skilldrop-cli 0.16.8 → 0.16.10

package/README.md

@@ -55,14 +55,14 @@ In Claude Code you can use the plugin marketplace instead: run `/plugin marketpl
 ## How it works
 
 - **A skill produces one file you own.** Each ships a quality bar, named anti-patterns and acceptance evals, so the output is an artifact, not a conversation. See [every skill, by category](guides/reference/skill-catalogue.md).
-- **Loops order skills, and a gate decides when work moves on.** Five loops cover the lifecycle (`discover`, `design`, `build`, `release`, `operate`), plus the `ship-a-draft` wrapper for any document and `apply` for a job application. Each gate is a script, a review panel or a person, chosen by how expensive the mistake is to undo. See [the loops, stage by stage](guides/reference/loops.md) and [why loops](guides/explanation/loops.md).
+- **Loops order skills, and a gate decides when work moves on.** Five loops cover the lifecycle (`discover`, `design`, `build`, `release`, `operate`), plus the `ship-a-draft` wrapper for any document and `apply` for a job application. Each gate is a script, a review panel or a person, chosen by how expensive the mistake is to undo. See [the operating model](guides/explanation/operating-model.md) for every stage and gate on one page, [the loops, stage by stage](guides/reference/loops.md), and [why loops](guides/explanation/loops.md).
 - **Measured, not asserted.** `run_bench.py` runs each acceptance eval with the skill and without it, in a sandbox, and reports the lift, a blind preference from two judges, and the cost per run. The results are published whether or not they flatter the skills. See [how skills are checked](https://sananthanarayan.github.io/skilldrop/evals/) and [RFC-0040](docs/rfcs/0040-skill-benchmark.md).
 - **Copy, never transform.** A skill is a plain `SKILL.md` folder in the [Agent Skills](https://agentskills.io) format, at `packs/<pack>/skills/<name>/`. What runs in your agent is byte-identical to what is reviewed here. There is no runtime, and the tooling has zero dependencies.
 - **Updates keep your edits.** `npx skilldrop-cli update` replaces files you haven't touched. For any file you changed, it leaves the new version beside it as `<file>.upstream`. See [upgrade installed skills](guides/how-to/upgrade-skills.md).
 
 ## Go deeper
 
-- **Use it:** [docs portal](https://sananthanarayan.github.io/skilldrop/docs/) · [a guide for every pack](guides/README.md#per-pack) · [install in any IDE](guides/how-to/install-per-ide.md) · [try skills in a repo you don't own](guides/how-to/install-per-ide.md#trying-skills-in-a-repo-you-dont-own) · [profiles](guides/how-to/profiles.md) · [hooks](guides/how-to/wire-a-hook.md)
+- **Use it:** [the operating model](guides/explanation/operating-model.md) · [docs portal](https://sananthanarayan.github.io/skilldrop/docs/) · [a guide for every pack](guides/README.md#per-pack) · [install in any IDE](guides/how-to/install-per-ide.md) · [try skills in a repo you don't own](guides/how-to/install-per-ide.md#trying-skills-in-a-repo-you-dont-own) · [profiles](guides/how-to/profiles.md) · [hooks](guides/how-to/wire-a-hook.md)
 - **Run it in CI:** [a skill on every pull request](guides/how-to/run-a-skill-in-ci.md) · [how skills are checked](https://sananthanarayan.github.io/skilldrop/evals/) · [benchmark skills yourself](guides/how-to/benchmark-skills.md) · [measure your loops](guides/how-to/measure-your-loops.md)
 - **Roll it out:** [across your org, including an internal mirror](guides/how-to/enterprise-distribution.md) · [publish your own catalogue](guides/how-to/publish-a-catalogue.md) · [security and the OWASP Top 10s](guides/reference/owasp-mapping.md)
 - **Reviewers:** three subagents that push back on generated work: `devils-advocate`, `security-reviewer` and `code-quality`. See [`agents/`](agents/README.md).

package/contracts/guide.schema.json

@@ -13,6 +13,10 @@
       "enum": ["tutorial", "how-to", "reference", "explanation"],
       "description": "tutorial = learning by doing. how-to = a task with a goal. reference = look it up. explanation = why it is this way. A page that cannot pick one is doing two jobs and should be split."
     },
-    "status": { "enum": ["draft", "review", "stable", "deprecated"], "default": "stable" }
+    "status": { "enum": ["draft", "review", "stable", "deprecated"], "default": "stable" },
+    "stage": {
+      "enum": ["discover", "design", "build", "release", "operate"],
+      "description": "RFC-0044. The lifecycle stage a page belongs to, when it belongs to one. The docs sidebar groups staged pages under that stage, beside the stage's loop; a page that spans every stage, or none, leaves it out."
+    }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skilldrop-cli",
-  "version": "0.16.8",
+  "version": "0.16.10",
   "description": "Portable AI-agent skills, measured against the agent without them. ADRs, PRDs, runbooks, decks and reviews, installable into Claude Code, Cursor, Kiro, and any IDE that takes custom instructions. One command per skill or per role-based pack.",
   "author": {
     "name": "Sanjay Ananthanarayan",

package/packs/ai-engineering/skills/ai-usage-policy/evals/evals.json

@@ -44,6 +44,36 @@
         "It does not state that a specific law, regulator or sector code applies as fact; any mention is marked as something to confirm",
         "The policy itself is short: about two pages or less (roughly 800 words)"
       ]
+    },
+    {
+      "id": 4,
+      "held_out": "2026-10-06",
+      "prompt": "I'm in security GRC at Ledgerline Payments (850 people) and I've been handed the AI acceptable-use policy to draft. The CISO's brief is in ciso-brief.md, the tools we have are in tool-inventory.csv, legal's notes are in legal-notes.md and there's a write-up of last month's incident in incident-summary.md. Can you draft it? Three pages tops — it's going to the exec meeting and people won't read more than that.",
+      "assertions": [
+        "It says cardholder data must not go into any AI tool, including CodePilot Enterprise, and tells the CISO it has not included the rule she asked for because legal's notes say the Corvane Bank agreement and PCI scope prohibit it regardless of zero retention",
+        "LingoDraft is not listed as approved: its contract expired on 31 August 2026 and the renewal is unsigned, and the draft says what support should do for translation meanwhile or flags it for decision",
+        "Transcribo is not approved for customer calls: the DPA is unsigned, so the support team's plan for next month is blocked until it is signed",
+        "It points out that CodePilot has 300 seats against 410 engineers, so about 110 engineers have no seat, and says what they should use or do instead of a personal account",
+        "It does not route exceptions to the AI Review Group as if it were working: it notes the group has not met since June and has no chair, and names an interim approver role or flags the decision for the exec",
+        "It says production logs and other customer data must not be pasted into personal or public AI accounts, and gives staff a specific place to report it if they already have",
+        "Last-four card digits together with an email address are treated as cardholder data for now, with a note that legal is still confirming this",
+        "It names no law, regulation or standard other than GDPR and PCI DSS, and does not name the engineer involved in the incident"
+      ]
+    },
+    {
+      "id": 5,
+      "held_out": "2026-10-06",
+      "prompt": "I run a small video production studio, 9 of us. One of our clients, a big retailer, has sent a supplier questionnaire and one question is 'do you have an AI policy?' We don't. What I know: we use AI image generation for mood boards and storyboards, a few people use ChatGPT for first drafts of scripts, and I think one of the editors has been using an AI voice tool for scratch voiceovers. The client contracts say something about not using their footage for anything else, but I haven't re-read them. Can you write me a one-pager I can attach to the questionnaire?",
+      "assertions": [
+        "It delivers a draft policy in the reply and does not stop at a list of questions",
+        "It says client footage, briefs and unreleased material must not be put into AI tools unless the client's contract or written permission allows it, and says what staff do in the meantime",
+        "It tells the user to re-read the client contracts before sending this, and does not state what those contracts permit or prohibit as if known",
+        "It covers the three uses mentioned (image generation for mood boards and storyboards, ChatGPT for script drafts, the AI voice tool) and marks the voice tool use as unconfirmed; it does not present a list of approved tools with accounts or plans as already settled",
+        "It says a real person's voice or likeness must not be cloned or imitated with AI without that person's consent",
+        "It says whether and when a client is told that AI-generated images, voice or script went into work delivered to them",
+        "It does not state as fact that a specific law applies or that the studio owns the copyright in AI-generated material; any such point is marked as something to check",
+        "The policy itself fits on about one page (roughly 500 words or fewer)"
+      ]
     }
   ]
 }

package/packs/ai-engineering/skills/ai-usage-policy/evals/files/4/ciso-brief.md

@@ -0,0 +1,15 @@
+From: Anneliese Vort (CISO)
+To: Security GRC
+Date: 28 September 2026
+Subject: AI policy - what I want in it
+
+Notes for the draft. I need it for the exec meeting on the 15th.
+
+- One policy for all 850 staff, not one per department.
+- All four tools on the inventory are approved. List them.
+- Everyone in engineering (410 people) has a CodePilot Enterprise licence, so there is no reason for anyone to be using a personal account. Say so.
+- Because CodePilot has the zero-retention addendum, say card data is OK in CodePilot. Engineers debugging payment issues need it, and it will stop them going elsewhere.
+- Exceptions go through the AI Review Group.
+- Support want to start using Transcribo on customer calls from next month. Cover that.
+- Refer to the 9 September incident so people understand why we are doing this, without naming the engineer.
+- People will not read ten pages.

package/packs/ai-engineering/skills/ai-usage-policy/evals/files/4/incident-summary.md

@@ -0,0 +1,22 @@
+# INC-2291: summary
+
+Opened 10 September 2026. Status at 30 September: open.
+
+## What happened
+On 9 September an engineer debugging failed refunds pasted about 600 lines of production logs into a personal account on a public chatbot.
+
+## What was in the logs
+- 2,300 customer email addresses
+- The last four digits of card numbers
+- No full card numbers, expiry dates or security codes
+
+## Timeline
+- 9 Sept: logs pasted.
+- 10 Sept: the engineer reported it themselves to their team lead, who did not know where to send it. It reached Security that afternoon.
+- 11 Sept: deletion request sent to the chatbot provider.
+- 30 Sept: no confirmation of deletion received.
+
+## Contributing factors
+- The engineer had no CodePilot Enterprise seat and was on the waiting list.
+- No written guidance on whether logs may be pasted into AI tools.
+- No clear place to report it.

package/packs/ai-engineering/skills/ai-usage-policy/evals/files/4/legal-notes.md

@@ -0,0 +1,14 @@
+# Legal notes for the AI policy
+
+Bartholomew Nkemelu, Senior Counsel, Ledgerline Payments
+22 September 2026
+
+1. **Cardholder data.** Card numbers, expiry dates and security codes must not leave the cardholder data environment. Our PCI DSS scope and our acquiring agreement with Corvane Bank (clause 14.3) both prohibit sending cardholder data to any third party not listed in the agreement. Northgate AI is not listed. A zero-retention addendum does not change this.
+
+2. **Customer personal data.** Under GDPR, customer names, email addresses and transaction history may be processed in AskDesk and CodePilot Enterprise under the signed DPAs. They may not go into any tool without a signed DPA.
+
+3. **Transcribo.** We are still negotiating the sub-processor terms. Do not record customers until the DPA is signed. I cannot give a date.
+
+4. **AI Review Group.** It has not met since June. Idris, who chaired it, moved to the Lisbon office project and was not replaced. Somebody needs to decide who approves exceptions. That is not a legal decision.
+
+5. **Not yet checked.** Whether the last four digits of a card number together with an email address count as cardholder data under our scope. I will confirm with the QSA. Treat as cardholder data until I do.

package/packs/ai-engineering/skills/ai-usage-policy/evals/files/4/tool-inventory.csv

@@ -0,0 +1,5 @@
+tool,vendor,purpose,seats,contract_status,contract_end,data_terms,notes
+CodePilot Enterprise,Northgate AI,coding assistant,300,signed,2027-03-31,"zero-retention addendum signed 2026-02-12; no training on our data",engineering only; waiting list open
+AskDesk,Pellam Systems,general internal chatbot,850,signed,2027-01-31,"DPA signed; no training on our data; 30-day retention; EU hosting",SSO for all staff
+Transcribo,Transcribo Inc,meeting notetaker,40,pilot,2026-12-31,"DPA in legal review - not signed",pilot limited to internal meetings
+LingoDraft,Lingo Labs,translation,25,expired,2026-08-31,"renewal not signed",support still use it for Polish and Spanish replies

package/packs/api-builder/skills/tool-use-schema-writer/evals/evals.json

@@ -42,6 +42,36 @@
         "It does not state a tracking number format or pattern, a weight limit, carrier names or a dimension unit as fact",
         "It does not describe the lookup's return fields as fact, and says what the lookup returns is not yet known"
       ]
+    },
+    {
+      "id": 4,
+      "held_out": "2026-10-06",
+      "prompt": "Need a Claude tool so our support assistant can issue refunds itself. The endpoint spec is in refunds.openapi.yaml. Policy from Marguerite (head of support): the assistant can refund up to £500 on its own, anything above that goes to a human. Amounts are in pounds. Just the tool definition plus a short list of anything in the spec that looks off, I don't need the Python around it.",
+      "assertions": [
+        "It produces a tool definition with a name, a description and an input_schema of type object whose properties include the order reference, the amount and the reason",
+        "The amount parameter is an integer in minor units (pence) and its description says so; it is not defined as pounds or as a decimal",
+        "It flags that the spec caps amount_minor at 25000, which is £250 and below the £500 policy, and does not set the maximum to 50000",
+        "It flags that the spec lists amount_minor as required while its description says to omit it for a full refund",
+        "goodwill is either left out of the reason values or marked as deprecated with customer_request to be used instead",
+        "The definition states that reason_note is needed when the reason is other and is limited to 280 characters",
+        "It does not add parameters the spec does not have, such as a currency, a customer id or a refund method",
+        "The reply contains no Python client code"
+      ]
+    },
+    {
+      "id": 5,
+      "held_out": "2026-10-06",
+      "prompt": "ops run this script by hand to change a price:\n\n./reprice.sh SKU-4471 19.99 --store 12 --until 2026-11-01\n\nwant our pricing agent to be able to call it as a tool. store is optional (no store = all stores i think), until is optional too and the price goes back after that date. price is dollars. there's also a --force flag, no idea what it does, Wendell wrote the script and he's out till the 19th. quick one, just the json",
+      "assertions": [
+        "It delivers a tool definition with a name, a description and an input_schema, and does not stop at questions",
+        "The required array contains the SKU and the price, and does not contain store or until",
+        "The price parameter's description states the unit is dollars",
+        "It says that leaving store out meaning all stores is unconfirmed and should be checked",
+        "It does not state what --force does; force is either left out of the tool or included with its effect marked as unknown",
+        "The until parameter is described as a date in the YYYY-MM-DD form shown in the example",
+        "It does not state a SKU pattern, a price minimum or maximum, or a range of valid store numbers as fact; any such constraint is marked as an assumption",
+        "The reply is the JSON definition with at most a few lines of notes, and contains no Python client code"
+      ]
     }
   ]
 }

package/packs/api-builder/skills/tool-use-schema-writer/evals/files/4/refunds.openapi.yaml

@@ -0,0 +1,63 @@
+# Excerpt from payments-api/openapi.yaml, Lanternfold Events
+# Changelog
+#   2026-06-02  reason: "goodwill" deprecated, send "customer_request" instead.
+#               Still accepted until the end of the year.
+#   2026-02-17  v2: amounts moved from decimal strings to integer minor units.
+paths:
+  /v2/refunds:
+    post:
+      operationId: createRefund
+      summary: Refund all or part of a paid order
+      description: >
+        Creates a refund against a paid order. The money goes back to the
+        original payment method. An order can be refunded more than once, until
+        the refunded total reaches the amount paid. Returns 409 event_passed if
+        the event has already taken place, and 422 over_limit if the amount is
+        more than the remaining refundable amount.
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              additionalProperties: false
+              required: [order_id, amount_minor, reason]
+              properties:
+                order_id:
+                  type: string
+                  pattern: '^LF-[0-9]{8}$'
+                  description: Order reference from the confirmation email, e.g. LF-00482913.
+                amount_minor:
+                  type: integer
+                  minimum: 1
+                  maximum: 25000
+                  description: >
+                    Amount to refund, in minor units of the order's currency
+                    (pence for GBP). Omit to refund the full remaining amount.
+                reason:
+                  type: string
+                  enum: [event_cancelled, event_rescheduled, duplicate_purchase, customer_request, goodwill, other]
+                  description: Why the refund is being made. Shown on the finance report.
+                reason_note:
+                  type: string
+                  maxLength: 280
+                  description: Free-text explanation. Required when reason is "other".
+                ticket_ids:
+                  type: array
+                  minItems: 1
+                  items:
+                    type: string
+                  description: >
+                    Tickets to cancel as part of this refund. Omit to leave the
+                    order's tickets valid.
+                notify_customer:
+                  type: boolean
+                  default: true
+                  description: Send the customer the refund confirmation email.
+      responses:
+        '201':
+          description: Refund created.
+        '409':
+          description: event_passed
+        '422':
+          description: over_limit or validation error

package/packs/career/loops/apply/LOOP.md

@@ -14,18 +14,18 @@ can say what the resume shows, but only the candidate knows what is true and wha
 
 | # | Stage | Type | Skills | Gate |
 |---|---|---|---|---|
-| 1 | `fit` | gate | [`job-fit-analysis`](../../skills/job-fit-analysis/SKILL.md) | **G5** human |
+| 1 | `fit` | gate | [`job-fit-analysis`](../../skills/job-fit-analysis/SKILL.md) | **G6** human |
 | 2 | `tailor` | generate | [`resume-tailor`](../../skills/resume-tailor/SKILL.md) | — |
 | 3 | `letter` | generate | [`cover-letter`](../../skills/cover-letter/SKILL.md) | — |
 | 4 | `form` | generate | [`application-form-answers`](../../skills/application-form-answers/SKILL.md) | — |
-| 5 | `confirm` | verify | [`output-hygiene`](../../../core/skills/output-hygiene/SKILL.md) | **G6** human |
+| 5 | `confirm` | verify | [`output-hygiene`](../../../core/skills/output-hygiene/SKILL.md) | **G6.1** human |
 
 ## How to run this loop
 
 1. **Check the fit and stop.** Run `job-fit-analysis` on the posting, the resume and any
    other material of the candidate's: a LinkedIn summary, a portfolio, a project. Put its
    verdict, what could get the application rejected and its questions to the candidate,
-   including whether anything outside the resume covers a gap, then wait at G5.
+   including whether anything outside the resume covers a gap, then wait at G6.
    - `PROCEED`: they are applying. Go on.
    - `PROCEED WITH CONDITIONS`: they are applying and have answered the questions. Save
      their answers to `notes.md`; from here on those answers are source material alongside
@@ -41,7 +41,7 @@ can say what the resume shows, but only the candidate knows what is true and wha
    the documents, run `application-form-answers` with those questions and the tailored
    resume. Skip this stage when there is no form.
 5. **Clean the documents.** Run `output-hygiene` on the resume and the letter.
-6. **Confirm at G6.** Show the candidate the documents with four short lists: what the
+6. **Confirm at G6.1.** Show the candidate the documents with four short lists: what the
    posting asks for that the documents do not claim; every fact added from outside the
    resume and where it came from; every line cut from the resume; and the form questions
    that are theirs alone to answer. Ask them to confirm every line is true. `NOT READY` returns to `tailor` with their
@@ -49,8 +49,8 @@ can say what the resume shows, but only the candidate knows what is true and wha
 
 ## Verdicts
 
-Defined in [`contracts/terminals.json`](../../../../contracts/terminals.json). G5 emits
-`PROCEED`, `PROCEED WITH CONDITIONS`, `RECONSIDER` or `BLOCKED`. G6 emits `READY`,
+Defined in [`contracts/terminals.json`](../../../../contracts/terminals.json). G6 emits
+`PROCEED`, `PROCEED WITH CONDITIONS`, `RECONSIDER` or `BLOCKED`. G6.1 emits `READY`,
 `NOT READY` or `BLOCKED`. `RECONSIDER` leaves the loop: the candidate's time goes to a
 better posting.
 
@@ -64,7 +64,7 @@ produce documents carrying their name that they have not confirmed.
 
 Name the missing skill and skilldrop as its source, do the minimal inline version of that
 stage under the same rule (nothing the candidate didn't supply), and record that it ran
-degraded. Never skip G6.
+degraded. Never skip G6.1.
 
 ## Run log (opt-in)
 
@@ -73,7 +73,7 @@ gate's verdict, append one JSON line to that file. Nothing else is recorded, and
 sent anywhere. When the variable isn't set, or you can't read it, skip this section.
 
 ```bash
-printf '%s\n' '{"ts":"2026-10-05T14:03:00Z","loop":"apply","stage":"fit","gate":"G5","verdict":"PROCEED","round":1}' >> "$SKILLDROP_LOOP_LOG"
+printf '%s\n' '{"ts":"2026-10-05T14:03:00Z","loop":"apply","stage":"fit","gate":"G6","verdict":"PROCEED","round":1}' >> "$SKILLDROP_LOOP_LOG"
 ```
 
 Fields: `ts` (UTC), `loop`, `stage`, `gate` (`null` for a stage without one), `verdict` (the
@@ -83,9 +83,9 @@ The log holds verdicts only: never the posting, the resume or the candidate's na
 ## Quality bar
 
 - **The candidate decides to apply before anything is written.** A tailored resume for a job they would have skipped is wasted work.
-- **Every claim in both documents traces to the resume or to something the candidate said.** Answers given at G5 are written to `notes.md`, so the trace exists.
+- **Every claim in both documents traces to the resume or to something the candidate said.** Answers given at G6 are written to `notes.md`, so the trace exists.
 - **The resume, the letter and the form agree.** Same titles, dates and numbers in all three.
-- **The candidate confirms and sends.** G6 is their signature; the loop never submits an application.
+- **The candidate confirms and sends.** G6.1 is their signature; the loop never submits an application.
 
 ## Anti-patterns to avoid
 
@@ -93,5 +93,5 @@ The log holds verdicts only: never the posting, the resume or the candidate's na
 - ❌ **Treating a `Not shown` item as true** because the candidate proceeded. Only what they answered goes in.
 - ❌ **Writing the letter from the original resume.** The letter follows the tailored one, or the two will disagree.
 - ❌ **Answering a declaration on the form** for the candidate, or leaving out the list of what was added and cut.
-- ❌ **Self-confirming at G6.** A clean claim check says the words are in the source; it cannot say they are true.
+- ❌ **Self-confirming at G6.1.** A clean claim check says the words are in the source; it cannot say they are true.
 - ❌ **Submitting the application.** Sending is the candidate's act.

package/packs/career/loops/apply/evals/evals.json

@@ -7,7 +7,7 @@
       "assertions": [
         "Starts with job-fit-analysis and delivers its verdict before any resume or letter is written",
         "Names the unmet bachelor's degree as a screening requirement",
-        "Stops at G5 and asks the candidate whether to apply; does not tailor the resume in the same turn",
+        "Stops at G6 and asks the candidate whether to apply; does not tailor the resume in the same turn",
         "Does not advise claiming the degree or adding any keyword the resume does not support"
       ]
     },
@@ -19,7 +19,7 @@
         "The tailored resume includes Spanish and does not claim SAP",
         "The cover letter is written after the tailored resume and uses the same titles, dates and numbers",
         "Runs output-hygiene on both documents before the final gate",
-        "Stops at G6 and asks the candidate to confirm every line is true; does not submit or send anything",
+        "Stops at G6.1 and asks the candidate to confirm every line is true; does not submit or send anything",
         "Lists what the posting asks for that neither document claims"
       ]
     }

package/packs/career/loops/apply/loop.json

@@ -13,7 +13,7 @@
       "intent": "Say honestly where the candidate stands against the posting, then let them decide whether this application is worth writing.",
       "skills": ["job-fit-analysis"],
       "gate": {
-        "id": "G5",
+        "id": "G6",
         "kind": "human",
         "verdicts": ["PROCEED", "PROCEED WITH CONDITIONS", "RECONSIDER", "BLOCKED"]
       }
@@ -42,7 +42,7 @@
       "intent": "Strip what the machine left behind, then have the candidate confirm that every line in the documents is true and theirs, and that anything added from outside the resume is right.",
       "skills": ["output-hygiene"],
       "gate": {
-        "id": "G6",
+        "id": "G6.1",
         "kind": "human",
         "verdicts": ["READY", "NOT READY", "BLOCKED"],
         "revise_to": "tailor"

package/packs/career/skills/job-fit-analysis/SKILL.md

@@ -51,10 +51,16 @@ These four rules outrank the steps below.
    - **Met**: the resume shows it. Quote the line.
    - **Partly**: the resume shows something close, smaller or older. Say what it shows and
      what is short: "team of 12; the posting asks for 20 or more".
-   - **Not shown**: the resume is silent. The person may well have it.
+   - **Not shown**: the resume is silent on a specific thing. The person may well have it.
    - **Not met**: the resume shows otherwise, such as a diploma where a degree is required
      or two years where five are asked for.
 
+   A requirement for a general ability, such as dealing with the public, organising work
+   or communicating clearly, is `Met` by any job that plainly involves it: four years
+   serving customers meets "friendly first point of contact". Keep `Not shown` and `Partly`
+   for specific things: a tool, a qualification, a setting, a scale, a number of years. Do
+   not mark half the table `Partly` to be safe.
+
    A similar tool is not the named tool. Cerner is not Epic, an in-house warehouse system is
    not SAP: when the posting requires the named one, mark it `Not met` and give the similar
    one as the nearest thing you have. A related task is not the named skill: cashing up a
@@ -76,9 +82,11 @@ These four rules outrank the steps below.
      true for it to be worth the time, and whether you would still send it.
    - **Not a match**: a requirement that cannot be worked around is unmet, such as a licence.
 
-   Write the table first and take the count from it. The opening sentence counts every
-   required item that is `Not met` or `Partly`, not only the worst one: "four of the six required items aren't met: the degree, the team size,
-   advanced Excel and SAP". It must agree with the table below it. Give the verdict on what
+   Write the table first, then write the opening from it. The opening names every required
+   item that is `Not met` or `Partly`, copied from those rows: "the degree, the team size,
+   advanced Excel and SAP aren't met". Name them; do not count them, and do not sum them up
+   in a number or a fraction anywhere in the reply. When two figures differ, give both and
+   leave the comparison there: "12 against 20 or more", not "less than half". Give the verdict on what
    you know now; say what answer would raise it, but do not make the verdict wait on the
    answer. Do not soften a long shot into encouragement, do not harden a workable gap into a
    refusal, and do not give a percentage.
@@ -93,14 +101,17 @@ These four rules outrank the steps below.
    required item is not shown, ask once whether anything outside the resume covers it: a
    side project, a repository, a portfolio, a volunteer role. People leave their best
    evidence off the page. Anything you credited from another file goes here too, as a line
-   to add to the resume. Never tell
-   them to add a keyword they have not said is true, and do not end on a list of questions
-   with no advice.
+   to add to the resume. Never ask
+   something the resume already answers. Never tell them to add a keyword they have not said
+   is true, or to reword a `Partly` so it reads as `Met`: "supported renewals" stays
+   supported, and the advice is how to present it honestly. Do not end on a list of
+   questions with no advice.
 
 8. **Lay the reply out in this order:** the answer and verdict; what could get it rejected;
    one table covering every requirement (requirement, required or preferred, status,
    evidence); what to bring forward; what to do next. Each requirement appears in the table
-   once and nothing is repeated in a second table or restated section by section.
+   once and nothing is repeated in a second table or restated section by section. A gap is
+   described where it first appears and only named after that.
 
    Match the length to what you were given. A short posting and a few lines about the person
    gets a short answer: the verdict, one line per requirement, and what to do, in under 250
@@ -140,6 +151,9 @@ posting**, ask for the posting in one line: there is nothing to compare against.
   person's evening.
 - ❌ **Crediting the usual.** "As a nurse you will have used Epic" is an invention.
 - ❌ **Treating a similar tool as the named one.**
+- ❌ **A count that disagrees with the table.** Name the gaps; a number invites the error.
+- ❌ **Hedging everything.** A table of `Partly` tells the person nothing.
+- ❌ **Coaching the wording past the facts.** Advising that "supported" be written as "owned".
 - ❌ **Advising them to add keywords** so the resume passes a filter. If it isn't true it
   doesn't go in.
 - ❌ **Judging the person.** No remarks on age, gaps, family, health or anything a recruiter

package/packs/career/skills/job-fit-analysis/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "job-fit-analysis",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Compare a job posting with a resume and say honestly whether to apply: each requirement marked met, partly met, not shown or not met, with the resume line it rests on; the requirements an employer screens on listed first; and the questions whose answers would change the picture. Works for any occupation and level. Use when the user asks \"am I a good fit for this job\", \"should I apply for this\", \"how does my resume match this posting\", or wants the gaps between a job description and their CV before applying.",
   "entrypoint": "SKILL.md",
   "deps": {

package/packs/core/loops/ship-a-draft/LOOP.md

@@ -16,7 +16,7 @@ check the argument and the surface after.
 |---|---|---|---|---|
 | 1 | `intake` | generate | [`brief-intake`](../../skills/brief-intake/SKILL.md) | — |
 | 2 | `draft` | generate | any generator (`*`) | — |
-| 3 | `critique` | verify | [`doc-critique`](../../skills/doc-critique/SKILL.md) | **G4** review |
+| 3 | `critique` | verify | [`doc-critique`](../../skills/doc-critique/SKILL.md) | **G5** review |
 | 4 | `polish` | verify | [`output-hygiene`](../../skills/output-hygiene/SKILL.md) | — |
 
 ## How to run this wrapper
@@ -29,7 +29,7 @@ check the argument and the surface after.
    chosen generator will refuse to start without. Resolve those before drafting.
 3. **Draft.** Run the chosen generator on the brief. It is a normal skilldrop skill with its
    own quality bar — this wrapper does not override it.
-4. **Critique at G4.** Run `doc-critique`, which dispatches to the same rubric the generator
+4. **Critique at G5.** Run `doc-critique`, which dispatches to the same rubric the generator
    was held to. `MAJOR REWRITE` returns to `intake` (not to `draft` — a rewrite usually means
    the input was wrong, not the prose). `WRONG ARTIFACT` leaves the wrapper entirely.
 5. **Polish last.** Run `output-hygiene` only once the argument is settled. It is a surface
@@ -37,14 +37,14 @@ check the argument and the surface after.
 
 ## Verdicts
 
-Defined in [`contracts/terminals.json`](../../../../contracts/terminals.json). G4 emits the critique
+Defined in [`contracts/terminals.json`](../../../../contracts/terminals.json). G5 emits the critique
 vocabulary. `SHIP WITH CHANGES` carries its changes forward to `polish`; it does not mean the
 changes are optional.
 
 ## When a stage's skill is not installed
 
 Name the missing skill and skilldrop as its source, do the minimal inline version of that
-stage, and say the stage ran degraded. Do not skip G4 — an unreviewed artifact is the failure
+stage, and say the stage ran degraded. Do not skip G5 — an unreviewed artifact is the failure
 mode this wrapper exists to prevent.
 
 ## Run log (opt-in)
@@ -54,7 +54,7 @@ gate's verdict, append one JSON line to that file. Nothing else is recorded, and
 sent anywhere. When the variable isn't set, or you can't read it, skip this section.
 
 ```bash
-printf '%s\n' '{"ts":"2026-10-01T14:03:00Z","loop":"ship-a-draft","stage":"critique","gate":"G4","verdict":"SHIP IT","round":1}' >> "$SKILLDROP_LOOP_LOG"
+printf '%s\n' '{"ts":"2026-10-01T14:03:00Z","loop":"ship-a-draft","stage":"critique","gate":"G5","verdict":"SHIP IT","round":1}' >> "$SKILLDROP_LOOP_LOG"
 ```
 
 Fields: `ts` (UTC), `loop`, `stage`, `gate` (`null` for a stage without one), `verdict` (the
@@ -71,7 +71,7 @@ which end in `BLOCKED`.
 
 ## Anti-patterns to avoid
 
-- ❌ **Running `polish` as the whole review.** Clean prose with a broken argument still fails; that is what G4 is for.
+- ❌ **Running `polish` as the whole review.** Clean prose with a broken argument still fails; that is what G5 is for.
 - ❌ **Skipping `intake` because the input "is already structured."** A Slack thread that looks organized is still untagged — nobody downstream can tell what was inferred.
 - ❌ **Looping `critique` → `draft` instead of `critique` → `intake`.** Re-drafting from the same incomplete brief reproduces the same gaps with new words.
 - ❌ **Treating `WRONG ARTIFACT` as a severe `MAJOR REWRITE`.** It is a redirect: the user wanted a different document, and revising this one cannot get there.

package/packs/core/loops/ship-a-draft/evals/evals.json

@@ -7,7 +7,7 @@
       "assertions": [
         "Chooses the target generator (exec-summary) BEFORE running intake, because the brief is shaped for a target",
         "Runs brief-intake and tags every field explicit / implied / inferred / missing",
-        "Runs doc-critique at G4 against the same rubric the generator was held to",
+        "Runs doc-critique at G5 against the same rubric the generator was held to",
         "Runs output-hygiene last, only once the argument is settled",
         "Reports what output-hygiene did not touch"
       ]
@@ -16,7 +16,7 @@
       "id": "major-rewrite-returns-to-intake",
       "prompt": "The critique on my draft came back MAJOR REWRITE. Continue the ship-a-draft wrapper.",
       "assertions": [
-        "Routes back to `intake`, not to `draft`, because G4's revise_to names intake",
+        "Routes back to `intake`, not to `draft`, because G5's revise_to names intake",
         "Explains that re-drafting from the same incomplete brief reproduces the same gaps",
         "Does not run output-hygiene on a draft that is about to be rewritten"
       ]

package/packs/core/loops/ship-a-draft/loop.json

@@ -25,7 +25,7 @@
       "intent": "Review the draft against the same rubric the generator was held to.",
       "skills": ["doc-critique"],
       "gate": {
-        "id": "G4",
+        "id": "G5",
         "kind": "review",
         "verdicts": ["SHIP IT", "SHIP WITH CHANGES", "MAJOR REWRITE", "WRONG ARTIFACT", "BLOCKED"],
         "revise_to": "intake"

package/packs/core/pack.json

@@ -37,7 +37,7 @@
         "skill": "doc-critique",
         "you_do": "Hand over the draft you wrote from the brief, by hand or with any generator skill.",
         "you_get": "A critique that opens with a verdict and lists findings as blocker, major, minor or nit, each pointing to the section and suggesting a fix.",
-        "decide": "Gate G4: SHIP IT or SHIP WITH CHANGES moves on; MAJOR REWRITE sends you back to the brief; WRONG ARTIFACT means you need a different kind of document."
+        "decide": "Gate G5: SHIP IT or SHIP WITH CHANGES moves on; MAJOR REWRITE sends you back to the brief; WRONG ARTIFACT means you need a different kind of document."
       },
       {
         "skill": "output-hygiene",

package/packs/data-analytics/skills/metric-definition/evals/evals.json

@@ -44,6 +44,36 @@
         "Any export column names it uses are marked as assumed, since no export layout was given",
         "It does not state a response-time target or SLA figure as the team's own, since none was given"
       ]
+    },
+    {
+      "id": 4,
+      "held_out": "2026-10-06",
+      "prompt": "Ops and customer care at Tarn Valley Heating both report first-time fix rate and they're miles apart. The Slack thread is in thread.md and the tables are in tables.md (we're on Snowflake). The FD wants one number for the board pack, ready on the 1st of each month, shown next to last September. Can you write the definition — one page, with the SQL underneath?",
+      "assertions": [
+        "It points out that 3,912 out of 4,830 is 81%, not the 84% quoted in the thread",
+        "The definition counts a repair as not fixed first time when there is a return visit within a stated number of days, and does not rely only on the engineer's follow_up_required flag",
+        "It explains the gap between the two teams' figures: 630 of the 3,912 repairs with no follow-up flag had a return visit within 30 days, leaving 3,282 (68%)",
+        "A return visit is counted whether it was logged as a 'recall' or as a new 'repair', and recall visits are not themselves added to the denominator as fresh repairs",
+        "It says the month's figure cannot be final on the 1st of the next month because the return window has not yet run for late-month repairs, and proposes a provisional figure, a lag or a shorter window",
+        "It says a like-for-like comparison with September 2025 is not possible by appliance because appliance_id is empty before 3 March 2026, and says what to do instead (match by address for both periods, or mark the comparison as not comparable)",
+        "The SQL uses only the tables and columns listed in tables.md, restricts the denominator to completed repairs, and does not invent a column linking a return visit to its original job",
+        "It leaves the metric owner as an open decision, noting the previous owner left in August, and says whether subcontractor jobs are included"
+      ]
+    },
+    {
+      "id": 5,
+      "held_out": "2026-10-06",
+      "prompt": "I run a coffee subscription box, just me and one part-timer. An investor asked what our monthly churn is and I realised I've never actually defined it. Billing is on Stripe and I keep a Google Sheet of subscribers. September: started the month with 312 subscribers, 21 cancelled, 9 paused (people can pause for a month or two instead of cancelling), 34 new signed up. Can you give me a quick definition I can stick to every month, and the September number for the investor update?",
+      "assertions": [
+        "It delivers a written definition and a September figure in the reply, and does not stop at a list of questions",
+        "The denominator is stated as subscribers active at the start of the month (312), and the 34 new sign-ups are not netted off against cancellations",
+        "It gives September churn on cancellations alone as 21 out of 312, about 6.7%",
+        "It does not decide silently whether pauses count: it states the choice made and gives the figure with pauses included, 30 out of 312, about 9.6%",
+        "It says revenue churn cannot be worked out from what was given because no prices or plan amounts were provided, and it does not invent a price",
+        "It says whether a cancellation is counted in the month the subscriber cancels or the month their paid period ends",
+        "It does not quote an industry-average or benchmark churn figure as fact",
+        "Any Stripe field names or sheet column names it uses are marked as assumed, since none were given"
+      ]
     }
   ]
 }

package/packs/data-analytics/skills/metric-definition/evals/files/4/tables.md

@@ -0,0 +1,32 @@
+# Tables (Snowflake, database TARNVALLEY)
+
+## FIELD.JOBS — one row per visit
+| column | type | notes |
+|---|---|---|
+| job_id | NUMBER | primary key |
+| address_id | NUMBER | always filled |
+| appliance_id | NUMBER | NULL for every job before 2026-03-03 |
+| job_type | VARCHAR | 'repair', 'recall', 'annual_service', 'install' |
+| status | VARCHAR | 'completed', 'cancelled', 'no_access' |
+| follow_up_required | BOOLEAN | ticked by the engineer on closing the job |
+| engineer_id | NUMBER | |
+| created_at | TIMESTAMP_NTZ | UK local time, when the job was booked |
+| completed_at | TIMESTAMP_NTZ | UK local time, NULL unless status = 'completed' |
+
+There is no column that links a recall, or any later visit, to the job it follows.
+
+## FIELD.APPLIANCES
+| column | type | notes |
+|---|---|---|
+| appliance_id | NUMBER | primary key |
+| address_id | NUMBER | |
+| make | VARCHAR | |
+| model | VARCHAR | |
+| installed_on | DATE | often NULL |
+
+## FIELD.ENGINEERS
+| column | type | notes |
+|---|---|---|
+| engineer_id | NUMBER | primary key |
+| region | VARCHAR | 'north', 'central', 'coast' |
+| employment_type | VARCHAR | 'employed', 'subcontractor' |