claude-code-arcane 2.10.0 → 2.12.0

package/rules/gamedev/ui-code.md

@@ -1,6 +1,7 @@
 ---
 paths:
   - "src/ui/**"
+  - "Assets/**/Scripts/UI/**"
 ---
 
 # UI Code Rules
@@ -13,3 +14,9 @@ paths:
 - UI must never block the game thread
 - Scalable text and colorblind modes are mandatory, not optional
 - Test all screens at minimum and maximum supported resolutions
+
+## How to verify
+
+- The project compiles with no new errors: the Unity console, or a batchmode compile (`Unity -batchmode -quit -projectPath . -logFile -`); for Unreal, see `unreal-code`.
+- Run the EditMode and PlayMode tests that cover the change (`-runTests -testPlatform EditMode` or `PlayMode`).
+- You cannot play the game. Name what needs a human playtest (game feel, timing, visuals, input) and list exactly what to try.

package/rules/gamedev/unreal-code.md

@@ -123,3 +123,9 @@ class AGate : public AActor
     }
 };
 ```
+
+## How to verify
+
+- The editor target compiles with no new errors or warnings (Build in the IDE, or `Build.bat <Project>Editor Win64 Development <path>.uproject`).
+- Run the automation tests that cover the change (`UnrealEditor-Cmd <project>.uproject -ExecCmds="Automation RunTests <Filter>;Quit" -unattended -nullrhi`).
+- You cannot play the game. Name what needs a human playtest (game feel, replication under latency, visuals) and list exactly what to try.

package/rules/git-worktrees.md

@@ -0,0 +1,22 @@
+# Git Worktree Rule
+
+A session can run inside a git worktree: a second checkout of the same repository, usually under `.claude/worktrees/`. You are in one when `git rev-parse --git-dir` and `git rev-parse --git-common-dir` print different paths.
+
+## Decide by the branch the action is about
+
+| The action is about | Where to run it |
+|---|---|
+| The worktree's own branch: commit, push, rebase, merge `main` into it | Inside the worktree. First push: `git push -u origin HEAD` |
+| Another branch: `main`, or whatever the main checkout has (checkout, switch, pull, update) | Outside: leave the worktree first |
+| Unclear | Ask once |
+
+## Leaving the worktree
+
+The user authorizes you to leave a worktree without asking, in two cases:
+
+1. **The task is done.** Commit the work on the worktree branch, push it if the task included pushing, then call `ExitWorktree` with `action: "keep"`. Tell the user the worktree path and its branch.
+2. **You need another branch** (second row of the table). Leave with `ExitWorktree` (`keep`), run the operation, and enter again if the task continues.
+
+Always `keep`. Never `remove` a worktree: deleting worktrees is the user's call.
+
+`ExitWorktree` only acts on a worktree this session entered with `EnterWorktree`. If it does nothing (the session started inside the worktree, or it was made with `git worktree add` or `arcane worktree`), run git against the main checkout instead: `git -C "<main checkout>" pull`. The main checkout is the parent directory of `git rev-parse --git-common-dir`. Tell the user the session itself is still inside the worktree.

package/rules/implementation-workflow.md

@@ -39,6 +39,15 @@ Use AskUserQuestion exactly like this:
 - **Goal-driven:** Help the user define a verifiable goal statement and 2-4 checkpoints, create tasks, implement toward each checkpoint. No formal plan.
 - **Directo:** Proceed immediately without ceremony.
 
+## Before writing new code
+
+In every mode, search in this order and take the first option that fully works:
+
+1. **The codebase**: a helper, component or pattern that already does it.
+2. **The standard library** or a platform feature.
+3. **A dependency the project already has.**
+4. **A new dependency**, only when 1–3 cannot do it. Name the package and why before installing it.
+
 ## Key principles
 
 - One question, not a wall of text — present options and wait

package/rules/infra-code.md

@@ -45,3 +45,9 @@ paths:
 - Inline shell scripts in CI that do complex logic — move to a versioned script with tests
 - Copying `production.tf` to `staging.tf` and diverging them by hand
 - Running DB migrations from a CI job that doesn't have transactional rollback if the deploy fails after
+
+## How to verify
+
+- Validate without applying: `terraform plan`, `helm lint` + `helm template`, `docker compose config`, `docker build`. Show the output.
+- Never run `apply`, a deploy or `kubectl apply` to verify a change.
+- For a CI workflow, run `actionlint` if it is installed, and say that the workflow itself only proves itself on the next push.

package/rules/meshy-assets.md

@@ -1,6 +1,6 @@
 # Meshy Assets
 
-Reglas para produccion de assets 3D con Meshy. Aplican a cualquier operacion que toque `assets/3d/`.
+Reglas que tienen que estar presentes antes de cualquier llamada a Meshy, aunque no se toque ningun archivo: cada llamada gasta creditos. Estructura en disco, ledger, ejes, rigging y Git estan en `.claude/rules/meshy-files.md`, que se carga al tocar `assets/3d/`.
 
 ## Creditos — cada llamada cuesta plata real
 
@@ -29,83 +29,14 @@ Reglas para produccion de assets 3D con Meshy. Aplican a cualquier operacion que
 
 Ante cualquier duda sobre si una operacion gasta, correr `meshy_check_balance` antes y despues y reportar el delta real.
 
-## Master unico, derivados baratos
+## Antes de gastar
 
-El GLB refined es la fuente de verdad y es **inmutable**. Ningun target se genera desde el prompt: todos salen del master.
+- Ningun target se genera desde el prompt: todos salen del master con `meshy_convert` (1).
+- Nunca usar `remesh` (5) cuando `convert` (1) alcanza, ni para LODs de web: `gltf-transform` los hace gratis.
+- `meshy_rig` (5) es solo para humanoides: con otro modelo se gastan los creditos y no sirve.
+- Si existe un art bible en el proyecto, el prompt de generacion se deriva de ahi, no se inventa.
+- `meshy_analyze_printability` (gratis) **siempre** antes de `meshy_repair_printability` (10). Print (20 white / 40 multicolor): doble confirmacion.
 
-| Target | Como | Creditos |
-|---|---|---|
-| Unity y UE5 | `meshy_convert` -> `fbx` (un solo archivo sirve para los dos) | 1 |
-| Blender | `meshy_convert` -> `blend` | 1 |
-| Impresion | `meshy_convert` -> `stl` (`3mf` si es multicolor) | 1 |
-| Web / three.js | `npx gltf-transform optimize --simplify` | **0** |
+## Secretos
 
-- Nunca usar `remesh` (5) cuando `convert` (1) alcanza. `remesh` es para cambiar topologia de verdad, no para cambiar de formato.
-- Nunca usar `remesh` para LODs de web: `gltf-transform` hace decimation, meshopt y KTX2 en local y gratis.
-
-## Estructura en disco
-
-```
-assets/3d/<slug>/
-  meshy.json           # ledger, ver abajo
-  master.glb           # refined, inmutable
-  thumb.png
-  targets/
-    web.glb            # <=15k tris, texturas 1024, KTX2 + draco
-    game.fbx           # Unity + UE5
-    edit.blend
-    print.stl
-```
-
-Slugs en kebab-case, sin fechas ni task_ids en el path.
-
-## Ledger: `meshy.json`
-
-Obligatorio por asset. Sin esto cada sesion nueva arranca ciega y se paga dos veces el mismo modelo.
-
-```json
-{
-  "slug": "rune-pedestal",
-  "prompt": "...",
-  "ai_model": "meshy-5",
-  "tasks": [
-    { "id": "...", "op": "text_to_3d_preview", "credits": 5, "at": "2026-08-18T14:02:00Z" },
-    { "id": "...", "op": "text_to_3d_refine", "credits": 25, "at": "2026-08-18T14:11:00Z" }
-  ],
-  "credits_total": 30,
-  "derived": ["targets/web.glb", "targets/game.fbx"]
-}
-```
-
-Actualizar `meshy.json` **en el mismo turno** en que se genera. No dejarlo para despues.
-
-## Ejes y escala
-
-Verificar una vez, anotar en el ledger, no volver a pensarlo.
-
-| Destino | Convencion |
-|---|---|
-| GLB | Y-up, metros |
-| Unity | Y-up, 1 unidad = 1 m |
-| UE5 | Z-up, 1 unidad = 1 cm (rotacion + factor 100) |
-| Blender | Z-up, metros |
-
-## Impresion 3D
-
-Correr `meshy_analyze_printability` (gratis) **siempre** antes de `meshy_repair_printability` (10). `meshy_resize` a milimetros reales antes de exportar STL. Las operaciones de print (20 white / 40 multicolor) son las mas caras del catalogo: doble confirmacion.
-
-## Rigging
-
-`meshy_rig` es solo humanoides. El esqueleto que devuelve **no** es el mannequin de UE5: el retargeting es manual. En UE5 los static meshes van a Nanite y no necesitan decimation; los skeletal meshes si necesitan LODs propios.
-
-## Git y secretos
-
-- `*.glb *.fbx *.blend *.stl *.3mf` por **Git LFS**.
-- `meshy.json` y `thumb.png` van como archivos normales — son chicos y son lo que hace grepeable el catalogo.
-- `MESHY_API_KEY` (formato `msy_...`) va en `.env`, **nunca** en el repo ni en un SKILL.md.
-
-## Integracion con el resto del stack
-
-`asset-spec` define que asset hace falta -> Meshy lo genera -> `asset-audit` valida el resultado. Meshy no reemplaza a ninguno de los dos.
-
-Si existe un art bible en el proyecto, el prompt de generacion se deriva de ahi, no se inventa.
+`MESHY_API_KEY` (formato `msy_...`) va en `.env`, **nunca** en el repo ni en un SKILL.md.

package/rules/meshy-files.md

@@ -0,0 +1,83 @@
+---
+paths:
+  - "assets/3d/**"
+---
+
+# Meshy Files
+
+Como se guardan los assets de Meshy. Los creditos y las reglas de gasto estan en `.claude/rules/meshy-assets.md`, que se carga siempre.
+
+## Master unico, derivados baratos
+
+El GLB refined es la fuente de verdad y es **inmutable**. Ningun target se genera desde el prompt: todos salen del master.
+
+| Target | Como | Creditos |
+|---|---|---|
+| Unity y UE5 | `meshy_convert` -> `fbx` (un solo archivo sirve para los dos) | 1 |
+| Blender | `meshy_convert` -> `blend` | 1 |
+| Impresion | `meshy_convert` -> `stl` (`3mf` si es multicolor) | 1 |
+| Web / three.js | `npx gltf-transform optimize --simplify` | **0** |
+
+## Estructura en disco
+
+```
+assets/3d/<slug>/
+  meshy.json           # ledger, ver abajo
+  master.glb           # refined, inmutable
+  thumb.png
+  targets/
+    web.glb            # <=15k tris, texturas 1024, KTX2 + draco
+    game.fbx           # Unity + UE5
+    edit.blend
+    print.stl
+```
+
+Slugs en kebab-case, sin fechas ni task_ids en el path.
+
+## Ledger: `meshy.json`
+
+Obligatorio por asset. Sin esto cada sesion nueva arranca ciega y se paga dos veces el mismo modelo.
+
+```json
+{
+  "slug": "rune-pedestal",
+  "prompt": "...",
+  "ai_model": "meshy-5",
+  "tasks": [
+    { "id": "...", "op": "text_to_3d_preview", "credits": 5, "at": "2026-08-18T14:02:00Z" },
+    { "id": "...", "op": "text_to_3d_refine", "credits": 25, "at": "2026-08-18T14:11:00Z" }
+  ],
+  "credits_total": 30,
+  "derived": ["targets/web.glb", "targets/game.fbx"]
+}
+```
+
+Actualizar `meshy.json` **en el mismo turno** en que se genera. No dejarlo para despues.
+
+## Ejes y escala
+
+Verificar una vez, anotar en el ledger, no volver a pensarlo.
+
+| Destino | Convencion |
+|---|---|
+| GLB | Y-up, metros |
+| Unity | Y-up, 1 unidad = 1 m |
+| UE5 | Z-up, 1 unidad = 1 cm (rotacion + factor 100) |
+| Blender | Z-up, metros |
+
+## Impresion 3D
+
+`meshy_resize` a milimetros reales antes de exportar STL.
+
+## Rigging
+
+El esqueleto que devuelve `meshy_rig` **no** es el mannequin de UE5: el retargeting es manual. En UE5 los static meshes van a Nanite y no necesitan decimation; los skeletal meshes si necesitan LODs propios.
+
+## Git
+
+- `*.glb *.fbx *.blend *.stl *.3mf` por **Git LFS**.
+- `meshy.json` y `thumb.png` van como archivos normales — son chicos y son lo que hace grepeable el catalogo.
+
+## Integracion con el resto del stack
+
+`asset-spec` define que asset hace falta -> Meshy lo genera -> `asset-audit` valida el resultado. Meshy no reemplaza a ninguno de los dos.

package/rules/migration-code.md

@@ -39,3 +39,9 @@ paths:
 - `DELETE FROM users WHERE ...` in a migration without a backup and written-out rollback
 - Migration that depends on application code (calling service layer) — migrations run with DB access only, not app code
 - Migrations that only work if previous migration left specific data — be defensive, check before mutating
+
+## How to verify
+
+- On the local database, run the migration up, then down, then up again. All three must succeed.
+- After up, confirm the schema change landed: `\d <table>` in psql, `DESCRIBE <table>` in MySQL, or the ORM's status command.
+- For a backfill, run it twice: the second run must change nothing.

package/rules/nestjs-code.md

@@ -71,3 +71,9 @@ Reglas production-ready para NestJS, ordenadas por impacto. Catálogo completo (
 ---
 
 _Derivado de [kadajett/agent-nestjs-skills](https://github.com/kadajett/agent-nestjs-skills) (nestjs-best-practices). Condensado al formato Arcane._
+
+## How to verify
+
+- Run the tests that cover the change (`npm test`, or the project's script) and the type check.
+- Start the app locally and call the changed endpoint with `curl`: show the status code and the body, plus one failure case (invalid DTO, missing auth).
+- Read the app log for those requests: no stack trace, no unexpected warning.

package/rules/verification.md

@@ -0,0 +1,13 @@
+# Verification Rule
+
+Every claim about the state of the work rests on evidence produced in this session.
+
+- **No claim without a run.** "Tests pass", "it builds" and "it works" each need the command you ran in this session and its result. If you did not run it, say so.
+- **Read before you edit.** Never change or overwrite a file you have not read in this session: the user may have changed it.
+- **Search, don't guess.** Before you use a path, function, flag or config key you are not sure exists, find it (Grep, Glob, `--help`, the source).
+- **The installed version beats memory.** Before you use a library API from memory, check its version in the lockfile; when in doubt, read the installed types or source.
+- **Fix the code, not the check.** Never edit a test, a lint/format/type config or a CI step to make it pass, unless the task is about that test or config. If you think the test is wrong, say so and ask.
+- **Filter long output.** Pipe it through `tail`, `grep` or a quiet flag instead of pouring thousands of lines into the context.
+- **Close with what was not verified.** End a task by naming what you could not check: a platform, a manual flow, a visual result.
+
+Domain rules add a `## How to verify` section with what counts as evidence in that kind of code.

package/skills/agent-protocol/SKILL.md

@@ -90,7 +90,7 @@ All C-suite output follows ONE format. See `references/communication-standard.md
 
 1. **Bottom line first.** The founder's time is the scarcest resource.
 2. **Results and decisions only.** No process narration.
-3. **Max 5 bullets per section.** Longer = reference doc.
+3. **About 5 bullets per section, ranked by impact.** Keep what changes the decision; the rest goes to a reference doc. Never drop a critical finding to fit the number: show it, and point to the doc for detail.
 4. **Actions have owners and deadlines.** "We should consider" is banned.
 5. **Decisions framed as options** with trade-offs and recommendation.
 6. **Risks are concrete.** "If X happens, Y breaks, costing $Z."

package/skills/agent-protocol/references/communication-standard.md

@@ -16,7 +16,7 @@ WHAT
 • [Finding 1 — most critical]
 • [Finding 2]
 • [Finding 3]
-(Max 5 bullets. If more needed → reference doc.)
+(About 5, ranked by impact. More only if critical; detail → reference doc.)
 
 WHY THIS MATTERS
 [1-2 sentences. Business impact. Not theory — consequence.]
@@ -106,7 +106,7 @@ ACTION ITEMS
 1. **Bottom line first.** Always. The founder's time is the scarcest resource.
 2. **Results and decisions only.** No process narration ("First I analyzed..."). No thinking out loud.
 3. **What + Why + How.** Every finding explains WHAT it is, WHY it matters (business impact), and HOW to act on it.
-4. **Max 5 bullets per section.** Longer = reference doc.
+4. **About 5 bullets per section, ranked by impact.** Keep what changes the decision; the rest goes to a reference doc. Never drop a critical finding to fit the number: show it, and point to the doc for detail.
 5. **Actions have owners and deadlines.** "We should consider" is banned. Who does what by when.
 6. **Decisions framed as options.** Not "what do you think?" — "Option A or B, here's the trade-off, here's my recommendation."
 7. **The founder decides.** Roles recommend. The founder approves, modifies, or rejects. Every output respects this hierarchy.

package/skills/ai-security/SKILL.md

@@ -72,6 +72,10 @@ Injection score (0.0-1.0) measures proportion of matched signatures. Score above
 
 Full ATLAS technique coverage and guardrail patterns: `references/atlas-coverage.md`
 
+### Step 5: Verdict
+
+**Verdict:** **FAIL** if any finding is Critical or High; **CONCERNS** if only Medium or Low findings remain; **PASS** if nothing actionable turned up. A prompt-injection score above 0.5 counts as High.
+
 ---
 
 ## Tool Reference

package/skills/audit-dev/SKILL.md

@@ -30,7 +30,7 @@ Identificar lenguajes/frameworks/package manager. Leer configs raíz. Mapear car
 
 ## Phase 3 — Producir reporte
 
-Guardar como `AUDIT.md` en raíz. Secciones: fecha/stack/estado general, resumen ejecutivo (3-5 oraciones), scorecard (tabla dimensión/estado OK-WARN-CRIT/nota), hallazgos críticos, hallazgos importantes, observaciones, lo que está bien, plan de acción recomendado, detalles por dimensión con evidencia (paths, líneas).
+Guardar como `AUDIT.md` en raíz. Secciones: fecha/stack/estado general (**SALUDABLE** si todas las dimensiones del scorecard están en OK, **NECESITA ATENCIÓN** si alguna quedó en WARN, **CRÍTICO** si alguna quedó en CRIT), resumen ejecutivo (3-5 oraciones), scorecard (tabla dimensión/estado OK-WARN-CRIT/nota), hallazgos críticos, hallazgos importantes, observaciones, lo que está bien, plan de acción recomendado, detalles por dimensión con evidencia (paths, líneas).
 
 ## Rules
 

package/skills/blender-animation/SKILL.md

@@ -164,4 +164,4 @@ influencias maximas por vertice, que se bakeo, y decision de root motion por cli
 
 ---
 
-> → Bake de constraints, frame rate y ejes estan en `.claude/rules/blender-pipeline.md`.
+> → Bake de constraints, frame rate y ejes estan en `.claude/rules/blender-files.md`.

package/skills/blender-export/SKILL.md

@@ -140,4 +140,4 @@ verdict.
 
 ---
 
-> → Formatos, ejes, escala y reglas de Git LFS estan en `.claude/rules/blender-pipeline.md`.
+> → Formatos, ejes, escala y reglas de Git LFS estan en `.claude/rules/blender-files.md`.

package/skills/blender-materials/SKILL.md

@@ -162,4 +162,4 @@ que se bakeo, y convencion de normal map elegida.
 ---
 
 > → Color space, convenciones de normal map y presupuesto de materiales estan en
-> `.claude/rules/blender-pipeline.md`.
+> `.claude/rules/blender-files.md`.

package/skills/blender-modeling/SKILL.md

@@ -157,4 +157,4 @@ Reportar por objeto: verts, tris, n-gons, materiales, escala, y tris contra el p
 ---
 
 > → Topologia, presupuestos, ejes y las reglas de scripts destructivos estan en
-> `.claude/rules/blender-pipeline.md`.
+> `.claude/rules/blender-files.md`.

package/skills/check/SKILL.md

@@ -17,6 +17,6 @@ Run a comprehensive code quality and security check on the current project:
    - Hardcoded secrets, API keys, tokens in source code
    - Known vulnerable dependencies (npm audit, pip audit, etc.)
    - SQL injection, XSS, or command injection patterns
-6. **Report** — Summarize findings with severity levels and suggested fixes
+6. **Report** — Summarize findings with severity levels and suggested fixes, then close with a verdict: **FAIL** if tests or type checks fail, or a secret or critical vulnerability turned up; **CONCERNS** if only lint issues or lower-severity findings remain; **PASS** if nothing actionable came up
 
 Focus on actionable issues, not style nitpicks.

package/skills/chief-of-staff/SKILL.md

@@ -59,7 +59,7 @@ Before delivering ANY output to the founder:
 - Company context loaded (not generic advice)
 - Actions have owners and deadlines
 - Conflicts named, not smoothed
-- Max 5 bullets per section
+- About 5 bullets per section, ranked by impact; a critical finding is never dropped to fit
 
 ## Ecosystem Awareness
 

package/skills/cloud-security/SKILL.md

@@ -73,6 +73,10 @@ Full escalation combos, severity guide, and least privilege recommendations: `re
 
 Catch misconfigurations at definition time in Terraform, CloudFormation, Kubernetes manifests, and Helm charts. Integrate into CI/CD as a pre-apply gate.
 
+### Step 6: Verdict
+
+**Verdict:** **FAIL** if any finding is Critical or High; **CONCERNS** if only Medium or Low findings remain; **PASS** if nothing actionable turned up. Apply the severity modifier first: an internet-facing or regulated-data resource raises the finding's severity before the verdict is taken.
+
 ---
 
 ## Cloud Provider Coverage

package/skills/isms-audit-expert/SKILL.md

@@ -54,6 +54,8 @@ For detailed control testing procedures by Annex A control, see [references/secu
 | Minor Nonconformity | Isolated deviation with limited impact | 90 days |
 | Observation | Improvement opportunity | Next audit cycle |
 
+**Audit conclusion:** **CONFORMING** (observations at most), **MINOR NONCONFORMITIES** (minor only), or **MAJOR NONCONFORMITY** (at least one major, which blocks a certification recommendation until it is corrected).
+
 ### Corrective Action Workflow
 
 1. Auditee acknowledges finding

package/skills/meshy-derive/SKILL.md

@@ -116,4 +116,4 @@ Reportar: targets generados, creditos gastados reales (delta de `check_balance`)
 
 ---
 
-> Presupuestos, estructura de `targets/`, formato del ledger y la tabla de creditos completa: `.claude/rules/meshy-assets.md`.
+> Presupuestos, estructura de `targets/` y formato del ledger: `.claude/rules/meshy-files.md`. Tabla de creditos completa: `.claude/rules/meshy-assets.md`.

package/skills/meshy-generate/SKILL.md

@@ -115,4 +115,4 @@ Reportar:
 
 ---
 
-> Tabla de creditos completa, reglas de gasto, formato del ledger y convenciones de ejes/escala: `.claude/rules/meshy-assets.md`. Leerla antes de la Phase 3.
+> Tabla de creditos completa, reglas de gasto, formato del ledger y convenciones de ejes/escala: `.claude/rules/meshy-assets.md` y `.claude/rules/meshy-files.md`. Leerlas antes de la Phase 3.

package/skills/meshy-setup/SKILL.md

@@ -113,4 +113,4 @@ Reportar:
 
 ---
 
-> Las reglas de gasto, estructura de `assets/3d/`, ledger `meshy.json` y tabla de derivados estan en `.claude/rules/meshy-assets.md`. Leerlas antes de cualquier operacion que gaste creditos.
+> Las reglas de gasto, estructura de `assets/3d/`, ledger `meshy.json` y tabla de derivados estan en `.claude/rules/meshy-assets.md` y `.claude/rules/meshy-files.md`. Leerlas antes de cualquier operacion que gaste creditos.

package/skills/owasp-top10-check/SKILL.md

@@ -86,7 +86,7 @@ Auditoría contra OWASP Top 10 2021. Go backend + TS/React frontend. Datos de me
 
 ## Reporte Output
 
-Formato: Resumen ejecutivo (hallazgos por severidad) → Hallazgos por categoría (archivo:línea, descripción, PoC, remediación, ticket Jira) → Plan priorizado → Herramientas ejecutadas.
+Formato: Resumen ejecutivo (hallazgos por severidad y veredicto: **FAIL** si hay algún hallazgo Critical o High, **CONCERNS** si quedan solo Medium o Low, **PASS** si no hay nada accionable) → Hallazgos por categoría (archivo:línea, descripción, PoC, remediación, ticket Jira) → Plan priorizado → Herramientas ejecutadas.
 
 ## Educabot Specifics
 

package/skills/qms-audit-expert/SKILL.md

@@ -63,6 +63,8 @@ Gap: [How evidence fails to meet requirement]
 | Minor | Isolated lapse or partial implementation | Recommended | 60 days |
 | Observation | Improvement opportunity | Optional | As appropriate |
 
+**Audit conclusion:** **CONFORMING** (observations at most), **MINOR NONCONFORMITIES** (minor only), or **MAJOR NONCONFORMITY** (at least one major, which blocks a certification recommendation until it is corrected).
+
 ### Corrective Action Integration
 
 | Severity | CAPA Depth | Verification |

package/skills/security-pen-testing/SKILL.md

@@ -74,7 +74,7 @@ Key tests: XSS (reflected, stored, DOM-based), CSRF (token replay, SameSite), SQ
 python scripts/pentest_report_generator.py --findings findings.json --format md --output report.md
 ```
 
-Report structure: executive summary, scope, methodology, findings table (by severity/CVSS), detailed findings with evidence and remediation, priority matrix.
+Report structure: executive summary with a verdict (**FAIL** if any finding is Critical or High, **CONCERNS** if only Medium or Low remain, **PASS** if nothing actionable turned up), scope, methodology, findings table (by severity/CVSS), detailed findings with evidence and remediation, priority matrix.
 
 Responsible disclosure timeline and templates: `references/responsible_disclosure.md`
 

package/skills/seo-audit/SKILL.md

@@ -43,7 +43,7 @@ Before auditing, understand:
 ### Audit Report Structure
 
 **Executive Summary**
-- Overall health assessment
+- Overall health: **HEALTHY** (no critical or high-impact issues), **NEEDS WORK** (high-impact issues, nothing blocking), or **CRITICAL** (something blocks indexation or ranking)
 - Top 3-5 priority issues
 - Quick wins identified
 

package/skills/skill-auditor/SKILL.md

@@ -68,7 +68,6 @@ Scan the body for required elements:
 
 - **Sections**: At least 2 phase headings (`## Phase`, `## Step`, `## Workflow`, or `###` subsections)
 - **Verdict keywords**: For review/analysis skills: APPROVED, PASS, FAIL, NEEDS REVISION (or equivalent)
-- **Collaborative protocol**: For file-modifying skills (Write/Edit in allowed-tools): must contain "May I write" or equivalent approval gate
 - **Next-step handoff**: Last section should guide what to do after the skill completes
 
 ### 1.4 Detect hallucinations

package/skills/skill-improve/SKILL.md

@@ -17,7 +17,7 @@ Read skill name from first arg. Verify `skills/[name]/SKILL.md` exists. If missi
 
 ## Phase 2: Baseline Test
 
-Run `/skill-test static [name]`. Record FAILs, WARNs, which checks failed (1-7).
+Run `/skill-test static [name]`. Record FAILs, WARNs, which checks failed (1-6).
 
 ### Phase 2b: Category Baseline
 
@@ -30,12 +30,11 @@ Read full skill file. For each failing/warning check, identify exact gap:
 | Check | Gap if failing |
 |-------|---------------|
 | 1 | Missing frontmatter field |
-| 2 | Fewer phases than minimum |
-| 3 | No verdict keywords in body |
-| 4 | Write/Edit in tools but no ask-before-write language |
-| 5 (warn) | No follow-up/next-step section |
-| 6 (warn) | `context: fork` with <5 phases |
-| 7 (warn) | argument-hint empty or mismatched with modes |
+| 2 | Over 40 lines with fewer than two `##` sections |
+| 3 | A value from the catalog's `verdict:` list missing from the skill |
+| 4 (warn) | No follow-up/next-step section |
+| 5 (warn) | `context: fork` with <5 phases |
+| 6 (warn) | argument-hint mismatched with modes |
 
 For category checks: identify text gaps (e.g., G2: missing director prompts, A2: no per-section May-I-write, T3: BLOCKED not surfaced). Show full diagnosis before proposing changes.
 

package/skills/skill-test/SKILL.md

@@ -15,18 +15,18 @@ Validates `skills/*/SKILL.md` for structural compliance and behavioral correctne
 
 | Mode | Command | Purpose | Cost |
 |------|---------|---------|------|
-| `static` | `/skill-test static [name\|all]` | 7 structural checks per skill | Low (~1k/skill) |
+| `static` | `/skill-test static [name\|all]` | 6 structural checks per skill | Low (~1k/skill) |
 | `spec` | `/skill-test spec [name]` | Behavioral assertions from test spec | Medium (~5k/skill) |
 | `category` | `/skill-test category [name\|all]` | Category-specific rubric metrics | Low (~2k/skill) |
 | `audit` | `/skill-test audit` | Coverage report — skills, agents, test dates | Low (~3k total) |
 
 ## Phase 1: Parse Arguments
 
-`static [name]` → 7 checks on one skill. `static all` → all skills (Glob `skills/*/SKILL.md`). `spec [name]` → read skill + test spec, evaluate assertions. `category [name|all]` → category rubric from `CCGS Skill Testing Framework/quality-rubric.md`. `audit` (or no arg) → read catalog, list all, show coverage. Missing/unrecognized → output usage and stop.
+`static [name]` → 6 checks on one skill. `static all` → all skills (Glob `skills/*/SKILL.md`). `spec [name]` → read skill + test spec, evaluate assertions. `category [name|all]` → category rubric from `skills-selftest/quality-rubric.md`. `audit` (or no arg) → read catalog, list all, show coverage. Missing/unrecognized → output usage and stop.
 
 ## Phase 2A: Static Mode
 
-> → Read references/static-checks.md for the 7 structural validation checks and verdict criteria
+> → Read references/static-checks.md for the 6 structural validation checks and verdict criteria
 
 ## Phase 2B: Spec Mode
 

package/skills/skill-test/references/static-checks.md

@@ -1,13 +1,18 @@
-# Static Checks — 7 Structural Validations
+# Static Checks — 6 Structural Validations
+
+Checks 1-3 are also enforced in CI by `src/__tests__/skill-static.test.ts`, so in this repo a skill that fails them never merges. Apply them here anyway: the skill may be running in a project with its own skills, where no test covers them.
 
 | Check | What | Verdict |
 |-------|------|---------|
-| 1 — Frontmatter | `name`, `description`, `argument-hint`, `user-invocable`, `allowed-tools` present | FAIL if any absent |
-| 2 — Phases | >=2 numbered phase headings (`## Phase N`, `## N.`, or >=2 `##` headings) | FAIL if <2 |
-| 3 — Verdict Keywords | Contains >=1 of: PASS, FAIL, CONCERNS, APPROVED, BLOCKED, COMPLETE, READY, COMPLIANT, NON-COMPLIANT | FAIL if none |
-| 4 — Collaborative Protocol | "May I write" / "before writing" / "approval" near file-write instructions | WARN if absent; FAIL if `allowed-tools` includes Write/Edit but no ask-before-write |
-| 5 — Next-Step Handoff | Final section mentions another skill, "next step", or follow-up | WARN if absent |
-| 6 — Fork Complexity | If `context: fork`, must have >=5 phase headings | WARN if <5 |
-| 7 — Argument Hint | Non-empty; documented modes should match hint | WARN if empty or mismatch |
+| 1 — Frontmatter | `name` (matching the directory), `description`, `argument-hint`, `user-invocable`, `allowed-tools` present; an empty `argument-hint` still counts as present | FAIL if any absent |
+| 2 — Sections | A skill longer than 40 lines has at least two `##` sections. Shorter skills are exempt | FAIL if longer than 40 lines with fewer than two |
+| 3 — Verdict | Only for skills that judge something: those with `verdict:` in `skills-selftest/catalog.yaml`. Every value listed there appears in the skill (SKILL.md or `references/`), in the skill's own vocabulary. Skills that build, write or advise do not need a verdict | FAIL if a listed value is missing |
+| 4 — Next-Step Handoff | Final section mentions another skill, "next step", or follow-up | WARN if absent |
+| 5 — Fork Complexity | If `context: fork`, must have >=5 phase headings | WARN if <5 |
+| 6 — Argument Hint | Documented modes should match the hint | WARN if mismatch |
+
+A new skill that judges something gets a `verdict:` list in the catalog when it is added; that is what makes check 3 apply to it.
+
+There is no check for ask-before-write language. Whether Claude may write without asking is set by the permission mode of each session, not by the skill, so a skill with `Write` or `Edit` is not non-compliant for leaving the decision there.
 
 **Output:** per-skill table of check results + verdict (COMPLIANT / WARNINGS / NON-COMPLIANT). For `static all`: summary table + aggregate counts.

package/skills/standup-report/SKILL.md

@@ -48,4 +48,4 @@ Flujo: detectar team/proyecto → pull data en paralelo (git, ClickUp, Jira, Git
 - NO incluir contenido sensible (PII, passwords, secrets)
 - Grouping lógico: mergear commits del mismo ticket
 - Sugerencias "hoy" basadas en tickets In Progress + priorities
-- Max 5 bullets per section, collapsar el resto
+- Unos 5 bullets por sección, ordenados por impacto, y el resto colapsado. Un blocker nunca se colapsa para respetar el número

package/skills/vn-gdd/SKILL.md

@@ -7,6 +7,8 @@ user-invocable: true
 allowed-tools: Read, Glob, Grep, Write, Edit, WebSearch, AskUserQuestion
 ---
 
+## Process
+
 When this skill is invoked:
 
 1. **Check for existing work**:

package/skills/web-security/SKILL.md

@@ -82,6 +82,10 @@ HSTS rollout: start with short `max-age` (300s), escalate to 2 years, then submi
 - **Threat modeling**: complex trust boundaries need STRIDE before implementation
 - **CSP breaks prod**: revert to report-only immediately; analyze before re-enforcing
 
+## Verdict
+
+**Verdict:** **FAIL** if any finding is Critical or High; **CONCERNS** if only Medium or Low findings remain; **PASS** if nothing actionable turned up.
+
 ## Checklist
 
 - [ ] All required security headers present and returning correct values (target A+ on securityheaders.com)