Verify and address PR #3809 discussions 4419228221, 4419257840 and 4419257844. Iterate string-array assertions through sparse positions, validate the declared example identifier grammar before request construction, and refresh Turkish/Chinese reviewer references. Regenerate the canonical Pi copy.
Compile and execute the actual typed fixture; keep published validation bodies aligned and prove invalid identifiers never call fetch. RED: 28 pass, 2 fail. GREEN: 30 pass, 0 fail. Strict tsc, changed ESLint/Markdownlint, Unicode/agent/skill validators and deterministic Pi checks pass. Parent independently reviewed all six paths. Registry rebinding is deferred to the combined integration.
Carry forward AbhiramMandala’s canonical TypeScript guidance from PR #3142, reviewed source head 643f61d604. Rebuild current-main counts, Pi projection and trigger digest without replacing existing registry entries.
Use bracket access under the documented noPropertyAccessFromIndexSignature baseline. Type-check and execute the actual fixture, compare published function bodies, and preserve deterministic undefined, sparse-array and concurrency regressions.
Validation: 26 focused checks; strict TypeScript compile; all repository validators; affected ESLint and Markdownlint; deterministic Pi rebuild; real npm pack; disposable Claude, Codex and Copilot install/repair/uninstall with exact skill bytes and preserved user files. Parent independently reviewed the complete staged diff.
Co-authored-by: AbhiramMandala <abhirammandala02@gmail.com>
Add a GitHub issue counterpart to the PR mode of /code-review. The
canonical workflow lives in skills/issue-review and walks nine phases:
fetch the issue with gh, build project context, classify type and
completeness, verify the claim against the code at HEAD, search for
duplicates and prior fixes, assess severity and decision, write a
review artifact with a draft reply, publish only on explicit flags,
and print a one-screen summary.
Issue text is treated as untrusted data: embedded instructions are
never followed, pasted code is never run, and arbitrary links are not
fetched. Writing to GitHub is opt-in via --comment or --label and the
workflow never closes, reopens, or assigns issues.
commands/issue-review.md is the thin slash-command shim. The new
structural test guards the frontmatter, required sections, phase
order, safety invariants, and registration on every surface.
Register the skill and command in package.json, agent.yaml, the
operator-workflows install module, the quick reference, the
command-agent map, and the README; regenerate the command registry
and sync catalog counts to 312 skills and 98 commands.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Signed-off-by: Tomoya.Fujita <fujita.tomoya@triorb.co.jp>
The sync.Pool example returned buf.Bytes(). That slice points into the
pooled buffer. The deferred Reset and Put give the buffer to the next
Get, so another goroutine can overwrite the result while the caller
still uses it.
Return bytes.Clone(buf.Bytes()) instead, and add a short note. Same code
fix in the five translations. pi/core regenerated with
scripts/build-pi-core.js.
Tested: 64 goroutines calling the example under go test -race (Go 1.27).
Old code: DATA RACE and wrong results. New code: passes.
node scripts/build-pi-core.js --check passes.
Replaces the golang part of closed PRs #3351 and #3405, which were not
merged.
Integrate contributor PRs #3533, #3534, and #3535 on current main. Preserve the read-only module audit, canonical glossary and ADR ownership, and opt-in install closure. Refresh only the manual trigger manifest registry binding and coverage after adding the skill.
Sources: #3689#3691#3692#3693. Preserve Claude marketplace migration guidance, tool-result boundaries, scoped workflow authority, and bounded batch preparation. Regenerate the Pi projection and recompute the shared registry digest on one main head.
The AJAX example reads csrftoken from document.cookie, which fails when
CSRF_COOKIE_HTTPONLY is True. Drop the setting from the production
block (the default is False) and set it to False in the CSRF block, as
the .kiro copy already does there. Also remove SECURE_BROWSER_XSS_FILTER,
which Django 4.0 removed. Updated .kiro and regenerated pi/core.
Signed-off-by: Wen <jwcastillo@gmail.com>
(cherry picked from commit bdc4407edf)
Perl::Critic has no InputOutput::RequireThreeArgOpen or
Modules::RequireTaintChecking policy. perlcritic warns that they are
not installed and ignores them. Two-arg open is already covered by
InputOutput::ProhibitTwoArgOpen in the same profile. Regenerated pi/core.
Signed-off-by: Wen <jwcastillo@gmail.com>
(cherry picked from commit d70726d79c)
sanitize_html is not a built-in Laravel rule and the skill never
registers it, so the validator throws BadMethodCallException. The same
FormRequest already strips tags in validated(). Regenerated pi/core.
Signed-off-by: Wen <jwcastillo@gmail.com>
(cherry picked from commit 453c0651f7)
The users router uses Depends() for OAuth2PasswordRequestForm but the
import line omits it, so the module raises NameError on import.
Regenerated pi/core with scripts/build-pi-core.js.
Signed-off-by: Wen <jwcastillo@gmail.com>
(cherry picked from commit d383fb57e9)
Preserve complete source ancestry for PRs #3512, #3513, #3515, #3516, #3517 and #3518. Repair bounded recovery, alias compatibility and evaluator packaging gaps while keeping registry reuse inside the canonical loader. Verified actual hook, setup, dashboard, evaluator, sandbox and profile workflows plus full npm, Python, lint and supply-chain checks. ECC-043 preparation only; integration remains with the delivery owner.
Preserve full contributor head; refresh catalogs and Pi projection. Verify disposable Claude/Codex installs and resource discovery, with no automatic hooks or governance files.
Drop the duplicate ECC_PREPUSH_RUN_CHECKS key now that main sets it,
refresh the skill-triggers registry digest, classify skill-host-compat
for pi/core, and bump the Turkish AGENTS.md counts the catalog sync
does not cover.
Treat non-2xx activity responses as feed errors, preserve non-Markdown Copilot agent assets, and apply the reviewed reference escape parity correction with regenerated bindings. Allow the test runner to drain piped output on its existing success or failure exit status. Validate installed workflows and bounded real Node20/24 pipe regressions.
Phase 1 pipes the build into `tail -20`. Without pipefail the pipeline's
exit status is tail's, so a failed build exits 0. Phase 2 already sets
pipefail, but only after Phase 1 has run, and each phase is its own code
block. Set it at the top of the Phase 1, 3 and 4 blocks, which pipe a gate
into head or tail. Mirrored in pi/core.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
haelyra