claude-code-arcane 2.9.9 → 2.11.0

package/rules/blender-pipeline.md

@@ -1,7 +1,6 @@
 # Blender Pipeline
 
-Reglas para trabajar assets en Blender con destino a un engine o a la web. Aplican a cualquier
-operacion que toque un `.blend` o exporte desde uno.
+Reglas que tienen que estar presentes antes de operar Blender, por MCP o headless, aunque todavia no se haya tocado un `.blend`. Ejes, topologia, materiales, animacion y Git estan en `.claude/rules/blender-files.md`, que se carga al tocar un `.blend` o un archivo exportado.
 
 ## El MCP es opcional, el headless no
 
@@ -32,64 +31,3 @@ barrera**. Consecuencias que no son negociables:
 3. No apuntarlo a una maquina con material sensible ni a credenciales.
 4. Un script que borra (`bpy.data.*.remove`, `object.delete`) se muestra al usuario **antes** de
    correrlo, siempre, incluso si lo pidio.
-
-## Ejes, escala y unidades
-
-Verificar una vez por proyecto, anotarlo, no volver a pensarlo.
-
-| Destino | Convencion | Al exportar desde Blender |
-|---|---|---|
-| Blender | Z-up, right-handed, 1 unidad = 1 m | — |
-| glTF / GLB | Y-up, metros | El exporter convierte solo (`+Y up`) |
-| Unity | Y-up, left-handed, 1 unidad = 1 m | glTF sale derecho; en FBX revisar el eje |
-| UE5 | Z-up, left-handed, 1 unidad = 1 cm | Factor 100 |
-
-Reglas duras:
-
-- **Aplicar escala antes de exportar** (`Object → Apply → Scale`). Un objeto que sale con `scale`
-  distinto de 1 arrastra el problema al engine y rompe la fisica y el skinning.
-- Origen al piso para props y personajes; al centro para objetos que rotan sobre si mismos.
-- Un nodo con escala `100` o `0.01` en el archivo exportado es una conversion de unidades sin
-  aplicar, no una decision de diseno. Se corrige, no se documenta.
-
-## Topologia
-
-- **Quads en todo lo que deforma.** Tris solo en geometria estatica. N-gons en nada que deforme.
-- Edge loops en articulaciones, poles de 5 aristas o menos.
-- Presupuesto de triangulos declarado **antes** de modelar, no medido despues.
-- Un LOD generado con Decimate es un borrador. Para heroes va retopo a mano.
-
-## Materiales y texturas
-
-- **Principled BSDF y nada mas** en lo que se exporta. Los nodos procedurales no sobreviven a
-  glTF ni a FBX: si el look depende de ellos, hay que bakearlo a textura.
-- Color space: Base Color en sRGB; Normal, Roughness, Metallic y AO en **Non-Color**. Es el bug
-  mas comun y el mas silencioso.
-- Normal maps: Blender, glTF y Unity usan OpenGL (+Y). **UE5 usa DirectX (-Y)**: hay que invertir
-  el canal verde o marcarlo en el import.
-- Resoluciones potencia de dos. Texel density consistente entre assets del mismo set.
-- Cantidad de materiales = draw calls. Atlas antes de sumar materiales.
-
-## Animacion
-
-- **Los constraints no se exportan, los keyframes si.** Todo rig con IK, drivers o constraints se
-  bakea (`nla.bake` con visual keying) antes de exportar.
-- Frame rate del `.blend` igual al del engine. Un mismatch se ve como animacion lenta o acelerada,
-  no como error.
-- Huesos con sufijo `.L` / `.R` para que la simetria funcione.
-- Root motion: hueso raiz en el origen. Decidir in-place vs root motion **antes** de animar.
-
-## Git
-
-- `*.blend *.fbx *.glb *.gltf` por **Git LFS**. Verificar `git lfs version` antes de agregar las
-  entradas: peor que no tenerlas es tenerlas sin LFS instalado.
-- `*.blend1` y `*.blend2` (backups de Blender) van al `.gitignore`, nunca al repo.
-- Las texturas fuente (`.psd`, `.kra`, `.exr` de bake) por LFS; los `.png` finales tambien.
-
-## Integracion con el resto del stack
-
-`asset-spec` define que asset hace falta → Meshy o modelado a mano lo produce → **Blender lo
-limpia y lo exporta** → `asset-audit` valida el resultado en el proyecto.
-
-Blender es el paso del medio, no el principio ni el final. Si el asset vino de `meshy-derive`, el
-`.blend` que bajo es el punto de entrada; no se regenera desde Meshy para arreglar topologia.

package/rules/gamedev/narrative.md

@@ -12,4 +12,4 @@ paths:
 - Mysteries must have documented "true answers" even if players never learn them
 - Faction motivations, relationships, and power structures must be internally logical
 - All narrative text must be localization-ready: no idioms that don't translate, named placeholders for variables
-- No line of dialogue should exceed 120 characters for dialogue box constraints
+- No line of dialogue should exceed 200 characters for dialogue box constraints

package/rules/meshy-assets.md

@@ -1,6 +1,6 @@
 # Meshy Assets
 
-Reglas para produccion de assets 3D con Meshy. Aplican a cualquier operacion que toque `assets/3d/`.
+Reglas que tienen que estar presentes antes de cualquier llamada a Meshy, aunque no se toque ningun archivo: cada llamada gasta creditos. Estructura en disco, ledger, ejes, rigging y Git estan en `.claude/rules/meshy-files.md`, que se carga al tocar `assets/3d/`.
 
 ## Creditos — cada llamada cuesta plata real
 
@@ -29,83 +29,14 @@ Reglas para produccion de assets 3D con Meshy. Aplican a cualquier operacion que
 
 Ante cualquier duda sobre si una operacion gasta, correr `meshy_check_balance` antes y despues y reportar el delta real.
 
-## Master unico, derivados baratos
+## Antes de gastar
 
-El GLB refined es la fuente de verdad y es **inmutable**. Ningun target se genera desde el prompt: todos salen del master.
+- Ningun target se genera desde el prompt: todos salen del master con `meshy_convert` (1).
+- Nunca usar `remesh` (5) cuando `convert` (1) alcanza, ni para LODs de web: `gltf-transform` los hace gratis.
+- `meshy_rig` (5) es solo para humanoides: con otro modelo se gastan los creditos y no sirve.
+- Si existe un art bible en el proyecto, el prompt de generacion se deriva de ahi, no se inventa.
+- `meshy_analyze_printability` (gratis) **siempre** antes de `meshy_repair_printability` (10). Print (20 white / 40 multicolor): doble confirmacion.
 
-| Target | Como | Creditos |
-|---|---|---|
-| Unity y UE5 | `meshy_convert` -> `fbx` (un solo archivo sirve para los dos) | 1 |
-| Blender | `meshy_convert` -> `blend` | 1 |
-| Impresion | `meshy_convert` -> `stl` (`3mf` si es multicolor) | 1 |
-| Web / three.js | `npx gltf-transform optimize --simplify` | **0** |
+## Secretos
 
-- Nunca usar `remesh` (5) cuando `convert` (1) alcanza. `remesh` es para cambiar topologia de verdad, no para cambiar de formato.
-- Nunca usar `remesh` para LODs de web: `gltf-transform` hace decimation, meshopt y KTX2 en local y gratis.
-
-## Estructura en disco
-
-```
-assets/3d/<slug>/
-  meshy.json           # ledger, ver abajo
-  master.glb           # refined, inmutable
-  thumb.png
-  targets/
-    web.glb            # <=15k tris, texturas 1024, KTX2 + draco
-    game.fbx           # Unity + UE5
-    edit.blend
-    print.stl
-```
-
-Slugs en kebab-case, sin fechas ni task_ids en el path.
-
-## Ledger: `meshy.json`
-
-Obligatorio por asset. Sin esto cada sesion nueva arranca ciega y se paga dos veces el mismo modelo.
-
-```json
-{
-  "slug": "rune-pedestal",
-  "prompt": "...",
-  "ai_model": "meshy-5",
-  "tasks": [
-    { "id": "...", "op": "text_to_3d_preview", "credits": 5, "at": "2026-08-18T14:02:00Z" },
-    { "id": "...", "op": "text_to_3d_refine", "credits": 25, "at": "2026-08-18T14:11:00Z" }
-  ],
-  "credits_total": 30,
-  "derived": ["targets/web.glb", "targets/game.fbx"]
-}
-```
-
-Actualizar `meshy.json` **en el mismo turno** en que se genera. No dejarlo para despues.
-
-## Ejes y escala
-
-Verificar una vez, anotar en el ledger, no volver a pensarlo.
-
-| Destino | Convencion |
-|---|---|
-| GLB | Y-up, metros |
-| Unity | Y-up, 1 unidad = 1 m |
-| UE5 | Z-up, 1 unidad = 1 cm (rotacion + factor 100) |
-| Blender | Z-up, metros |
-
-## Impresion 3D
-
-Correr `meshy_analyze_printability` (gratis) **siempre** antes de `meshy_repair_printability` (10). `meshy_resize` a milimetros reales antes de exportar STL. Las operaciones de print (20 white / 40 multicolor) son las mas caras del catalogo: doble confirmacion.
-
-## Rigging
-
-`meshy_rig` es solo humanoides. El esqueleto que devuelve **no** es el mannequin de UE5: el retargeting es manual. En UE5 los static meshes van a Nanite y no necesitan decimation; los skeletal meshes si necesitan LODs propios.
-
-## Git y secretos
-
-- `*.glb *.fbx *.blend *.stl *.3mf` por **Git LFS**.
-- `meshy.json` y `thumb.png` van como archivos normales — son chicos y son lo que hace grepeable el catalogo.
-- `MESHY_API_KEY` (formato `msy_...`) va en `.env`, **nunca** en el repo ni en un SKILL.md.
-
-## Integracion con el resto del stack
-
-`asset-spec` define que asset hace falta -> Meshy lo genera -> `asset-audit` valida el resultado. Meshy no reemplaza a ninguno de los dos.
-
-Si existe un art bible en el proyecto, el prompt de generacion se deriva de ahi, no se inventa.
+`MESHY_API_KEY` (formato `msy_...`) va en `.env`, **nunca** en el repo ni en un SKILL.md.

package/rules/meshy-files.md

@@ -0,0 +1,83 @@
+---
+paths:
+  - "assets/3d/**"
+---
+
+# Meshy Files
+
+Como se guardan los assets de Meshy. Los creditos y las reglas de gasto estan en `.claude/rules/meshy-assets.md`, que se carga siempre.
+
+## Master unico, derivados baratos
+
+El GLB refined es la fuente de verdad y es **inmutable**. Ningun target se genera desde el prompt: todos salen del master.
+
+| Target | Como | Creditos |
+|---|---|---|
+| Unity y UE5 | `meshy_convert` -> `fbx` (un solo archivo sirve para los dos) | 1 |
+| Blender | `meshy_convert` -> `blend` | 1 |
+| Impresion | `meshy_convert` -> `stl` (`3mf` si es multicolor) | 1 |
+| Web / three.js | `npx gltf-transform optimize --simplify` | **0** |
+
+## Estructura en disco
+
+```
+assets/3d/<slug>/
+  meshy.json           # ledger, ver abajo
+  master.glb           # refined, inmutable
+  thumb.png
+  targets/
+    web.glb            # <=15k tris, texturas 1024, KTX2 + draco
+    game.fbx           # Unity + UE5
+    edit.blend
+    print.stl
+```
+
+Slugs en kebab-case, sin fechas ni task_ids en el path.
+
+## Ledger: `meshy.json`
+
+Obligatorio por asset. Sin esto cada sesion nueva arranca ciega y se paga dos veces el mismo modelo.
+
+```json
+{
+  "slug": "rune-pedestal",
+  "prompt": "...",
+  "ai_model": "meshy-5",
+  "tasks": [
+    { "id": "...", "op": "text_to_3d_preview", "credits": 5, "at": "2026-08-18T14:02:00Z" },
+    { "id": "...", "op": "text_to_3d_refine", "credits": 25, "at": "2026-08-18T14:11:00Z" }
+  ],
+  "credits_total": 30,
+  "derived": ["targets/web.glb", "targets/game.fbx"]
+}
+```
+
+Actualizar `meshy.json` **en el mismo turno** en que se genera. No dejarlo para despues.
+
+## Ejes y escala
+
+Verificar una vez, anotar en el ledger, no volver a pensarlo.
+
+| Destino | Convencion |
+|---|---|
+| GLB | Y-up, metros |
+| Unity | Y-up, 1 unidad = 1 m |
+| UE5 | Z-up, 1 unidad = 1 cm (rotacion + factor 100) |
+| Blender | Z-up, metros |
+
+## Impresion 3D
+
+`meshy_resize` a milimetros reales antes de exportar STL.
+
+## Rigging
+
+El esqueleto que devuelve `meshy_rig` **no** es el mannequin de UE5: el retargeting es manual. En UE5 los static meshes van a Nanite y no necesitan decimation; los skeletal meshes si necesitan LODs propios.
+
+## Git
+
+- `*.glb *.fbx *.blend *.stl *.3mf` por **Git LFS**.
+- `meshy.json` y `thumb.png` van como archivos normales — son chicos y son lo que hace grepeable el catalogo.
+
+## Integracion con el resto del stack
+
+`asset-spec` define que asset hace falta -> Meshy lo genera -> `asset-audit` valida el resultado. Meshy no reemplaza a ninguno de los dos.

package/skills/agent-protocol/SKILL.md

@@ -90,7 +90,7 @@ All C-suite output follows ONE format. See `references/communication-standard.md
 
 1. **Bottom line first.** The founder's time is the scarcest resource.
 2. **Results and decisions only.** No process narration.
-3. **Max 5 bullets per section.** Longer = reference doc.
+3. **About 5 bullets per section, ranked by impact.** Keep what changes the decision; the rest goes to a reference doc. Never drop a critical finding to fit the number: show it, and point to the doc for detail.
 4. **Actions have owners and deadlines.** "We should consider" is banned.
 5. **Decisions framed as options** with trade-offs and recommendation.
 6. **Risks are concrete.** "If X happens, Y breaks, costing $Z."

package/skills/agent-protocol/references/communication-standard.md

@@ -16,7 +16,7 @@ WHAT
 • [Finding 1 — most critical]
 • [Finding 2]
 • [Finding 3]
-(Max 5 bullets. If more needed → reference doc.)
+(About 5, ranked by impact. More only if critical; detail → reference doc.)
 
 WHY THIS MATTERS
 [1-2 sentences. Business impact. Not theory — consequence.]
@@ -106,7 +106,7 @@ ACTION ITEMS
 1. **Bottom line first.** Always. The founder's time is the scarcest resource.
 2. **Results and decisions only.** No process narration ("First I analyzed..."). No thinking out loud.
 3. **What + Why + How.** Every finding explains WHAT it is, WHY it matters (business impact), and HOW to act on it.
-4. **Max 5 bullets per section.** Longer = reference doc.
+4. **About 5 bullets per section, ranked by impact.** Keep what changes the decision; the rest goes to a reference doc. Never drop a critical finding to fit the number: show it, and point to the doc for detail.
 5. **Actions have owners and deadlines.** "We should consider" is banned. Who does what by when.
 6. **Decisions framed as options.** Not "what do you think?" — "Option A or B, here's the trade-off, here's my recommendation."
 7. **The founder decides.** Roles recommend. The founder approves, modifies, or rejects. Every output respects this hierarchy.

package/skills/ai-security/SKILL.md

@@ -72,6 +72,10 @@ Injection score (0.0-1.0) measures proportion of matched signatures. Score above
 
 Full ATLAS technique coverage and guardrail patterns: `references/atlas-coverage.md`
 
+### Step 5: Verdict
+
+**Verdict:** **FAIL** if any finding is Critical or High; **CONCERNS** if only Medium or Low findings remain; **PASS** if nothing actionable turned up. A prompt-injection score above 0.5 counts as High.
+
 ---
 
 ## Tool Reference

package/skills/arcane-add/SKILL.md

@@ -27,7 +27,7 @@ Mismo criterio que el picker de `arcane install`: mostrar solo lo que **no** est
 elegir. No listar los 400 skills.
 
 1. Read `.claude/arcane-manifest.json` (`profiles`, `installed_skills`)
-2. List `profiles/*.yaml` from the source, skip `core.yaml` and the ones already in `profiles`
+2. List `profiles/*.yaml` from the source, skip `core.yaml`, the ones already in `profiles`, and bridge files (those with a `renamed_to` field: an old name kept for older CLIs). An installed old name counts as its `renamed_to` profile
 3. Print the remaining profiles grouped by their `category` field, in the order of
    `CATEGORY_ORDER` (Backend, Frontend & Design, Mobile, Gamedev, Platform & Quality,
    Project Management, Business, Personal, Utilities), each with its description

package/skills/arcane-list/SKILL.md

@@ -15,7 +15,7 @@ List all profiles and skills available in the Arcane source repo, so you can see
 1. Read `.claude/arcane-manifest.json` to find the `source` path (Arcane repo location)
 2. If no manifest, ask the user for the Arcane repo path
 3. From the source repo, list:
-   - **Profiles** from `profiles/*.yaml`, grouped by their `category` field (backend, frontend, mobile, gamedev, platform, management, business, personal, utilities)
+   - **Profiles** from `profiles/*.yaml`, skipping bridge files (those with a `renamed_to` field), grouped by their `category` field (backend, frontend, mobile, gamedev, platform, management, business, personal, utilities)
    - **All skills** in `skills/` directory, grouped by category from SKILL.md frontmatter
 4. Mark skills that are already installed in the current project with `[installed]`
 5. Close with a one-line summary (`COMPLETE — N profiles, M skills, K installed`)
@@ -25,8 +25,8 @@ List all profiles and skills available in the Arcane source repo, so you can see
 ```
 === Available Profiles ===
 Backend:
-  backend-ts     Backend TypeScript — Fastify, Prisma, Zod
-  backend-go     Backend Go — scaffold, DB, auth, API design
+  backend-typescript  Backend TypeScript — Fastify, Prisma, Zod
+  backend-go          Backend Go — scaffold, DB, auth, API design
   ...
 
 Project Management:

package/skills/arcane-status/SKILL.md

@@ -27,7 +27,7 @@ Show what profiles, skills, rules, and agents are installed in the current proje
 
 ```
 === Arcane Status ===
-Profiles:  backend-ts + agile + testing
+Profiles:  backend-typescript + agile + testing
 Installed: 2026-05-01T12:00:00Z
 Source:    /path/to/Claude-Code-Arcane
 

package/skills/audit-dev/SKILL.md

@@ -30,7 +30,7 @@ Identificar lenguajes/frameworks/package manager. Leer configs raíz. Mapear car
 
 ## Phase 3 — Producir reporte
 
-Guardar como `AUDIT.md` en raíz. Secciones: fecha/stack/estado general, resumen ejecutivo (3-5 oraciones), scorecard (tabla dimensión/estado OK-WARN-CRIT/nota), hallazgos críticos, hallazgos importantes, observaciones, lo que está bien, plan de acción recomendado, detalles por dimensión con evidencia (paths, líneas).
+Guardar como `AUDIT.md` en raíz. Secciones: fecha/stack/estado general (**SALUDABLE** si todas las dimensiones del scorecard están en OK, **NECESITA ATENCIÓN** si alguna quedó en WARN, **CRÍTICO** si alguna quedó en CRIT), resumen ejecutivo (3-5 oraciones), scorecard (tabla dimensión/estado OK-WARN-CRIT/nota), hallazgos críticos, hallazgos importantes, observaciones, lo que está bien, plan de acción recomendado, detalles por dimensión con evidencia (paths, líneas).
 
 ## Rules
 

package/skills/blender-animation/SKILL.md

@@ -164,4 +164,4 @@ influencias maximas por vertice, que se bakeo, y decision de root motion por cli
 
 ---
 
-> → Bake de constraints, frame rate y ejes estan en `.claude/rules/blender-pipeline.md`.
+> → Bake de constraints, frame rate y ejes estan en `.claude/rules/blender-files.md`.

package/skills/blender-export/SKILL.md

@@ -140,4 +140,4 @@ verdict.
 
 ---
 
-> → Formatos, ejes, escala y reglas de Git LFS estan en `.claude/rules/blender-pipeline.md`.
+> → Formatos, ejes, escala y reglas de Git LFS estan en `.claude/rules/blender-files.md`.

package/skills/blender-materials/SKILL.md

@@ -162,4 +162,4 @@ que se bakeo, y convencion de normal map elegida.
 ---
 
 > → Color space, convenciones de normal map y presupuesto de materiales estan en
-> `.claude/rules/blender-pipeline.md`.
+> `.claude/rules/blender-files.md`.

package/skills/blender-modeling/SKILL.md

@@ -157,4 +157,4 @@ Reportar por objeto: verts, tris, n-gons, materiales, escala, y tris contra el p
 ---
 
 > → Topologia, presupuestos, ejes y las reglas de scripts destructivos estan en
-> `.claude/rules/blender-pipeline.md`.
+> `.claude/rules/blender-files.md`.

package/skills/check/SKILL.md

@@ -17,6 +17,6 @@ Run a comprehensive code quality and security check on the current project:
    - Hardcoded secrets, API keys, tokens in source code
    - Known vulnerable dependencies (npm audit, pip audit, etc.)
    - SQL injection, XSS, or command injection patterns
-6. **Report** — Summarize findings with severity levels and suggested fixes
+6. **Report** — Summarize findings with severity levels and suggested fixes, then close with a verdict: **FAIL** if tests or type checks fail, or a secret or critical vulnerability turned up; **CONCERNS** if only lint issues or lower-severity findings remain; **PASS** if nothing actionable came up
 
 Focus on actionable issues, not style nitpicks.

package/skills/chief-of-staff/SKILL.md

@@ -59,7 +59,7 @@ Before delivering ANY output to the founder:
 - Company context loaded (not generic advice)
 - Actions have owners and deadlines
 - Conflicts named, not smoothed
-- Max 5 bullets per section
+- About 5 bullets per section, ranked by impact; a critical finding is never dropped to fit
 
 ## Ecosystem Awareness
 

package/skills/cloud-security/SKILL.md

@@ -73,6 +73,10 @@ Full escalation combos, severity guide, and least privilege recommendations: `re
 
 Catch misconfigurations at definition time in Terraform, CloudFormation, Kubernetes manifests, and Helm charts. Integrate into CI/CD as a pre-apply gate.
 
+### Step 6: Verdict
+
+**Verdict:** **FAIL** if any finding is Critical or High; **CONCERNS** if only Medium or Low findings remain; **PASS** if nothing actionable turned up. Apply the severity modifier first: an internet-facing or regulated-data resource raises the finding's severity before the verdict is taken.
+
 ---
 
 ## Cloud Provider Coverage

package/skills/freelance-kickoff/SKILL.md

@@ -77,7 +77,7 @@ Después **rutear al trabajo técnico**, que ya existe en el repo:
 | Si el proyecto es | Seguí con |
 |---|---|
 | Historias y tickets | `/create-stories`, `/create-epics` |
-| Backend, frontend, mobile | El perfil técnico que corresponda (`+backend-ts`, `+frontend`, ...) |
+| Backend, frontend, mobile | El perfil técnico que corresponda (`+backend-typescript`, `+frontend-react-vite`, ...) |
 | Algo sin especificar del lado del cliente | `/product-discovery` antes de codear |
 | Documentar lo que ya existe | `/reverse-document` |
 

package/skills/isms-audit-expert/SKILL.md

@@ -54,6 +54,8 @@ For detailed control testing procedures by Annex A control, see [references/secu
 | Minor Nonconformity | Isolated deviation with limited impact | 90 days |
 | Observation | Improvement opportunity | Next audit cycle |
 
+**Audit conclusion:** **CONFORMING** (observations at most), **MINOR NONCONFORMITIES** (minor only), or **MAJOR NONCONFORMITY** (at least one major, which blocks a certification recommendation until it is corrected).
+
 ### Corrective Action Workflow
 
 1. Auditee acknowledges finding

package/skills/meshy-derive/SKILL.md

@@ -116,4 +116,4 @@ Reportar: targets generados, creditos gastados reales (delta de `check_balance`)
 
 ---
 
-> Presupuestos, estructura de `targets/`, formato del ledger y la tabla de creditos completa: `.claude/rules/meshy-assets.md`.
+> Presupuestos, estructura de `targets/` y formato del ledger: `.claude/rules/meshy-files.md`. Tabla de creditos completa: `.claude/rules/meshy-assets.md`.

package/skills/meshy-generate/SKILL.md

@@ -115,4 +115,4 @@ Reportar:
 
 ---
 
-> Tabla de creditos completa, reglas de gasto, formato del ledger y convenciones de ejes/escala: `.claude/rules/meshy-assets.md`. Leerla antes de la Phase 3.
+> Tabla de creditos completa, reglas de gasto, formato del ledger y convenciones de ejes/escala: `.claude/rules/meshy-assets.md` y `.claude/rules/meshy-files.md`. Leerlas antes de la Phase 3.

package/skills/meshy-setup/SKILL.md

@@ -113,4 +113,4 @@ Reportar:
 
 ---
 
-> Las reglas de gasto, estructura de `assets/3d/`, ledger `meshy.json` y tabla de derivados estan en `.claude/rules/meshy-assets.md`. Leerlas antes de cualquier operacion que gaste creditos.
+> Las reglas de gasto, estructura de `assets/3d/`, ledger `meshy.json` y tabla de derivados estan en `.claude/rules/meshy-assets.md` y `.claude/rules/meshy-files.md`. Leerlas antes de cualquier operacion que gaste creditos.

package/skills/owasp-top10-check/SKILL.md

@@ -86,7 +86,7 @@ Auditoría contra OWASP Top 10 2021. Go backend + TS/React frontend. Datos de me
 
 ## Reporte Output
 
-Formato: Resumen ejecutivo (hallazgos por severidad) → Hallazgos por categoría (archivo:línea, descripción, PoC, remediación, ticket Jira) → Plan priorizado → Herramientas ejecutadas.
+Formato: Resumen ejecutivo (hallazgos por severidad y veredicto: **FAIL** si hay algún hallazgo Critical o High, **CONCERNS** si quedan solo Medium o Low, **PASS** si no hay nada accionable) → Hallazgos por categoría (archivo:línea, descripción, PoC, remediación, ticket Jira) → Plan priorizado → Herramientas ejecutadas.
 
 ## Educabot Specifics
 

package/skills/qms-audit-expert/SKILL.md

@@ -63,6 +63,8 @@ Gap: [How evidence fails to meet requirement]
 | Minor | Isolated lapse or partial implementation | Recommended | 60 days |
 | Observation | Improvement opportunity | Optional | As appropriate |
 
+**Audit conclusion:** **CONFORMING** (observations at most), **MINOR NONCONFORMITIES** (minor only), or **MAJOR NONCONFORMITY** (at least one major, which blocks a certification recommendation until it is corrected).
+
 ### Corrective Action Integration
 
 | Severity | CAPA Depth | Verification |

package/skills/security-pen-testing/SKILL.md

@@ -74,7 +74,7 @@ Key tests: XSS (reflected, stored, DOM-based), CSRF (token replay, SameSite), SQ
 python scripts/pentest_report_generator.py --findings findings.json --format md --output report.md
 ```
 
-Report structure: executive summary, scope, methodology, findings table (by severity/CVSS), detailed findings with evidence and remediation, priority matrix.
+Report structure: executive summary with a verdict (**FAIL** if any finding is Critical or High, **CONCERNS** if only Medium or Low remain, **PASS** if nothing actionable turned up), scope, methodology, findings table (by severity/CVSS), detailed findings with evidence and remediation, priority matrix.
 
 Responsible disclosure timeline and templates: `references/responsible_disclosure.md`
 

package/skills/seo-audit/SKILL.md

@@ -43,7 +43,7 @@ Before auditing, understand:
 ### Audit Report Structure
 
 **Executive Summary**
-- Overall health assessment
+- Overall health: **HEALTHY** (no critical or high-impact issues), **NEEDS WORK** (high-impact issues, nothing blocking), or **CRITICAL** (something blocks indexation or ranking)
 - Top 3-5 priority issues
 - Quick wins identified
 

package/skills/skill-auditor/SKILL.md

@@ -68,7 +68,6 @@ Scan the body for required elements:
 
 - **Sections**: At least 2 phase headings (`## Phase`, `## Step`, `## Workflow`, or `###` subsections)
 - **Verdict keywords**: For review/analysis skills: APPROVED, PASS, FAIL, NEEDS REVISION (or equivalent)
-- **Collaborative protocol**: For file-modifying skills (Write/Edit in allowed-tools): must contain "May I write" or equivalent approval gate
 - **Next-step handoff**: Last section should guide what to do after the skill completes
 
 ### 1.4 Detect hallucinations

package/skills/skill-improve/SKILL.md

@@ -17,7 +17,7 @@ Read skill name from first arg. Verify `skills/[name]/SKILL.md` exists. If missi
 
 ## Phase 2: Baseline Test
 
-Run `/skill-test static [name]`. Record FAILs, WARNs, which checks failed (1-7).
+Run `/skill-test static [name]`. Record FAILs, WARNs, which checks failed (1-6).
 
 ### Phase 2b: Category Baseline
 
@@ -30,12 +30,11 @@ Read full skill file. For each failing/warning check, identify exact gap:
 | Check | Gap if failing |
 |-------|---------------|
 | 1 | Missing frontmatter field |
-| 2 | Fewer phases than minimum |
-| 3 | No verdict keywords in body |
-| 4 | Write/Edit in tools but no ask-before-write language |
-| 5 (warn) | No follow-up/next-step section |
-| 6 (warn) | `context: fork` with <5 phases |
-| 7 (warn) | argument-hint empty or mismatched with modes |
+| 2 | Over 40 lines with fewer than two `##` sections |
+| 3 | A value from the catalog's `verdict:` list missing from the skill |
+| 4 (warn) | No follow-up/next-step section |
+| 5 (warn) | `context: fork` with <5 phases |
+| 6 (warn) | argument-hint mismatched with modes |
 
 For category checks: identify text gaps (e.g., G2: missing director prompts, A2: no per-section May-I-write, T3: BLOCKED not surfaced). Show full diagnosis before proposing changes.
 

package/skills/skill-test/SKILL.md

@@ -15,18 +15,18 @@ Validates `skills/*/SKILL.md` for structural compliance and behavioral correctne
 
 | Mode | Command | Purpose | Cost |
 |------|---------|---------|------|
-| `static` | `/skill-test static [name\|all]` | 7 structural checks per skill | Low (~1k/skill) |
+| `static` | `/skill-test static [name\|all]` | 6 structural checks per skill | Low (~1k/skill) |
 | `spec` | `/skill-test spec [name]` | Behavioral assertions from test spec | Medium (~5k/skill) |
 | `category` | `/skill-test category [name\|all]` | Category-specific rubric metrics | Low (~2k/skill) |
 | `audit` | `/skill-test audit` | Coverage report — skills, agents, test dates | Low (~3k total) |
 
 ## Phase 1: Parse Arguments
 
-`static [name]` → 7 checks on one skill. `static all` → all skills (Glob `skills/*/SKILL.md`). `spec [name]` → read skill + test spec, evaluate assertions. `category [name|all]` → category rubric from `CCGS Skill Testing Framework/quality-rubric.md`. `audit` (or no arg) → read catalog, list all, show coverage. Missing/unrecognized → output usage and stop.
+`static [name]` → 6 checks on one skill. `static all` → all skills (Glob `skills/*/SKILL.md`). `spec [name]` → read skill + test spec, evaluate assertions. `category [name|all]` → category rubric from `skills-selftest/quality-rubric.md`. `audit` (or no arg) → read catalog, list all, show coverage. Missing/unrecognized → output usage and stop.
 
 ## Phase 2A: Static Mode
 
-> → Read references/static-checks.md for the 7 structural validation checks and verdict criteria
+> → Read references/static-checks.md for the 6 structural validation checks and verdict criteria
 
 ## Phase 2B: Spec Mode
 

package/skills/skill-test/references/static-checks.md

@@ -1,13 +1,18 @@
-# Static Checks — 7 Structural Validations
+# Static Checks — 6 Structural Validations
+
+Checks 1-3 are also enforced in CI by `src/__tests__/skill-static.test.ts`, so in this repo a skill that fails them never merges. Apply them here anyway: the skill may be running in a project with its own skills, where no test covers them.
 
 | Check | What | Verdict |
 |-------|------|---------|
-| 1 — Frontmatter | `name`, `description`, `argument-hint`, `user-invocable`, `allowed-tools` present | FAIL if any absent |
-| 2 — Phases | >=2 numbered phase headings (`## Phase N`, `## N.`, or >=2 `##` headings) | FAIL if <2 |
-| 3 — Verdict Keywords | Contains >=1 of: PASS, FAIL, CONCERNS, APPROVED, BLOCKED, COMPLETE, READY, COMPLIANT, NON-COMPLIANT | FAIL if none |
-| 4 — Collaborative Protocol | "May I write" / "before writing" / "approval" near file-write instructions | WARN if absent; FAIL if `allowed-tools` includes Write/Edit but no ask-before-write |
-| 5 — Next-Step Handoff | Final section mentions another skill, "next step", or follow-up | WARN if absent |
-| 6 — Fork Complexity | If `context: fork`, must have >=5 phase headings | WARN if <5 |
-| 7 — Argument Hint | Non-empty; documented modes should match hint | WARN if empty or mismatch |
+| 1 — Frontmatter | `name` (matching the directory), `description`, `argument-hint`, `user-invocable`, `allowed-tools` present; an empty `argument-hint` still counts as present | FAIL if any absent |
+| 2 — Sections | A skill longer than 40 lines has at least two `##` sections. Shorter skills are exempt | FAIL if longer than 40 lines with fewer than two |
+| 3 — Verdict | Only for skills that judge something: those with `verdict:` in `skills-selftest/catalog.yaml`. Every value listed there appears in the skill (SKILL.md or `references/`), in the skill's own vocabulary. Skills that build, write or advise do not need a verdict | FAIL if a listed value is missing |
+| 4 — Next-Step Handoff | Final section mentions another skill, "next step", or follow-up | WARN if absent |
+| 5 — Fork Complexity | If `context: fork`, must have >=5 phase headings | WARN if <5 |
+| 6 — Argument Hint | Documented modes should match the hint | WARN if mismatch |
+
+A new skill that judges something gets a `verdict:` list in the catalog when it is added; that is what makes check 3 apply to it.
+
+There is no check for ask-before-write language. Whether Claude may write without asking is set by the permission mode of each session, not by the skill, so a skill with `Write` or `Edit` is not non-compliant for leaving the decision there.
 
 **Output:** per-skill table of check results + verdict (COMPLIANT / WARNINGS / NON-COMPLIANT). For `static all`: summary table + aggregate counts.

package/skills/standup-report/SKILL.md

@@ -48,4 +48,4 @@ Flujo: detectar team/proyecto → pull data en paralelo (git, ClickUp, Jira, Git
 - NO incluir contenido sensible (PII, passwords, secrets)
 - Grouping lógico: mergear commits del mismo ticket
 - Sugerencias "hoy" basadas en tickets In Progress + priorities
-- Max 5 bullets per section, collapsar el resto
+- Unos 5 bullets por sección, ordenados por impacto, y el resto colapsado. Un blocker nunca se colapsa para respetar el número

package/skills/vn-gdd/SKILL.md

@@ -7,6 +7,8 @@ user-invocable: true
 allowed-tools: Read, Glob, Grep, Write, Edit, WebSearch, AskUserQuestion
 ---
 
+## Process
+
 When this skill is invoked:
 
 1. **Check for existing work**:

package/skills/web-security/SKILL.md

@@ -82,6 +82,10 @@ HSTS rollout: start with short `max-age` (300s), escalate to 2 years, then submi
 - **Threat modeling**: complex trust boundaries need STRIDE before implementation
 - **CSP breaks prod**: revert to report-only immediately; analyze before re-enforcing
 
+## Verdict
+
+**Verdict:** **FAIL** if any finding is Critical or High; **CONCERNS** if only Medium or Low findings remain; **PASS** if nothing actionable turned up.
+
 ## Checklist
 
 - [ ] All required security headers present and returning correct values (target A+ on securityheaders.com)