Files
ECC/pi/core
Wen 95e6e4e735 docs(django-security): keep the CSRF cookie readable for the AJAX example
The AJAX example reads csrftoken from document.cookie, which fails when
CSRF_COOKIE_HTTPONLY is True. Drop the setting from the production
block (the default is False) and set it to False in the CSRF block, as
the .kiro copy already does there. Also remove SECURE_BROWSER_XSS_FILTER,
which Django 4.0 removed. Updated .kiro and regenerated pi/core.

Signed-off-by: Wen <jwcastillo@gmail.com>
(cherry picked from commit bdc4407edf)
2026-10-20 18:01:40 -04:00
..

ecc-pi-core

A curated, Pi-native profile of ECC: 132 portable engineering skills and 24 pure prompt-workflow commands, with no extensions, no hooks, no runtime downloads, and no network or SaaS dependencies.

Contents

  • skills/ - language, framework, testing/TDD, code review, security review, planning, refactoring, docs, and git/PR workflow skills.
  • commands/ - prompt commands that are pure prompt workflows.
  • CURATION.md - every excluded skill and command with its reason.

Use

Copy this directory into your project (or pin a release tarball) and load it with the Pi coding agent:

pi --no-extensions --extension pi/core

Offline load test (as run in CI):

PI_OFFLINE=1 pi --offline --mode rpc --no-session --no-context-files --no-extensions \
  --extension pi/core </dev/null >/dev/null

Regenerate

pi/core is generated from manifests/pi-core.json and committed so release tarballs contain it verbatim. After changing the manifest or any included source content, run:

node scripts/build-pi-core.js

and commit the result. CI verifies the committed profile is up to date.