jhste-skills 0.4.0 → 0.5.0

package/CHANGELOG.md

@@ -1,122 +1,11 @@
 # Changelog
 
-## 0.4.0 - 2026-07-01
+## Unreleased
 
-### Added
-- Added `skills/_shared/` shared companion resources (`solid-lens`, `evidence-discipline`, `issue-candidate`, `scope-discipline`) as the single source for cross-cutting doctrine, cited by the jhste skills instead of restating it per skill.
-- Added a first-class shared-resource install concept: directories under `skills/` starting with `_` are not skills (excluded from listing, selection, and missing-skill checks) but are copied alongside skills so installed `../_shared/...` references never dangle.
-- Added `jhste-skills global` — advisory-only, user-level setup for Codex, Claude Code, and OpenCode that installs skills to `~/.jhste/skills` and writes marker-managed bridges into `~/.claude/CLAUDE.md`, `~/.codex/AGENTS.md`, and `~/.config/opencode/AGENTS.md`, with no git hooks or per-repo files; `--uninstall` reverses it.
-- Added `ask-jhste`, a user-invoked router for choosing the right jhste skill/workflow without adding always-on model context.
-- Added OpenCode support to global setup via `~/.config/opencode/AGENTS.md`.
-- Added a safe global-only npm postinstall refresh: after a user has opted into `jhste-skills global`, later `npm update -g jhste-skills` refreshes managed global skill copies and existing managed global bridges without creating a new setup.
+## 0.5.0 - 2026-07-02
 
 ### Changed
-- Trimmed jhste skill descriptions and SKILL bodies for lower operating-context cost while preserving behavior; SKILL files now own the decision procedure and cite `_shared` doctrine, and reference files are examples/lookup only.
-- Reduced `docs-check` to load-bearing behavior anchors (pinned once at their source) instead of exact prose/section titles; de-duplicated the triplicated issue-candidate pin to the shared doctrine.
-- Deduplicated the `## Workflow` section in `AGENTS.md` against the managed bridge block.
-- Extracted shared `removeManagedSkills`/manifest loading into `install-actions/skills.mjs` for reuse by `uninstall` and `global`.
-- Made `grill-me` a user-invoked alias for `grilling` to reduce duplicate invocation surface while preserving the personal pressure-test entrypoint.
-- Made `global` skip bridge writes when skill installation is blocked, and preflight `_shared` unmanaged conflicts before copying selected skills.
-- Synced README translations (ko/zh/ja) with global setup, `ask-jhste`, and `_shared` companion-resource docs.
-- Hardened `global` option validation, refused vendor-only global installs, reported invalid-manifest uninstall failures, and rejected unsafe manifest entry names before managed skill removal.
-
-### Validation
-- `npm test` passed (12 stages, including new `_shared` install integrity and `global` command smoke coverage).
-
-## 0.3.7 - 2026-06-30
-
-### Added
-- Added `implement`, a jhste-compatible implementation workflow skill for scoped PRD/issue/spec work.
-- Added `writing-great-skills`, replacing the legacy `write-a-skill` skill with upstream skill-writing guidance.
-
-### Changed
-- Refreshed Matt Pocock vendored workflow skills against upstream `43ea088`, excluding `tdd` and `resolving-merge-conflicts`.
-- Updated `triage` to cover external PRs as a triage surface, including PR diff verification and PR-specific agent briefs.
-- Slimmed duplicated architecture/grilling docs by routing shared vocabulary through `codebase-design`, `grilling`, and `domain-modeling`.
-- Updated issue slicing to prefer prefactoring slices where they make later implementation easier and to represent human decisions as blockers rather than a separate HITL/AFK field.
-- Removed managed legacy `write-a-skill` installs during sync/update; `writing-great-skills` is the replacement skill going forward.
-
-### Validation
-- `npm test` passed.
-- `jhste-skills guard --scope changed --format text --fail-on error` passed with 0 warnings/errors.
-- `git diff --check` passed.
-## 0.3.6 - 2026-06-28
-
-### Changed
-- Clarified that `jhste-long-running-work-loop` is triggered by state-loss risk rather than elapsed time alone, including same-day external wait states.
-- Updated README skill summaries to describe durable state preservation instead of implying only long-duration work.
-
-### Validation
-- `npm test` passed.
-- `jhste-skills guard --scope changed --format text --fail-on error` passed with 0 warnings/errors.
-- `git diff --check` passed.
-- `npm pack --dry-run` completed for `jhste-skills@0.3.6`.
-
-## 0.3.5 - 2026-06-28
-
-### Added
-- Added `jhste-long-running-work-loop`, a narrow orchestration skill for multi-session and long-running work that preserves goals, phases, approval boundaries, resume points, and durable-state routing without replacing code-quality, PRD, issue, triage, or handoff workflows.
-
-### Changed
-- Updated smoke-test expected skill counts now that the bundled/core skill set includes the new long-running work loop skill.
-
-### Validation
-- `npm test` passed.
-- `jhste-skills guard --scope changed --format text --fail-on error` passed with 0 warnings/errors.
-
-## 0.3.4 - 2026-06-26
-
-### Changed
-- Shifted groundwork and red-team review guidance away from fixed checklist axes and toward context-based failure-mode review of the changed execution path.
-- Tightened DB/API and code-quality skill guidance around caller-appropriate response shapes, storage-backed invariants, authorization/data-isolation paths, and understandable failure behavior without turning those examples into a mandatory checklist.
-- Clarified red-team review versus red-team questioning/interrogation triggers while preserving the red-team wording and intent.
-- Clarified architecture, PRD, issue-slicing, and triage skill trigger boundaries to reduce accidental over-triggering.
-
-### Added
-- Added `sync`/`update --skills-only` to refresh installed skill files without touching repository profiles, bridge blocks, hooks, or deep-scan outputs.
-
-## 0.3.3 - 2026-06-26
-
-### Removed
-- Removed the global npm `postinstall` auto-sync. Updating the npm package no longer requires install-script approval or a persistent user-level `allow-scripts` npm config; run `jhste-skills update --yes --skip-hooks` explicitly when you want to refresh managed local skill copies.
-
-## 0.3.2 - 2026-06-26
-
-### Added
-- Added a safe global postinstall sync for existing manifest-managed `~/.jhste/skills` so `npm update -g jhste-skills` refreshes local agent skill copies without touching repositories, hooks, or bridge files.
-
-## 0.3.1 - 2026-06-26
-
-### Changed
-- Strengthened completion review around current proof, consumer-path and fresh-client verification, skipped checks, checks not run, and residual risk.
-- Added final behavior predicates to pre-change engineering groundwork.
-- Clarified cleanup/search-replace safety by separating editable product paths from protected evidence/history-like surfaces.
-- Kept SOLID-informed coding discipline while emphasizing concrete failure modes over automatic abstraction.
-- Clarified that `grilling` and `grill-me` are read-only by default.
-- Made architecture improvement Markdown-first, with HTML visual reports optional when requested or materially useful.
-
-## 0.3.0 - 2026-06-24
-
-### Added
-- Added repo-local agent autonomy and standing approval guidance for routine reversible work, tracker/doc workflows, prototypes, handoffs, and bounded review follow-up.
-- Added shared generated-profile detection with legacy generated profile support, including legacy profiles that still contain `guard.exit_codes`.
-- Added `--allow-profile-overwrite` for explicit modified profile replacement when used with `--force`.
-- Added smoke and fixture coverage for profile overwrite safety, legacy generated profiles, deep-scan validation, baseline path handling, legacy guard exit-code no-op handling, and managed skill rename migration.
-
-### Changed
-- Renamed `jhste-engineering-judgment` to `jhste-engineering-groundwork`; managed `sync`/`update` migrate the old managed skill name automatically.
-- Replaced general user-facing “seam” language with “boundary” while preserving stable rule/profile ids such as `extension_seam_advisory` for compatibility.
-- Updated skill descriptions and bodies for grilling, PRD/issues, prototype, handoff, triage, domain modeling, codebase design, architecture review, code quality, groundwork, and red-team review triggers/side-effect policy.
-- Refactored install/connect preset planning to table-driven plan factories so the previous OCP advisory warning is no longer emitted.
-
-### Fixed
-- `install --force` no longer overwrites modified/custom `.jhste/profile.yaml` unless `--allow-profile-overwrite` is also supplied.
-- `connect`, `sync`, and `update` now share the same profile overwrite safety policy.
-- New generated/example profiles no longer advertise unsupported `guard.exit_codes`; existing profile `guard.exit_codes` blocks are accepted as legacy no-op configuration.
-- `deep-scan` now validates `.jhste/profile.yaml` and exits with config failure before writing reports when the profile is invalid.
-- `baseline` now validates profile configuration and shows/uses the effective baseline path from CLI args, profile, or the default consistently.
-
-### Validation
-- `npm test` passed.
-- `jhste-skills guard --scope changed --format text --fail-on error` passed with 0 warnings/errors.
-- `git diff --check` passed.
+- Reworked the package into a single personal `jhste-coding` skill.
+- Removed bundled Matt Pocock workflow skills; users can install `mattpocock/skills` separately.
+- Removed jhste workflow/review/guard/setup skills and shared review doctrine from the model-facing package.
+- Simplified docs, package files, and validation around the one-skill structure.

package/README.en.md

@@ -0,0 +1,42 @@
+# jhste-skills
+
+[한국어](README.md) | ENG
+
+A tiny personal coding-discipline skill.
+
+This repository provides one skill:
+
+- `jhste-coding`: a lightweight SOLID-first coding discipline for repository code edits.
+
+It does not vendor workflow skills. Use `mattpocock/skills` separately for broader planning, issue, PRD, debugging, architecture, or review workflows.
+
+## Install from npm
+
+This package does not provide a CLI. The npm package is a small distribution bundle for the skill file.
+
+```sh
+npm install -g jhste-skills
+mkdir -p ~/.codex/skills
+cp -R "$(npm root -g)/jhste-skills/skills/jhste-coding" ~/.codex/skills/
+```
+
+If your agent uses a different skills directory, copy `skills/jhste-coding/` there instead.
+
+## Install from the repository
+
+```sh
+mkdir -p ~/.codex/skills
+cp -R skills/jhste-coding ~/.codex/skills/
+```
+
+## SOLID-first discipline
+
+`jhste-coding` keeps code changes small and practical, with SOLID as the main lens:
+
+- **Single Responsibility:** keep each changed unit centered on one clear job.
+- **Open/Closed:** add extension seams only when real variation would otherwise keep changing the same core logic.
+- **Liskov Substitution:** preserve caller-facing expectations such as return shape, nullability, errors, and side effects.
+- **Interface Segregation:** depend on the smallest useful contract.
+- **Dependency Inversion:** keep business rules separate from concrete side effects when it improves clarity.
+
+The skill is for active coding discipline, not broader process automation or review pipelines.

package/README.md

@@ -1,293 +1,42 @@
 # jhste-skills
 
-Languages: [English](README.md) · [한국어](README.ko.md) · [中文](README.zh.md) · [日本語](README.ja.md)
+한국어 | [ENG](README.en.md)
 
-An installable working-rules kit that helps AI coding agents consistently follow your engineering standards.
+작은 개인용 코딩 규율 스킬입니다.
 
-`jhste-skills` gives Codex, Claude Code, and other AI coding agents a shared engineering workflow. It helps agents verify assumptions before editing, respect repo-local instructions, keep API/database/automation boundaries clear, apply SOLID-informed coding discipline and design review, run changed-file guards, and perform a red-team code review before claiming work is complete. Guard findings are review candidates, not automatic SOLID proof, and completion reports should separate current proof, checks not run, and residual risk.
+이 저장소는 하나의 스킬만 제공합니다.
 
-## What SOLID means here
+- `jhste-coding`: 저장소 코드 수정 중 적용하는 가벼운 SOLID-first 코딩 규율
 
-SOLID is used here as a design review lens for concrete maintenance and failure risks, not as an automatic compliance checklist or abstraction trigger.
+이 저장소는 workflow 스킬을 vendoring하지 않습니다. 더 넓은 계획, 이슈, PRD, 디버깅, 아키텍처, 리뷰 workflow에는 `mattpocock/skills`를 별도로 사용하세요.
 
-- **S — Single Responsibility:** each changed function, module, or class should have one main job and one main reason to change.
-- **O — Open/Closed:** adding a new variant, provider, or policy should not force repeated edits to core branching when a real extension boundary would be safer.
-- **L — Liskov Substitution:** implementations should not weaken caller expectations for return shape, nullability, errors, side effects, or documented behavior.
-- **I — Interface Segregation:** callers should not depend on broad config, interface, or props objects when they only need a small, stable slice.
-- **D — Dependency Inversion:** high-level policy should not be tightly coupled to concrete DB, API, browser, filesystem, email, payment, or queue effects unless that boundary is intentional and visible.
+## npm으로 설치
 
-This tool does **not** take over your project. Repo-local `AGENTS.md`, `CLAUDE.md`, and docs remain authoritative. The default setup is advisory, marker-managed, and designed to be low-risk to try.
+이 패키지는 CLI를 제공하지 않습니다. npm 패키지는 스킬 파일을 배포하기 위한 작은 번들입니다.
 
-Skills are designed to be used automatically when the situation calls for them. For example, when an agent edits API code, it is guided to use the API/database boundary skill; before completion, it is guided to use the red-team review skill. You can also call a skill directly, for example: `use jhste-engineering-groundwork to review this change premise`, or `run jhste-red-team-review on this diff`.
-
-## Why install this?
-
-AI coding agents are fast, but they fail in predictable ways:
-
-- They silently accept unclear requirements or incorrect premises.
-- They expand the scope while trying to be helpful.
-- They mix UI, route/controller, service, database, and side-effect responsibilities in one place, or add abstractions without a real SOLID-informed boundary.
-- They apply broad cleanup or search/replace edits directly from raw search results.
-- They hide failures or produce unsafe logs.
-- They say “done” before the changed code has been checked.
-- They forget repo-specific rules when you switch machines or repositories.
-
-`jhste-skills` gives agents a repeatable loop for reducing those failures:
-
-```text
-Before a non-trivial code change:
-  check the goal, premise, ownership boundary, data contract, failure path, final behavior predicates, and SOLID-informed review lens
-  identify the failure modes that matter for the changed execution path instead of filling out a fixed checklist
-
-While editing:
-  treat repo-local instructions as the authority
-
-After changing code:
-  run a fast changed-file guard when available
-
-Before saying “done”:
-  run a read-only red-team code review and prefer actual consumer-path proof when feasible
-
-If warnings appear:
-  attempt a bounded fix, re-check, and stop instead of looping forever
-```
-
-The expected result is smaller diffs, clearer SOLID-informed boundaries, safer API/database code, fewer silent assumptions, safer cleanup/search-replace behavior, and more honest completion reports grounded in current proof of the changed public behavior.
-
-## Who should install this?
-
-Install `jhste-skills` if you:
-
-- use Codex, Claude Code, or another coding agent across multiple repositories;
-- want agents to verify assumptions before non-trivial code changes;
-- want existing repo docs to remain the source of authority;
-- want lightweight advisory checks before commit or before declaring work complete;
-- care about SOLID-informed coding discipline, API/database boundaries, safe logging, input validation, cleanup safety, side effects, and automation reliability;
-- want to restore the same AI coding workflow across machines and repositories.
-
-You may not need this if you only want a single prompt file, want strict CI enforcement immediately after installation, do not want generated `.jhste/` files or bridge blocks, or expect this tool to automatically refactor code.
-
-## Quick start
-
-```bash
-npx jhste-skills install
-```
-
-Or install the CLI globally with npm and use it from any repository:
-
-```bash
+```sh
 npm install -g jhste-skills
-jhste-skills install
-```
-
-Use `npx` when you want a one-off run without a global install. Use `npm install -g` when you want `jhste-skills` available as a normal shell command.
-
-### Global setup (Codex + Claude Code + OpenCode, advisory-only)
-
-If you want the skills available in every repository without per-repo files or git hooks, set up once at the user level:
-
-```bash
-npm install -g jhste-skills
-jhste-skills global
-```
-
-This copies the skills (and shared companion resources) to `~/.jhste/skills` and writes a marker-managed bridge block into each agent's global instruction file (`~/.claude/CLAUDE.md`, `~/.codex/AGENTS.md`, `~/.config/opencode/AGENTS.md`), creating them if needed. No git hooks and no per-repo files are written; guard stays advisory (`jhste-skills guard --scope changed`). Choose agents with `--agents codex,claude,opencode`, and remove everything with `jhste-skills global --uninstall`.
-
-After this one-time global setup, later `npm update -g jhste-skills` runs a safe global-only refresh of the managed skill copies and existing managed global bridge blocks. Re-run `jhste-skills global` when you want to change agents or options.
-
-The default (per-repo) install uses Normal mode.
-
-- Installs all bundled skills: jhste core skills + vendored workflow skills.
-- Creates `.jhste/profile.yaml` when missing; `--force` refreshes generated/managed profiles, while modified profiles require `--force --allow-profile-overwrite`.
-- Adds or refreshes a marker-managed bridge block in `AGENTS.md` or `CLAUDE.md` when project guidance is enabled.
-- Installs an advisory pre-commit hook when safe.
-- Does not modify CI, target `package.json`, lockfiles, or source code.
-
-To connect another repository:
-
-```bash
-cd /path/to/another-repo
-jhste-skills connect
-```
-
-To install only the jhste core guardrail skills:
-
-```bash
-npx jhste-skills install --skill-set core
-```
-
-To run the changed-file guard manually:
-
-```bash
-jhste-skills guard --scope changed --format text --fail-on error
+mkdir -p ~/.codex/skills
+cp -R "$(npm root -g)/jhste-skills/skills/jhste-coding" ~/.codex/skills/
 ```
 
-To refresh only the installed skill files after pulling this repository, without touching a project bridge, profile, hook, or scan output:
+사용하는 에이전트의 skills 디렉터리가 다르다면 `skills/jhste-coding/`을 그 위치로 복사하세요.
 
-```bash
-jhste-skills update --yes --skills-only
-```
-
-To run an optional repo-wide advisory scan:
-
-```bash
-jhste-skills deep-scan
-```
-
-To remove managed outputs:
+## 저장소에서 설치
 
-```bash
-jhste-skills uninstall --yes --repo /path/to/repo
+```sh
+mkdir -p ~/.codex/skills
+cp -R skills/jhste-coding ~/.codex/skills/
 ```
 
-`uninstall` removes managed hooks, marker-managed bridge blocks, and manifest-managed skill directories. It does not touch non-managed files. `.jhste/profile.yaml` is removed only when it still matches the current or legacy generated shape; use `--force-profile` only after reviewing a modified profile.
-
-## Install modes
-
-```text
-Minimal  - installs only jhste core skills; no project files or hooks
-Normal   - recommended default; all bundled skills + project profile/bridge + advisory pre-commit hook
-Full     - all bundled skills + profile/bridge + advisory pre-commit/pre-push hooks + deep scan
-Custom   - asks effect-oriented questions so you can choose the setup
-```
-
-`Full` still follows the safety contract. It does not overwrite non-managed hooks, source files, CI, `package.json`, or lockfiles, and it does not enable strict mode. Interactive Full mode only asks how automatic checks should behave: warning-only, block at commit time, or block at commit and push time. `--yes` uses warning-only unless `--hooks blocking` is explicit.
-
-## Safety contract
-
-`jhste-skills` is safe-by-default:
-
-- repo-local `AGENTS.md`, `CLAUDE.md`, and docs remain authoritative;
-- explicit user instructions set task scope, but do not silently override verified safety, privacy, data-loss, or repo-architecture constraints;
-- default install does not modify CI;
-- default install does not modify target `package.json` or lockfiles;
-- default install does not automatically refactor source code;
-- managed hooks are advisory by default;
-- strict mode requires explicit opt-in;
-- bridge blocks use `<!-- jhste-skills:start -->` / `<!-- jhste-skills:end -->` markers;
-- guard output is review evidence, not proof by itself;
-- completion review should prefer actual consumer-path proof when feasible and separate current proof, skipped checks, checks not run, and residual risk;
-- cleanup/search-replace work should classify editable paths separately from protected evidence/history-like paths before writing;
-- guard runtime/config failures must be reported separately from rule violations;
-- install/update/uninstall flows leave non-managed hooks, bridge text, and skill directories untouched.
-
-## Core jhste skills
-
-These are the jhste-authored guardrail skills. They are installed by default as part of the bundled skill set. Use `--skill-set core` to install only these core skills.
-
-| Skill | Use it when | What it helps reduce |
-|---|---|---|
-| [`setup`](skills/setup/SKILL.md)<br>A safe setup skill that prevents install/connect/update flows from overwriting existing project instructions | Installing or connecting the kit to a repository | Unsafe overwrite, unmanaged hook conflict, repo instruction replacement |
-| [`ask-jhste`](skills/ask-jhste/SKILL.md)<br>A user-invoked router for choosing the right jhste skill or workflow | You are not sure which jhste skill or workflow to use next | Wrong workflow selection, unnecessary always-on context, accidental side effects from routing |
-| [`jhste-engineering-groundwork`](skills/jhste-engineering-groundwork/SKILL.md)<br>A pre-change groundwork skill that verifies goal, premise, scope, boundary, failure path, and final behavior predicates before code edits | Before non-trivial code changes | Blind agreement, scope creep, unverified assumptions, unclear boundaries |
-| [`jhste-code-quality`](skills/jhste-code-quality/SKILL.md)<br>A code-quality skill for input validation, observable failure handling, secret-safe logging, and oversized-file review | Touching external input, failure handling, logging, env/config, cleanup/search-replace, or code-quality review paths | Unvalidated input, silent failure, secret logging, unsafe broad cleanup, oversized files |
-| [`jhste-architecture-review`](skills/jhste-architecture-review/SKILL.md)<br>An architecture review skill for module boundaries, side-effect placement, and SOLID-informed design risks | Changing module boundaries, app structure, side-effect placement, or responsibility splits | Pass-through abstraction, mixed responsibility, side-effect leakage |
-| [`jhste-db-api-boundary`](skills/jhste-db-api-boundary/SKILL.md)<br>A boundary skill that checks responsibility and data contracts across API routes, services, repositories, and SQL | Touching API, controller, service, repository, SQL, or persistence code | Fat routes, unsafe SQL, missing auth/data scoping, leaky DTOs |
-| [`jhste-crawler-automation`](skills/jhste-crawler-automation/SKILL.md)<br>An automation skill for crawler/scraper/worker/scheduler producer-consumer boundaries and side effects | Touching crawlers, scrapers, workers, schedulers, or browser automation | Fragile automation, unclear producer/consumer boundaries, hidden side effects |
-| [`jhste-red-team-review`](skills/jhste-red-team-review/SKILL.md)<br>A read-only red-team code review skill that aggressively re-checks changed code before completion | Before declaring non-trivial code work complete | Premature “done”, missing consumer-path proof, missed null/auth/env/write/API/performance risks |
-| [`jhste-long-running-work-loop`](skills/jhste-long-running-work-loop/SKILL.md)<br>A narrow orchestration skill for preserving work state across sessions, wait states, and durable decisions | Losing state could make work wrong, duplicated, unsafe, or hard to resume: multi-session work, recurring reviews, same-day or multi-day external wait states, multiple repos, PRD→issue→implementation→review flows, or durable decisions | Lost context, stale scratchpads, unclear approval boundaries, unsafe resume points |
-
-## Bundled workflow skills
-
-Normal install also includes 14 workflow skills vendored from Matt Pocock's [`mattpocock/skills`](https://github.com/mattpocock/skills). These are useful for implementation, debugging, planning, architecture, issue workflows, prototyping, handoffs, and skill-writing guidance. Use `--skill-set core` if you do not want them installed.
-
-| Skill | Use it when |
-|---|---|
-| [`diagnosing-bugs`](skills/diagnosing-bugs/SKILL.md)<br>A debugging skill that narrows root cause around a fast pass/fail feedback loop | You need a reproduce → minimise → hypothesise → instrument → fix loop |
-| [`grill-me`](skills/grill-me/SKILL.md)<br>A direct personal grilling skill for aggressively questioning your own plan or reasoning | You ask to be grilled, challenged, pressure-tested, or questioned aggressively |
-| [`grill-with-docs`](skills/grill-with-docs/SKILL.md)<br>A grilling skill that records resulting domain terms and decisions in CONTEXT.md or ADRs | You want stress-testing plus documentation, ADR, glossary, or CONTEXT updates |
-| [`grilling`](skills/grilling/SKILL.md)<br>A general read-only grilling skill for pressure-testing plans and designs before implementation | You ask to challenge, pressure-test, red-team, grill, or find gaps without docs updates |
-| [`domain-modeling`](skills/domain-modeling/SKILL.md)<br>A skill for sharpening project terminology, domain models, and architectural decisions | Refining domain terms, ubiquitous language, or architectural decisions |
-| [`codebase-design`](skills/codebase-design/SKILL.md)<br>A codebase design skill for deep modules, small interfaces, and clear boundaries | You need better module interface, boundary, and testability vocabulary |
-| [`improve-codebase-architecture`](skills/improve-codebase-architecture/SKILL.md)<br>An architecture skill that finds shallow modules and coupling that can be improved into deeper modules | You want to find deepening opportunities and reduce architectural friction |
-| [`prototype`](skills/prototype/SKILL.md)<br>A prototyping skill for validating logic/state models or UI directions with throwaway local code | You ask to prototype, mock up, try designs, sanity-check behavior, or “let me play with it” |
-| [`to-prd`](skills/to-prd/SKILL.md)<br>A PRD-writing skill that drafts requirements and makes them ready for the normal project workflow | You want a PRD; tracker publication happens only when directly requested or repo-approved |
-| [`to-issues`](skills/to-issues/SKILL.md)<br>A skill that breaks a plan into issue-ready vertical slices | You want implementation tickets or work breakdown; tracker creation follows direct request or repo approval |
-| [`triage`](skills/triage/SKILL.md)<br>An issue triage skill that classifies issues and plans next actions through a structured workflow | You want issue classification, next-action planning, or repo-approved triage writes |
-| [`handoff`](skills/handoff/SKILL.md)<br>A handoff skill that compresses context so the next agent or session can continue | You ask for a handoff, session summary, continuation brief, or next-agent context |
-| [`implement`](skills/implement/SKILL.md)<br>An implementation workflow skill for scoped PRD/issue/spec work using jhste groundwork, verification, guard, and review | You want an agent to implement focused work from a PRD, issue, spec, or handoff |
-| [`writing-great-skills`](skills/writing-great-skills/SKILL.md)<br>A skill-writing reference for predictable invocation, progressive disclosure, context load control, and pruning | You want to create, replace, or refine an agent skill |
-
-## Attribution: Matt Pocock skills
-
-This repository vendors the 14 skills listed above from Matt Pocock's [`mattpocock/skills`](https://github.com/mattpocock/skills).
-
-Those skills are vendored under the upstream MIT License. This repository preserves the required copyright/license notice and records the imported sources.
-
-- Upstream: [`mattpocock/skills`](https://github.com/mattpocock/skills)
-- License: MIT
-- Attribution: [`vendor/matt-pocock/NOTICE.md`](vendor/matt-pocock/NOTICE.md)
-- Upstream license copy: [`vendor/matt-pocock/LICENSE`](vendor/matt-pocock/LICENSE)
-- Allowlist: [`vendor/matt-pocock/allowlist.json`](vendor/matt-pocock/allowlist.json)
-- Source lock: [`vendor/matt-pocock/source-lock.json`](vendor/matt-pocock/source-lock.json)
-
-Do not add vendored skills outside the allowlist without separate review. When updating vendored copies, refresh the source lock and review the diff.
-
-## CLI commands
-
-```bash
-jhste-skills install
-jhste-skills connect
-jhste-skills guard
-jhste-skills deep-scan
-jhste-skills tune
-jhste-skills baseline
-jhste-skills sync
-jhste-skills update
-jhste-skills hooks
-jhste-skills uninstall
-```
-
-See [`docs/CLI.md`](docs/CLI.md) for detailed command behavior.
-
-## Recommended rollout
-
-1. Run the default install and dogfood the advisory workflow first.
-2. Keep advisory hooks at first. Use `--skip-hooks` if you do not want commit-time checks, and enable blocking mode only after reviewing noise and false positives.
-3. Start with the default 300-line advisory limit. Use `--line-limit-mode blocking` only when the team is ready for warning-level hook enforcement.
-4. During code changes, run `guard --scope changed --format text --fail-on error` manually.
-5. Before non-trivial code changes, use `jhste-engineering-groundwork` to check scope, boundary, failure path, data contract, assumptions, and the SOLID-informed review lens for changed classes/modules/functions.
-6. Before declaring non-trivial code work complete, use `jhste-red-team-review`. Skip docs-only, comment-only, formatting-only, and trivial rename-only changes.
-7. Limit fix + re-review loops to two cycles, then report remaining risks instead of looping indefinitely.
-8. Create a baseline only after reviewing existing debt. Treat the baseline as a known-issues ledger and use ratchet behavior to stop new debt, not to hide scanner failures.
-
-## Repository layout
-
-```text
-skills/                 AI-readable skill guidance
-rules/                  Stable rule metadata used by skills and scans
-packs/                  Core, web, API, database, and crawler rule bundles
-adapters/               Codex, Claude, and generic adapter notes
-cli/                    install, uninstall, deep-scan, guard, hooks, tune, and baseline commands
-vendor/matt-pocock/     Matt Pocock allowlist, source lock, license, and attribution
-examples/profile.yaml   Default advisory profile example
-```
-
-## Verification
-
-```bash
-npm test
-npm run public-safety:check
-npm run vendor:check
-npm run docs:check
-```
-
-See [`docs/ACCEPTANCE_CHECK.md`](docs/ACCEPTANCE_CHECK.md) for release acceptance notes.
-
-## Philosophy
-
-`jhste-skills` is not a tool for giving agents more authority. It is a tool for making fast agents more reliable.
-
-- Do not agree blindly.
-- Do not overwrite local project authority.
-- Keep changes scoped.
-- Use SOLID-informed coding discipline as a clean-code review lens: name responsibilities, review extension boundaries, preserve caller contracts, keep interfaces right-sized, and make concrete dependencies visible when they create maintenance or failure risk.
-- Make failures observable.
-- Treat automated guard output as evidence, not proof.
-- Run a red-team code review before calling non-trivial work complete.
+## SOLID-first 규율
 
-Fast agents need guardrails. `jhste-skills` gives them a repo-respecting engineering workflow.
+`jhste-coding`은 작은 실제 코드 변경에 SOLID를 주된 렌즈로 적용합니다.
 
-Skills share cross-cutting doctrine (SOLID lens, evidence discipline, issue-candidate protocol, scope discipline) from `skills/_shared/`. Directories under `skills/` whose name starts with `_` are shared companion resources, not skills: they are excluded from skill listing, selection, and missing-skill checks, but are copied alongside the skills whenever any skill is installed so cross-skill `../_shared/...` references never dangle in the installed artifact.
+- **단일 책임:** 변경한 단위가 하나의 분명한 일을 하도록 유지합니다.
+- **개방/폐쇄:** 실제 변형이 반복해서 같은 핵심 로직을 바꾸게 만들 때만 확장 지점을 둡니다.
+- **리스코프 치환:** 반환 형태, null 가능성, 오류, 부수 효과 같은 호출자 기대를 보존합니다.
+- **인터페이스 분리:** 필요한 만큼의 작은 계약에 의존합니다.
+- **의존성 역전:** 명확해질 때 비즈니스 규칙과 구체적인 부수 효과를 분리합니다.
 
-Installed skill directories are tracked with `.jhste-skills-manifest.json`. `--force` refreshes manifest-managed skill copies and generated/managed profiles; modified profiles need `--force --allow-profile-overwrite`; overwriting unmanaged differing skill directories still requires the separate `--allow-unmanaged-skill-overwrite` flag after review. `sync` and `update` can also adopt additional known jhste skills into an already managed skills directory so older mixed installs can be reconciled without a manual overwrite flag. Legacy managed renames are also reconciled during `sync` and `update`, so older managed installs that still have `diagnose` or `jhste-engineering-judgment` are migrated to `diagnosing-bugs` or `jhste-engineering-groundwork`. Managed copies of retired `write-a-skill` are removed rather than kept as a compatibility fallback.
+이 스킬은 코드 작성 중 쓰는 규율이며 더 넓은 프로세스 자동화나 리뷰 파이프라인이 아닙니다.

package/package.json

@@ -1,53 +1,22 @@
 {
   "name": "jhste-skills",
-  "version": "0.4.0",
-  "description": "Installable engineering guardrails and workflow skills for AI coding agents.",
+  "version": "0.5.0",
+  "description": "A single lightweight SOLID-first coding discipline skill.",
   "type": "module",
   "license": "MIT",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/jhste102lab/jhste-skills.git"
   },
-  "bin": {
-    "jhste-skills": "cli/index.mjs"
-  },
   "files": [
-    "adapters/",
-    "cli/",
-    "docs/ACCEPTANCE_CHECK.md",
-    "docs/CLI.md",
-    "docs/CONFLICT_RESOLUTION.md",
-    "docs/PUBLIC_SAFETY.md",
-    "docs/RULES.md",
-    "docs/VENDORING.md",
-    "examples/",
-    "packs/",
-    "rules/",
-    "scripts/",
-    "skills/",
-    "vendor/",
+    "skills/jhste-coding/SKILL.md",
     "README.md",
-    "README.ko.md",
-    "README.zh.md",
-    "README.ja.md",
+    "README.en.md",
     "CHANGELOG.md",
     "LICENSE"
   ],
   "scripts": {
-    "test": "npm run syntax:check && npm run docs:check && npm run vendor:check && npm run public-safety:check && npm run public-safety-fixtures:test && npm run profile-fixtures:test && npm run guard-fixtures:test && npm run responsibility-budget-fixtures:test && npm run single-responsibility-fixtures:test && npm run solid-design-fixtures:test && npm run smoke:test && npm run release:gates",
-    "postinstall": "node cli/postinstall-global-refresh.mjs",
-    "syntax:check": "node scripts/syntax-check.mjs",
-    "docs:check": "node scripts/docs-check.mjs",
-    "vendor:check": "node scripts/vendor-check.mjs",
-    "public-safety:check": "node scripts/public-safety-check.mjs",
-    "public-safety-fixtures:test": "node scripts/public-safety-fixtures-test.mjs",
-    "profile-fixtures:test": "node scripts/profile-fixtures-test.mjs",
-    "guard-fixtures:test": "node scripts/guard-fixtures-test.mjs",
-    "responsibility-budget-fixtures:test": "node scripts/responsibility-budget-fixtures-test.mjs",
-    "single-responsibility-fixtures:test": "node scripts/single-responsibility-fixtures-test.mjs",
-    "smoke:test": "node scripts/smoke-test.mjs",
-    "release:gates": "node scripts/release-gates-test.mjs",
-    "solid-design-fixtures:test": "node scripts/solid-design-fixtures-test.mjs"
+    "test": "node --input-type=module -e \"import fs from 'node:fs'; const exists = (p) => fs.existsSync(p); const pkg = JSON.parse(fs.readFileSync('package.json', 'utf8')); const skill = 'skills/jhste-coding/SKILL.md'; if (!exists(skill)) throw new Error('missing skill'); const text = fs.readFileSync(skill, 'utf8'); if (!/^---\\nname: jhste-coding\\ndescription: .+\\n---/m.test(text)) throw new Error('invalid skill frontmatter'); const dirs = fs.readdirSync('skills', { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name); if (dirs.length !== 1 || dirs[0] !== 'jhste-coding') throw new Error('expected only jhste-coding skill'); for (const file of pkg.files) if (!exists(file)) throw new Error('package file does not exist: ' + file); for (const file of ['README.md', 'README.en.md']) { const body = fs.readFileSync(file, 'utf8'); if (!body.includes('jhste-coding')) throw new Error(file + ' does not describe jhste-coding'); for (const match of body.matchAll(/\\[[^\\]]+\\]\\(([^)]+)\\)/g)) { const href = match[1]; if (!/^(https?:|mailto:|#)/.test(href) && !exists(href.split('#')[0])) throw new Error(file + ' has broken link: ' + href); } }\""
   },
   "engines": {
     "node": ">=18"

package/skills/jhste-coding/SKILL.md

@@ -0,0 +1,36 @@
+---
+name: jhste-coding
+description: Apply lightweight SOLID-first coding discipline while actively writing or editing repository code.
+---
+
+# jhste-coding
+
+Use this skill to write small, direct, readable code guided primarily by SOLID.
+
+SOLID is the main discipline. The guardrails below keep the code practical.
+
+## Core rule
+
+Prefer the smallest clear change that fits the requested problem and keeps the code SOLID-aligned.
+
+Use SOLID for the current change; speculative architecture, broad refactors, and abstraction layers are outside this skill's purpose.
+
+## SOLID discipline
+
+- **S — Single Responsibility:** keep each changed function, module, or class centered on one clear job. Choose names that make the job easy to see.
+- **O — Open/Closed:** add an extension seam when real variation or repeated branching would otherwise keep changing the same core logic. Keep simple branches when they read better.
+- **L — Liskov Substitution:** preserve caller-facing expectations: return shape, nullability, errors, side effects, timing assumptions, and documented behavior.
+- **I — Interface Segregation:** depend on the smallest useful contract. Prefer narrow parameters over broad objects, global context, or large config bags when only a small slice is needed.
+- **D — Dependency Inversion:** keep business rules separate from concrete side effects when that separation makes the code clearer. Make database, network, filesystem, browser, queue, email, payment, clock, environment, and secret boundaries easy to see.
+
+## Practical guardrails
+
+- Interfaces, factories, base classes, dependency containers, and strategy layers fit best when they clarify a real boundary, remove real repeated change, or protect a caller contract.
+- Validate external input where it enters the code path.
+- Make uncertain, partial, and failed states visible rather than silently treating them as success.
+- Keep secrets, tokens, credentials, cookies, authorization headers, sessions, and raw sensitive payloads out of logs and responses.
+- When adding or changing tests, focus on observable behavior related to the change.
+
+## Final response
+
+Briefly say what changed.