n "$WARNINGS" ]] && echo -e "warnings:\n${WARNINGS}"
+  exit 0
+fi
+
+mkdir -p "$REPO_ROOT/specs/tech-architecture"
+
+{
+  echo "# CATALOG-BASELINE-${DATE_STR}.yaml"
+  echo "# frozen for e54-e59 migration; do not hand-edit"
+  echo "snapshot_date: \"${DATE_STR}\""
+  echo "commit_hash: \"${COMMIT_HASH}\""
+  echo "total_skill_count: ${COUNT}"
+  echo "warnings:"
+  if [[ -n "$WARNINGS" ]]; then
+    echo -e "$WARNINGS"
+  else
+    echo "  []"
+  fi
+  echo "skills:"
+  echo -e "$ROWS"
+} > "$OUT_FILE"
+
+echo "Wrote ${OUT_FILE} (${COUNT} skills, ${WARN_COUNT} warnings)"

package/scripts/test-completeness-critic-scope.sh

@@ -0,0 +1,99 @@
+#!/usr/bin/env bash
+# story: e53s01
+# test-completeness-critic-scope.sh — regression test for
+# BUG-2026-07-23-completeness-critic-code-tags-schema-drift: the zero-tag
+# check must scope to the active story only (not siblings/other epics), and
+# must WARN — not silently no-op — when active_story is unset or unresolved.
+#
+# Usage: bash scripts/test-completeness-critic-scope.sh
+
+set -euo pipefail
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$REPO_ROOT"
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+NC='\033[0m'
+
+FAILURES=0
+tt_pass() { echo -e "${GREEN}PASS${NC} $1"; }
+tt_fail() { echo -e "${RED}FAIL${NC} $1"; FAILURES=$((FAILURES + 1)); }
+
+STATE_FILE="specs/state.yaml"
+MATRIX_FILE="specs/traceability-matrix.json"
+STATE_BACKUP=$(mktemp)
+MATRIX_BACKUP=$(mktemp)
+cp "$STATE_FILE" "$STATE_BACKUP"
+cp "$MATRIX_FILE" "$MATRIX_BACKUP"
+
+cleanup() {
+  cp "$STATE_BACKUP" "$STATE_FILE"
+  cp "$MATRIX_BACKUP" "$MATRIX_FILE"
+  rm -f "$STATE_BACKUP" "$MATRIX_BACKUP"
+}
+trap cleanup EXIT
+
+run_critic() {
+  bash scripts/lib/completeness-critic.sh 2>&1 || true
+}
+
+# Fixture matrix: one untagged sibling story (e00s02) that must NOT block,
+# and the active story (e00s01) which is under test.
+write_matrix() {
+  local active_links="$1"
+  cat > "$MATRIX_FILE" <<FIXTUREEOF
+{
+  "stories": [
+    {"id": "e00s01", "status": "in_progress", "links": ${active_links}},
+    {"id": "e00s02", "status": "todo", "links": []}
+  ]
+}
+FIXTUREEOF
+}
+
+# --- Scenario: active_story unset → WARNING, not silent pass ---
+sed -i.bak '/^active_story:/d' "$STATE_FILE" && rm -f "${STATE_FILE}.bak"
+write_matrix '[]'
+output=$(run_critic)
+if echo "$output" | grep -q "\[WARNING\].*no active_story set"; then
+  tt_pass "unset active_story produces an explicit WARNING"
+else
+  tt_fail "unset active_story did not produce the expected WARNING"
+fi
+
+# --- Scenario: active_story set but absent from the matrix → WARNING ---
+printf 'active_story: e99s99\n' >> "$STATE_FILE"
+output=$(run_critic)
+if echo "$output" | grep -q "\[WARNING\].*e99s99 not found"; then
+  tt_pass "unresolved active_story produces an explicit WARNING"
+else
+  tt_fail "unresolved active_story did not produce the expected WARNING"
+fi
+sed -i.bak '/^active_story:/d' "$STATE_FILE" && rm -f "${STATE_FILE}.bak"
+
+# --- Scenario: active story has zero explicit_tag links → BLOCKER, scoped to it ---
+printf 'active_story: e00s01\n' >> "$STATE_FILE"
+write_matrix '[]'
+output=$(run_critic)
+if echo "$output" | grep -q "\[BLOCKER\] active story e00s01 has zero explicit story-tag links"; then
+  tt_pass "active story with zero tags is correctly flagged as BLOCKER"
+else
+  tt_fail "active story with zero tags was not flagged as BLOCKER"
+fi
+
+# --- Scenario: active story IS tagged → no BLOCKER, even though sibling e00s02 is untagged ---
+write_matrix '[{"method": "explicit_tag", "file": "scripts/fixture.sh", "line": 1, "confidence": 1.0}]'
+output=$(run_critic)
+if echo "$output" | grep -q "\[BLOCKER\] active story e00s01"; then
+  tt_fail "tagged active story incorrectly flagged as BLOCKER"
+else
+  tt_pass "tagged active story is not flagged, and untagged sibling e00s02 does not leak into the check"
+fi
+
+echo "---"
+if [[ "$FAILURES" -eq 0 ]]; then
+  echo -e "${GREEN}test-completeness-critic-scope: ALL PASS${NC}"
+else
+  echo -e "${RED}test-completeness-critic-scope: $FAILURES failure(s)${NC}"
+fi
+exit "$FAILURES"

package/scripts/test-generate-epics-wiki-zero-stories.sh

@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+# story: e53s01
+# test-generate-epics-wiki-zero-stories.sh — regression test for
+# BUG-2026-07-23-epics-wiki-empty-references: generate-epics-wiki.sh must
+# skip epics with zero sliced stories rather than emit an invalid OKF bundle
+# with an empty references[].
+#
+# Usage: bash scripts/test-generate-epics-wiki-zero-stories.sh
+
+set -euo pipefail
+source "$(dirname "${BASH_SOURCE[0]}")/lib/skill-common.sh"
+resolve_repo_root
+cd "$REPO_ROOT"
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+NC='\033[0m'
+
+FAILURES=0
+tt_pass() { echo -e "${GREEN}PASS${NC} $1"; }
+tt_fail() { echo -e "${RED}FAIL${NC} $1"; FAILURES=$((FAILURES + 1)); }
+
+FIXTURE_ID="e00"
+FIXTURE_DIR="specs/epics/e00-zero-story-fixture"
+FIXTURE_BUNDLE="specs/epics-wiki/${FIXTURE_ID}.okf.md"
+
+cleanup() {
+  rm -rf "$FIXTURE_DIR"
+  rm -f "$FIXTURE_BUNDLE"
+}
+trap cleanup EXIT
+
+mkdir -p "$FIXTURE_DIR"
+cat > "${FIXTURE_DIR}/epic.yaml" <<'FIXTUREEOF'
+id: e00
+title: "Zero-story fixture epic"
+wsjf: 0
+bcps: 0
+capsule_dir: epics/e00-zero-story-fixture
+mode: capsule
+status: todo
+depends_on: []
+stories: []
+FIXTUREEOF
+
+# A scoped-but-unsliced epic has a `stories:` key with nothing under it —
+# grep -c '^\s*- id:' correctly returns 0 for this shape.
+[[ -f "$FIXTURE_BUNDLE" ]] && rm -f "$FIXTURE_BUNDLE"
+
+bash scripts/generate-epics-wiki.sh > /dev/null
+
+if [[ ! -f "$FIXTURE_BUNDLE" ]]; then
+  tt_pass "generate-epics-wiki.sh skips a zero-story epic (no bundle emitted)"
+else
+  tt_fail "generate-epics-wiki.sh emitted a bundle for a zero-story epic: $FIXTURE_BUNDLE"
+fi
+
+echo "---"
+if [[ "$FAILURES" -eq 0 ]]; then
+  echo -e "${GREEN}test-generate-epics-wiki-zero-stories: ALL PASS${NC}"
+else
+  echo -e "${RED}test-generate-epics-wiki-zero-stories: $FAILURES failure(s)${NC}"
+fi
+exit "$FAILURES"

package/scripts/test-golden-g11-worktree-venv.sh

@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+# story: e53s01
+# test-golden-g11-worktree-venv.sh — regression test for
+# BUG-2026-07-23-golden-g11-worktree-venv: golden-g11-gitignore-venv.sh must
+# PASS in a fresh worktree where .venv does not exist yet on disk (before
+# setup-environment has run), not just when a real .venv is already present.
+#
+# Usage: bash scripts/test-golden-g11-worktree-venv.sh
+
+set -euo pipefail
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$REPO_ROOT"
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+NC='\033[0m'
+
+FAILURES=0
+tt_pass() { echo -e "${GREEN}PASS${NC} $1"; }
+tt_fail() { echo -e "${RED}FAIL${NC} $1"; FAILURES=$((FAILURES + 1)); }
+strip_ansi() { sed -E 's/\x1b\[[0-9;]*m//g'; }
+
+VENV_MOVED=0
+if [[ -e .venv ]]; then
+  mv .venv .venv.test-golden-g11-backup
+  VENV_MOVED=1
+fi
+
+cleanup() {
+  rm -rf .venv
+  if [[ "$VENV_MOVED" -eq 1 ]]; then
+    mv .venv.test-golden-g11-backup .venv
+  fi
+}
+trap cleanup EXIT
+
+# --- Scenario: .venv absent (fresh worktree) → gate still PASSes ---
+if [[ -e .venv ]]; then
+  tt_fail "test setup failed to remove .venv before running the gate"
+else
+  output=$(bash scripts/golden-g11-gitignore-venv.sh 2>&1 | strip_ansi) && exit_code=0 || exit_code=$?
+  if [[ "$exit_code" -eq 0 ]] && echo "$output" | grep -q "PASS git check-ignore .venv"; then
+    tt_pass "gate PASSes when .venv does not exist on disk"
+  else
+    tt_fail "gate did not PASS with .venv absent (exit=$exit_code)"
+  fi
+
+  # The gate must clean up the .venv it created for the check — a fresh
+  # worktree shouldn't be left with a stray directory after a gate run.
+  if [[ ! -e .venv ]]; then
+    tt_pass "gate removes the .venv it created for the check"
+  else
+    tt_fail "gate left a stray .venv behind after the check"
+  fi
+fi
+
+echo "---"
+if [[ "$FAILURES" -eq 0 ]]; then
+  echo -e "${GREEN}test-golden-g11-worktree-venv: ALL PASS${NC}"
+else
+  echo -e "${RED}test-golden-g11-worktree-venv: $FAILURES failure(s)${NC}"
+fi
+exit "$FAILURES"

package/scripts/test-tombstone-mechanism.sh

@@ -102,6 +102,48 @@ else
   tt_fail "expired tombstone was not flagged"
 fi
 
+# --- Scenario: rejects path-traversal / invalid skill names (threat model CWE-22) ---
+# tombstone-skill.sh exits non-zero on rejection, and this script runs under
+# `set -o pipefail` — capture output via `|| true` first so the pipe's exit
+# status doesn't mask the grep check below.
+output=$(bash scripts/tombstone-skill.sh "../../etc/passwd" "target" 2>&1 || true)
+if echo "$output" | grep -qi "not a valid skill name"; then
+  tt_pass "tombstone-skill.sh rejects a path-traversal old-name"
+else
+  tt_fail "tombstone-skill.sh did not reject a path-traversal old-name"
+fi
+
+output=$(bash scripts/tombstone-skill.sh "$FIXTURE_OLD" "../../etc/passwd" 2>&1 || true)
+if echo "$output" | grep -qi "not a valid skill name"; then
+  tt_pass "tombstone-skill.sh rejects a path-traversal new-name"
+else
+  tt_fail "tombstone-skill.sh did not reject a path-traversal new-name"
+fi
+
+# --- Scenario: validate-tombstones.sh rejects an invalid name read back from the ledger ---
+python3 -c "
+import yaml
+d = yaml.safe_load(open('$TOMBSTONES_FILE')) or {'tombstones': []}
+d.setdefault('tombstones', []).append({
+    'old_name': '../../etc/passwd',
+    'new_name_or_merge_target': 'target',
+    'created_at_version': '0.0.0',
+})
+yaml.dump(d, open('$TOMBSTONES_FILE', 'w'), default_flow_style=False)
+"
+output=$(bash scripts/validate-tombstones.sh 2>&1 | strip_ansi || true)
+if echo "$output" | grep -qi "FAIL.*not a valid skill name"; then
+  tt_pass "validate-tombstones.sh rejects a path-traversal name read from the ledger"
+else
+  tt_fail "validate-tombstones.sh did not reject a path-traversal name read from the ledger"
+fi
+python3 -c "
+import yaml
+d = yaml.safe_load(open('$TOMBSTONES_FILE')) or {'tombstones': []}
+d['tombstones'] = [t for t in d.get('tombstones', []) if t.get('old_name') != '../../etc/passwd']
+yaml.dump(d, open('$TOMBSTONES_FILE', 'w'), default_flow_style=False)
+"
+
 echo "---"
 if [[ "$FAILURES" -eq 0 ]]; then
   echo -e "${GREEN}test-tombstone-mechanism: ALL PASS${NC}"

package/scripts/tombstone-skill.sh

@@ -51,7 +51,7 @@ if [[ ! -f "$OLD_SKILL_MD" ]]; then
 fi
 
 STORY_TAGS=$(grep -E '^#\s*story:' "$OLD_SKILL_MD" || true)
-CURRENT_VERSION=$(grep '"version"' package.json 2>/dev/null | head -1 | sed 's/.*: *"\(.*\)".*/\1/')
+CURRENT_VERSION=$(jq -r '.version' package.json 2>/dev/null)
 CREATED_AT=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
 
 cat > "$OLD_SKILL_MD" <<STUBEOF
@@ -73,16 +73,27 @@ STUBEOF
 TOMBSTONES_FILE="specs/tombstones.yaml"
 [[ -f "$TOMBSTONES_FILE" ]] || echo "tombstones: []" > "$TOMBSTONES_FILE"
 
+# Values flow through the environment, never interpolated into the python
+# source string — string-interpolating shell variables into `python3 -c`
+# turns any unvalidated field (e.g. CURRENT_VERSION, sourced from
+# package.json) into a code-injection vector.
+TOMBSTONE_FILE="$TOMBSTONES_FILE" \
+TOMBSTONE_OLD_NAME="$OLD_NAME" \
+TOMBSTONE_NEW_NAME="$NEW_NAME" \
+TOMBSTONE_CREATED_AT="$CREATED_AT" \
+TOMBSTONE_VERSION="$CURRENT_VERSION" \
 python3 -c "
+import os
 import yaml
-d = yaml.safe_load(open('$TOMBSTONES_FILE')) or {'tombstones': []}
+path = os.environ['TOMBSTONE_FILE']
+d = yaml.safe_load(open(path)) or {'tombstones': []}
 d.setdefault('tombstones', []).append({
-    'old_name': '$OLD_NAME',
-    'new_name_or_merge_target': '$NEW_NAME',
-    'created_at': '$CREATED_AT',
-    'created_at_version': '$CURRENT_VERSION',
+    'old_name': os.environ['TOMBSTONE_OLD_NAME'],
+    'new_name_or_merge_target': os.environ['TOMBSTONE_NEW_NAME'],
+    'created_at': os.environ['TOMBSTONE_CREATED_AT'],
+    'created_at_version': os.environ['TOMBSTONE_VERSION'],
 })
-yaml.dump(d, open('$TOMBSTONES_FILE', 'w'), default_flow_style=False)
+yaml.dump(d, open(path, 'w'), default_flow_style=False)
 "
 
 echo "Tombstoned: ${OLD_NAME} -> ${NEW_NAME}"

package/scripts/validate-tombstones.sh

@@ -16,6 +16,7 @@ YELLOW='\033[1;33m'
 NC='\033[0m'
 
 TOMBSTONES_FILE="specs/tombstones.yaml"
+NAME_PATTERN='^[a-z][a-z0-9-]*$'
 FAIL=0
 
 if [[ ! -f "$TOMBSTONES_FILE" ]]; then
@@ -23,7 +24,14 @@ if [[ ! -f "$TOMBSTONES_FILE" ]]; then
   exit 0
 fi
 
-CURRENT_VERSION=$(grep '"version"' package.json 2>/dev/null | head -1 | sed 's/.*: *"\(.*\)".*/\1/')
+CURRENT_VERSION=$(jq -r '.version' package.json 2>/dev/null)
+
+# A "release" for tombstone-expiry purposes is a minor/major version bump.
+# This repo ships via semantic-release on every merge to main (multiple
+# patch releases per day) — comparing full semver strings would expire
+# every tombstone within minutes instead of giving consumers the one-release
+# migration window CONVENTIONS.md promises.
+release_train() { echo "$1" | cut -d. -f1-2; }
 
 ROWS=$(python3 -c "
 import yaml
@@ -39,6 +47,17 @@ fi
 
 while IFS=$'\t' read -r old_name new_name created_version; do
   [[ -z "$old_name" ]] && continue
+
+  # Threat-model mitigation (specs/security/epics/e53/THREAT_MODEL.md): apply
+  # the same kebab-case validation tombstone-skill.sh applies before writing
+  # entries, since these names come back out of specs/tombstones.yaml here
+  # and are used to construct a filesystem path.
+  if [[ ! "$old_name" =~ $NAME_PATTERN || ! "$new_name" =~ $NAME_PATTERN ]]; then
+    echo -e "${RED}FAIL${NC}: '${old_name}' -> '${new_name}' — not a valid skill name (must match ${NAME_PATTERN})"
+    FAIL=1
+    continue
+  fi
+
   stub="skills/${old_name}/SKILL.md"
 
   if [[ ! -f "$stub" ]]; then
@@ -52,7 +71,7 @@ while IFS=$'\t' read -r old_name new_name created_version; do
     continue
   fi
 
-  if [[ -n "$created_version" && "$created_version" != "$CURRENT_VERSION" ]]; then
+  if [[ -n "$created_version" && "$(release_train "$created_version")" != "$(release_train "$CURRENT_VERSION")" ]]; then
     echo -e "${YELLOW}EXPIRED${NC}: ${old_name} -> ${new_name} — created at ${created_version}, now ${CURRENT_VERSION}; remove the stub"
     continue
   fi