Resolve six conflicts:
- hooks/hooks.metadata.json: keep this branch's gateguard description and
fingerprint, add upstream's hookify-runtime entries.
- package.json: keep both gateguard-report.js and github-coordination.js.
- scripts/hooks/gateguard-fact-force.js, tests/hooks/gateguard-fact-force.test.js,
skills/gateguard/SKILL.md: upstream added a simpler session denial cap; this
branch already has the fuller one (cap threaded through
markCheckedAndCountDenial, malformed-value warning, miss and target notes),
so keep it. Upstream's taskset and su wrapper handling, fail-closed
recursion limit and soft-hyphen sanitising merged cleanly and their tests pass.
- manifests/context-packs/skill-triggers@1.json: take upstream's file and
recompute registryDigest for the merged registry.
Preserve PR #2968 contributor history, verified upstream claims, and target-specific metadata. Rebind the existing trigger registry metadata after the merge, retaining current trigger phrases and generation provenance. Portable Bun 1.4.2 isolation and parallel-timing examples passed; all five Markdown files and context profiles validated.
Brings in the three commits main gained since the branch's merge base: the 2.2.3
release, retiring the Everything Claude Code name for ECC, and the ja-JP sponsor
update. 227 files arrive from main; two conflicted.
CHANGELOG.md: the branch had added an Unreleased section and main a released
2.2.3 section, both at the top. Both are kept verbatim with Unreleased above
2.2.3, since none of the branch's entries shipped in that release.
manifests/context-packs/skill-triggers@1.json: both sides had recomputed
registryDigest from the same earlier value to different results, and neither is
the digest of the merged tree. It is recomputed with loadContextRegistry over the
merged tree and only that field changes; triggers and triggersDigest are
untouched on both sides. validate-context-profiles passes.
All twelve CI validators pass. The full suite reports 44 failures in seven files;
43 of them fail by name and count identically on an unmodified upstream/main, and
the remaining one, plugin-hook-bootstrap, fails only inside run-all and passes in
isolation on both trees. The merge introduces no failing test that main does not
already have.
* chore: retire the Everything Claude Code name, ECC only
Replace the expanded product name and the everything-claude-code slug
with ECC across READMEs, translated docs, harness folders, skills,
commands, scripts and examples. Repo URLs now point at affaan-m/ECC.
Rename repo-internal artifacts to ecc forms (ecc-conventions skill,
ecc-guardrails, ecc-research-playbook, ecc-team-config, ecc-instincts
with ecc-* ids) and update .claude/ecc-tools.json.
Legacy install ids, plugin dirs, package names and MCP prefixes stay
where existing installs resolve against them. The codex global-state
check and harness-audit repo detection accept the new name first and
the legacy one as a fallback. The Discord bot prefers ~/GitHub/ECC and
falls back to the nested legacy checkout path.
Refresh the skill-triggers registryDigest for the changed skill text.
* fix(ecc-tools): drop managed paths to the removed Claude repo skill
.claude/skills/<repo-skill>/SKILL.md was deleted in #2770 but stayed listed in
ecc-tools.json and the team config. Remove those entries and point the Claude
Code adapter at the existing .agents/skills/ecc-conventions/SKILL.md.
payOnce reserved MAX_AMOUNT before awaiting confirmation but only released
it when confirmWithUser returned false. A prompt that threw (timeout, closed
window) or a challenge the payment policy rejected before signing kept the
reservation, so five such failures exhausted SESSION_CAP with zero payments.
Track per call whether a request carrying PAYMENT-SIGNATURE / X-PAYMENT was
actually sent, and release the reservation in a finally block unless it was.
A sent signed request may settle, so it stays counted even if the response
fails. The reservation still happens before any await, so concurrent calls
cannot overrun the cap. Mirrored in ja-JP and zh-CN.
Reconciles a local, unpushed doc fix (missing imports in the ja-JP
database.md example) with a CodeRabbit-suggested wording fix applied
on GitHub to the ja-JP SKILL.md security warning. Non-overlapping files,
no conflicts.
Add metadata.upstream: tinystruct==1.7.34 to both the English skill and
its Japanese translation, so a future sync can mechanically diff the
pinned version against the current tinystruct release instead of
rediscovering drift from prose. Also migrates the legacy top-level
`origin: ECC` key into the metadata block, matching the schema used by
the rest of the skills in this repo (tests/commands/learn-skill-discovery.test.js
already asserts top-level `origin:` is unsupported).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Preserve the original contributor histories and apply the exact independently reviewed repair.
Source-Parent: edcb389e2c
Review-Manifest-SHA256: c607db261fe8760465af1dffd5f9a3dda42478c5f745dbfa5916fd8e014ef306
Preserve contributor name changes, update carrier expectations, and bind the existing manually curated trigger seed to the actual registry.
Source-PR: https://github.com/affaan-m/ECC/pull/3059
Source-Head: 8115a5e46c
Reviewed-Manifest-SHA256: 6295aa042be428a2f3f9fc5a120a0e5a26a9548e1d53e17a3b20febe9baa1fdc
Two overlapping first payOnce calls could both pass the session-cap check
while sessionSpent was still 0, then both increment after the confirm await,
exceeding SESSION_CAP. Reserve MAX_AMOUNT before any await and release it
only when the user declines. Mirrored in ja-JP and zh-CN.
Sync skills/tinystruct-patterns against tinystruct's own canonical copy of
this skill (.agents/skills/tinystruct-patterns/), which the framework repo
keeps up to date with each release:
- Document the bin/dispatcher / bin/dispatcher.cmd launcher generation
workflow (never hand-write or copy it; the framework generates it via
ApplicationManager.init()).
- Add native MCP server/tool integration (org.tinystruct.mcp.*), including
the prompt-injection warning for tool return values and overloaded-tool
schema merging.
- Add annotation-based DB mapping (@Table/@Id/@Column) alongside XML
mapping, the --mapping annotation generator flag, and table
auto-creation via database.autocreate.
- Add the programmatic logging/diagnostics subsystem (ANSI console colors,
StackWalker-based caller tracing, per-package level overrides).
- Update the architecture package map accordingly.
Also update the Japanese translation (docs/ja-JP/skills/tinystruct-patterns)
to match, which had drifted to an older, condensed version of this skill.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Keep the contributor's corrected Haiku and Fable/Mythos tiers, update the live Sonnet and Opus rows against the current official pricing contract, and mirror the same numeric changes in the Japanese and Chinese tables.
Keep the duplicate estimator and its tests deleted as landed through #2866, while carrying the contributor's pricing-table correction forward and refreshing the documented live model rows against the current official pricing contract.
Two findings from the bot review.
The reusable payment client had no authorization boundary. The policy
validates one challenge at a time, so it cannot see a session total and
cannot ask a human anything — a long-lived wrapped client could pay
repeatedly, to any recipient, past any intended budget. This also
contradicted the skill's own Spending Controls section, which promises
per-session budgets and allowlisted recipients.
Adds an allowlist of recipients to the policy, and routes every paid call
through a boundary that asks for confirmation once and holds a session
ledger. Settlement responses carry no amount, so the ledger reserves the
per-call cap — a deliberate over-estimate that can stop early, never late.
The payment-enabled client stays private behind it.
The Solana recipient check was too loose. Scanning an owner's token
accounts proves only that some account exists for the mint; the exact-SVM
client targets the canonical ATA specifically, so an auxiliary account
would pass while settlement still fails. Now derives the ATA with
findAssociatedTokenPda and checks that exact address. Also corrects the
provisioning advice: a bare transfer does not create the account, only one
that includes the create instruction does.
Mirrored across en, ja-JP, and zh-CN.
Addresses the security review on #2575.
Enforce policy against the actual challenge. The previous example compared
a budget against a number the caller passed in, so a server quoting any
amount could still be paid. Replaces it with a PaymentPolicy registered on
the client, which filters the server-provided requirements before a
signature exists and validates all three fields — amount, asset, network.
Filtering everything out makes createPaymentPayload throw rather than fall
back to paying.
Testing this adversarially surfaced a bug in the guard itself: EVM
addresses are case-insensitive, so a server quoting lowercase USDC — the
same token — was dropped. Assets are now normalised before comparison,
lowercasing only 0x addresses, since Solana base58 is case-sensitive and
must not be folded. Also rejects negative amounts.
Verified against 12 cases: over-budget, wrong mint, wrong network,
case-flipped Solana mint, non-numeric and negative amounts all refuse;
checksummed, lowercase and uppercase EVM forms and the cap boundary all
pass.
Refresh the supported contract. Pins move 2.19.0 -> 2.22.0 (upstream
shipped 2.20, 2.21 and 2.22 since this branch opened). The documented
server and client APIs are unchanged across that range — re-ran the
seller middleware on 2.22.0 and it still returns a multi-network 402.
Keep facilitator guidance vendor-neutral. Self-facilitation and running
your own facilitator are now listed first, ahead of the testnet default
and hosted options, and the hosted paragraph points at the upstream
maintained list rather than naming a default. Adds an explicit disclosure
of the author's affiliation with one listed facilitator.
Mirrored across en, ja-JP, and zh-CN.
Model-routing guidance across the rules, skills, and harness-steering docs
still recommends Sonnet 4.6 / Opus 4.5-4.6 by name. Readers on the current
generation have to map those onto Sonnet 5 / Opus 5 themselves, and the
recommendation reads as pinned to a superseded generation.
Renames the recommended models in guidance tables and updates two pinned
model IDs in code samples:
- rules/steering guidance: .cursor, .kiro, and the seven translated
performance.md copies (ja-JP, zh-CN, zh-TW, ko-KR, pt-BR, es, tr)
- skills/prompt-optimizer complexity-routing table (+ zh-CN copy)
- skills/cost-aware-llm-pipeline MODEL_SONNET constant (+ zh-CN, ja-JP)
- docs/examples project-guidelines template, which pinned the invalid ID
claude-sonnet-4-5-20250514 (+ zh-TW, ja-JP copies)
Deliberately left alone:
- The "Pricing Reference (2025-2026)" table in cost-aware-llm-pipeline.
Renaming those rows while keeping the existing per-token figures would
assert Claude 5 pricing this change has not verified.
- Executable model config (.opencode/opencode.json, agent.yaml). Those pins
change real agent behavior and belong in their own reviewed change.
- Historical and illustrative references: the-shortform-guide session
transcripts, the ECC-PRO roadmap log entry, gan-style-harness's
"Opus 4.5-class"/"Opus 4.6-class" capability tiers, and
strategic-compact's deliberately generic "400k Opus 4.x" example.
- docs/ATLAS-CLOUD-GUIDE.md, which lists a third-party provider's catalog.
Documentation wording only; no behavioral change.
Co-authored-by: Phumchai Tanonsi <274848436+phumchai1515-prog@users.noreply.github.com>
* fix(quarkus-verification): use current ghcr.io/zaproxy/zaproxy:stable image
The owasp/zap2docker-* images are deprecated (ZAP left the OWASP org). The
current canonical image published by the ZAP project is
ghcr.io/zaproxy/zaproxy:stable; the packaged scan scripts (zap-api-scan.py)
are unchanged.
Applies to the source skill and the ja-JP, tr translated copies.
Refs: https://www.zaproxy.org/docs/docker/about/
* chore(quarkus-verification): bump GitHub Actions v3 -> v4
actions/checkout, actions/setup-java, actions/cache and codecov/codecov-action
were pinned at v3 (which runs on the deprecated Node 16 runtime). Bump to v4.
Applies to the source skill and the ja-JP, tr translated copies.
* docs(quarkus): finish current CI example refresh
---------
Co-authored-by: haelyra <49814733+haelyra@users.noreply.github.com>
`estimateCost` used `inputTokens` and `outputTokens` without validation.
A negative count yielded a negative cost, and a non-finite one yielded
NaN. That matters here specifically because this module backs the
cost-aware-llm-pipeline budget skill: `NaN > budget` is false, so a
corrupt token count silently passes the budget check it exists to
enforce. It now throws a RangeError naming the offending field.
The unknown-model fallback to sonnet rates deliberately stays fail-open:
that degrades an estimate, whereas these inputs corrupt one.
Separately, the estimator prices Fable and Mythos at $10/$50 per million
tokens, but all three pricing tables (the skill and its ja-JP and zh-CN
translations) listed only Haiku, Sonnet, and Opus, so a reader could not
budget for two supported model families. Added the missing row to each.
16 of the new assertions fail against the previous behaviour (23 passed,
16 failed) and all pass with the guard (39 passed).
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KV43bDJpgyMPovT2CHAoba
Completes the model re-tiering from #2442: the gan-planner, gan-generator,
and gan-evaluator agents were already re-pinned to sonnet, but the
gan-style-harness script and docs still defaulted GAN_PLANNER_MODEL,
GAN_GENERATOR_MODEL, and GAN_EVALUATOR_MODEL to opus. Align the script
defaults, skill docs (en/ja/zh), and example commands with the landed
agent tiers. Opus remains available via the existing env overrides.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
montjeffrey