Add a GitHub issue counterpart to the PR mode of /code-review. The
canonical workflow lives in skills/issue-review and walks nine phases:
fetch the issue with gh, build project context, classify type and
completeness, verify the claim against the code at HEAD, search for
duplicates and prior fixes, assess severity and decision, write a
review artifact with a draft reply, publish only on explicit flags,
and print a one-screen summary.
Issue text is treated as untrusted data: embedded instructions are
never followed, pasted code is never run, and arbitrary links are not
fetched. Writing to GitHub is opt-in via --comment or --label and the
workflow never closes, reopens, or assigns issues.
commands/issue-review.md is the thin slash-command shim. The new
structural test guards the frontmatter, required sections, phase
order, safety invariants, and registration on every surface.
Register the skill and command in package.json, agent.yaml, the
operator-workflows install module, the quick reference, the
command-agent map, and the README; regenerate the command registry
and sync catalog counts to 312 skills and 98 commands.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Signed-off-by: Tomoya.Fujita <fujita.tomoya@triorb.co.jp>
Line 13 still said 'Verify that 2.2.0 is readable' after the install
command was updated to @2.2.3. Align prose with the pin to remove the
version mismatch within the Quick Start section.
(cherry picked from commit b0b955541f)
The Quick Start section pinned ecc-universal@2.2.0 while every other
reference in the repo (README.md, and all other docs) uses @2.2.3.
This caused Antigravity users to install an outdated version.
Update the pin to @2.2.3 to match the rest of the codebase.
(cherry picked from commit a052b208e5)
* docs: correct MODULE_NOT_FOUND plugin cache path
Point the install command at cache/ecc/ecc/<version>.
The cache/ecc directory itself has no package.json.
* docs: explain the MODULE_NOT_FOUND version placeholder
Tell readers to replace <version> with the version from claude plugin list
before running the install command.
* docs: quote plugin cache version placeholder
---------
Co-authored-by: haelyra <49814733+haelyra@users.noreply.github.com>
The multi-backend, multi-frontend, multi-plan, multi-execute and multi-workflow commands were copied from ccg-workflow's command templates, which carry {{LITE_MODE_FLAG}} and {{GEMINI_MODEL_FLAG}} for that project's installer to substitute. ECC has no substitution step, so bash passed the literal token to codeagent-wrapper as a positional argument, the backend name landed in the working-directory slot, and every call exited 1. Remove the tokens from the five commands and the ja-JP, tr and zh-CN docs copies so the wrapper receives a plain --backend invocation. A regression test scans every multi-* command and translated copy for codeagent-wrapper lines that still contain a {{TEMPLATE}} token.
Fixes#3595
Snapshot the header and expected rows when the grader loads and pass
exportCsv copies, so an exporter that overwrites its input cannot change
what it is compared with. decoy-mutates now scores 0.75 with the other
two decoys; reference still scores 1.
- csv-export-delimiter's grader adds a fourth check: the data rows are
the exported values, with an optional header (the hidden intent says a
header is fine either way). Reference scores 1; both decoys 0.75.
- graderIsSound grades every decoy-* overlay and is sound only when each
scores below 1; --check-graders and the pre-billing check print the
decoy scores through formatGraderScores.
- isValidTrial and completedTrialKeys move to lib.js; coverage.js and
run-intent.js use them from there.
- run.js resumes with completedTrialKeys, so a provider-error or timed-out
key is retried, and writes one transcript per attempt
(<key>__<attemptId>.jsonl, recorded on the row) so a retry never
overwrites the failed attempt's record.
- armSummary computes trials, passes and means over valid rows and counts
the failed attempts apart as providerErrors.
Docs: question-effectiveness.md states the decoy rule and that a
csv-export-delimiter pass in the reported runs reflects the dialect only;
its Measures section and the harness README describe retries, per-attempt
transcripts and the hookless-trial stop.
Scoped adaptation of PR #2716: keep compact rendering as the default and require ECC_STATUSLINE_USAGE=1. Installer registration, managed aliases and the Codex background bar remain outside this slice.
Preserve full contributor head; refresh catalogs and Pi projection. Verify disposable Claude/Codex installs and resource discovery, with no automatic hooks or governance files.
Preserve full contributor history and current catalog. Actual process workflows cover concurrency, recovery, sprint planning and read-only status. Bound registry symlinks, counts and lock waits; preserve manually curated trigger provenance.
Reproduced issue #3485 on installed Codex CLI 0.162.0. Keep user legacy choices for explicit migration and verify disposable install, repair, reinstall and removal.
- questionIdsFor and condensedHintFor take an optional
{ externalContract: true }; without it a code change that handles data
asks data-schema only, and an unknown profile gets the original four
questions and condensed hint.
- The hook reads GATEGUARD_EXTERNAL_CONTRACT_QUESTION with the same
spellings as GATEGUARD_METRICS and passes it to the full denial, the
condensed denial and the metrics record, so all three agree.
- The effectiveness harness's arm patch forwards the option, so an arm
never drops it silently.
Docs: change-profile.md gains an External-contract question section and
qualifies "byte-identical to the fixed four questions"; design-notes.md,
SKILL.md (switch table, data rule, word-for-word set) and CHANGELOG say
the fifth question is opt-in; question-effectiveness.md and the harness
README note that the runner clears GATEGUARD_* variables, so a gate arm
from a current tree measures the gate without the question.
skill-triggers@1.json: registryDigest refreshed for the SKILL.md body
change; the description and triggers are unchanged.
- design-notes.md: new Type filters and Path patterns sections; Search
scope extends the search-of-the-target rule to name lookups; Flag
parsing lists the new value flags.
- change-profile.md: Unicode line terminators make an edit non-trivial.
- skills/gateguard/SKILL.md and CHANGELOG.md describe the same rules.
- skill-triggers@1.json: refresh registryDigest for the SKILL.md body
change. The skill's description is unchanged, so triggers and
triggersDigest are untouched, as in the plan-orchestrate refresh.
- Record whether each `{` opens a block or an object literal from the
token before it; only a block's `}` lets a regex follow, so `{} / 2`
divides again while `if (ok) {} /re/` stays a regex.
- Match regex-preceding keywords only when no member dot precedes them,
so `a.of / 2` divides.
- Exempt the last dot of a spread from the member-call guard, so
`...require('./x')` is a module load.
- Resolve a call's first argument up to its first top-level comma, so
`require('./x', null)` and `import('./x.json', { with })` name `./x`.
`import(path.join(__dirname, ...))`, previously skipped silently, now
warns as dynamic.
Rescanning all 802 repository JavaScript files against the previous head
changes no result. The real registry is unchanged: 35/35 resolved, zero
failures or warnings. The design doc records the fix and states the gate's
scope: static relative specifiers in planned JavaScript only.
