dsh-ecc-skills 0.4.1 → 0.5.1

package/README.en.md

@@ -4,6 +4,8 @@
 [![GitHub release](https://img.shields.io/github/v/release/gongyijie85/dsh-ecc)](https://github.com/gongyijie85/dsh-ecc/releases)
 [![CI](https://github.com/gongyijie85/dsh-ecc/actions/workflows/ci.yml/badge.svg)](https://github.com/gongyijie85/dsh-ecc/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
+[![DSH](https://img.shields.io/badge/DSH-0.1.0--rc.8%2B-4d6bfe)](https://github.com/gongyijie85/dsh-ecc)
+[![-skills](https://img.shields.io/badge/-skills-4d6bfe)]() [![-patterns](https://img.shields.io/badge/-patterns-4d6bfe)]() [![-orchestration](https://img.shields.io/badge/-orchestration-4d6bfe)]() [![-vertical-domains](https://img.shields.io/badge/-vertical--domains-4d6bfe)]() [![-methodology](https://img.shields.io/badge/-methodology-4d6bfe)]()
 
 <div align="center">
 
@@ -12,7 +14,7 @@
 </div>
 
 [affaan-m/ECC](https://github.com/affaan-m/ECC) (the ~227k⭐ "operator system",
-285 skills) skills for the **DeepSeek Harness (DSH)** — a progressive port to
+286 skills) skills for the **DeepSeek Harness (DSH)** — a progressive port to
 DSH's Cordis plugin architecture.
 
 > **Unofficial port**: skill content adapted from
@@ -36,7 +38,7 @@ dsh plugin --profile web add D:\plugins\dsh-ecc
 
 Restart the profile (`dsh web`) — the skills then load with the `skill` tool.
 
-## Port status: 273 / 285 skills (95.8%)
+## Port status: 274 / 286 skills (95.8%)
 
 - **v0.1.0** ✅ 20 skills — engineering methodology, agent systems, foundations
 - **v0.2.0** ✅ 68 skills — framework/language patterns (react, vue, django,
@@ -48,16 +50,19 @@ Restart the profile (`dsh web`) — the skills then load with the `skill` tool.
 - **v0.4.0** ✅ 135 skills — vertical domains (healthcare, homelab, scientific,
   finance, design/content, network ops, supply chain, marketing, research &
   data)
+- **v0.5.0 (this release)** ✅ +1 skill — `tasteforge-video` (repeatable
+  taste-driven video workflow: taste interview → style pack → validate → apply
+  → editable EDL/FCPXML export; ported from upstream 2026-08-18 commit 9c45004)
 - **Not ported (12)**: 6 skills depending on `/ecc:*` commands/hooks
   (ecc-guide, ecc-recipes, gateguard, plan-orchestrate, strategic-compact,
-  continuous-learning-v2) and 7 with companion files — unless a hooks/commands
+  continuous-learning-v2) and 6 with companion files — unless a hooks/commands
   bridge layer is built later.
 
 ## Adaptation notes
 
 - `skills/<name>/SKILL.md` copied verbatim (standard format, frontmatter carries
   `metadata.origin: ECC`).
-- Zero harness-specific references in all 273 ported skills; only 2 command
+- Zero harness-specific references in all 274 ported skills; only 2 command
   references were renamed to DSH bare names in v0.1 (`/bug-check` →
   `bug-check`, `/prompt-optimize` → `prompt-optimizer`).
 - Skill identity comes from the frontmatter `name` (e.g. the five
@@ -71,7 +76,7 @@ Restart the profile (`dsh web`) — the skills then load with the `skill` tool.
 Host-layer `ctx.skills.registerProvider` (same pattern as
 [mattpocock-skills-dsh](https://github.com/gongyijie85/mattpocock-skills-dsh)).
 Drop a `skills/<kebab-name>/SKILL.md` and it is auto-discovered. Verify with
-`npm run verify` (273/273).
+`npm run verify` (274/274).
 
 ## License
 

package/README.md

@@ -4,6 +4,8 @@
 [![GitHub release](https://img.shields.io/github/v/release/gongyijie85/dsh-ecc)](https://github.com/gongyijie85/dsh-ecc/releases)
 [![CI](https://github.com/gongyijie85/dsh-ecc/actions/workflows/ci.yml/badge.svg)](https://github.com/gongyijie85/dsh-ecc/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
+[![DSH](https://img.shields.io/badge/DSH-0.1.0--rc.8%2B-4d6bfe)](https://github.com/gongyijie85/dsh-ecc)
+[![-技能](https://img.shields.io/badge/-技能-4d6bfe)]() [![-模式](https://img.shields.io/badge/-模式-4d6bfe)]() [![-编排](https://img.shields.io/badge/-编排-4d6bfe)]() [![-垂直领域](https://img.shields.io/badge/-垂直领域-4d6bfe)]() [![-方法论文法](https://img.shields.io/badge/-方法论文法-4d6bfe)]()
 
 <div align="center">
 
@@ -11,7 +13,7 @@
 
 </div>
 
-把 [affaan-m/ECC](https://github.com/affaan-m/ECC)(~227k⭐ 的"操作员系统",285 个
+把 [affaan-m/ECC](https://github.com/affaan-m/ECC)(~227k⭐ 的"操作员系统",286 个
 技能)渐进移植到 **DeepSeek Harness (DSH)** 的 Cordis 插件架构。
 
 > **English:** ECC (227k⭐ operator system) skills for DeepSeek Harness —
@@ -27,6 +29,8 @@
 
 ## 安装
 
+**支持的 DSH 版本**：`>=0.1.0-rc.8`（宿主面仅 `ctx.skills.registerProvider`，覆盖 0.1.0-rc.8 起全部 rc/alpha 线；实测基线 0.1.1-rc.2）。
+
 ```sh
 # npm(包名 dsh-ecc 已被同名项目占用,本包发布为 dsh-ecc-skills)
 dsh plugin --profile web add dsh-ecc-skills
@@ -75,16 +79,19 @@ dsh plugin --profile web add D:\plugins\dsh-ecc
 - **v0.1.0** ✅ 20 个纯单文件、无 harness 依赖的技能
 - **v0.2.0** ✅ 68 个模式类批量(前端/后端/语言/数据/架构)
 - **v0.3.0** ✅ 50 个编排/自动化/运维类(orch-*、council、team-*、e2e-testing、benchmark 等)
-- **v0.4.0(本次,收官)** ✅ **135 个垂直领域与全部剩余可移植技能**:
+- **v0.4.0** ✅ **135 个垂直领域与全部剩余可移植技能**:
   医疗(healthcare-*、hipaa)、家庭网络(homelab-*)、科学(scientific-* / pubmed / uspto / gget)、
   金融(customer-billing / finance-billing / defi / prediction-market / evm / x402)、
   设计与内容(brand-*、motion-*、liquid-glass、manim、remotion、article-writing、seo)、
   网络运维(cisco-ios、netmiko、network-*、terminal-*)、供应链/物流、营销/销售、
   研究与数据(pytorch、recsys、mle、clickhouse、video/audio)等
-- **累计:273/285 技能已移植**(占 95.8%);未移植仅 12 个:
+- **v0.5.0(本次)** ✅ **+1 个技能**:`tasteforge-video`(可复现的 taste 驱动
+  视频工作流——风格访谈 → style pack → 校验 → 应用 → EDL/FCPXML 导出,
+  移植上游 2026-08-18 新增提交 9c45004)
+- **累计:274/286 技能已移植**(占 95.8%);未移植仅 12 个:
   - 依赖 ECC 专属基础设施(`ecc-guide`、`ecc-recipes`、`gateguard`、`plan-orchestrate`、
     `strategic-compact`、`continuous-learning-v2`)——除非后续做 hooks/commands 桥接层
-  - 带辅助文件的 7 个(`continuous-learning`、`frontend-slides`、`openclaw-persona-forge`、
+  - 带辅助文件的 6 个(`continuous-learning`、`frontend-slides`、`openclaw-persona-forge`、
     `security-review`、`skill-comply`、`visa-doc-translate`)
 
 ## 移植说明(对比上游)
@@ -102,7 +109,7 @@ dsh plugin --profile web add D:\plugins\dsh-ecc
 同 [mattpocock-skills-dsh](https://github.com/gongyijie85/mattpocock-skills-dsh)
 (host 层 `ctx.skills.registerProvider`;零运行时依赖;原生解析折叠 YAML
 frontmatter)。往 `skills/<kebab-name>/SKILL.md` 放文件即自动发现;验证:
-`npm run verify`(20/20)。
+`npm run verify`(274/274)。
 
 ## 许可证
 

package/dsh.plugin.json

@@ -0,0 +1,288 @@
+{
+  "id": "gongyijie85/dsh-ecc",
+  "version": "0.5.1",
+  "main": "./lib/index.js",
+  "description": "ECC (227k-star operator system) skills for DeepSeek Harness — progressive port of 274 curated single-file skills (agentic engineering, evaluation, testing, patterns, vertical domains, docs). Adapted from affaan-m/ECC (MIT)",
+  "engines": {
+    "dsh": ">=0.1.0-rc.8"
+  },
+  "contributes": {
+    "tools": [],
+    "skills": [
+      "accessibility",
+      "agent-architecture-audit",
+      "agent-eval",
+      "agent-harness-construction",
+      "agent-introspection-debugging",
+      "agent-payment-x402",
+      "agent-self-evaluation",
+      "agent-sort",
+      "agentic-engineering",
+      "agentic-os",
+      "ai-first-engineering",
+      "ai-regression-testing",
+      "android-clean-architecture",
+      "angular-developer",
+      "api-connector-builder",
+      "api-design",
+      "architecture-decision-records",
+      "article-writing",
+      "automation-audit-ops",
+      "autonomous-agent-harness",
+      "autonomous-loops",
+      "backend-patterns",
+      "benchmark",
+      "benchmark-methodology",
+      "benchmark-optimization-loop",
+      "blender-motion-state-inspection",
+      "blueprint",
+      "brand-discovery",
+      "brand-voice",
+      "browser-qa",
+      "bun-runtime",
+      "canary-watch",
+      "carrier-relationship-management",
+      "cisco-ios-patterns",
+      "ck",
+      "claude-devfleet",
+      "click-path-audit",
+      "clickhouse-io",
+      "code-tour",
+      "codebase-onboarding",
+      "codehealth-mcp",
+      "coding-standards",
+      "competitive-platform-analysis",
+      "competitive-report-structure",
+      "compose-multiplatform-patterns",
+      "config-gc",
+      "configure-ecc",
+      "connections-optimizer",
+      "content-engine",
+      "content-hash-cache-pattern",
+      "context-budget",
+      "continuous-agent-loop",
+      "contract-first",
+      "cost-aware-llm-pipeline",
+      "cost-tracking",
+      "council",
+      "council-multi-model",
+      "cpp-coding-standards",
+      "cpp-testing",
+      "crosspost",
+      "csharp-testing",
+      "customer-billing-ops",
+      "customs-trade-compliance",
+      "dart-flutter-patterns",
+      "dashboard-builder",
+      "data-scraper-agent",
+      "data-throughput-accelerator",
+      "database-migrations",
+      "deep-research",
+      "defi-amm-security",
+      "delivery-gate",
+      "deployment-patterns",
+      "design-system",
+      "dev-team",
+      "django-celery",
+      "django-patterns",
+      "django-security",
+      "django-tdd",
+      "django-verification",
+      "dmux-workflows",
+      "docker-patterns",
+      "documentation-lookup",
+      "dotnet-patterns",
+      "dynamic-workflow-mode",
+      "e2e-testing",
+      "ecc-tools-cost-audit",
+      "email-ops",
+      "energy-procurement",
+      "enterprise-agent-ops",
+      "error-handling",
+      "eval-harness",
+      "evm-token-decimals",
+      "exa-search",
+      "fal-ai-media",
+      "fastapi-patterns",
+      "finance-billing-ops",
+      "flox-environments",
+      "flutter-dart-code-review",
+      "foundation-models-on-device",
+      "frontend-a11y",
+      "frontend-design-direction",
+      "frontend-patterns",
+      "fsharp-testing",
+      "gan-style-harness",
+      "generating-python-installer",
+      "git-workflow",
+      "github-ops",
+      "golang-patterns",
+      "golang-testing",
+      "google-workspace-ops",
+      "growth-log",
+      "healthcare-cdss-patterns",
+      "healthcare-emr-patterns",
+      "healthcare-eval-harness",
+      "healthcare-phi-compliance",
+      "hermes-imports",
+      "hexagonal-architecture",
+      "hipaa-compliance",
+      "homelab-network-readiness",
+      "homelab-network-setup",
+      "homelab-pihole-dns",
+      "homelab-vlan-segmentation",
+      "homelab-wireguard-vpn",
+      "hookify-rules",
+      "inherit-legacy-style",
+      "intent-driven-development",
+      "inventory-demand-planning",
+      "investor-materials",
+      "investor-outreach",
+      "ios-icon-gen",
+      "iterative-retrieval",
+      "ito-baskets",
+      "ito-compute",
+      "ito-inference",
+      "ito-training",
+      "java-coding-standards",
+      "jira-integration",
+      "jpa-patterns",
+      "knowledge-ops",
+      "kotlin-coroutines-flows",
+      "kotlin-exposed-patterns",
+      "kotlin-ktor-patterns",
+      "kotlin-patterns",
+      "kotlin-testing",
+      "kubernetes-patterns",
+      "laravel-patterns",
+      "laravel-plugin-discovery",
+      "laravel-security",
+      "laravel-tdd",
+      "laravel-verification",
+      "latency-critical-systems",
+      "lead-intelligence",
+      "liquid-glass-design",
+      "living-docs-governance",
+      "llm-trading-agent-security",
+      "logistics-exception-management",
+      "loop-design-check",
+      "mailtrap-email-integration",
+      "make-interfaces-feel-better",
+      "manim-video",
+      "market-research",
+      "marketing-campaign",
+      "mcp-server-patterns",
+      "messages-ops",
+      "ml-adoption-playbook",
+      "mle-workflow",
+      "motion-advanced",
+      "motion-foundations",
+      "motion-patterns",
+      "motion-ui",
+      "mysql-patterns",
+      "nanoclaw-repl",
+      "nasiko-control-plane",
+      "nestjs-patterns",
+      "netmiko-ssh-automation",
+      "network-bgp-diagnostics",
+      "network-config-validation",
+      "network-interface-health",
+      "nextjs-turbopack",
+      "nodejs-keccak256",
+      "nutrient-document-processing",
+      "nuxt4-patterns",
+      "opensource-pipeline",
+      "orch-add-feature",
+      "orch-build-mvp",
+      "orch-change-feature",
+      "orch-fix-defect",
+      "orch-pipeline",
+      "orch-refine-code",
+      "parallel-execution-optimizer",
+      "perl-patterns",
+      "perl-security",
+      "perl-testing",
+      "plan-canvas",
+      "plankton-code-quality",
+      "postgres-patterns",
+      "prediction-market-oracle-research",
+      "prediction-market-risk-review",
+      "prisma-patterns",
+      "product-capability",
+      "product-lens",
+      "production-audit",
+      "production-scheduling",
+      "project-flow-ops",
+      "prompt-optimizer",
+      "python-patterns",
+      "python-testing",
+      "pytorch-patterns",
+      "quality-nonconformance",
+      "quarkus-patterns",
+      "quarkus-security",
+      "quarkus-tdd",
+      "quarkus-verification",
+      "ralphinho-rfc-pipeline",
+      "react-native-patterns",
+      "react-patterns",
+      "react-performance",
+      "react-testing",
+      "recsys-pipeline-architect",
+      "recursive-decision-ledger",
+      "redis-patterns",
+      "regex-vs-llm-structured-text",
+      "remotion-video-creation",
+      "repo-scan",
+      "research-ops",
+      "returns-reverse-logistics",
+      "rules-distill",
+      "rust-patterns",
+      "rust-testing",
+      "safety-guard",
+      "santa-method",
+      "scientific-db-pubmed-database",
+      "scientific-db-uspto-database",
+      "scientific-pkg-gget",
+      "scientific-thinking-literature-review",
+      "scientific-thinking-scholar-evaluation",
+      "search-first",
+      "security-bounty-hunter",
+      "security-scan",
+      "seo",
+      "skill-scout",
+      "skill-stocktake",
+      "social-graph-ranker",
+      "social-publisher",
+      "springboot-patterns",
+      "springboot-security",
+      "springboot-tdd",
+      "springboot-verification",
+      "swift-actor-persistence",
+      "swift-concurrency-6-2",
+      "swift-protocol-di-testing",
+      "swiftui-patterns",
+      "taste",
+      "tasteforge-video",
+      "tdd-workflow",
+      "team-agent-orchestration",
+      "team-builder",
+      "terminal-opener",
+      "terminal-ops",
+      "tinystruct-patterns",
+      "token-budget-advisor",
+      "ui-demo",
+      "ui-to-vue",
+      "uncloud",
+      "unified-memory",
+      "unified-notifications-ops",
+      "verification-loop",
+      "video-editing",
+      "videodb",
+      "vite-patterns",
+      "vue-patterns",
+      "windows-desktop-e2e",
+      "workspace-surface-audit",
+      "x-api"
+    ]
+  }
+}

package/package.json

@@ -1,47 +1,53 @@
-{
-  "name": "dsh-ecc-skills",
-  "description": "ECC (227k-star operator system) skills for DeepSeek Harness — progressive port: v0.1 ships 20 curated single-file skills (agentic engineering, evaluation, testing, patterns, docs); 270+ more follow. Adapted from affaan-m/ECC (MIT)",
-  "version": "0.4.1",
-  "private": false,
-  "type": "module",
-  "main": "lib/index.js",
-  "exports": {
-    ".": "./lib/index.js",
-    "./package.json": "./package.json"
-  },
-  "files": [
-    "lib",
-    "skills",
-    "cordis.patch.yml",
-    "README.md",
-    "README.en.md",
-    "LICENSE"
-  ],
-  "license": "MIT",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/gongyijie85/dsh-ecc.git"
-  },
-  "homepage": "https://github.com/gongyijie85/dsh-ecc",
-  "bugs": {
-    "url": "https://github.com/gongyijie85/dsh-ecc/issues"
-  },
-  "scripts": {
-    "verify": "node scripts/verify-provider.mjs",
-    "prepublishOnly": "node scripts/verify-provider.mjs"
-  },
-  "keywords": [
-    "dsh",
-    "dsh-plugin",
-    "deepseek-harness",
-    "plugin",
-    "skills",
-    "ecc",
-    "agent"
-  ],
-  "dsh": {
-    "bundle": {
-      "patch": "./cordis.patch.yml"
-    }
-  }
-}
+{
+  "name": "dsh-ecc-skills",
+  "description": "ECC (227k-star operator system) skills for DeepSeek Harness — progressive port of 274 curated single-file skills (agentic engineering, evaluation, testing, patterns, vertical domains, docs). Adapted from affaan-m/ECC (MIT)",
+  "version": "0.5.1",
+  "private": false,
+  "type": "module",
+  "main": "lib/index.js",
+  "exports": {
+    ".": "./lib/index.js",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib",
+    "skills",
+    "dsh.plugin.json",
+    "cordis.patch.yml",
+    "README.md",
+    "README.en.md",
+    "LICENSE"
+  ],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/gongyijie85/dsh-ecc.git"
+  },
+  "homepage": "https://github.com/gongyijie85/dsh-ecc",
+  "bugs": {
+    "url": "https://github.com/gongyijie85/dsh-ecc/issues"
+  },
+  "scripts": {
+    "verify": "node scripts/verify-provider.mjs",
+    "prepublishOnly": "node scripts/verify-provider.mjs"
+  },
+  "keywords": [
+    "dsh",
+    "dsh-plugin",
+    "deepseek-harness",
+    "plugin",
+    "skills",
+    "ecc",
+    "agent"
+  ],
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "compatibility": {
+      "dshReleases": {
+        "0.1.1-rc.2": "compatible"
+      }
+    }
+  }
+}

package/skills/ito-compute/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Itô Compute"
+  short_description: "GPU inventory, RFQs, status, and revocation"
+  default_prompt: "Use $ito-compute to request a live GPU RFQ, inspect status, or revoke this device safely."

package/skills/nasiko-control-plane/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Nasiko Control Plane"
+  short_description: "Safely install and inspect the optional Nasiko control plane"
+  default_prompt: "Use $nasiko-control-plane to inspect or explicitly install the pinned Nasiko CLI without enabling telemetry or exposing secrets."

package/skills/skill-stocktake/scripts/quick-diff.sh

@@ -0,0 +1,87 @@
+#!/usr/bin/env bash
+# quick-diff.sh — compare skill file mtimes against results.json evaluated_at
+# Usage: quick-diff.sh RESULTS_JSON [CWD_SKILLS_DIR]
+# Output: JSON array of changed/new files to stdout (empty [] if no changes)
+#
+# When CWD_SKILLS_DIR is omitted, defaults to $PWD/.claude/skills so the
+# script always picks up project-level skills without relying on the caller.
+#
+# Environment:
+#   SKILL_STOCKTAKE_GLOBAL_DIR   Override ~/.claude/skills (for testing only;
+#                                do not set in production — intended for bats tests)
+#   SKILL_STOCKTAKE_PROJECT_DIR  Override project dir detection (for testing only)
+
+set -euo pipefail
+
+RESULTS_JSON="${1:-}"
+CWD_SKILLS_DIR="${SKILL_STOCKTAKE_PROJECT_DIR:-${2:-$PWD/.claude/skills}}"
+GLOBAL_DIR="${SKILL_STOCKTAKE_GLOBAL_DIR:-$HOME/.claude/skills}"
+
+if [[ -z "$RESULTS_JSON" || ! -f "$RESULTS_JSON" ]]; then
+  echo "Error: RESULTS_JSON not found: ${RESULTS_JSON:-<empty>}" >&2
+  exit 1
+fi
+
+# Validate CWD_SKILLS_DIR looks like a .claude/skills path (defense-in-depth).
+# Only warn when the path exists — a nonexistent path poses no traversal risk.
+if [[ -n "$CWD_SKILLS_DIR" && -d "$CWD_SKILLS_DIR" && "$CWD_SKILLS_DIR" != */.claude/skills* ]]; then
+  echo "Warning: CWD_SKILLS_DIR does not look like a .claude/skills path: $CWD_SKILLS_DIR" >&2
+fi
+
+evaluated_at=$(jq -r '.evaluated_at' "$RESULTS_JSON")
+
+# Fail fast on a missing or malformed evaluated_at rather than producing
+# unpredictable results from ISO 8601 string comparison against "null".
+if [[ ! "$evaluated_at" =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$ ]]; then
+  echo "Error: invalid or missing evaluated_at in $RESULTS_JSON: $evaluated_at" >&2
+  exit 1
+fi
+
+# Pre-extract known paths from results.json once (O(1) lookup per file instead of O(n*m))
+known_paths=$(jq -r '.skills[].path' "$RESULTS_JSON" 2>/dev/null)
+
+tmpdir=$(mktemp -d)
+# Use a function to avoid embedding $tmpdir in a quoted string (prevents injection
+# if TMPDIR were crafted to contain shell metacharacters).
+_cleanup() { rm -rf "$tmpdir"; }
+trap _cleanup EXIT
+
+# Shared counter across process_dir calls — intentionally NOT local
+i=0
+
+process_dir() {
+  local dir="$1"
+  while IFS= read -r file; do
+    local mtime dp is_new
+    mtime=$(date -u -r "$file" +%Y-%m-%dT%H:%M:%SZ)
+    dp="${file/#$HOME/~}"
+
+    # Check if this file is known to results.json (exact whole-line match to
+    # avoid substring false-positives, e.g. "python-patterns" matching "python-patterns-v2").
+    if echo "$known_paths" | grep -qxF "$dp"; then
+      is_new="false"
+      # Known file: only emit if mtime changed (ISO 8601 string comparison is safe)
+      [[ "$mtime" > "$evaluated_at" ]] || continue
+    else
+      is_new="true"
+      # New file: always emit regardless of mtime
+    fi
+
+    jq -n \
+      --arg path "$dp" \
+      --arg mtime "$mtime" \
+      --argjson is_new "$is_new" \
+      '{path:$path,mtime:$mtime,is_new:$is_new}' \
+      > "$tmpdir/$i.json"
+    i=$((i+1))
+  done < <(find "$dir" -name "*.md" -type f 2>/dev/null | sort)
+}
+
+[[ -d "$GLOBAL_DIR" ]] && process_dir "$GLOBAL_DIR"
+[[ -n "$CWD_SKILLS_DIR" && -d "$CWD_SKILLS_DIR" ]] && process_dir "$CWD_SKILLS_DIR"
+
+if [[ $i -eq 0 ]]; then
+  echo "[]"
+else
+  jq -s '.' "$tmpdir"/*.json
+fi

package/skills/skill-stocktake/scripts/save-results.sh

@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+# save-results.sh — merge evaluated skills into results.json with correct UTC timestamp
+# Usage: save-results.sh RESULTS_JSON <<< "$EVAL_JSON"
+#
+# stdin format:
+#   { "skills": {...}, "mode"?: "full"|"quick", "batch_progress"?: {...} }
+#
+# Always sets evaluated_at to current UTC time via `date -u`.
+# Merges stdin .skills into existing results.json (new entries override old).
+# Optionally updates .mode and .batch_progress if present in stdin.
+
+set -euo pipefail
+
+RESULTS_JSON="${1:-}"
+
+if [[ -z "$RESULTS_JSON" ]]; then
+  echo "Error: RESULTS_JSON argument required" >&2
+  echo "Usage: save-results.sh RESULTS_JSON <<< \"\$EVAL_JSON\"" >&2
+  exit 1
+fi
+
+EVALUATED_AT=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+
+# Read eval results from stdin and validate JSON before touching the results file
+input_json=$(cat)
+if ! echo "$input_json" | jq empty 2>/dev/null; then
+  echo "Error: stdin is not valid JSON" >&2
+  exit 1
+fi
+
+if [[ ! -f "$RESULTS_JSON" ]]; then
+  # Bootstrap: create new results.json from stdin JSON + current UTC timestamp
+  echo "$input_json" | jq --arg ea "$EVALUATED_AT" \
+    '. + { evaluated_at: $ea }' > "$RESULTS_JSON"
+  exit 0
+fi
+
+# Merge: new .skills override existing ones; old skills not in input_json are kept.
+# Optionally update .mode and .batch_progress if provided.
+#
+# Use mktemp for a collision-safe temp file (concurrent runs on the same RESULTS_JSON
+# would race on a predictable ".tmp" suffix; random suffix prevents silent overwrites).
+tmp=$(mktemp "${RESULTS_JSON}.XXXXXX")
+trap 'rm -f "$tmp"' EXIT
+
+jq -s \
+  --arg ea "$EVALUATED_AT" \
+  '.[0] as $existing | .[1] as $new |
+   $existing |
+   .evaluated_at = $ea |
+   .skills = ($existing.skills + ($new.skills // {})) |
+   if ($new | has("mode")) then .mode = $new.mode else . end |
+   if ($new | has("batch_progress")) then .batch_progress = $new.batch_progress else . end' \
+  "$RESULTS_JSON" <(echo "$input_json") > "$tmp"
+
+mv "$tmp" "$RESULTS_JSON"

package/skills/skill-stocktake/scripts/scan.sh

@@ -0,0 +1,170 @@
+#!/usr/bin/env bash
+# scan.sh — enumerate skill files, extract frontmatter and UTC mtime
+# Usage: scan.sh [CWD_SKILLS_DIR]
+# Output: JSON to stdout
+#
+# When CWD_SKILLS_DIR is omitted, defaults to $PWD/.claude/skills so the
+# script always picks up project-level skills without relying on the caller.
+#
+# Environment:
+#   SKILL_STOCKTAKE_GLOBAL_DIR   Override ~/.claude/skills (for testing only;
+#                                do not set in production — intended for bats tests)
+#   SKILL_STOCKTAKE_PROJECT_DIR  Override project dir detection (for testing only)
+
+set -euo pipefail
+
+GLOBAL_DIR="${SKILL_STOCKTAKE_GLOBAL_DIR:-$HOME/.claude/skills}"
+CWD_SKILLS_DIR="${SKILL_STOCKTAKE_PROJECT_DIR:-${1:-$PWD/.claude/skills}}"
+# Path to JSONL file containing tool-use observations (optional; used for usage frequency counts).
+# Override via SKILL_STOCKTAKE_OBSERVATIONS env var if your setup uses a different path.
+OBSERVATIONS="${SKILL_STOCKTAKE_OBSERVATIONS:-$HOME/.claude/observations.jsonl}"
+
+# Validate CWD_SKILLS_DIR looks like a .claude/skills path (defense-in-depth).
+# Only warn when the path exists — a nonexistent path poses no traversal risk.
+if [[ -n "$CWD_SKILLS_DIR" && -d "$CWD_SKILLS_DIR" && "$CWD_SKILLS_DIR" != */.claude/skills* ]]; then
+  echo "Warning: CWD_SKILLS_DIR does not look like a .claude/skills path: $CWD_SKILLS_DIR" >&2
+fi
+
+# Extract a frontmatter field (handles both quoted and unquoted single-line values).
+# Does NOT support multi-line YAML blocks (| or >) or nested YAML keys.
+extract_field() {
+  local file="$1" field="$2"
+  awk -v f="$field" '
+    BEGIN { fm=0 }
+    /^---$/ { fm++; next }
+    fm==1 {
+      n = length(f) + 2
+      if (substr($0, 1, n) == f ": ") {
+        val = substr($0, n+1)
+        gsub(/^"/, "", val)
+        gsub(/"$/, "", val)
+        print val
+        exit
+      }
+    }
+    fm>=2 { exit }
+  ' "$file"
+}
+
+# Get UTC timestamp N days ago (supports both macOS and GNU date)
+date_ago() {
+  local n="$1"
+  date -u -v-"${n}d" +%Y-%m-%dT%H:%M:%SZ 2>/dev/null ||
+  date -u -d "${n} days ago" +%Y-%m-%dT%H:%M:%SZ
+}
+
+# Count observations matching a file path since a cutoff timestamp
+count_obs() {
+  local file="$1" cutoff="$2"
+  if [[ ! -f "$OBSERVATIONS" ]]; then
+    echo 0
+    return
+  fi
+  jq -r --arg p "$file" --arg c "$cutoff" \
+    'select(.tool=="Read" and .path==$p and .timestamp>=$c) | 1' \
+    "$OBSERVATIONS" 2>/dev/null | wc -l | tr -d ' '
+}
+
+# Scan a directory and produce a JSON array of skill objects
+scan_dir_to_json() {
+  local dir="$1"
+  local c7 c30
+  c7=$(date_ago 7)
+  c30=$(date_ago 30)
+
+  local tmpdir
+  tmpdir=$(mktemp -d)
+  # Use a function to avoid embedding $tmpdir in a quoted string (prevents injection
+  # if TMPDIR were crafted to contain shell metacharacters).
+  local _scan_tmpdir="$tmpdir"
+  _scan_cleanup() { rm -rf "$_scan_tmpdir"; }
+  trap _scan_cleanup RETURN
+
+  # Pre-aggregate observation counts in two passes (one per window) instead of
+  # calling jq per-file — reduces from O(n*m) to O(n+m) jq invocations.
+  local obs_7d_counts obs_30d_counts
+  obs_7d_counts=""
+  obs_30d_counts=""
+  if [[ -f "$OBSERVATIONS" ]]; then
+    obs_7d_counts=$(jq -r --arg c "$c7" \
+      'select(.tool=="Read" and .timestamp>=$c) | .path' \
+      "$OBSERVATIONS" 2>/dev/null | sort | uniq -c)
+    obs_30d_counts=$(jq -r --arg c "$c30" \
+      'select(.tool=="Read" and .timestamp>=$c) | .path' \
+      "$OBSERVATIONS" 2>/dev/null | sort | uniq -c)
+  fi
+
+  local i=0
+  while IFS= read -r file; do
+    local name desc mtime u7 u30 dp
+    name=$(extract_field "$file" "name")
+    desc=$(extract_field "$file" "description")
+    mtime=$(date -u -r "$file" +%Y-%m-%dT%H:%M:%SZ)
+    # Use awk exact field match to avoid substring false-positives from grep -F.
+    # uniq -c output format: "   N /path/to/file" — path is always field 2.
+    u7=$(echo "$obs_7d_counts" | awk -v f="$file" '$2 == f {print $1}' | head -1)
+    u7="${u7:-0}"
+    u30=$(echo "$obs_30d_counts" | awk -v f="$file" '$2 == f {print $1}' | head -1)
+    u30="${u30:-0}"
+    dp="${file/#$HOME/~}"
+
+    jq -n \
+      --arg path "$dp" \
+      --arg name "$name" \
+      --arg description "$desc" \
+      --arg mtime "$mtime" \
+      --argjson use_7d "$u7" \
+      --argjson use_30d "$u30" \
+      '{path:$path,name:$name,description:$description,use_7d:$use_7d,use_30d:$use_30d,mtime:$mtime}' \
+      > "$tmpdir/$i.json"
+    i=$((i+1))
+  done < <(find "$dir" -name "*.md" -type f 2>/dev/null | sort)
+
+  if [[ $i -eq 0 ]]; then
+    echo "[]"
+  else
+    jq -s '.' "$tmpdir"/*.json
+  fi
+}
+
+# --- Main ---
+
+global_found="false"
+global_count=0
+global_skills="[]"
+
+if [[ -d "$GLOBAL_DIR" ]]; then
+  global_found="true"
+  global_skills=$(scan_dir_to_json "$GLOBAL_DIR")
+  global_count=$(echo "$global_skills" | jq 'length')
+fi
+
+project_found="false"
+project_path=""
+project_count=0
+project_skills="[]"
+
+if [[ -n "$CWD_SKILLS_DIR" && -d "$CWD_SKILLS_DIR" ]]; then
+  project_found="true"
+  project_path="$CWD_SKILLS_DIR"
+  project_skills=$(scan_dir_to_json "$CWD_SKILLS_DIR")
+  project_count=$(echo "$project_skills" | jq 'length')
+fi
+
+# Merge global + project skills into one array
+all_skills=$(jq -s 'add' <(echo "$global_skills") <(echo "$project_skills"))
+
+jq -n \
+  --arg global_found "$global_found" \
+  --argjson global_count "$global_count" \
+  --arg project_found "$project_found" \
+  --arg project_path "$project_path" \
+  --argjson project_count "$project_count" \
+  --argjson skills "$all_skills" \
+  '{
+    scan_summary: {
+      global: { found: ($global_found == "true"), count: $global_count },
+      project: { found: ($project_found == "true"), path: $project_path, count: $project_count }
+    },
+    skills: $skills
+  }'

package/skills/tasteforge-video/SKILL.md

@@ -0,0 +1,383 @@
+---
+
+name: tasteforge-video
+
+description: Use for file-driven multimodal image, video, and 3D-asset discovery; taste interviews; distill or apply workflows; style-pack validation; editable EDL/FCPXML export; provenance audits; and offline planning that must fail closed before provider generation.
+
+metadata:
+
+  origin: ECC
+
+---
+
+
+
+# TasteForge Video
+
+
+
+TasteForge turns "make it feel like this reference" into a repeatable,
+
+inspectable workflow: interview taste, distill it into a structured style
+
+pack, validate the pack, apply its measured cadence and look to local media,
+
+and export an editable timeline. The canonical implementation is the
+
+`tasteforge` package in the Itô video repository; ECC orchestrates and
+
+explains it and does not vendor or duplicate its code.
+
+
+
+## When to Use
+
+
+
+- The user asks to **interview for video taste** before any footage is made
+
+  ("ask me about the look", "interview me about aesthetic direction").
+
+- The user wants to **distill an aesthetic into structured constraints** — a
+
+  reusable style pack rather than vibes ("turn these references into a pack").
+
+- The user wants to **validate a style pack** (is the metadata complete,
+
+  schema-valid, cadence measured, spec distilled?).
+
+- The user wants to **apply a style pack to local footage** — plan a cut from
+
+  the pack's measured cadence over local clips, deterministically.
+
+- The user wants to **export EDL/FCPXML** — an editable, frame-exact handoff
+
+  to DaVinci Resolve / Premiere / Final Cut.
+
+- The user asks for a **generated-media provenance audit** — where did this
+
+  pack, spec, or cut come from; what was measured locally versus generated by
+
+  a provider; what was dry-run.
+
+- The user asks to **discover or plan file-driven multimodal image, video, or
+
+  3D-asset outputs** from local reference files, including separate manifests,
+
+  subject-anchored CV effects, or Resolve effect recipes.
+
+- The user mentions TasteForge, style packs, flashethereal, taste distillation,
+
+  cadence/rhythm planning, multimodal discovery, distill/apply workflows, or a
+
+  taste interview for video.
+
+
+
+## Local Deterministic Operations vs Provider Generation
+
+
+
+This boundary is the core of the skill. Everything ECC can actually run is
+
+**local, deterministic, and offline**:
+
+
+
+| Operation | Deterministic? | ECC may run |
+
+|---|---|---|
+
+| Taste interview → profile | yes (offline) | yes |
+
+| Pack inspect / validate against schemas | yes | yes |
+
+| Distill profile (+ measured grounding) → spec | yes (dry-run semantics) | yes |
+
+| Apply pack cadence to local media → report + timeline | yes | yes |
+
+| Export EDL (CMX3600) / FCPXML 1.9 | yes | yes |
+
+| Provenance / lineage report | yes | yes |
+
+| Vision-model distillation of stills | **provider generation** | **no** |
+
+| Reference-to-video, image-to-3D, hosted compose | **provider generation** | **no** |
+
+
+
+**Provider generation must fail closed in ECC.** Any live Fal (or other
+
+provider) call — generating shots, minting prop meshes, hosted VLM
+
+distillation — requires explicit separately authorized execution under a
+
+separate lane with its own review. ECC never calls Fal, never reads any API
+
+key or other credentials (`FAL_KEY` included), uploads no media, and mutates
+
+no provider account state. When a request needs provider generation, state
+
+exactly that boundary, run the local half (interview, pack validation,
+
+planning, export), and stop.
+
+
+
+**Never claim a Fal workflow is saved.** A local reference to a Fal endpoint,
+
+model id, or dry-run URL (they appear inside pack metadata) is
+
+**reference-only**: it never means a provider-side workflow was saved,
+
+persisted, or is authorized to run. Anything produced offline carries
+
+dry-run/dry_run semantics — say "dry-run spec" or "deterministic plan", never
+
+"generated by the model".
+
+
+
+## Canonical Implementation
+
+
+
+- Repository: `Ito-Markets/ito-video` — find it under the workspace's
+
+  canonical local GitHub checkout root (never a hard-coded machine path);
+
+  package directory `tasteforge/`.
+
+- CLI: `python3 -m tasteforge <command>` — `provenance`, `inspect`, `validate`,
+
+  `interview`, `distill`, `apply`, `export`, `multimodal`. `--live` flags exit
+
+  with code 2 and refuse.
+
+- Schemas are the contract: taste profile, pack manifest, grade, cadence,
+
+  spec, timeline events, application reports (`provider` is enum-locked to
+
+  `"none"`; `dry_run` to `true`).
+
+- Recovered-source lineage and deliberate exclusions live in the repo's
+
+  `PROVENANCE.md`. Run `python3 -m tasteforge provenance` for the machine-
+
+  readable version.
+
+
+
+ECC's job is to route here, run the local deterministic commands, and
+
+interpret their JSON — not to reimplement cadence planning, LUT/grade
+
+statistics, or timeline emission. If the canonical package is absent, say so
+
+and stop; do not reconstruct its logic inline.
+
+
+
+## Workflow
+
+
+
+1. **Interview** (`interview`): collect answers for the look axes — palette,
+
+   grain, lighting, focal length, camera motion, subject framing, grade,
+
+   mood adjectives, avoid list — and separately the content brief. Keep look
+
+   and content separate; merging them is the classic failure.
+
+2. **Distill** (`distill`): map the profile onto the spec schema offline,
+
+   embedding the pack's measured grounding (black/white point, contrast,
+
+   per-zone chroma, palette, cut rhythm) when a pack is supplied. The result
+
+   is a dry-run spec: deterministic, provider `"none"`.
+
+3. **Validate** (`validate` / `inspect`): check the pack against its schemas;
+
+   report errors vs warnings (missing stills in a metadata-only pack are a
+
+   warning, not an error).
+
+4. **Apply** (`apply`): plan shot durations from the pack's measured cadence
+
+   (seeded, deterministic) over the user's local clips; produce the
+
+   application report and frame-exact timeline events.
+
+5. **Export** (`export`): write CMX3600 EDL + FCPXML 1.9 with rational,
+
+   NTSC-safe times for import into a real NLE.
+
+6. **Audit** (`provenance`): report lineage — recovered-source digests,
+
+   generation history, fixture provenance, provider references as
+
+   pointer-only records.
+
+
+
+## File-Driven Multimodal Contract
+
+
+
+Use this path when local references must drive dry-run generation plans for
+
+image, video, and 3D-asset outputs while preserving genre separation:
+
+
+
+```bash
+
+python3 -m tasteforge multimodal --config workflow.json --out-dir out/multimodal
+
+```
+
+
+
+The config names numbered genres and local evidence files. Keep these candidate
+
+genres distinct rather than blending them into one generic aesthetic:
+
+
+
+1. Flash Ethereal
+
+2. 3D Cyber Glitch
+
+3. Fluid Sketch
+
+
+
+The command measures local references with ffprobe/ffmpeg and emits one style
+
+spec per genre, separate image, video, and 3D-asset manifests, provenance, and
+
+a Resolve effect recipe. The effect schedule must be seeded aperiodic. CV
+
+effects require a real subject anchor whose exact lost-track policy is
+
+`disable_effect_until_track_recovers`; `continue_without_anchor` and every
+
+other policy fail closed. Every effect carries placement constraints that
+
+preserve faces and readable type and prevent decorative corner meshes from
+
+replacing full-frame 3D work.
+
+
+
+The returned receipt is the bundle boundary. It binds every emitted evidence
+
+artifact by relative path, byte size, SHA-256, genre, modality,
+
+`provider_execution:false`, and exact reference/time provenance. The receipt
+
+requires `provider_calls:0` as an exact integer (the JSON boolean `false` is
+
+invalid), `provider_execution:false`, and `dry_run:true`. Every genre spec also
+
+requires explicit `dry_run:true`. The Resolve effect recipe requires that same
+
+exact integer `provider_calls:0`, `provider_execution:false`, and `dry_run:true`.
+
+Every modality manifest and every nested request must contain all four exact
+
+fail-closed fields: integer `provider_calls:0`, `provider_execution:false`,
+
+`dry_run:true`, and `submit:false`; each request also requires
+
+`provider_call_mode:"disabled"`. A missing field is a rejection, not a default,
+
+and `dry_run:false` must be rejected before output is written.
+
+
+
+Treat booleans as invalid numbers everywhere in timeline, evidence, probe, and
+
+source-duration data. Every such numeric value must be a finite real: reject
+
+`true`, `false`, NaN, infinities, negative event starts, non-positive durations,
+
+out-of-range evidence times, and events ending beyond the declared finite
+
+positive timeline. Whole-file evidence uses an explicit whole-file time basis
+
+and never invents timestamps.
+
+
+
+Receipt references are the duration authority. Key each validated reference
+
+duration by its cited SHA-256; duplicate occurrences of one digest must agree
+
+on duration or the bundle is invalid. Every effect evidence `source_duration`
+
+and every subject-anchor `source_duration` must equal that digest's validated
+
+receipt duration, not merely contain its cited time. Probe duration and all
+
+probe measurements must describe the same stable bytes used for byte count and
+
+SHA-256. If the source mutates while probing or rehashes differently while it
+
+is still available, fail closed rather than emitting or accepting a receipt.
+
+
+
+Always run bundle validation after creation. A missing image, video, or 3D-asset
+
+manifest must fail closed. Genericized or duplicate genres, periodic schedules,
+
+unanchored CV effects, missing placement constraints, provider-execution flags,
+
+unbound output files, byte-size drift, or SHA-256 tampering must fail closed.
+
+Reject output roots, intermediates, or artifacts that are symlinks, and reject
+
+special files (including FIFOs and devices); outputs must remain regular files
+
+under a real directory tree. If local `ffmpeg` or `ffprobe` is unavailable, the
+
+CLI must return its bounded nonzero local-media-processing error without a
+
+Python traceback. Do not repair a failed receipt by deleting evidence or
+
+weakening validation.
+
+
+
+## Example Session
+
+
+
+```bash
+
+# in the canonical ito-video checkout
+
+python3 -m tasteforge validate stylepacks/flashethereal
+
+python3 -m tasteforge interview --answers answers.json --genre flashethereal --out profile.json
+
+python3 -m tasteforge distill --profile profile.json --pack stylepacks/flashethereal --out spec.json
+
+python3 -m tasteforge apply --pack stylepacks/flashethereal --media media.json --duration 20 --out report.json
+
+python3 -m tasteforge export --events events.json --out-dir out --title flashethereal-cut
+
+python3 -m tasteforge provenance
+
+```
+
+
+
+If the user asks for the shots to actually be generated: stop, explain the
+
+fail-closed provider boundary, and deliver the deterministic plan, spec, and
+
+editable timeline instead.