bigpowers 2.86.4 → 2.86.6

package/skills/harden-vps/REFERENCE.md

@@ -2,47 +2,47 @@
 
 ## Health check script
 
-Deploy to `/opt/bigbase/scripts/healthcheck.sh`:
+Deploy to `/opt/your-app/scripts/healthcheck.sh`:
 
 ```bash
 #!/bin/bash
-LOG=/var/log/bigbase/health.log
-mkdir -p /var/log/bigbase
+LOG=/var/log/your-app/health.log
+mkdir -p /var/log/your-app
 DISK=$(df / | awk 'NR==2 {print $5}' | tr -d '%')
 RAM=$(free | awk '/Mem:/ {printf "%.0f", $3/$2*100}')
 NOW=$(date -Iseconds)
 [ "$DISK" -gt 85 ] && echo "$NOW ALERT: Disk ${DISK}%" >> "$LOG"
 [ "$RAM" -gt 90 ]   && echo "$NOW ALERT: RAM ${RAM}%" >> "$LOG"
-systemctl is-active --quiet bigbase || { echo "$NOW ALERT: BigBase DOWN" >> "$LOG"; systemctl restart bigbase; }
+systemctl is-active --quiet your-app || { echo "$NOW ALERT: your application DOWN" >> "$LOG"; systemctl restart your-app; }
 [ -f /var/run/reboot-required ] && echo "$NOW WARN: kernel reboot pending" >> "$LOG"
 ```
 
-Make executable: `chmod +x /opt/bigbase/scripts/healthcheck.sh`
+Make executable: `chmod +x /opt/your-app/scripts/healthcheck.sh`
 
-## BigBase systemd unit
+## your application systemd unit
 
-Full hardened unit at `/etc/systemd/system/bigbase.service`:
+Full hardened unit at `/etc/systemd/system/your-app.service`:
 
 ```ini
 [Unit]
-Description=BigBase BaaS Platform
-Documentation=https://github.com/danielvm-git/bigbase
+Description=your application BaaS Platform
+Documentation=https://github.com/example-org/example-app
 After=network.target caddy.service
 Wants=caddy.service
 
 [Service]
 Type=simple
-User=bigbase
-Group=bigbase
-WorkingDirectory=/opt/bigbase
-ExecStart=/opt/bigbase/bin/bigbase serve \
+User=your-app
+Group=your-app
+WorkingDirectory=/opt/your-app
+ExecStart=/opt/your-app/bin/your-app serve \
     --port 8080 \
-    --db /opt/bigbase/data/bigbase.db \
+    --db /opt/your-app/data/your-app.db \
     --sites-domain <your-domain.example.com>
-EnvironmentFile=-/opt/bigbase/.env
-Environment=BIGBASE_HOME=/opt/bigbase
-Environment=HOME=/opt/bigbase
-Environment=NPM_CONFIG_CACHE=/opt/bigbase/.npm
+EnvironmentFile=-/opt/your-app/.env
+Environment=APP_HOME=/opt/your-app
+Environment=HOME=/opt/your-app
+Environment=NPM_CONFIG_CACHE=/opt/your-app/.npm
 Environment=PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
 Restart=always
 RestartSec=5
@@ -59,11 +59,11 @@ ProtectKernelModules=yes
 ProtectControlGroups=yes
 RestrictAddressFamilies=AF_INET AF_INET6
 RestrictRealtime=yes
-ReadWritePaths=/opt/bigbase/data
-ReadWritePaths=/opt/bigbase/backups
-ReadWritePaths=/opt/bigbase/secrets
-ReadWritePaths=/opt/bigbase/.npm
-ReadWritePaths=/opt/bigbase/logs
+ReadWritePaths=/opt/your-app/data
+ReadWritePaths=/opt/your-app/backups
+ReadWritePaths=/opt/your-app/secrets
+ReadWritePaths=/opt/your-app/.npm
+ReadWritePaths=/opt/your-app/logs
 LimitNOFILE=65536
 
 [Install]
@@ -83,17 +83,20 @@ bantime = 3600
 findtime = 600
 ```
 
-Note: BigBase auth jail deferred — BigBase logs to journald, not a file. To enable, use `backend = systemd` with a journald filter.
+Note: your application auth jail deferred — your application logs to journald, not a file. To enable, use `backend = systemd` with a journald filter.
 
-## contabo-snapshot.sh
+## provider-snapshot.sh — worked example (Contabo API)
 
-Deploy to `/opt/bigbase/scripts/contabo-snapshot.sh`. Reads credentials from `/opt/bigbase/.env` (same file used by BigBase systemd unit):
+> Snapshot APIs are provider-specific. This is one worked example, not a
+> bigpowers default; swap the auth and endpoint calls for your own provider.
+
+Deploy to `/opt/your-app/scripts/contabo-snapshot.sh`. Reads credentials from `/opt/your-app/.env` (same file used by your application systemd unit):
 
 ```bash
 #!/bin/bash
 set -e
-LOG=/var/log/bigbase/snapshot.log
-ENVFILE=/opt/bigbase/.env
+LOG=/var/log/your-app/snapshot.log
+ENVFILE=/opt/your-app/.env
 INSTANCE_ID=<your-contabo-instance-id>
 
 [ -f "$ENVFILE" ] || { echo "$(date -Iseconds) ERROR: $ENVFILE missing" >> "$LOG"; exit 1; }
@@ -122,9 +125,9 @@ echo >> "$LOG"
 echo "$(date -Iseconds) Snapshot requested for $INSTANCE_ID" >> "$LOG"
 ```
 
-## Contabo credentials
+## your VPS provider credentials
 
-Add to `/opt/bigbase/.env` (same file used by BigBase systemd unit, deployed by GitHub Actions):
+Add to `/opt/your-app/.env` (same file used by your application systemd unit, deployed by GitHub Actions):
 
 ```
 CONTABO_CLIENT_ID=
@@ -133,13 +136,13 @@ CONTABO_API_USER=
 CONTABO_API_PASSWORD=
 ```
 
-Source: Contabo Customer Control Panel → API Details. ClientId and ClientSecret are generated there. API User is your email. API Password is set separately in the panel.
+Source: your VPS provider Customer Control Panel → API Details. ClientId and ClientSecret are generated there. API User is your email. API Password is set separately in the panel.
 
-**Pipeline:** GitHub Secrets → deploy workflow → `/opt/bigbase/.env` on VPS. For local dev (`cntb get instances`), add to `.envrc`.
+**Pipeline:** GitHub Secrets → deploy workflow → `/opt/your-app/.env` on VPS. For local dev (`cntb get instances`), add to `.envrc`.
 
-## Contabo instance info template
+## your VPS provider instance info template
 
-Fill in your instance details from the Contabo Customer Control Panel:
+Fill in your instance details from the your VPS provider Customer Control Panel:
 
 ```
 IP:           <your-instance-ip>
@@ -151,7 +154,7 @@ Default user: root
 Customer ID:  <your-customer-id>
 ```
 
-## BigBase monitoring alert SQL
+## your application monitoring alert SQL
 
 ```sql
 INSERT INTO monitoring_alerts (id, name, metric, threshold, operator, enabled, duration_seconds)
@@ -164,7 +167,7 @@ INSERT INTO monitoring_alerts (id, name, metric, threshold, operator, enabled, d
 VALUES ('alert-003', 'VPS RAM above 85%', 'mem_used_percent', 85, 'gt', 1, 120);
 ```
 
-Alerts are loaded at BigBase startup. Restart with `systemctl restart bigbase` after inserting.
+Alerts are loaded at your application startup. Restart with `systemctl restart your-app` after inserting.
 
 ## Base64 encoding workaround
 

package/skills/harden-vps/SKILL.md

@@ -1,17 +1,17 @@
 ---
 name: harden-vps
-description: "Harden a production Linux VPS for BigBase across three layers — BigBase app (systemd hardening, monitoring alerts, backup automation), Ubuntu OS (UFW firewall, fail2ban SSH, unattended-upgrades, SSH hardening), and Contabo VPS (health checks, daily backups, monthly snapshots). Use when the user wants to secure a production server, harden a VPS, audit server security, or mentions production hardening, VPS security, or harden the server."
+description: "Harden a production Linux VPS for your application across three layers — application (systemd hardening, monitoring alerts, backup automation), Ubuntu OS (UFW firewall, fail2ban SSH, unattended-upgrades, SSH hardening), and VPS provider (health checks, daily backups, monthly snapshots). Use when the user wants to secure a production server, harden a VPS, audit server security, or mentions production hardening, VPS security, or harden the server."
 model: haiku
 effort: standard
 ---
 
 # Harden VPS
 
-Three-layer production hardening for BigBase on Contabo VPS. Each layer independently verifiable. Apply OS first (firewall blocks attacks immediately), then BigBase (alerts + backups), then Contabo (snapshots). See [REFERENCE.md](REFERENCE.md) for full script bodies, systemd unit template, and gotchas.
+Three-layer production hardening for a self-hosted app on any VPS. Each layer independently verifiable. Apply OS first (firewall blocks attacks immediately), then your application (alerts + backups), then your VPS provider (snapshots). See [REFERENCE.md](REFERENCE.md) for full script bodies, systemd unit template, and gotchas.
 
 ## Quick start
 
-SSH as root into the VPS. Find credentials in the Contabo Customer Control Panel.
+SSH as root into the VPS. Find credentials in the your VPS provider Customer Control Panel.
 
 > **HARD GATE** — Run `ufw status` first. No firewall = layer 1 takes priority over everything.
 
@@ -36,21 +36,21 @@ apt install -y unattended-upgrades && dpkg-reconfigure -plow unattended-upgrades
 # SSH: PermitRootLogin no, PasswordAuthentication no, PubkeyAuthentication yes
 # → verify: sshd -T | grep -E 'permitrootlogin no|passwordauthentication no'
 
-# Deploy healthcheck.sh → /opt/bigbase/scripts/healthcheck.sh
-# Crontab: */5 * * * * /opt/bigbase/scripts/healthcheck.sh
+# Deploy healthcheck.sh → /opt/your-app/scripts/healthcheck.sh
+# Crontab: */5 * * * * /opt/your-app/scripts/healthcheck.sh
 ```
 
-## Layer 2 — BigBase application
+## Layer 2 — applicationlication
 
 ```bash
-# systemd: User=bigbase, NoNewPrivileges=yes, ProtectSystem=full,
+# systemd: User=your-app, NoNewPrivileges=yes, ProtectSystem=full,
 #   ProtectKernelTunables=yes, ProtectKernelModules=yes,
 #   ProtectControlGroups=yes, RestrictAddressFamilies=AF_INET AF_INET6,
 #   RestrictRealtime=yes, PrivateTmp=yes, LimitNOFILE=65536
-# → verify: systemctl show bigbase -p NoNewPrivileges -p ProtectSystem -p User
+# → verify: systemctl show your-app -p NoNewPrivileges -p ProtectSystem -p User
 
-# Alerts (BigBase requires auth; insert via SQLite)
-sqlite3 /opt/bigbase/data/bigbase.db "
+# Alerts (your application requires auth; insert via SQLite)
+sqlite3 /opt/your-app/data/your-app.db "
 INSERT INTO monitoring_alerts (id,name,metric,threshold,operator,enabled,duration_seconds)
 VALUES ('a1','Disk >80%','disk_used_percent',80,'gt',1,300);
 INSERT INTO monitoring_alerts (id,name,metric,threshold,operator,enabled,duration_seconds)
@@ -58,14 +58,14 @@ VALUES ('a2','CPU >90%','cpu_percent',90,'gt',1,60);
 INSERT INTO monitoring_alerts (id,name,metric,threshold,operator,enabled,duration_seconds)
 VALUES ('a3','RAM >85%','mem_used_percent',85,'gt',1,120);
 "
-systemctl restart bigbase
+systemctl restart your-app
 
 # Backup crontab (root):
-# 0 2 * * * cp /opt/bigbase/data/bigbase.db /backup/bigbase-$(date +\%Y\%m\%d).db
-# 0 3 * * * find /backup/ -name "bigbase-*.db" -mtime +90 -delete
+# 0 2 * * * cp /opt/your-app/data/your-app.db /backup/your-app-$(date +\%Y\%m\%d).db
+# 0 3 * * * find /backup/ -name "your-app-*.db" -mtime +90 -delete
 ```
 
-## Layer 3 — Contabo VPS
+## Layer 3 — VPS provider
 
 ```bash
 # cntb CLI
@@ -73,14 +73,14 @@ curl -sL "$(curl -sL https://api.github.com/repos/contabo/cntb/releases/latest \
   | grep browser_download_url.*linux_amd64.tar.gz | head -1 | cut -d'"' -f4)" \
   | tar xz -C /usr/local/bin
 
-# Snapshot script → /opt/bigbase/scripts/contabo-snapshot.sh (reads from /opt/bigbase/.env)
-# Credentials as env vars in /opt/bigbase/.env (deployed by GitHub Actions):
+# Snapshot script → /opt/your-app/scripts/contabo-snapshot.sh (reads from /opt/your-app/.env)
+# Credentials as env vars in /opt/your-app/.env (deployed by GitHub Actions):
 #   CONTABO_CLIENT_ID, CONTABO_CLIENT_SECRET, CONTABO_API_USER, CONTABO_API_PASSWORD
-# Crontab: 0 4 1 * * /opt/bigbase/scripts/contabo-snapshot.sh
+# Crontab: 0 4 1 * * /opt/your-app/scripts/contabo-snapshot.sh
 
 # > HARD GATE — Snapshot cron silently fails until env vars are set in .env.
-# Credentials source: Contabo Customer Panel → API Details.
-# Local dev: add to .envrc. Production: GitHub Secrets → deploy → /opt/bigbase/.env
+# Credentials source: your VPS provider Customer Panel → API Details.
+# Local dev: add to .envrc. Production: GitHub Secrets → deploy → /opt/your-app/.env
 ```
 
 ## CRITICAL GOTCHAS
@@ -88,7 +88,7 @@ curl -sL "$(curl -sL https://api.github.com/repos/contabo/cntb/releases/latest \
 1. **Shell escaping in Orca terminals:** `$VAR`, `$(…)`, and `%` get eaten by the local shell. Always use base64: `echo '<base64>' | base64 -d > script.sh`
 2. **Crontab `%`:** cron interprets `%` as newline. Escape as `\%` in `$(date +\%Y\%m\%d)`
 3. **fail2ban exit 255:** means a jail references a missing log file. Remove the broken jail, restart.
-4. **BigBase alerts need auth:** POST to `/api/monitoring/alerts` requires Bearer token. Workaround: insert directly into SQLite, then restart BigBase.
+4. **your application alerts need auth:** POST to `/api/monitoring/alerts` requires Bearer token. Workaround: insert directly into SQLite, then restart your application.
 
 ## Verify all 8 gates
 
@@ -97,10 +97,10 @@ ufw status|grep -q active||echo FAIL:ufw
 fail2ban-client status sshd>/dev/null 2>&1||echo FAIL:fail2ban
 systemctl is-active unattended-upgrades|grep -q active||echo FAIL:unattended
 sshd -T|grep -q 'permitrootlogin no'||echo FAIL:sshd
-systemctl show bigbase -p NoNewPrivileges|grep -q yes||echo FAIL:systemd
-systemctl is-active bigbase|grep -q active||echo FAIL:bigbase
-sqlite3 /opt/bigbase/data/bigbase.db "SELECT count(*) FROM monitoring_alerts"|grep -q 3||echo FAIL:alerts
-crontab -l|grep -q healthcheck&&crontab -l|grep -q bigbase.db&&crontab -l|grep -q contabo-snapshot||echo FAIL:crontab
+systemctl show your-app -p NoNewPrivileges|grep -q yes||echo FAIL:systemd
+systemctl is-active your-app|grep -q active||echo FAIL:your-app
+sqlite3 /opt/your-app/data/your-app.db "SELECT count(*) FROM monitoring_alerts"|grep -q 3||echo FAIL:alerts
+crontab -l|grep -q healthcheck&&crontab -l|grep -q your-app.db&&crontab -l|grep -q contabo-snapshot||echo FAIL:crontab
 echo ALL 8 GATES PASSED
 ```
 

package/skills/investigate-bug/SKILL.md

@@ -124,6 +124,6 @@ After writing the bug file, print a one-line summary of the root cause and sugge
 
 <!-- story: e35s10 -->
 
-- [Feathers' Seams & Characterization Tests](https://github.com/danielvm-git/bigpowers/blob/main/docs/references/feathers.md) — seam types, characterization tests, and the legacy code change algorithm
-- [Fowler's Code Smells](https://github.com/danielvm-git/bigpowers/blob/main/docs/references/fowler.md) — identifying structural problems by smell before investigating
+- [Feathers' Seams & Characterization Tests](../../docs/references/feathers.md) — seam types, characterization tests, and the legacy code change algorithm
+- [Fowler's Code Smells](../../docs/references/fowler.md) — identifying structural problems by smell before investigating
 

package/skills/orchestrate-project/REFERENCE.md

@@ -19,7 +19,7 @@ Detailed documentation for the `orchestrate-project` meta-skill.
 ### PHASE 3: PLAN
 - **Goal**: Write a verifiable implementation plan with success criteria.
 - **Deliverables**: `release-plan.yaml`, `epics/eNN-*.yaml` with `verify:` per task.
-- **Skills**: `scope-work`, `slice-tasks`, `define-success`, `plan-work`.
+- **Skills**: `scope-work`, `slice-tasks`, `plan-work`.
 - **Gate**: Quality (request-review ≥94%) + slopcheck [SUS]/[SLOP].
 
 ### PHASE 4: BUILD

package/skills/plan-refactor/SKILL.md

@@ -82,8 +82,8 @@ After writing `specs/REFACTOR_LATEST.md`, suggest running `kickoff-branch` next
 
 <!-- story: e35s10 -->
 
-- [Fowler's Refactoring Catalog](https://github.com/danielvm-git/bigpowers/blob/main/docs/references/fowler.md) — canonical refactoring vocabulary and code-smell taxonomy
-- [Beck's Tidy First?](https://github.com/danielvm-git/bigpowers/blob/main/docs/references/kent-beck.md) — structural change before behavioral change
+- [Fowler's Refactoring Catalog](../../docs/references/fowler.md) — canonical refactoring vocabulary and code-smell taxonomy
+- [Beck's Tidy First?](../../docs/references/kent-beck.md) — structural change before behavioral change
 
 ## Verify
 

package/skills/plan-release/SKILL.md

@@ -17,7 +17,7 @@ Synthesize the conversation context into `specs/release-plan.yaml` (index) and s
 |------|---------|
 | `specs/release-plan.yaml` | `release.version`, semver bump hint, WSJF-ordered epic list with `id`, `capsule_dir`, `wsjf`, `bcps` — **no story status** |
 | `specs/epics/eNN-<slug>/epic.yaml` | Epic manifest: `id`, `title`, `wsjf`, `total_bcps`, `status`, `stories[]` list |
-| `specs/epics/eNN-<slug>/eNNsYY-<slug>.md` | Story spec in [countable-story-format.md](https://github.com/danielvm-git/bigpowers/blob/main/docs/countable-story-format.md) with 20 sections and Gherkin acceptance criteria |
+| `specs/epics/eNN-<slug>/eNNsYY-<slug>.md` | Story spec in [countable-story-format.md](../../docs/countable-story-format.md) with 20 sections and Gherkin acceptance criteria |
 | `specs/epics/eNN-<slug>/eNNsYY-tasks.yaml` | Decoupled task checklist with `verify:` commands per task |
 | `specs/execution-status.yaml` | Flat key-value store for story status (`eNNsYY: todo`) |
 
@@ -102,7 +102,7 @@ stories:
 ```
 ### 6. Save story specs (countable-story-format .md)
 
-Each story becomes a standalone `.md` file following [countable-story-format.md](https://github.com/danielvm-git/bigpowers/blob/main/docs/countable-story-format.md). Minimum: maturity 3 (Countable) with all 20 sections present. Acceptance criteria in §17 use Gherkin scenarios.
+Each story becomes a standalone `.md` file following [countable-story-format.md](../../docs/countable-story-format.md). Minimum: maturity 3 (Countable) with all 20 sections present. Acceptance criteria in §17 use Gherkin scenarios.
 ### 7. Save decoupled task files (`-tasks.yaml`)
 
 Each story has a decoupled `-tasks.yaml` with implementation steps:

package/skills/plan-work/SKILL.md

@@ -18,7 +18,7 @@ description: "PLANNING SPINE STEP 3 of 3 — Plan the work: write detailed imple
 
 Produce a detailed, verifiable implementation plan in the **active epic capsule directory** (`specs/epics/eNN-slug/`). Output: a story spec `.md` file (countable-story-format) and a decoupled `eNNsYY-tasks.yaml` with runnable verify commands. "I think it works" is not a step.
 
-> **HARD GATE** — Do NOT proceed with a plan until the task's success criteria are clear. If success is ambiguous, run `define-success` first to convert the task into "step → verify: <cmd>" pairs.
+> **HARD GATE** — Do NOT proceed with a plan until the task's success criteria are clear. If success is ambiguous, convert the task into "step → verify: `<cmd>`" pairs here before writing tasks — every task ships a runnable `verify:` or the plan is not done.
 >
 > **RECURSIVE DISCIPLINE** — This lifecycle applies to EVERY task, including updating these skills. Never skip planning because a task is "meta" or "just documentation."
 

package/skills/security-review/fixtures/CWE-639-idor-negative.go

@@ -5,7 +5,7 @@
 // is part of the WHERE clause. A caller from another organization gets zero
 // rows rather than someone else's site.
 //
-// Note the retrofit trap this deliberately avoids: bigbase's BUG-2026-07-24T184443
+// Note the retrofit trap this deliberately avoids: a real-world IDOR retrofit (BUG-2026-07-24T184443)
 // added `org_id INTEGER NOT NULL DEFAULT 0`, which passed tests on new rows and
 // hid 8 of 9 production sites whose legacy rows defaulted to org 0. Scope on a
 // real, backfilled org_id — never a placeholder default.

package/skills/security-review/fixtures/CWE-639-idor-positive.go

@@ -1,7 +1,7 @@
 // story: e80s05
 // Positive fixture: IDOR / missing tenant scoping (must be flagged).
 //
-// Modelled on the bigbase family (BUG-129/130/133/135/136/140/143): the
+// Modelled on a real-world bug family (BUG-129/130/133/135/136/140/143): the
 // handler authenticates the caller, then trusts an ID from the request and
 // queries by that ID alone. Authentication is proven; authorization is not.
 // Nothing in the type system or a diff-scoped review makes this look wrong —

package/skills/using-bigpowers/SKILL.md

@@ -9,7 +9,7 @@ description: One-time bootstrap that introduces the bigpowers skills system, the
 > **HARD GATE** — **HARD GATE** — This skill is the entry point. Do NOT skip it when onboarding new users or starting a new session. It establishes the bigpowers methodology, lifecycle phases, and conventions.
 
 
-Welcome to **bigpowers** — a lifecycle of **70** agent skills for production-ready, TDD-driven software by solo developers.
+Welcome to **bigpowers** — a lifecycle of agent skills for production-ready, TDD-driven software by solo developers. The live catalog and its count are generated in [`SKILL-INDEX.md`](../../SKILL-INDEX.md); never hardcode the number here.
 
 ## Install
 
@@ -38,7 +38,7 @@ DISCOVER    survey-context → research-first → elaborate-spec
               ↓
 DESIGN      model-domain / define-language / grill-me / deepen-architecture / design-interface
               ↓
-PLAN        scope-work → slice-tasks → define-success → plan-work / plan-refactor
+PLAN        scope-work → slice-tasks → plan-work / plan-refactor
               ↓
 INITIATE    kickoff-branch → guard-git / hook-commits / seed-conventions
               ↓

package/skills/wire-ci/REFERENCE.md

@@ -145,7 +145,7 @@ jobs:
 
 ---
 
-## Reference block 2 — deploy.yml (BigBase, excerpt)
+## Reference block 2 — deploy.yml (generic web app, excerpt)
 
 ```yaml
 name: Deploy
@@ -163,7 +163,7 @@ concurrency:
   cancel-in-progress: false
 
 env:
-  SITE_URL: "https://CHANGE-ME.bigbase.click"
+  SITE_URL: "https://CHANGE-ME.example.com"
 
 jobs:
   deploy:
@@ -179,18 +179,15 @@ jobs:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           run-id: ${{ github.event.workflow_run.id }}
           path: deploy-meta
-      # BigBase-specific composite action, not a bigpowers default: this deploy
-      # example targets the author's own hosting stack. Replace it with your
-      # platform's deploy step (or drop the deploy job entirely for CLI and
-      # library repos). bigpowers itself ships no deploy templates. (GH #104)
-      - uses: danielvm-git/.github/actions/bigbase-deploy@9c56ac10c629f3baa110ddb19136579e3c90d690  # v1
-        with:
-          site_id: ${{ secrets.BIGBASE_SITE_ID }}
-          app_type: go
-          site_url: ${{ env.SITE_URL }}
-          deploy_token: ${{ secrets.BIGBASE_DEPLOY_TOKEN }}
-          ref: ${{ steps.meta.outputs.ref }}
-          skip_health_check: true
+      # Placeholder deploy step — bigpowers ships no deploy templates and pins
+      # no third-party action. Substitute your platform's own step here, or drop
+      # the deploy job entirely for CLI and library repos. Pin whatever action
+      # you choose to a full commit SHA rather than a tag. (GH #104)
+      - name: Deploy
+        run: |
+          echo "Replace this step with your platform's deploy command."
+          echo "commit=$(jq -r .sha deploy-meta/deploy-meta.json)"
+          exit 1
       - name: Health check
         run: |
           curl -sf "${{ env.SITE_URL }}" || exit 1

package/skills/write-document/REFERENCE.md

@@ -168,7 +168,7 @@ Detect from CLAUDE.md or project LICENSE file.
 ```markdown
 ## Credits
 
-Built with [bigpowers](https://github.com/danielvm-git/bigpowers).
+Built with [bigpowers](https://www.npmjs.com/package/bigpowers).
 ```
 
 ## Verify

package/skills-lock.json

@@ -48,7 +48,7 @@
     },
     "craft-skill": {
       "description": "Create new bigpowers skills with proper structure, progressive disclosure, and bundled resources. Use when user wants to create, write, or build a new skill for the bigpowers lifecycle.",
-      "sha256": "cc2d3a6c70693114",
+      "sha256": "f3b08c24979f1857",
       "path": "skills/craft-skillSKILL.md"
     },
     "deepen-architecture": {
@@ -62,8 +62,8 @@
       "path": "skills/define-languageSKILL.md"
     },
     "define-success": {
-      "description": "'Convert an imperative task statement into explicit \"step → verify: <cmd>\" pairs before implementation begins. Use before plan-work when success criteria are unclear, when a task lacks verifiable checkpoints, or when user says \"how will we know this is done?\".'",
-      "sha256": "458d06a29b0a5b67",
+      "description": "\"TOMBSTONE — renamed/merged to plan-work. This stub resolves for one release then is removed.\"",
+      "sha256": "b0aeb8c0d870fe2e",
       "path": "skills/define-successSKILL.md"
     },
     "delegate-task": {
@@ -73,7 +73,7 @@
     },
     "deploy": {
       "description": "\"Build → verify artifact → deploy → wait → smoke deployment pipeline. Platform-agnostic (MCP or CLI), with configurable timeout, retry with exponential backoff, and integrated health-check. The deploy half of CI/CD: run after build to push to production.\"",
-      "sha256": "09d24b7e5d2e759c",
+      "sha256": "ddfcbfbfc464c620",
       "path": "skills/deploySKILL.md"
     },
     "design-interface": {
@@ -108,7 +108,7 @@
     },
     "elaborate-spec": {
       "description": "Refine a rough idea into a clear, detailed specification through dialogue. Does not produce code. Use when user has a vague idea, wants to think through a feature before planning, or needs to turn \"I want X\" into a concrete spec.",
-      "sha256": "9307ab61c789a0a0",
+      "sha256": "67385bef84425f6d",
       "path": "skills/elaborate-specSKILL.md"
     },
     "enforce-first": {
@@ -167,8 +167,8 @@
       "path": "skills/guard-gitSKILL.md"
     },
     "harden-vps": {
-      "description": "\"Harden a production Linux VPS for BigBase across three layers — BigBase app (systemd hardening, monitoring alerts, backup automation), Ubuntu OS (UFW firewall, fail2ban SSH, unattended-upgrades, SSH hardening), and Contabo VPS (health checks, daily backups, monthly snapshots). Use when the user wants to secure a production server, harden a VPS, audit server security, or mentions production hardening, VPS security, or harden the server.\"",
-      "sha256": "5768af4f96e9a3b3",
+      "description": "\"Harden a production Linux VPS for your application across three layers — application (systemd hardening, monitoring alerts, backup automation), Ubuntu OS (UFW firewall, fail2ban SSH, unattended-upgrades, SSH hardening), and VPS provider (health checks, daily backups, monthly snapshots). Use when the user wants to secure a production server, harden a VPS, audit server security, or mentions production hardening, VPS security, or harden the server.\"",
+      "sha256": "38db97ca3c00d736",
       "path": "skills/harden-vpsSKILL.md"
     },
     "hook-commits": {
@@ -183,7 +183,7 @@
     },
     "investigate-bug": {
       "description": "Investigate a bug or issue by exploring the codebase to find root cause, then write a TDD-based fix plan to specs/bugs/BUG-*.md. Use when user reports a bug, wants to investigate a problem, mentions \"triage\", or wants to plan a fix.",
-      "sha256": "54f8c5417be34ef0",
+      "sha256": "b842fd329d1f7741",
       "path": "skills/investigate-bugSKILL.md"
     },
     "kickoff-branch": {
@@ -223,12 +223,12 @@
     },
     "plan-refactor": {
       "description": "Create a detailed refactor plan with tiny commits via user interview, then save it as specs/REFACTOR_LATEST.md. Use when user wants to plan a refactor, create a refactoring RFC, or break a refactor into safe incremental steps.",
-      "sha256": "2d18809da7cc9de8",
+      "sha256": "c418c850806e2f16",
       "path": "skills/plan-refactorSKILL.md"
     },
     "plan-release": {
       "description": "\"RELEASE-INDEX BUILDER — Sequence elaborated epics into specs/release-plan.yaml with WSJF ordering and BCP baselines. NOT a planning-spine substitute: it does not scope work (scope-work) or write story tasks (plan-work). Use after elaborate-spec when the user wants a versioned release index of epics.\"",
-      "sha256": "9334ff48e5b1fab3",
+      "sha256": "071acc0626c2a203",
       "path": "skills/plan-releaseSKILL.md"
     },
     "plan-tests": {
@@ -238,7 +238,7 @@
     },
     "plan-work": {
       "description": "\"PLANNING SPINE STEP 3 of 3 — Plan the work: write detailed implementation tasks into the active epic capsule (specs/epics/eNN-slug/). Produces countable-story-format .md specs and runnable -tasks.yaml files. Use after slice-tasks (step 2). Not a substitute for scope-work (step 1) or slice-tasks (step 2).\"",
-      "sha256": "e5d751ca5e928e2d",
+      "sha256": "32c2bcaf16cb4ad2",
       "path": "skills/plan-workSKILL.md"
     },
     "publish-package": {
@@ -363,7 +363,7 @@
     },
     "using-bigpowers": {
       "description": "One-time bootstrap that introduces the bigpowers skills system, the PMBOK lifecycle arc, and tells you which skill to call first for your situation. Use when starting with bigpowers for the first time, when user asks \"where do I start?\", or when the skills system needs to be explained.",
-      "sha256": "bad9ebe9bf303b36",
+      "sha256": "a6d780440a936929",
       "path": "skills/using-bigpowersSKILL.md"
     },
     "validate-contracts": {

package/.fix_regex.sh

@@ -1,16 +0,0 @@
-#!/bin/bash
-# Fix the broken regex in migrate-version.sh
-cd /Users/danielvm/Developer/bigpowers
-python3 -c '
-path = "scripts/migrate-version.sh"
-with open(path) as f:
-    content = f.read()
-
-old = """    pat = re.compile(rf\"^\"+re.escape(md_key.rstrip(\":\"))+\"\\\\s*[:=]\\\\s*(.+)$\", re.MULTILINE | re.IGNORECASE)"""
-new = """    pat = re.compile(r\"^\" + re.escape(md_key.rstrip(\":\")) + r\"\\s*[:=]\\s*(.+)$\", re.MULTILINE | re.IGNORECASE)"""
-
-content = content.replace(old, new)
-with open(path, "w") as f:
-    f.write(content)
-print("Fixed")
-'

package/.hermes-verify-sed-fix.py

@@ -1,53 +0,0 @@
-import subprocess
-
-REPO = "/Users/danielvm/Developer/bigpowers"
-names = ["kickoff-branch","develop-tdd","wire-observability","hook-commits",
-         "request-review","dispatch-agents","investigate-bug","define-language",
-         "assess-impact","guard-git","smoke-test","respond-review","enforce-first"]
-
-errs = 0
-print("=== 1. Old sed vs new python3 (13 skills) ===")
-for name in names:
-    old = subprocess.run(["sed", "-E", r"s/-/ /g; s/\b(.)/\U\1/g"],
-                        input=name, capture_output=True, text=True).stdout.strip()
-    new = name.replace("-", " ").title()
-    if old != new:
-        print(f"  BROKEN: {name:22s} -> old='{old}'  new='{new}'")
-        errs += 1
-
-print(f"\n  {errs}/13 titles broken by BSD sed")
-
-print("\n=== 2. Generated files match new fix ===")
-ok = 0
-for name in ["kickoff-branch","develop-tdd","wire-observability","dispatch-agents","guard-git"]:
-    path = f"{REPO}/specs/skills-wiki/skills/{name}.md"
-    expected = f'title: "{name.replace("-", " ").title()}"'
-    actual = "MISSING"
-    try:
-        with open(path) as f:
-            for line in f:
-                if line.startswith("title:"):
-                    actual = line.strip()
-                    break
-    except FileNotFoundError:
-        pass
-    match = "OK" if actual == expected else "MISMATCH"
-    if match == "OK": ok += 1
-    print(f"  {match:8s} {name:22s} {actual}")
-
-print(f"\n  {ok}/5 generated files verified")
-
-print("\n=== 3. validate-okf.sh ===")
-r = subprocess.run(["bash", f"{REPO}/scripts/validate-okf.sh",
-                    "--dir", f"{REPO}/specs/skills-wiki/skills"],
-                   capture_output=True, text=True)
-print(f"  PASS={r.stdout.count('PASS ')}  FAIL={r.stdout.count('FAIL ')}  exit={r.returncode}")
-
-print("\n=== 4. Patch applied ===")
-with open(f"{REPO}/scripts/sync-skills.sh") as f:
-    for i, line in enumerate(f, 1):
-        if "python3" in line and "title()" in line:
-            print(f"  line {i}: {line.strip()}")
-            break
-
-print(f"\nVERDICT: {errs}/13 sed bug confirmed, {ok}/5 outputs correct, validate-okf pass")

package/_test_e28s01.sh

@@ -1,2 +0,0 @@
-#!/usr/bin/env bash
-echo "test"