claude-dev-env 1.93.1 → 1.95.0

package/skills/code/SKILL.md

@@ -1,178 +0,0 @@
----
-name: code
-description: >-
-  Prepends strict code standards to every implementation session. Enforces
-  strong typing, no Any, no casts, no type: ignore, treated-as-immutable
-  TypedDicts, 100% test coverage, DRY, no mocks, no stubs, no fallbacks, and
-  proper module structure. Triggers: /code, code standards, strict code, enforce
-  standards, implement with standards.
----
-
-# Code Standards Enforcer
-
-Prepends these standards to every implementation session. Every criterion is binary — pass or fail. No partial credit.
-
-## When this applies
-
-Invoke at the start of any implementation task. The standards persist for the entire session.
-
-**Refusal cases — first match wins:**
-
-- **Not an implementation task.** "This skill applies to code implementation. Ask me to implement something specific."
-- **Exploratory research or planning.** "Code standards are for implementation. Use /anthropic-plan for planning, then invoke /code when implementing."
-
-## Gotchas
-
-- **`make check` must run from pwsh, not bash.** The Bash tool routes through Git Bash on Windows, where `make` may not be on PATH. Always use `pwsh -NoProfile -Command 'make check 2>&1 | Select-Object -Last 100; exit $LASTEXITCODE'` so the pipeline does not mask a non-zero exit code from make.
-- **`New-Item`, `Get-ChildItem`, `Remove-Item` are pwsh cmdlets.** Don't use them inside Bash tool calls. Use the PowerShell tool or prefix with `pwsh -NoProfile -Command`.
-- **`TypedDict` encode/decode must be manual.** Pydantic and similar frameworks bypass the strict validation pattern. Write `_encode_*` and `_decode_*` functions by hand.
-- **`_test_hooks.py` is per-module, not per-package.** Every module that has dependencies needs its own hooks file. A single `conftest.py` with mocks does not satisfy this rule.
-- **Protocol must match the real API exactly.** If the real class has `async def fetch(self, key: str) -> bytes`, the Protocol must declare the same signature. A mismatch is caught at type-check time by mypy strict mode.
-
----
-
-## Completion criteria
-
-Every criterion below must be met before the change is complete.
-
-### 1. Typing strictness
-
-Zero violations across the project's source, test, and script directories (adapt `src/`, `tests/`, `scripts/` to the project's actual layout):
-
-- No `Any`, `cast()`, `# type: ignore`, `# noqa`.
-- No `.pyi` files, stubs, or shims.
-- Mypy strict mode exits 0 with no errors.
-- All TypedDicts are treated as immutable after construction and carry explicit `_encode_*` / `_decode_*` functions.
-- All decode functions call `require_*` validation on every field.
-- Internal encoder is typed — no untyped dict intermediaries.
-
-### 2. Error handling
-
-- No `try`/`except` in core logic that recovers, softens, or best-efforts a failure.
-- Failures propagate. Callers decide whether to handle.
-- APIs signal failure points through naming, docstrings, and test expectations — not by catching.
-
-### 3. Test coverage
-
-- Test runner exits 0 with full statement and branch coverage (e.g. `pytest -n auto --cov --cov-branch --cov-report=term-missing` with paths adapted to the project layout) (requires pytest-xdist and pytest-cov).
-- Statement coverage: 100%. Branch coverage: 100%.
-- Zero mocks. Every test exercises actual code paths through fakes injected via DI hooks (see criterion 4).
-- Zero weak assertions. Every assert checks a specific, falsifiable property.
-- Zero fake tests (tests that pass without validating behavior).
-
-### 4. Dependency injection
-
-- Every module that has external dependencies provides a `_test_hooks.py` with internal DI hooks (underscore = private). The hook file lives alongside the module it services.
-- A shared testing utility module exports public test helpers for consumers (adapt the path to the project's conventions, e.g. `Libs/testing.py`).
-- Production code sets hooks to real implementations at startup. Tests set them to fakes.
-- No `if`/`else` branching on test vs. production — call the hook directly.
-
-### 5. Codebase standards
-
-- DRY: zero duplicate function bodies longer than 3 lines. Zero duplicate constant definitions.
-- No placeholder code, no dead code, no commented-out blocks.
-- No fallback paths, no back-compat shims, no legacy code.
-- No `TypeAlias`, no `TYPE_CHECKING` import guards.
-
-### 6. TypedDict protocol
-
-- Every TypedDict has a paired `_encode_*` and `_decode_*` function.
-- Every decode calls `require_*` (non-null, type-check, range-check) on every field before returning.
-- Decode functions are the single point where untyped data becomes typed.
-
-### 7. Redis boundary
-
-- Use module-level helper functions or a Protocol.
-- Never reference `Redis[Any]` in type annotations.
-
-### 8. TOML boundary
-
-- No `TYPE_CHECKING` guard for TOML types.
-- Parse untyped dicts from TOML, then convert into TypedDict (no dataclasses) before use.
-
-### 9. JSON recursive types
-
-- Bypass framework validation (e.g., Pydantic).
-- Parse with `json.loads()`, validate immediately with internal `_decode_*` / `_load_json_*` functions before any other use.
-
-### 10. ASGI / framework boundaries
-
-- Define a Protocol for the minimal interface (e.g., `async def body() -> bytes`).
-- Never use `dict[str, Any]` in ASGI scopes.
-- Parse at the edge, validate immediately, propagate as strict types.
-
-### 11. Dynamic import pattern
-
-When using `importlib.import_module()` + `getattr()`, the intermediate variables are untyped. Bind the final instance through a typed wrapper so the result carries a concrete type rather than `Any`:
-
-```python
-import importlib
-from collections.abc import Callable
-
-mod = importlib.import_module("module_name")
-cls = getattr(mod, "ClassName")
-
-def _construct(klass: Callable[..., TheProtocol]) -> TheProtocol:
-    return klass()
-
-instance = _construct(cls)
-```
-
-### 12. Documentation
-
-Google-style docstrings on every public function, method, and class:
-
-```python
-def load_config(config_path: str) -> AppConfig:
-    """Load and validate the application configuration from disk.
-
-    Args:
-        config_path: Absolute path to the TOML configuration file.
-
-    Returns:
-        A fully validated AppConfig TypedDict.
-
-    Raises:
-        FileNotFoundError: If config_path does not exist.
-        ValidationError: If the parsed config fails require_* checks.
-    """
-```
-
-For a public function whose behavior needs a picture, lead the narrative with a diagram: one summary line, then a `::` literal block or a doctest showing a concrete input and its marked outcome, then a couple of short prose lines, then the `Args:` / `Returns:` sections. See `../../rules/plain-illustrative-docstrings.md` for the shape and a worked example.
-
-### 13. Build infrastructure
-
-The project under development must contain:
-
-- `Makefile` with targets: `check`, `lint`, `test`, `coverage`.
-- `pyproject.toml` with `[tool.mypy]` strict mode, `[tool.pytest.ini_options]` with `addopts = -n auto` (requires pytest-xdist).
-- A lint guard script that covers the project's source, test, and script directories.
-
-### 14. Lint gates
-
-- `make lint` runs mypy (strict), ruff, and the project's guard script.
-- All linters cover the project's source, test, and script directories.
-- `make lint` exits 0 before `make test` is valid.
-
-### 15. Protocol signature match
-
-- Every Protocol's method signatures match the real API they abstract.
-- If the real API changes, the Protocol fails type-checking — no silent drift.
-
-### 16. Auth, credentials, multi-tenancy
-
-- Auth and credential handling is explicit, typed, and testable.
-- Multi-tenant DB access uses typed connection factories, not string-formatted queries.
-- MCP-shared resources follow the same strictness as application code.
-
----
-
-## Verification
-
-Each criterion returns either **at least one finding** OR **exactly one proof-of-absence** with at least 3 adversarial probes specific to that criterion. A criterion returning neither is a protocol gap.
-
-## File index
-
-| File | Purpose |
-|------|---------|
-| `SKILL.md` | Hub — binary criteria, gotchas, when-to-apply, verification protocol |

package/skills/deep-research/CLAUDE.md

@@ -1,17 +0,0 @@
-# deep-research
-
-Runs an iterative multi-source research pipeline that produces a comprehensive Obsidian report with citations. Triggered by `/deep-research [topic]`.
-
-## Purpose
-
-The skill operates in two phases. Phase 1 (main thread) turns the raw topic into a precise research brief through a short AskUserQuestion session covering audience, scope, recency, and depth. Phase 2 delegates to the `deep-research` agent with the confirmed brief and an iteration budget (8 / 15 / 25 based on depth preference). The agent handles iteration, state tracking, and Obsidian output.
-
-## Key file
-
-| File | Purpose |
-|---|---|
-| `SKILL.md` | Phase 1 steps (classify, ask, construct `<research_brief>` XML, set iteration budget) and Phase 2 spawn instructions, including `mode: bypassPermissions` for unrestricted web access. |
-
-## Post-run cleanup
-
-After the agent returns, the skill summarizes the Obsidian path, source counts, and any gaps, then deletes the `.deep-research-state.md` temp file.

package/skills/deep-research/SKILL.md

@@ -1,80 +0,0 @@
----
-name: deep-research
-description: "Deep Research mode — iterative multi-source research producing comprehensive Obsidian reports with citations. Official-docs-first methodology. Triggers: '/deep-research [topic]'"
-argument-hint: "TOPIC or RESEARCH QUESTION"
----
-
-# Deep Research
-
-You orchestrate a two-phase deep research pipeline. Phase 1 happens here (main thread). Phase 2 is delegated to the `deep-research` agent.
-
-## Phase 1: Build the Research Prompt (Interactive Q&A)
-
-The user's raw topic is: `$ARGUMENTS`
-
-Your job is to turn this raw topic into a precise, well-scoped research brief using prompt-generator methodology. Follow these steps:
-
-### Step 1: Classify and assess
-
-Silently determine:
-- **Complexity**: Is this a narrow factual question or a broad landscape survey?
-- **Ambiguity**: Can you research this as-is, or does it need scoping?
-- **Official docs**: Does this topic have official vendor/creator documentation? If yes, that is the primary source and must be consulted first.
-
-### Step 2: Ask clarifying questions
-
-Use AskUserQuestion to ask 1-3 questions. Choose from these dimensions based on what's genuinely unclear — skip any that are obvious from context:
-
-- **Audience**: "Who is this research for?" (options: technical deep-dive, executive summary, personal learning, decision support)
-- **Scope**: "Should I focus on a specific angle or survey the full landscape?" (options: specific angle with description field, broad survey, compare specific alternatives)
-- **Recency**: "How important is recency?" (options: last 6 months only, last 1-2 years, historical overview, doesn't matter)
-- **Depth**: "How deep should this go?" (options: quick overview 5-10 sources, standard 15-20 sources, exhaustive 25+ sources)
-
-Skip clarification entirely only if the topic is already narrow, unambiguous, and the audience is obvious.
-
-### Step 3: Construct the research brief
-
-From the user's answers, write a structured research brief:
-
-```
-<research_brief>
-  <topic>The original topic, cleaned up</topic>
-  <official_docs>Known official documentation sources, or "none identified" if the topic lacks vendor docs</official_docs>
-  <scope>Exactly what to research — boundaries, inclusions, exclusions</scope>
-  <audience>Who this is for and what they need</audience>
-  <depth>Target source count and iteration budget</depth>
-  <output>What the final deliverable looks like</output>
-  <key_questions>
-    1. Specific question the research must answer
-    2. Another specific question
-    3. ...
-  </key_questions>
-</research_brief>
-```
-
-Show the brief to the user. Ask: "Does this capture what you need, or should I adjust the scope?"
-
-### Step 4: Set iteration budget
-
-Map the user's depth preference to iteration count:
-- Quick overview: 8 iterations
-- Standard (default): 15 iterations
-- Exhaustive: 25 iterations
-
-## Phase 2: Launch the Research Agent
-
-Once the brief is confirmed, spawn the `deep-research` agent using the Agent tool with:
-
-- **subagent_type**: `deep-research`
-- **prompt**: The full `<research_brief>` XML block from Step 3, plus the iteration budget
-- **mode**: `bypassPermissions` (research agent needs unrestricted tool access for web searches)
-- **description**: "Deep research: [short topic summary]"
-
-The agent handles everything from here: iteration, state tracking, and Obsidian output.
-
-When the agent returns, summarize:
-1. Where the report was saved (Obsidian path)
-2. How many sources were consulted (official vs secondary)
-3. Any gaps or limitations noted
-
-Then clean up temporary files: `.deep-research-state.md`

package/skills/findbugs/CLAUDE.md

@@ -1,20 +0,0 @@
-# findbugs
-
-Audits the current branch's pull request for bugs by spawning the `code-quality-agent` against the full PR diff in a clean room. Triggered by `/findbugs`, `find bugs in this PR`, `audit the PR`, or `bug audit on the branch`.
-
-## Purpose
-
-Read-only. The skill resolves PR scope via the `pr-scope-resolve` skill, writes the diff to a scoped temp file, and spawns two `code-quality-agent` instances (primary sonnet + secondary haiku) with a self-contained, context-free prompt covering all A–P audit categories. After both return it merges findings (de-dup, max-wins severity), posts one audit review to the PR via the `post-audit-findings` skill (APPROVE on clean, REQUEST_CHANGES with inline anchored comments on dirty), and reports totals and cleared categories to the user.
-
-## Key file
-
-| File | Purpose |
-|---|---|
-| `SKILL.md` | Five-step process: resolve scope (`pr-scope-resolve` skill), capture diff to a scoped temp path, spawn agents (clean-room prompt XML), post audit review (`post-audit-findings` skill), surface findings and offer `/fixbugs`. Includes refusals and the output format. |
-
-## Constraints
-
-- Never edits files, never commits, never pushes.
-- One audit review per invocation is posted back to the PR — required so the unresolved-thread gate sees the audit pass.
-- Disabled by `CLAUDE_REVIEWS_DISABLED=bugteam` (shared token across the audit-skill family).
-- Always ask before running `/fixbugs`; never auto-spawn the fixer.

package/skills/findbugs/SKILL.md

@@ -1,241 +0,0 @@
----
-name: findbugs
-description: >-
-  Audits the current branch's pull request as a whole for bugs by spawning the
-  code-quality-agent against the full PR diff with zero conversation context.
-  Returns P0/P1/P2 findings with file:line evidence and a verified-clean
-  coverage list. Read-only — never modifies code. Triggers: '/findbugs',
-  'find bugs in this PR', 'audit the PR', 'bug audit on the branch'.
----
-
-# Findbugs
-
-**Core principle:** A clean-room bug audit on the entire pull request. The audit agent receives the PR diff and nothing else — no chat history, no prior framing, no implicit "we already looked at this." Independence is the point.
-
-## Transport check (before any GitHub step)
-
-Run `command -v gh`; when it succeeds, run `gh auth status`; once the PR scope is resolved, run `gh api repos/<owner>/<repo> --jq .permissions.push` and take `true` as the pass. When any check fails, run the `pr-loop-cloud-transport` skill first and route every `gh` operation in this skill through its substitution matrix.
-
-## When this skill applies
-
-User types `/findbugs` or asks for a bug audit on the current branch's PR. Typical moment: PR is up (draft or ready), and the user wants an independent second pair of eyes before merge or before requesting human review.
-
-If the current branch has no associated PR and no diff against the default branch, say so and stop. Do not invent scope.
-
-## Refusals
-
-First match wins; respond with the quoted line exactly and stop:
-
-- **Disabled via environment.** When `CLAUDE_REVIEWS_DISABLED` carries the
-  token `bugteam`:
-  `/findbugs is disabled via CLAUDE_REVIEWS_DISABLED.` Run the check via
-  `python "$HOME/.claude/_shared/pr-loop/scripts/reviews_disabled.py" --reviewer bugteam`
-  (exit 0 = disabled). `/findbugs` is a PR bug-audit skill in the same family
-  as `/bugteam` and `/qbug`, so the shared `bugteam` token disables all three.
-  The gate semantics live in the `reviewer-gates` skill (`../reviewer-gates/SKILL.md`).
-
-## The Process
-
-### Step 1: Resolve PR scope
-
-Apply the `pr-scope-resolve` skill (`../pr-scope-resolve/SKILL.md`) with caller `findbugs`. Findbugs consumes the resolved `owner`, `repo`, `number`, `head_ref`, `base_ref`, and `url`; when no PR exists, the ladder's merge-base rung sets the audit scope. When no target exists, respond exactly with the sub-skill's canonical refusal line and stop:
-
-`No PR or upstream diff. /findbugs needs a target.`
-
-### Step 2: Capture the full PR diff
-
-Resolve the temp diff path **once, Claude-side**, before invoking any shell command. Use Python's `tempfile.gettempdir()` which honors `TMPDIR`, `TEMP`, and `TMP` in the platform-correct order and falls back to `C:\Users\<user>\AppData\Local\Temp` on Windows or `/tmp` on Unix. Avoid hand-rolled env var chains. The lookup works on macOS, Linux, Windows cmd.exe, and PowerShell:
-
-```
-import tempfile
-diff_temp_path = Path(tempfile.gettempdir()) / f"findbugs-pr-{os.getpid()}.patch"
-```
-
-`os.getpid()` supplies the per-invocation suffix that prevents collisions with parallel `/findbugs` runs (a UUID or timestamp is equally acceptable). Capture the resolved absolute path as `<diff_temp_path>` and pass that **literal** path to every shell command that follows. Shell-side parameter expansion (`${TMPDIR:-/tmp}`, `$$`, `%TEMP%`) is forbidden because cmd.exe and PowerShell do not honor it.
-
-When a PR exists: call `pull_request_read(method="get_diff", pullNumber=N, owner=O, repo=R)` and save the returned diff content to `"<diff_temp_path>"`.
-
-When falling back to merge-base diff: `git diff <merge-base>...HEAD > "<diff_temp_path>"`.
-
-The audit's authoritative scope is this single diff file. Do not inject extra files, related history, or "files Claude edited this session" — those introduce anchoring bias.
-
-### Step 3: Spawn the code-quality-agent — clean room
-
-Call the Agent tool twice in a single message (primary + Haiku secondary per the audit contract's Haiku secondary section):
-
-- Primary: `subagent_type: code-quality-agent`, `model: sonnet`, `description: "PR bug audit"`, `run_in_background: false`
-- Secondary: `subagent_type: code-quality-agent`, `model: haiku`, `description: "PR bug audit (secondary)"`, `run_in_background: false`
-
-After both return, merge per the contract's Haiku secondary section (de-dup key, max-wins severity, malformed-output fallback) before reporting to the user.
-
-**The agent prompt must be self-contained and context-free.** Specifically:
-
-- **No references to the orchestrator's conversation.** Forbidden phrases: "as we discussed," "the earlier issue," "given our prior work," "the bug from last turn," "you previously identified."
-- **No hints about expected outcomes.** Do not pre-stage findings, do not suggest where bugs probably are, do not name files as "the suspicious one." The agent forms its own hypotheses.
-- **No instructions to favor or skip particular categories** beyond the standard category list. No "skip the typing stuff" or "focus on the clipboard logic" — those bias the audit.
-- **Minimal background.** Identify the repo, branch, base branch, and PR URL only. Do not summarize what the PR does.
-
-The XML prompt skeleton:
-
-```xml
-<context>
-  <repo>owner/repo</repo>
-  <branch>head ref</branch>
-  <base_branch>base ref</base_branch>
-  <pr_url>url or "none"</pr_url>
-</context>
-
-<scope>
-  <diff_path><diff_temp_path> (absolute scoped temp path from Step 2)</diff_path>
-  <scope_rule>Audit only lines added or modified in the diff. Pre-existing code on untouched lines is out of scope.</scope_rule>
-</scope>
-
-<bug_categories>
-  Investigate each explicitly:
-  A. API contract verification
-  B. Selector / query / engine compatibility
-  C. Resource cleanup and lifecycle
-  D. Variable scoping, ordering, and unbound references
-  E. Dead code and unused imports
-  F. Silent failures
-  G. Off-by-one, bounds, integer overflow
-  H. Security boundaries
-  I. Concurrency hazards
-  J. CODE_RULES.md compliance
-  K. Codebase conflicts (incomplete propagation)
-  L. Behavior-equivalence for refactors
-  M. Producer/consumer cardinality vs collection-type contract
-  N. Test-name scenario verifier
-  O. Docstring / fixture-prose vs implementation drift
-  P. Name / regex / word-list vs behavior-contract precision
-
-  The category list above is a summary. The binding definition of each
-  category is its rubric file under $HOME/.claude/audit-rubrics/category_rubrics/
-  (ready-to-send prompt variants under $HOME/.claude/audit-rubrics/prompts/).
-  Read the rubric files before auditing.
-</bug_categories>
-
-<constraints>
-  Read-only. Report findings only. Do not modify code, do not propose
-  full diffs, do not commit, do not push. Cite file:line for every claim.
-  When the diff alone does not provide enough context to confirm or deny
-  a bug, list it under "Open questions" rather than asserting.
-</constraints>
-
-<output_format>
-  Follow the shared audit contract at $HOME/.claude/_shared/pr-loop/audit-contract.md:
-
-  - Severity: P0 = will not run / data corruption; P1 = regression or silent
-    failure; P2 = dead code, minor smell.
-  - Per category, produce either Shape A (structured finding) or Shape B
-    (proof-of-absence). Bare "verified clean" labels are REJECTED.
-  - Run the contract's adversarial second pass after the primary list.
-
-  Preamble: `Total: N (P0=N, P1=N, P2=N)`. Emit findings and proof-of-absence
-  entries in the JSON shapes defined by the contract. Include an "Open
-  questions" section for items the diff alone cannot resolve.
-</output_format>
-```
-
-### Step 4: Post the audit review
-
-Every `/findbugs` invocation posts one audit review back to the PR. The
-unresolved-thread gate counts review threads, so a findbugs pass that
-returns findings without posting them as inline comments is invisible
-to the gate. Findbugs remains read-only on code — the review post is
-the only side effect.
-
-Capture `<head_sha>` once at the start of Step 4 via `git rev-parse
-HEAD` in the worktree the diff was scoped against.
-
-After the agent (and Haiku secondary) return and the merge is complete,
-apply the `post-audit-findings` skill (`../post-audit-findings/SKILL.md`)
-with `--skill findbugs`. That skill owns the findings-JSON mapping, the
-anchored-only serialization (unanchored findings surface via Step 5's
-user-facing output), the CLEAN/DIRTY decision, the self-PR reviewer
-toggle, and the exit codes. On exit 0, surface the emitted review
-`html_url` alongside the totals in Step 5. On exit 2, tell the user the
-review post failed and that the unresolved-thread gate will not see this
-audit pass; do not retry silently.
-
-### Step 5: Surface findings, then clean up
-
-When the agent returns, report concisely:
-
-- One-line totals: `N P0 / N P1 / N P2 — K categories cleared`
-- Each finding's `file:line`, category, and one-sentence description
-- The cleared categories so the user can see coverage breadth
-- Any open questions the agent could not resolve from the diff alone
-
-Offer the next step without auto-executing it: `Want me to run /fixbugs for the P0/P1 findings?`
-
-Delete the scoped temp diff at `<diff_temp_path>` after the audit completes (or moves to a fix flow). Temporary diff files do not belong in the working tree.
-
-Do not paste the full agent transcript or the XML prompt unless the user asks.
-
-## Output Format
-
-```
-N P0 / N P1 / N P2 — K categories cleared
-
-P1 — short title
-  file/path.py:NN — one-sentence description (category: <name>)
-
-P2 — short title
-  file/path.py:NN — one-sentence description (category: <name>)
-
-Verified clean: <category>, <category>, <category>
-
-Open questions:
-  <if any>
-
-Want me to run /fixbugs for the P0/P1 findings?
-```
-
-## Constraints
-
-- **Read-only on code.** The skill never edits files, never pushes, never commits. One audit review per invocation gets posted back to the PR (Step 4) — that is the only side effect, and it is required so the unresolved-thread gate sees the audit pass.
-- **Foreground spawn.** The user is waiting for the result on this turn.
-- **PR-scoped, not session-scoped.** The audit covers the entire PR diff regardless of which files were edited in this conversation.
-- **Clean-room prompt.** The agent's prompt is self-contained — no references to chat history, no anchoring hints, no expected outcomes.
-- **No clean-coder auto-spawn.** Always ask before fixing.
-- **Trust the agent's verdict.** Pass through P0/P1/P2 categorizations as the agent assigned them; do not re-rank.
-- **Temp file cleanup.** Delete the scoped `<diff_temp_path>` when the audit ends.
-
-## Examples
-
-<example>
-User: `/findbugs`
-Claude: [resolves PR #42 from current branch, fetches full diff, spawns code-quality-agent foreground with self-contained prompt, returns]
-
-`1 P0 / 2 P1 / 0 P2 — 11 categories cleared`
-
-`P0 — race condition on shared cache write`
-`  src/cache.py:88 — concurrent writers can both pass the existence check before either writes (category: I — Concurrency hazards)`
-
-`P1 — silent paste failure`
-`  utils/clipboard.py:33 — validated_paste returns success without verifying the post-paste state (category: F — Silent failures)`
-
-`P1 — unbound variable on early-exception path`
-`  src/processor.py:283 — scheduling_log referenced after try/finally where it may be unbound (category: D — Variable scoping, ordering, and unbound references)`
-
-`Verified clean: API contract, selector compatibility, resource cleanup, dead code, off-by-one, security boundaries, CODE_RULES.md compliance, codebase conflicts, behavior-equivalence, producer/consumer cardinality, Test-name scenario verifier`
-
-`Open questions: none`
-
-`Want me to run /fixbugs for the P0 + P1s?`
-</example>
-
-<example>
-User: `/findbugs`
-Claude: `No PR or upstream diff. /findbugs needs a target.`
-</example>
-
-<example>
-User: `/findbugs` (branch with no PR but commits ahead of main)
-Claude: [falls back to `git diff origin/main...HEAD`, runs audit on that diff scope]
-</example>
-
-## Why this design
-
-Anchoring bias is the failure mode of context-rich audits. An agent that inherits "we just fixed three bugs in clipboard_utils.py" subconsciously scopes its hunt around clipboard_utils.py and pattern-matches on the same bug shapes. A clean-room audit on the full PR diff treats every file equally, considers every category, and surfaces things the orchestrator session never looked at. The diff is the contract; everything else is noise.

package/skills/fixbugs/CLAUDE.md

@@ -1,19 +0,0 @@
-# fixbugs
-
-Bridges `/findbugs` audit results to `/agent-prompt` for automated fixing. Triggered by `/fixbugs`, `fix all the bugs`, `apply the audit fixes`, or `implement the findbugs results`.
-
-## Purpose
-
-A thin bridge: recover the prior `/findbugs` findings from the current conversation, apply an optional severity filter (`P0`, `P0+P1`, `P1`, or all), re-resolve PR scope, then hand the filtered finding list to `/agent-prompt` as a structured goal string. `/agent-prompt` authors the XML prompt, shows an Outcome preview, asks for confirmation, and spawns a background sonnet `clean-coder` agent to apply all fixes in one commit.
-
-This skill never audits, never edits files, and never spawns agents directly. The `/agent-prompt` confirmation gate is always preserved.
-
-## Key file
-
-| File | Purpose |
-|---|---|
-| `SKILL.md` | Four-step process: recover findings, apply severity filter, re-resolve PR scope, hand off to `/agent-prompt` with a goal string in the exact expected shape. Includes refusal cases (no findings, zero bugs, empty filter, missing `agent-prompt` skill) and the implementer constraints (one commit, no `--force`, no rebase, explicit `git add` by path). |
-
-## Invocation order
-
-Run `/findbugs` first, then `/fixbugs`. Running `/fixbugs` with no prior `/findbugs` in the session returns `No findings in this session. Run /findbugs first.`