skillpacks 0.1.1 → 0.1.2

package/packs/code-debug/claude/investigate/archive/v0.1/SKILL.md

@@ -0,0 +1,158 @@
+---
+name: investigate
+description: Validate user claims against codebase and git history, trace to root cause, and propose a fix
+type: debugging
+version: v0.1
+argument-hint: <error, bug description, user observations, or issue URL> [--ui] [--data] [--plan]
+---
+
+# Investigate
+
+Given a bug report, error message, unexpected behavior, or user observations about what they think is wrong, validate claims against the codebase and git history, trace to root cause, and propose a fix.
+
+## Process
+
+1. **Parse the input** from `$ARGUMENTS`:
+   - Error message or stack trace → extract file paths, line numbers, error types
+   - Bug description → identify the expected vs. actual behavior
+   - User claims/observations → extract each specific claim to validate (e.g., "I think the auth middleware is stripping the header," "this worked before the last deploy," "the database query is returning stale data")
+   - Issue URL → fetch the issue details via `gh`
+   - Check for `--plan` flag → if present, force plan output mode (write fix steps to `tasks/todo.md` instead of applying inline)
+   - Check for `--ui` or `--data` flag → if present, skip auto-detection and use that investigation strategy (see step 1b)
+   - If no arguments provided, ask the user what to investigate.
+
+1b. **Select investigation strategy:**
+
+   If `--ui` or `--data` flag is set, use that strategy directly. Otherwise, auto-detect from the input:
+
+   - **UI strategy** (`--ui`): Use when the problem is visual — layout, spacing, animation, transitions, skeleton/loading states, theming, colors, popovers, positioning, truncation, responsive behavior, CSS.
+     - Signal words: skeleton, animation, spacing, popover, transition, theme, truncated, glitch, dead space, detached, pop-in, flickering, layout, positioning, z-index, overflow.
+   - **Data strategy** (`--data`): Use when the problem is wrong values, stale state, sync mismatches, timers, counters, missing data, or data pipeline issues.
+     - Signal words: countdown, percentage, usage, sync, stale, timer, refresh, reset, missing data, wrong number, out of sync, not updating, mismatch.
+   - **General strategy** (default): Use for errors/crashes (stack traces, console errors, server errors), behavioral bugs (wrong flow, missing options, incorrect form behavior), and anything ambiguous.
+
+   If the input contains signals from multiple strategies (e.g., "the countdown shows wrong AND the animation glitches"), start with the data strategy — wrong data is more commonly the root cause that manifests as a visual symptom.
+
+2. **Gather context** (varies by strategy):
+
+   All strategies:
+   - Read `CLAUDE.md` for project conventions.
+   - Check `git log --oneline -20` for recent changes that may have introduced the issue.
+   - If the user references specific files, commits, or timeframes, read those directly.
+
+   **UI strategy** — start from the component tree:
+   - Identify the component(s) rendering the affected area.
+   - Read the component file(s) and their styles (CSS modules, Tailwind classes, styled-components).
+   - Trace the render path: parent → child → conditional renders → animation/transition logic.
+   - Check for CSS specificity conflicts, z-index stacking, overflow rules, and layout model issues (flex/grid).
+   - If the component uses loading/skeleton states, trace the state transition that swaps skeleton → content.
+
+   **Data strategy** — start from the data pipeline:
+   - Identify the data source (API, store, local state, timer, computed value).
+   - Trace the data flow: source → transformations → state management → component prop.
+   - Check for stale caches, missing refresh triggers, incorrect timer intervals, timezone/epoch issues.
+   - Compare the expected value computation against the actual one — read the business logic, not just the display.
+   - If multiple components show the same data differently, find where they diverge in the pipeline.
+
+   **General strategy** — start from the symptom:
+   - If a stack trace is available, start from the crash site and read those files.
+   - If behavioral, identify the relevant feature area and read entry points.
+
+3. **Validate user claims** (when the user provides observations or hypotheses):
+   - Extract each distinct claim the user has made.
+   - For each claim, verify it against the codebase and git history:
+     - Read the files the user references — does the code behave as they describe?
+     - Check `git log`, `git diff`, and `git blame` on relevant files — does the history support their timeline?
+     - If the user says "this used to work" or "this changed recently," use `git log --all -- <file>` and `git diff <commit range>` to verify.
+   - Classify each claim as: **confirmed**, **partially correct** (right intuition, wrong detail), or **not supported by evidence**.
+   - Report findings before proceeding to trace — the user's mental model may be off, and correcting it early saves time.
+
+4. **Trace the issue:**
+   - Follow the execution path from the symptom to the source.
+   - Read only the files in the chain — do not explore the full codebase.
+   - **UI strategy**: trace component tree → styles → layout → animation/transition → render lifecycle. Check for CSS conflicts, missing keys, layout thrashing, and transition timing.
+   - **Data strategy**: trace data source → transform → store → subscription → render. Check for stale closures, missing dependency arrays, incorrect comparisons, cache invalidation, and timer drift.
+   - **General strategy**: check for null/undefined, wrong types, missing env vars, stale imports, race conditions, schema mismatches, config drift.
+   - If the initial strategy hits a dead end, pivot to the other strategy — a "UI bug" may have a data root cause, and vice versa.
+   - If the issue was introduced by a recent commit, identify which one with `git log` or `git bisect` logic.
+   - If user claims were partially correct or unsupported, trace from the actual evidence rather than the user's hypothesis.
+
+5. **Verify the hypothesis:**
+   - Look for test coverage of the affected code path.
+   - Check if the bug is reproducible from the code alone (no need to run the app unless necessary).
+   - If there are related tests, run them to confirm the current state.
+
+6. **Apply or plan the fix:**
+   - **Determine fix mode:**
+     - If `--plan` flag is set → **plan mode** (always write to `tasks/todo.md`)
+     - If fix requires 3+ discrete steps across multiple files → **plan mode**
+     - Otherwise → **inline mode** (apply fix directly)
+   - **Inline mode** (default for single contained fixes):
+     - Write the minimal code change that fixes the root cause.
+     - If tests exist, update them. If not, write a test that would have caught this.
+     - Run the relevant tests to confirm the fix works and no regressions.
+   - **Plan mode** (multi-step fixes or `--plan` flag):
+     - Do NOT apply code changes. Proceed to step 7.
+
+7. **Write fix steps to `tasks/todo.md`** (plan mode only):
+   - Read existing `tasks/todo.md` if present — do NOT overwrite existing content.
+   - Append a new section:
+     ```
+     ## Investigation Fix: [concise title of the issue]
+
+     - [ ] Step description — `file/path.ext` — why this change is needed
+     - [ ] Step description — `file/path.ext` — why this change is needed
+     ...
+     - [ ] Verify: run [specific test command or acceptance criterion]
+     ```
+   - Each item must specify: what to change, which file, and why.
+   - Final item must be an acceptance criterion (run tests, verify behavior).
+   - Order steps by dependency — changes that other steps depend on come first.
+
+## Output
+
+### Strategy Used
+- **Mode**: UI / Data / General (and whether auto-detected or flag-forced)
+- **Pivoted**: Yes/No — if the initial strategy didn't find the root cause and a different layer was the actual source
+
+### User Claims Validated
+For each claim the user made:
+- **Claim**: What the user said
+- **Verdict**: Confirmed / Partially correct / Not supported
+- **Evidence**: What the code or git history actually shows
+
+_(Skip this section if the input was a plain error message or stack trace with no user hypotheses.)_
+
+### Root Cause
+- **Location**: `file:line`
+- **What's wrong**: One-sentence explanation
+- **Introduced by**: commit hash or "pre-existing" if not recent
+- **Relationship to user's theory**: How this connects to (or diverges from) what the user suspected
+
+### Fix Applied
+_(Shown in inline mode)_
+- Files modified and what changed
+- Test results
+
+### Fix Steps Written
+_(Shown in plan mode — replaces "Fix Applied")_
+- Written to `tasks/todo.md` under `## Investigation Fix: [title]`
+- Number of steps and summary
+- Run `/exec` to execute the fix steps sequentially
+
+### Prevention
+- What test or check would have caught this earlier
+
+## Constraints
+- Do not refactor unrelated code while fixing the bug.
+- Do not guess — if you can't trace the root cause, say so and list what you've ruled out.
+- Always validate user claims before assuming they're correct — the user's observations are a starting point, not ground truth.
+- Always run tests after applying the fix (inline mode).
+- If the fix requires changes outside the current project (infra, env vars, external service), document what's needed instead of attempting it.
+- Do not write to `docs/debug-changelog.md` — that is `/debug`'s domain.
+- Do not write to `tasks/todo.md` for single-step fixes unless `--plan` is explicitly set.
+
+
+## Default Shipping Contract
+
+Follow the shared shipping contract convention in CLAUDE.md.

package/packs/code-debug/codex/debug/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## v0.3 - 2026-06-13
+
+- Removed direct execution-loop command handoffs from non-exec routing; route through approved YAML, task, or roadmap artifacts instead.
+
+
+## v0.2 - 2026-06-12
+
+- Added explicit next-step routing for unresolved bugs, dirty fix handoff, systemic follow-up execution, and no-follow-up completion.
+
 ## v0.0
 
 - Archived previous skill contract.

package/packs/code-debug/codex/debug/SKILL.md

@@ -2,7 +2,7 @@
 name: debug
 description: Investigate a problem, log it to the debug changelog, cross-check past issues, and suggest a non-duplicate fix.
 type: debugging
-version: v0.1
+version: v0.3
 ---
 
 # Debug
@@ -32,6 +32,15 @@ Investigate a reported problem, maintain a persistent debug changelog (`docs/deb
 - **Changelog Updated**: entry added, any cross-references
 - **Prevention**: what check would have caught this earlier; systemic follow-up if applicable
 
+## Next-Step Routing
+
+After reporting the debug outcome:
+
+- If the root cause remains unresolved or verification still fails, use **Recommended next command:** `$debug <specific failing symptom>` with the failing command and evidence, or `$investigate <claim>` when the remaining work is broader repo validation.
+- If the fix created or modified tracked files, check `.agents/project.json` for `exec-loop`; recommend `$ship` when enabled, or `npx skillpacks install exec-loop` from the project shell when it is not enabled.
+- If a systemic follow-up was added to `tasks/todo.md`, check `.agents/project.json` for `exec-loop`; state that the approved task artifact is ready for an execution-loop runner; if runner tooling is missing, recommend installing `exec-loop` with the project package manager.
+- If verification passed, no tracked files are dirty, and no systemic follow-up remains, state that no follow-up command is recommended.
+
 ## Constraints
 
 - Always read the full debug changelog before proposing a fix.

package/packs/code-debug/codex/debug/archive/v0.1/SKILL.md

@@ -0,0 +1,46 @@
+---
+name: debug
+description: Investigate a problem, log it to the debug changelog, cross-check past issues, and suggest a non-duplicate fix.
+type: debugging
+version: v0.1
+---
+
+# Debug
+
+Invoke as `$debug`.
+
+Investigate a reported problem, maintain a persistent debug changelog (`docs/debug-changelog.md`), and propose a fix that avoids repeating past solutions.
+
+## Process
+
+1. Parse the error message, stack trace, or bug description.
+2. Capture environment context: current branch, recent commits, uncommitted changes.
+3. Ensure `docs/debug-changelog.md` exists (create `docs/` directory and file if missing).
+4. Read the full debug changelog and search for prior entries matching the current symptom.
+5. If a match is found, report what was tried before and whether the recurrence is systemic.
+6. Trace the execution path from the symptom to the root cause, reading only files in the chain.
+7. Check recent git history for changes that may have introduced the issue.
+8. Propose a minimal fix, cross-checking the changelog to avoid repeating a previously failed approach.
+9. Apply the fix, write or update tests, and run them to verify.
+10. Prepend a structured entry to `docs/debug-changelog.md` with: date, symptom, category, severity, root cause, fix, test results, related entries, and systemic flag.
+
+## Output
+
+- **Problem**: Symptom, new or recurring
+- **Root Cause**: file:line, what's wrong, when introduced
+- **Fix Applied**: approach, files modified, test results
+- **Changelog Updated**: entry added, any cross-references
+- **Prevention**: what check would have caught this earlier; systemic follow-up if applicable
+
+## Constraints
+
+- Always read the full debug changelog before proposing a fix.
+- Do not refactor unrelated code.
+- Never duplicate a previously failed fix without justification.
+- If the root cause can't be determined, report what was ruled out.
+- Always run tests after applying the fix.
+
+
+## Default Shipping Contract
+
+Follow the shared shipping contract convention in CLAUDE.md.

package/packs/code-debug/codex/debug/archive/v0.2/SKILL.md

@@ -0,0 +1,55 @@
+---
+name: debug
+description: Investigate a problem, log it to the debug changelog, cross-check past issues, and suggest a non-duplicate fix.
+type: debugging
+version: v0.2
+---
+
+# Debug
+
+Invoke as `$debug`.
+
+Investigate a reported problem, maintain a persistent debug changelog (`docs/debug-changelog.md`), and propose a fix that avoids repeating past solutions.
+
+## Process
+
+1. Parse the error message, stack trace, or bug description.
+2. Capture environment context: current branch, recent commits, uncommitted changes.
+3. Ensure `docs/debug-changelog.md` exists (create `docs/` directory and file if missing).
+4. Read the full debug changelog and search for prior entries matching the current symptom.
+5. If a match is found, report what was tried before and whether the recurrence is systemic.
+6. Trace the execution path from the symptom to the root cause, reading only files in the chain.
+7. Check recent git history for changes that may have introduced the issue.
+8. Propose a minimal fix, cross-checking the changelog to avoid repeating a previously failed approach.
+9. Apply the fix, write or update tests, and run them to verify.
+10. Prepend a structured entry to `docs/debug-changelog.md` with: date, symptom, category, severity, root cause, fix, test results, related entries, and systemic flag.
+
+## Output
+
+- **Problem**: Symptom, new or recurring
+- **Root Cause**: file:line, what's wrong, when introduced
+- **Fix Applied**: approach, files modified, test results
+- **Changelog Updated**: entry added, any cross-references
+- **Prevention**: what check would have caught this earlier; systemic follow-up if applicable
+
+## Next-Step Routing
+
+After reporting the debug outcome:
+
+- If the root cause remains unresolved or verification still fails, use **Recommended next command:** `$debug <specific failing symptom>` with the failing command and evidence, or `$investigate <claim>` when the remaining work is broader repo validation.
+- If the fix created or modified tracked files, check `.agents/project.json` for `exec-loop`; recommend `$ship` when enabled, or `npx skillpacks install exec-loop` from the project shell when it is not enabled.
+- If a systemic follow-up was added to `tasks/todo.md`, check `.agents/project.json` for `exec-loop`; recommend `$exec` when enabled, or `npx skillpacks install exec-loop` from the project shell when it is not enabled.
+- If verification passed, no tracked files are dirty, and no systemic follow-up remains, state that no follow-up command is recommended.
+
+## Constraints
+
+- Always read the full debug changelog before proposing a fix.
+- Do not refactor unrelated code.
+- Never duplicate a previously failed fix without justification.
+- If the root cause can't be determined, report what was ruled out.
+- Always run tests after applying the fix.
+
+
+## Default Shipping Contract
+
+Follow the shared shipping contract convention in CLAUDE.md.

package/packs/code-debug/codex/investigate/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## v0.2 - 2026-06-13
+
+- Kept the Codex mirror aligned with the alignment-YAML routing remediation and approved-artifact execution boundary.
+
+
 ## v0.0
 
 - Archived previous skill contract.

package/packs/code-debug/codex/investigate/SKILL.md

@@ -2,7 +2,7 @@
 name: investigate
 description: Validate user claims against codebase and git history, trace to root cause, and propose a fix
 type: debugging
-version: v0.1
+version: v0.2
 ---
 
 # Investigate

package/packs/code-debug/codex/investigate/archive/v0.1/SKILL.md

@@ -0,0 +1,51 @@
+---
+name: investigate
+description: Validate user claims against codebase and git history, trace to root cause, and propose a fix
+type: debugging
+version: v0.1
+---
+
+# Investigate
+
+Invoke as `$investigate`.
+
+Use this skill when the user reports a bug, error, unexpected behavior, or provides observations/hypotheses about what they think is wrong. Validates claims against the codebase and git history before tracing to root cause.
+
+## Process
+
+1. Parse the error message, stack trace, bug description, or user observations/claims.
+2. **Select investigation strategy** from flags or auto-detection:
+   - `--ui`: Visual/layout bugs — start from component tree, styles, animations, transitions, spacing, theming, skeleton/loading states, positioning. Signal words: skeleton, animation, spacing, popover, transition, theme, truncated, glitch, dead space, detached, pop-in, flickering, layout, z-index, overflow.
+   - `--data`: Data/state bugs — start from data pipeline, state management, timers, counters, sync logic. Signal words: countdown, percentage, usage, sync, stale, timer, refresh, reset, missing data, wrong number, out of sync, not updating, mismatch.
+   - General (default): Errors, crashes, behavioral bugs, and anything ambiguous — start from symptom/stack trace.
+   - If input has signals from both UI and data, prefer data strategy — wrong data commonly manifests as a visual symptom.
+3. If the user provides claims or hypotheses, validate each one against the codebase and git history (`git log`, `git diff`, `git blame`). Classify each as confirmed, partially correct, or not supported by evidence. Report findings before proceeding.
+4. Trace using the selected strategy:
+   - **UI**: component tree → styles → layout → animation/transition → render lifecycle. Check CSS conflicts, missing keys, layout thrashing, transition timing.
+   - **Data**: data source → transform → store → subscription → render. Check stale closures, missing dependency arrays, incorrect comparisons, cache invalidation, timer drift.
+   - **General**: execution path from symptom to source — null/undefined, wrong types, missing env vars, stale imports, race conditions, schema mismatches.
+   - If the initial strategy hits a dead end, pivot to the other — a UI bug may have a data root cause, and vice versa.
+5. Check recent git history for changes that may have introduced the issue.
+6. Identify the root cause with file and line reference.
+7. Apply a minimal fix and write or update tests.
+8. Run tests to verify the fix and check for regressions.
+
+## Output
+
+- **Strategy Used**: UI / Data / General (auto-detected or flag-forced), whether a pivot occurred
+- **User Claims Validated**: For each claim — verdict (confirmed/partially correct/not supported) and evidence. Skip if input was a plain error message.
+- **Root Cause**: file:line, what's wrong, when introduced, relationship to user's theory
+- **Fix Applied**: files modified, test results
+- **Prevention**: what check would have caught this earlier
+
+## Constraints
+
+- Do not refactor unrelated code.
+- Validate user claims before assuming they're correct — observations are a starting point, not ground truth.
+- If the root cause can't be determined, report what was ruled out.
+- Always run tests after applying the fix.
+
+
+## Default Shipping Contract
+
+Follow the shared shipping contract convention in CLAUDE.md.

package/packs/code-maintenance/claude/migrate/ALIGNMENT-PAGE.md

@@ -57,7 +57,9 @@ The tier is set per skill via `visual_tier` in SKILL.md frontmatter (or detected
 
 **Report-only research gates.** For report-only or pre-approval research skills, the first `review` alignment page must explicitly contain proposed research scope, source plan, assumptions/confidence, recommended output path, proposed file changes, and approval gates before synthesized research begins and before any working packet, canonical research, spec, or task file is created or updated.
 
-**Staged research workflow.** Heavy report-first research uses a scope-first three-stage approval workflow. Stage 1 is minimal scope discovery only: inspect enough repository, user, and source context to propose research scope, source plan, assumptions, output paths, and approval questions. Build the `review` alignment page before synthesized research. The page must render the proposed scope, available source categories, known context, assumptions/confidence, proposed working-packet and canonical output paths, and research-scope approval gates. Stop for final compiled response YAML approval of the research scope. Do not synthesize findings, rank candidates, recommend a path, or create working packets, canonical research, spec, or task files in Stage 1. Stage 2 starts only after final compiled response YAML approves the research scope with no unresolved `needs-clarification`, unresolved `down` feedback, or other unresolved negative feedback. Perform the synthesized research, run required source/code checks, and write only a non-canonical working packet. Flat mode uses `research/_working/preliminary-migrate-research.md`; product-path mode uses `research/{slug}/_working/preliminary-migrate-research.md`. Existing raw evidence or search-log outputs may remain as supporting evidence when the skill contract already requires them, but synthesized deliverables stay in the working packet. Update the same `review` alignment page so it renders the full preliminary packet, evidence matrix, assumptions/confidence register, source coverage gaps, proposed canonical file changes, and artifact approval gates. Partial compiled responses revise the working packet and review page, then remain in Stage 2. Stage 3 consumes final compiled response YAML for artifact approval only when it has `approval_status: ready-for-agent-review` and no unresolved `needs-clarification`, unresolved `down` feedback, or other unresolved negative feedback. Apply approved edits first, archive the working packet to `docs/history/archive/YYYY-MM-DD/HHMMSS/<original-working-path>`, remove the active working packet, write the approved canonical artifacts to the unchanged output paths, and convert the page to `confirmed` with the approval record preserved.
+**Staged research workflow.** Heavy report-first research uses a scope-first three-stage approval workflow. Stage 1 is minimal scope discovery only: inspect enough repository, user, and source context to propose research scope, source plan, assumptions, output paths, and approval questions. Build the `review` alignment page before synthesized research. The page must render the proposed scope, available source categories, known context, assumptions/confidence, proposed working-packet and canonical output paths, research-scope approval gates, and a `Stage 2 Preview / Expected Review Format` section that shows the future Stage 2 review shape before research starts. Stop for final compiled response YAML approval of the research scope. Do not synthesize findings, rank candidates, recommend a path, or create working packets, canonical research, spec, or task files in Stage 1. Stage 2 starts only after final compiled response YAML approves the research scope with no unresolved `needs-clarification`, unresolved `down` feedback, or other unresolved negative feedback. Perform the synthesized research, run required source/code checks, and write only a non-canonical working packet. Flat mode uses `research/_working/preliminary-migrate-research.md`; product-path mode uses `research/{slug}/_working/preliminary-migrate-research.md`. Existing raw evidence or search-log outputs may remain as supporting evidence when the skill contract already requires them, but synthesized deliverables stay in the working packet. Update the same `review` alignment page so it renders the complete working-packet substance as structured HTML review UI: purpose-built sections, tables, matrices, gates, cards, and tier-appropriate charts or diagrams that preserve every packet section, finding, caveat, and decision detail without summary loss. Raw Markdown packet text may appear only as a supplemental source view after the rendered review UI; do not make a `Full Preliminary Packet` or `Full Working Packet` raw Markdown dump, giant `<pre><code>` block, link-only view, or source-only view the primary review surface. Include the evidence matrix, assumptions/confidence register, source coverage gaps, proposed canonical file changes, and artifact approval gates. Partial compiled responses revise the working packet and review page, then remain in Stage 2. Stage 3 consumes final compiled response YAML for artifact approval only when it has `approval_status: ready-for-agent-review` and no unresolved `needs-clarification`, unresolved `down` feedback, or other unresolved negative feedback. Apply approved edits first, archive the working packet to `docs/history/archive/YYYY-MM-DD/HHMMSS/<original-working-path>`, remove the active working packet, write the approved canonical artifacts to the unchanged output paths, and convert the page to `confirmed` with the approval record preserved.
+
+**Stage 2 review-page template.** Stage 1 scope-review pages must include a `Stage 2 Preview / Expected Review Format` section that previews the exact section sequence, table shapes, evidence treatment, visual density, and approval gates the user will see after research; make it specific enough for the user to flag preferred content formats, grouping, labels, visuals, and evidence density before the agent does heavy research. After scope approval and research, the Stage 2 review page must include these sections as structured HTML, not as raw Markdown dumps: `Research Scope Approved` status block with approved scope, source plan, output paths, and unresolved caveats; `Executive Findings` or a skill-specific top-findings section with confidence labels; `Evidence Matrix` mapping claim, evidence/source/path, inference, confidence, assumptions, and decision impact; `Working Packet Review` with the complete working-packet substance rendered as purpose-built HTML sections, lists, tables, matrices, cards, and tier-appropriate charts or diagrams; `Alternatives / Rejected or Lower-Confidence Findings`; `Source Coverage & Gaps`; `Assumptions / Confidence Register`; `Proposed Canonical Artifacts & File Changes`; a required `User Format Preferences` gate asking whether the layout, tables, grouping, visuals, labels, and evidence density match expectations; and a required `Final Artifact Approval` gate for Stage 3 readiness. Raw Markdown packet text, search logs, or source notes may appear only as supplemental source views after the rendered review UI and never replace the Stage 2 review sections.
 
 **Required inline questions.** In `review` pages, each gate must contain at least one required inline question placed directly under the content it governs, inside a visually distinct question block. Each question must use radio-button inputs and include two standing options after the skill-generated choices: "Other / None of the above" backed by a multi-line text box for free-form input, and "Need clarification" backed by an optional notes box where the user can explain what is unclear. When any radio option other than "Other" or "Need clarification" is selected, show an optional "Additional notes" text box beneath it so the user can qualify their choice. Generate questions based on what genuinely needs user input -- do not add filler questions. Do not create a separate bottom "Decisions & Clarifications" section. Confirmed pages must not keep these as required input controls; render the answered decisions as read-only records.
 

package/packs/code-maintenance/claude/update-packages/CHANGELOG.md

@@ -0,0 +1,10 @@
+# Changelog
+
+## v0.1 - 2026-06-13
+
+- Stop recommending unsupported npm project `.npmrc` age-gate keys.
+- Require retained publish-time proof for npm-only projects and persisted pnpm `minimumReleaseAge: 11520` config where supported.
+
+## v0.0 - 2026-05-17
+
+- Initial dependency update workflow with 8-day package publish-age selection and package-manager migration guidance.

package/packs/code-maintenance/claude/update-packages/SKILL.md

@@ -2,7 +2,7 @@
 name: update-packages
 description: Update project dependencies to the latest version that is more than 8 days old, preferring pnpm over npm and enforcing installer age gates
 type: execution
-version: v0.0
+version: v0.1
 argument-hint: "[package names, workspace scope, or --all]"
 ---
 
@@ -30,13 +30,12 @@ Use this skill when a project needs dependency updates but should avoid newly pu
    - If npm must remain, record the reason and continue with npm commands without inventing a pnpm migration.
    - In monorepo parallel-agent contexts, do not run commands that mutate shared lockfiles. Stop and route dependency changes to a single serial session.
 
-3. **Add the installer age gate.**
-   - Create or update the project-root `.npmrc` before dependency updates, preserving existing registry/auth settings.
-   - Add npm's relative age gate: `min-release-age=8`.
-   - Add pnpm's 8-day equivalent in minutes for pnpm versions/configurations that read `.npmrc`: `minimum-release-age=11520`.
-   - If the active pnpm version uses `pnpm-workspace.yaml` or `pnpm config` for non-auth settings, also add or update `minimumReleaseAge: 11520` in the project `pnpm-workspace.yaml` or documented pnpm project config. Do this in addition to `.npmrc`, not instead of it, so npm and pnpm installs are both covered.
-   - When documenting the settings, keep their ownership clear: `min-release-age=8` is the npm relative-age guard, while `minimum-release-age=11520` and `minimumReleaseAge: 11520` are pnpm coverage for the same 8-day policy where supported.
-   - Avoid overwriting private registry tokens, scoped registry lines, or unrelated project config.
+3. **Add or verify the age gate.**
+   - Do not add unsupported age-gate keys to project `.npmrc`; modern npm warns on unknown project config such as `min-release-age` and `minimum-release-age`.
+   - For npm-only projects that cannot migrate to pnpm, enforce the 8-day policy by selecting versions from retained registry publish-time evidence before mutation, and document that npm does not provide a supported persisted project age gate.
+   - For pnpm projects, add or update pnpm project config with `minimumReleaseAge: 11520` in `pnpm-workspace.yaml` or the documented pnpm project config location supported by the active pnpm version.
+   - When documenting the settings, keep ownership clear: npm coverage is explicit registry age verification during the run; `minimumReleaseAge: 11520` is pnpm's persisted 8-day installer age gate where supported.
+   - Avoid overwriting private registry tokens, scoped registry lines, or unrelated package-manager config.
    - If an existing config deliberately excludes packages from the age gate, keep only exclusions that are documented and necessary; otherwise remove or narrow exclusions before updating.
 
 4. **Discover eligible versions.**
@@ -58,15 +57,15 @@ Use this skill when a project needs dependency updates but should avoid newly pu
    - For non-trivial or plan-first dependency updates, write a batch execution checklist before mutating files. Each batch must include:
      - exact mutation command(s) or file edits for that batch;
      - exact verification command(s) to run before moving on;
-     - expected proof or artifact, such as `packageManager`, `.npmrc`, lockfile creation, selected package version, or smoke-test output;
+     - expected proof or artifact, such as `packageManager`, retained publish-time evidence, pnpm age-gate config, lockfile creation, selected package version, or smoke-test output;
      - a "do not proceed on red" gate and a stop condition that routes broad compatibility work to `/migrate <package or framework>`.
    - For npm-to-pnpm migrations, make the package-manager migration Batch 0, then put low-risk minors/patches before framework, runtime, test-runner, or build-tool majors unless peer constraints require a different order.
    - For Vitest and other test-runner migrations, prefer the project script (`pnpm test`, `pnpm run test`, or the discovered package-manager equivalent) plus a discovered single-file or config smoke check. Do not recommend Jest-only or version-uncertain flags unless you have verified that the selected runner version supports them.
    - Do not edit lockfiles by hand.
 
 6. **Verify after updates.**
-   - Confirm `.npmrc` contains `min-release-age=8` and, for pnpm coverage, `minimum-release-age=11520` unless the project has a documented reason to store pnpm settings only in `pnpm-workspace.yaml` or pnpm config.
-   - For pnpm projects, confirm `minimumReleaseAge: 11520` is present in `pnpm-workspace.yaml` or equivalent project pnpm config when required by the active pnpm version.
+   - Confirm npm-only projects retain publish-time evidence proving selected versions are older than 8 full days.
+   - For pnpm projects, confirm `minimumReleaseAge: 11520` is present in `pnpm-workspace.yaml` or equivalent project pnpm config supported by the active pnpm version.
    - Run the repo's install/update command, typecheck, tests, lint, build, and any focused smoke checks implied by changed packages.
    - For major/framework/build-tool updates, run or document package-specific compatibility checks and smoke tests before calling the update complete.
    - If verification fails, diagnose the root cause. Apply the smallest durable fix when it is clearly inside the dependency update scope.
@@ -82,7 +81,7 @@ Use this skill when a project needs dependency updates but should avoid newly pu
 ## Output
 
 - **Package manager:** before and after, including any npm-to-pnpm migration result.
-- **Age gate:** `.npmrc` and pnpm config files changed, including `min-release-age=8` and `minimum-release-age`/`minimumReleaseAge` values.
+- **Age gate:** npm publish-time proof and pnpm config files changed, including `minimumReleaseAge: 11520` where supported.
 - **Updated packages:** package, old version, new version, selected publish date, and batch.
 - **Skipped packages:** package and reason.
 - **Major-upgrade risk handling:** affected packages, batch order, compatibility checks, focused smoke checks, and any stop route to `/migrate <target>`.
@@ -93,7 +92,7 @@ Use this skill when a project needs dependency updates but should avoid newly pu
 ## Constraints
 
 - Never select a package version published within the last 8 days unless the user explicitly overrides the safety gate.
-- Do not finish a mutation run without adding or verifying the package-manager age gate, unless the user explicitly declines it or the package manager cannot support it; document either exception.
+- Do not finish a mutation run without adding or verifying the package-manager age gate: retained publish-time proof for npm-only projects and persisted `minimumReleaseAge: 11520` for pnpm projects where supported. If the user explicitly declines it or the package manager cannot support persisted enforcement, document the exception.
 - Do not run package-manager commands that mutate a shared lockfile while acting as one of multiple parallel agents.
 - Do not hand-edit generated lockfiles.
 - Do not remove npm support when scripts, deployment docs, CI, or hosting constraints explicitly require npm.

package/packs/code-maintenance/claude/update-packages/archive/v0.0/SKILL.md

@@ -0,0 +1,105 @@
+---
+name: update-packages
+description: Update project dependencies to the latest version that is more than 8 days old, preferring pnpm over npm and enforcing installer age gates
+type: execution
+version: v0.0
+argument-hint: "[package names, workspace scope, or --all]"
+---
+
+# Update Packages
+
+Use this skill when a project needs dependency updates but should avoid newly published versions that may still be unstable or compromised. The default target is the newest package version whose publish timestamp is more than 8 days old. When the project uses npm, try to migrate it to pnpm first unless project constraints make that unsafe. Every mutation run must also leave behind package-manager configuration that enforces the same age gate for future installs.
+
+## Process
+
+1. **Plan and scope the update.**
+   - Inspect repository instructions, `package.json` files, workspace config, and lockfiles.
+   - Enter plan mode for non-trivial updates, especially monorepos, package-manager migration, or updates spanning multiple apps/packages.
+   - Treat explicit package names or workspace filters from the user as the scope. If no scope is provided, default to all direct dependencies and devDependencies in the active project or workspace.
+   - Check for existing dirty files before editing and avoid staging unrelated work.
+
+2. **Resolve package manager strategy.**
+   - Prefer pnpm when the project is JavaScript/TypeScript and does not already have a stronger package-manager requirement.
+   - If `pnpm-lock.yaml` or `packageManager: "pnpm@..."` exists, use pnpm.
+   - If only npm is present (`package-lock.json`, npm scripts, or `packageManager: "npm@..."`), migrate to pnpm when practical:
+     - Add or update `packageManager` to a stable pnpm version already used by the repo/toolchain when discoverable.
+     - Do not default to `pnpm@latest`; use an existing repo-pinned pnpm version or an explicitly age-eligible pnpm version, and document the proof.
+     - Before recommending a new `packageManager: "pnpm@..."` value, prove the chosen pnpm version is older than 8 full days by using retained project evidence, an existing project pin, or registry publish-time evidence such as `npm view pnpm@<version> time.version`. If you only know a local/toolchain pnpm version but have not verified its publish time, mark it provisional and make the registry check a blocker before mutation instead of presenting it as final.
+     - Generate `pnpm-lock.yaml` using pnpm.
+     - Remove npm lockfile only after pnpm install/update succeeds and the repo does not explicitly require npm.
+   - If npm must remain, record the reason and continue with npm commands without inventing a pnpm migration.
+   - In monorepo parallel-agent contexts, do not run commands that mutate shared lockfiles. Stop and route dependency changes to a single serial session.
+
+3. **Add the installer age gate.**
+   - Create or update the project-root `.npmrc` before dependency updates, preserving existing registry/auth settings.
+   - Add npm's relative age gate: `min-release-age=8`.
+   - Add pnpm's 8-day equivalent in minutes for pnpm versions/configurations that read `.npmrc`: `minimum-release-age=11520`.
+   - If the active pnpm version uses `pnpm-workspace.yaml` or `pnpm config` for non-auth settings, also add or update `minimumReleaseAge: 11520` in the project `pnpm-workspace.yaml` or documented pnpm project config. Do this in addition to `.npmrc`, not instead of it, so npm and pnpm installs are both covered.
+   - When documenting the settings, keep their ownership clear: `min-release-age=8` is the npm relative-age guard, while `minimum-release-age=11520` and `minimumReleaseAge: 11520` are pnpm coverage for the same 8-day policy where supported.
+   - Avoid overwriting private registry tokens, scoped registry lines, or unrelated project config.
+   - If an existing config deliberately excludes packages from the age gate, keep only exclusions that are documented and necessary; otherwise remove or narrow exclusions before updating.
+
+4. **Discover eligible versions.**
+   - For each target package, query the registry for version metadata and publish times.
+   - Select the highest semver version whose published timestamp is strictly older than 8 full days from the current date/time.
+   - Include stable releases by default. Include prerelease/dist-tag targets only when the existing dependency already tracks that prerelease channel or the user explicitly requests it.
+   - Skip packages when no eligible version is older than 8 days, when the package is pinned for a documented reason, or when peer constraints make the update unsafe.
+   - Record the current version, selected version, publish date, and reason for skips.
+
+5. **Apply updates in safe batches.**
+   - Update manifests through package-manager commands where practical (`pnpm up`, `pnpm add -D`, workspace filters) so manifests and lockfiles stay consistent.
+   - Prefer small batches for major upgrades, framework packages, build tooling, and peer-sensitive groups such as React, Next.js, ESLint, TypeScript, Vite, Vitest, Playwright, Prisma, database clients, and SDKs.
+   - For every major, framework, build-tool, or peer-sensitive update, write an explicit risk section before applying it:
+     - batch order and whether the package should move alone or with a peer group;
+     - peer/config compatibility checks, such as React renderer/framework compatibility, Vitest/Vite/TypeScript config compatibility, ESLint/parser compatibility, Prisma/database client generation, or SDK API changes;
+     - focused smoke checks tied to the package's runtime surface, not only generic install/test/build commands;
+     - stop conditions that route broad compatibility work to `/migrate <package or framework>` instead of hiding it inside the package update.
+   - For npm-to-pnpm migration, first establish a clean pnpm install, then perform dependency upgrades.
+   - For non-trivial or plan-first dependency updates, write a batch execution checklist before mutating files. Each batch must include:
+     - exact mutation command(s) or file edits for that batch;
+     - exact verification command(s) to run before moving on;
+     - expected proof or artifact, such as `packageManager`, `.npmrc`, lockfile creation, selected package version, or smoke-test output;
+     - a "do not proceed on red" gate and a stop condition that routes broad compatibility work to `/migrate <package or framework>`.
+   - For npm-to-pnpm migrations, make the package-manager migration Batch 0, then put low-risk minors/patches before framework, runtime, test-runner, or build-tool majors unless peer constraints require a different order.
+   - For Vitest and other test-runner migrations, prefer the project script (`pnpm test`, `pnpm run test`, or the discovered package-manager equivalent) plus a discovered single-file or config smoke check. Do not recommend Jest-only or version-uncertain flags unless you have verified that the selected runner version supports them.
+   - Do not edit lockfiles by hand.
+
+6. **Verify after updates.**
+   - Confirm `.npmrc` contains `min-release-age=8` and, for pnpm coverage, `minimum-release-age=11520` unless the project has a documented reason to store pnpm settings only in `pnpm-workspace.yaml` or pnpm config.
+   - For pnpm projects, confirm `minimumReleaseAge: 11520` is present in `pnpm-workspace.yaml` or equivalent project pnpm config when required by the active pnpm version.
+   - Run the repo's install/update command, typecheck, tests, lint, build, and any focused smoke checks implied by changed packages.
+   - For major/framework/build-tool updates, run or document package-specific compatibility checks and smoke tests before calling the update complete.
+   - If verification fails, diagnose the root cause. Apply the smallest durable fix when it is clearly inside the dependency update scope.
+   - If a failure requires broad migration work, stop, report the blocker, and route to `/migrate <package or framework>`.
+   - Re-run verification after fixes.
+
+7. **Document and ship.**
+   - Summarize packages updated, versions selected, publish dates, packages skipped, package-manager changes, and verification.
+   - Include the age-gate config files changed and the exact setting values.
+   - Update task docs or changelogs when the repository workflow requires it.
+   - If tracked files changed, commit and push on the repository primary branch unless the user explicitly says not to.
+
+## Output
+
+- **Package manager:** before and after, including any npm-to-pnpm migration result.
+- **Age gate:** `.npmrc` and pnpm config files changed, including `min-release-age=8` and `minimum-release-age`/`minimumReleaseAge` values.
+- **Updated packages:** package, old version, new version, selected publish date, and batch.
+- **Skipped packages:** package and reason.
+- **Major-upgrade risk handling:** affected packages, batch order, compatibility checks, focused smoke checks, and any stop route to `/migrate <target>`.
+- **Batch execution checklist:** for each batch, list the mutation command or edit, verification command, expected proof/artifact, and stop gate before proceeding.
+- **Verification:** install/update, typecheck, tests, lint, build, and smoke checks with pass/fail.
+- **Next work:** `none`, `/migrate <target>`, or another exact follow-up command.
+
+## Constraints
+
+- Never select a package version published within the last 8 days unless the user explicitly overrides the safety gate.
+- Do not finish a mutation run without adding or verifying the package-manager age gate, unless the user explicitly declines it or the package manager cannot support it; document either exception.
+- Do not run package-manager commands that mutate a shared lockfile while acting as one of multiple parallel agents.
+- Do not hand-edit generated lockfiles.
+- Do not remove npm support when scripts, deployment docs, CI, or hosting constraints explicitly require npm.
+- Do not create or modify GitHub Actions workflows.
+
+
+## Default Shipping Contract
+
+Follow the shared shipping contract convention in CLAUDE.md.

package/packs/code-maintenance/codex/migrate/ALIGNMENT-PAGE.md

@@ -57,7 +57,9 @@ The tier is set per skill via `visual_tier` in SKILL.md frontmatter (or detected
 
 **Report-only research gates.** For report-only or pre-approval research skills, the first `review` alignment page must explicitly contain proposed research scope, source plan, assumptions/confidence, recommended output path, proposed file changes, and approval gates before synthesized research begins and before any working packet, canonical research, spec, or task file is created or updated.
 
-**Staged research workflow.** Heavy report-first research uses a scope-first three-stage approval workflow. Stage 1 is minimal scope discovery only: inspect enough repository, user, and source context to propose research scope, source plan, assumptions, output paths, and approval questions. Build the `review` alignment page before synthesized research. The page must render the proposed scope, available source categories, known context, assumptions/confidence, proposed working-packet and canonical output paths, and research-scope approval gates. Stop for final compiled response YAML approval of the research scope. Do not synthesize findings, rank candidates, recommend a path, or create working packets, canonical research, spec, or task files in Stage 1. Stage 2 starts only after final compiled response YAML approves the research scope with no unresolved `needs-clarification`, unresolved `down` feedback, or other unresolved negative feedback. Perform the synthesized research, run required source/code checks, and write only a non-canonical working packet. Flat mode uses `research/_working/preliminary-migrate-research.md`; product-path mode uses `research/{slug}/_working/preliminary-migrate-research.md`. Existing raw evidence or search-log outputs may remain as supporting evidence when the skill contract already requires them, but synthesized deliverables stay in the working packet. Update the same `review` alignment page so it renders the full preliminary packet, evidence matrix, assumptions/confidence register, source coverage gaps, proposed canonical file changes, and artifact approval gates. Partial compiled responses revise the working packet and review page, then remain in Stage 2. Stage 3 consumes final compiled response YAML for artifact approval only when it has `approval_status: ready-for-agent-review` and no unresolved `needs-clarification`, unresolved `down` feedback, or other unresolved negative feedback. Apply approved edits first, archive the working packet to `docs/history/archive/YYYY-MM-DD/HHMMSS/<original-working-path>`, remove the active working packet, write the approved canonical artifacts to the unchanged output paths, and convert the page to `confirmed` with the approval record preserved.
+**Staged research workflow.** Heavy report-first research uses a scope-first three-stage approval workflow. Stage 1 is minimal scope discovery only: inspect enough repository, user, and source context to propose research scope, source plan, assumptions, output paths, and approval questions. Build the `review` alignment page before synthesized research. The page must render the proposed scope, available source categories, known context, assumptions/confidence, proposed working-packet and canonical output paths, research-scope approval gates, and a `Stage 2 Preview / Expected Review Format` section that shows the future Stage 2 review shape before research starts. Stop for final compiled response YAML approval of the research scope. Do not synthesize findings, rank candidates, recommend a path, or create working packets, canonical research, spec, or task files in Stage 1. Stage 2 starts only after final compiled response YAML approves the research scope with no unresolved `needs-clarification`, unresolved `down` feedback, or other unresolved negative feedback. Perform the synthesized research, run required source/code checks, and write only a non-canonical working packet. Flat mode uses `research/_working/preliminary-migrate-research.md`; product-path mode uses `research/{slug}/_working/preliminary-migrate-research.md`. Existing raw evidence or search-log outputs may remain as supporting evidence when the skill contract already requires them, but synthesized deliverables stay in the working packet. Update the same `review` alignment page so it renders the complete working-packet substance as structured HTML review UI: purpose-built sections, tables, matrices, gates, cards, and tier-appropriate charts or diagrams that preserve every packet section, finding, caveat, and decision detail without summary loss. Raw Markdown packet text may appear only as a supplemental source view after the rendered review UI; do not make a `Full Preliminary Packet` or `Full Working Packet` raw Markdown dump, giant `<pre><code>` block, link-only view, or source-only view the primary review surface. Include the evidence matrix, assumptions/confidence register, source coverage gaps, proposed canonical file changes, and artifact approval gates. Partial compiled responses revise the working packet and review page, then remain in Stage 2. Stage 3 consumes final compiled response YAML for artifact approval only when it has `approval_status: ready-for-agent-review` and no unresolved `needs-clarification`, unresolved `down` feedback, or other unresolved negative feedback. Apply approved edits first, archive the working packet to `docs/history/archive/YYYY-MM-DD/HHMMSS/<original-working-path>`, remove the active working packet, write the approved canonical artifacts to the unchanged output paths, and convert the page to `confirmed` with the approval record preserved.
+
+**Stage 2 review-page template.** Stage 1 scope-review pages must include a `Stage 2 Preview / Expected Review Format` section that previews the exact section sequence, table shapes, evidence treatment, visual density, and approval gates the user will see after research; make it specific enough for the user to flag preferred content formats, grouping, labels, visuals, and evidence density before the agent does heavy research. After scope approval and research, the Stage 2 review page must include these sections as structured HTML, not as raw Markdown dumps: `Research Scope Approved` status block with approved scope, source plan, output paths, and unresolved caveats; `Executive Findings` or a skill-specific top-findings section with confidence labels; `Evidence Matrix` mapping claim, evidence/source/path, inference, confidence, assumptions, and decision impact; `Working Packet Review` with the complete working-packet substance rendered as purpose-built HTML sections, lists, tables, matrices, cards, and tier-appropriate charts or diagrams; `Alternatives / Rejected or Lower-Confidence Findings`; `Source Coverage & Gaps`; `Assumptions / Confidence Register`; `Proposed Canonical Artifacts & File Changes`; a required `User Format Preferences` gate asking whether the layout, tables, grouping, visuals, labels, and evidence density match expectations; and a required `Final Artifact Approval` gate for Stage 3 readiness. Raw Markdown packet text, search logs, or source notes may appear only as supplemental source views after the rendered review UI and never replace the Stage 2 review sections.
 
 **Required inline questions.** In `review` pages, each gate must contain at least one required inline question placed directly under the content it governs, inside a visually distinct question block. Each question must use radio-button inputs and include two standing options after the skill-generated choices: "Other / None of the above" backed by a multi-line text box for free-form input, and "Need clarification" backed by an optional notes box where the user can explain what is unclear. When any radio option other than "Other" or "Need clarification" is selected, show an optional "Additional notes" text box beneath it so the user can qualify their choice. Generate questions based on what genuinely needs user input -- do not add filler questions. Do not create a separate bottom "Decisions & Clarifications" section. Confirmed pages must not keep these as required input controls; render the answered decisions as read-only records.