mosaicstack/stack
13
0
Fork 1
Code Issues 304 Pull Requests 10 Actions Packages Projects Releases 15 Wiki Activity

skills: fold agent-skills into the monorepo, single install path, promote ms-unslop (plan phase D) #1319

Merged
fargo merged 22 commits from fold-agent-skills into next 2026-08-19 20:08:11 +00:00
Conversation 1 Commits 22 Files Changed 1404
+268216 -153
fargo commented 2026-08-19 19:44:42 +00:00
Member
Copy Link
Copy Source

What

Phase D of docs/plans/2026-08-19_fleet-access-sync-and-canon.md (brain repo), decisions S19-S21:

  • D1 — fold mosaicstack/agent-skills into the monorepo as the shipped canonical skills package (packages/mosaic/framework/skills/), with history preserved.
  • D2 — single install path: canonical skills now ship with the framework package. The second repository, its clone/pull step, and the sources/agent-skills fallback are gone. mosaic-sync-skills (bash + PowerShell) now only links installed skills into runtime homes.
  • D3 — promote ms-unslop from the operator's skills-local test bed into the package (the only local skill with working enforcement evidence; its checker stays fleet-local pending its own promotion case).

How the history is preserved (and why this PR must merge as a real merge)

Each of the 16 agent-skills commits was path-rewritten (skills/ -> packages/mosaic/framework/skills/) via git fast-export | rewrite | git fast-import (authors, dates, messages, blob shas preserved — tree fidelity verified blob-for-blob), then merged with --allow-unrelated-histories. git log packages/mosaic/framework/skills/ reaches the original commits; git log --follow works on individual files.

A squash merge would destroy exactly this. This repo already merges PRs with merge commits on next (e.g. fe4fa20, d4d32a8), so this PR requests merge-commit, not squash. pr-merge.sh enforces squash-only and will refuse; the merge must go through the API with Do: merge + head pin, or be merged from the UI as "merge". Flagging this explicitly for the reviewer.

Commit map

Commit Content
5e58597 fold merge (pure additions vs parent 1; 0 non-A entries)
d2eeb64 sanitize 4 skills that hit the denylist (kickstart template path, one estate stack-name row, two credential-source lines) — estate values belong in skills-local overrides, which link with precedence
1a82249 repo prettier 3.8.1 (pinned, node_modules/.bin/prettier, never npx) over 963 folded md files
1556982 single install path: sync scripts reworked, catalog fallback removed, inbound refs rewritten
d5f3fae ms-unslop promotion (denylist clean, prettier clean; 7249 chars as shipped)
95d5cb3 js/ts scripts inside folded skills, same prettier (the repo glob covers ts/js, first pass covered md only)

The prettier pass normalizes embedded code fences too (TS semicolons, closed HTML tags, one renumbered list). Alphanumeric-token deltas vs the fold commit were audited file-by-file; all formatter-equivalent.

Verification (all measured on this branch, sb-it-1-dt)

  • Clean install into a fresh MOSAIC_HOME: install.sh file phase produces 103 skills (101 folded + mosaic-context-refresh + ms-unslop), no sources/ directory — the plan's "clean install produces the skills without a separate sync step".
  • Linker smoke: mosaic-sync-skills links a MOSAIC_INSTALL_SKILLS whitelist into all four runtime homes, no git involvement; --no-link exits clean.
  • verify-sanitized.sh: pass (self-test included).
  • pnpm format:check, pnpm typecheck, pnpm lint: pass.
  • packages/mosaic vitest: 1577/1577; install-ordering guard: 5/5.
  • framework-shell suite: all green except invariant_r_unittest.py, which fails identically on the base commit on this host (pi 0.84.2 vs measured 0.84.1 — host drift, not this branch; CI uses its pinned pi).

Follow-ups (not in this PR)

  • Archive/freeze mosaicstack/agent-skills after merge.
  • The estate's ~/.config/mosaic/skills/mosaic-deploy (jarvis-crypto row) and kickstart brain-templates now belong in skills-local overrides.
  • D4: the remaining six skills-local skills promote individually as they acquire evidence.
## What Phase D of `docs/plans/2026-08-19_fleet-access-sync-and-canon.md` (brain repo), decisions S19-S21: - **D1 — fold `mosaicstack/agent-skills` into the monorepo** as the shipped canonical skills package (`packages/mosaic/framework/skills/`), **with history preserved**. - **D2 — single install path**: canonical skills now ship with the framework package. The second repository, its clone/pull step, and the `sources/agent-skills` fallback are gone. `mosaic-sync-skills` (bash + PowerShell) now only links installed skills into runtime homes. - **D3 — promote `ms-unslop`** from the operator's `skills-local` test bed into the package (the only local skill with working enforcement evidence; its checker stays fleet-local pending its own promotion case). ## How the history is preserved (and why this PR must merge as a real merge) Each of the 16 `agent-skills` commits was path-rewritten (`skills/` -> `packages/mosaic/framework/skills/`) via `git fast-export | rewrite | git fast-import` (authors, dates, messages, blob shas preserved — tree fidelity verified blob-for-blob), then merged with `--allow-unrelated-histories`. `git log packages/mosaic/framework/skills/` reaches the original commits; `git log --follow` works on individual files. **A squash merge would destroy exactly this.** This repo already merges PRs with merge commits on `next` (e.g. fe4fa20, d4d32a8), so this PR requests merge-commit, not squash. `pr-merge.sh` enforces squash-only and will refuse; the merge must go through the API with `Do: merge` + head pin, or be merged from the UI as "merge". Flagging this explicitly for the reviewer. ## Commit map | Commit | Content | |---|---| | `5e58597` | fold merge (pure additions vs parent 1; 0 non-A entries) | | `d2eeb64` | sanitize 4 skills that hit the denylist (kickstart template path, one estate stack-name row, two credential-source lines) — estate values belong in `skills-local` overrides, which link with precedence | | `1a82249` | repo prettier 3.8.1 (pinned, `node_modules/.bin/prettier`, never npx) over 963 folded md files | | `1556982` | single install path: sync scripts reworked, catalog fallback removed, inbound refs rewritten | | `d5f3fae` | ms-unslop promotion (denylist clean, prettier clean; 7249 chars as shipped) | | `95d5cb3` | js/ts scripts inside folded skills, same prettier (the repo glob covers ts/js, first pass covered md only) | The prettier pass normalizes embedded code fences too (TS semicolons, closed HTML tags, one renumbered list). Alphanumeric-token deltas vs the fold commit were audited file-by-file; all formatter-equivalent. ## Verification (all measured on this branch, sb-it-1-dt) - Clean install into a fresh `MOSAIC_HOME`: `install.sh` file phase produces **103 skills** (101 folded + mosaic-context-refresh + ms-unslop), **no `sources/` directory** — the plan's "clean install produces the skills without a separate sync step". - Linker smoke: `mosaic-sync-skills` links a `MOSAIC_INSTALL_SKILLS` whitelist into all four runtime homes, no git involvement; `--no-link` exits clean. - `verify-sanitized.sh`: pass (self-test included). - `pnpm format:check`, `pnpm typecheck`, `pnpm lint`: pass. - `packages/mosaic` vitest: **1577/1577**; install-ordering guard: 5/5. - framework-shell suite: all green except `invariant_r_unittest.py`, which fails identically on the base commit on this host (pi 0.84.2 vs measured 0.84.1 — host drift, not this branch; CI uses its pinned pi). ## Follow-ups (not in this PR) - Archive/freeze `mosaicstack/agent-skills` after merge. - The estate's `~/.config/mosaic/skills/mosaic-deploy` (jarvis-crypto row) and kickstart brain-templates now belong in `skills-local` overrides. - D4: the remaining six skills-local skills promote individually as they acquire evidence.
fargo added 22 commits 2026-08-19 19:44:43 +00:00
feat: Initial agent-skills repo — 4 adapted skills for Mosaic Stack ecde74439c 
Skills included:
- pr-reviewer: Adapted for Gitea/GitHub via platform-aware scripts
  (dropped fetch_pr_data.py and add_inline_comment.py, kept generate_review_files.py)
- code-review-excellence: Methodology and checklists (React, TS, Python, etc.)
- vercel-react-best-practices: 57 rules for React/Next.js performance
- tailwind-design-system: Tailwind CSS v4 patterns, CVA, design tokens

New shell scripts added to ~/.claude/scripts/git/:
- pr-diff.sh: Get PR diff (GitHub gh / Gitea API)
- pr-metadata.sh: Get PR metadata as normalized JSON

Co-Authored-By: Claude Opus 4.6 <[email protected]>
docs: Add npx install commands and clone instructions b032d23889 
- Add npx skills add commands for single, all, and non-interactive install
- Document .git suffix requirement for Gitea-hosted repos
- Add git clone step to manual installation
- Use ln -sf for idempotent symlinks

Co-Authored-By: Claude Opus 4.6 <[email protected]>
feat: Add 5 curated skills for Mosaic Stack 7ea13332ed 
New skills:
- next-best-practices: Next.js 15+ RSC, async patterns, self-hosting (vercel-labs)
- better-auth-best-practices: Official Better-Auth with Drizzle adapter (better-auth)
- verification-before-completion: Evidence-based completion claims (obra/superpowers)
- shadcn-ui: Component patterns with Tailwind v4 adaptation note (developer-kit)
- writing-skills: TDD methodology for skill authoring (obra/superpowers)

README reorganized by category with Mosaic Stack alignment section.
Total: 9 skills (4 existing + 5 new).

Co-Authored-By: Claude Opus 4.6 <[email protected]>
feat: Expand fleet to 23 skills across all domains dfeb4d9692 
New skills (14):
- nestjs-best-practices: 40 priority-ranked rules (kadajett)
- fastapi: Pydantic v2, async SQLAlchemy, JWT auth (jezweb)
- architecture-patterns: Clean Architecture, Hexagonal, DDD (wshobson)
- python-performance-optimization: Profiling and optimization (wshobson)
- ai-sdk: Vercel AI SDK streaming and agent patterns (vercel)
- create-agent: Modular agent architecture with OpenRouter (openrouterteam)
- proactive-agent: WAL Protocol, compaction recovery, self-improvement (halthelobster)
- brand-guidelines: Brand identity enforcement (anthropics)
- ui-animation: Motion design with accessibility (mblode)
- marketing-ideas: 139 ideas across 14 categories (coreyhaines31)
- pricing-strategy: SaaS pricing and tier design (coreyhaines31)
- programmatic-seo: SEO at scale with playbooks (coreyhaines31)
- competitor-alternatives: Comparison page architecture (coreyhaines31)
- referral-program: Referral and affiliate programs (coreyhaines31)

README reorganized by domain: Code Quality, Frontend, Backend,
Auth, AI/Agent Building, Marketing, Design, Meta.

Mosaic Stack is not limited to coding — the Orchestrator serves
coding, business, design, marketing, writing, logistics, and analysis.

Co-Authored-By: Claude Opus 4.6 <[email protected]>
feat: Complete fleet — 94 skills across 10+ domains b1eb1fb2f9 
Pulled ALL skills from 15 source repositories:
- anthropics/skills: 16 (docs, design, MCP, testing)
- obra/superpowers: 14 (TDD, debugging, agents, planning)
- coreyhaines31/marketingskills: 25 (marketing, CRO, SEO, growth)
- better-auth/skills: 5 (auth patterns)
- vercel-labs/agent-skills: 5 (React, design, Vercel)
- antfu/skills: 16 (Vue, Vite, Vitest, pnpm, Turborepo)
- Plus 13 individual skills from various repos

Mosaic Stack is not limited to coding — the Orchestrator and
subagents serve coding, business, design, marketing, writing,
logistics, analysis, and more.

Co-Authored-By: Claude Opus 4.6 <[email protected]>
security: Remove vercel-deploy (data exfiltration), annotate LD_PRELOAD shims b4f2019529 
Security audit findings:
- CRITICAL: vercel-deploy uploaded entire project to external endpoint — REMOVED
- ANNOTATED: docx/pptx/xlsx soffice.py LD_PRELOAD shims — security warnings added
- README updated to 93 skills with full security audit section and Vue/Vite ecosystem

Co-Authored-By: Claude Opus 4.6 <[email protected]>
feat: Add kickstart skill — orchestrator launcher via /kickstart command 2c524b6da2 
/kickstart [milestone|issue|task] replaces manual orchestrator boilerplate.
Auto-discovers project context, fetches issues from Gitea/GitHub, bootstraps
tracking files, and transforms the session into an orchestrator.

Modes: milestone, issue, task ID, resume, interactive (no args)
Built-in: quality gates, Two-Phase Completion, context handoff protocol

Co-Authored-By: Claude Opus 4.6 <[email protected]>
feat: Add lint skill (zero-tolerance) + strengthen kickstart linting mandate 8cae9e0883 
New skill: lint — zero-tolerance linting enforcement for all code changes.
Detects project linter, fixes ALL violations, never disables rules.

Updated kickstart: linting now explicit standing order #3 in worker template
with "NON-NEGOTIABLE" language and zero-tolerance enforcement.

Co-Authored-By: Claude Opus 4.6 <[email protected]>
migrate kickstart skill to mosaic-first paths 74d1cdc7c1
standardize skills to mosaic-first paths and docs b47c4024cc
add delegation mode fallback to matrix rail in kickstart c3d2179ad8
remove legacy nested skill link artifacts 8c51bf7575
switch skill docs to xdg mosaic config path 57435bb879
feat: add mosaic ops skills (portainer, gitea, woodpecker, deploy, orchestrator) 809ca9a1d9 
- mosaic-portainer: stack list/status/redeploy/logs via Portainer API scripts
- mosaic-gitea: PR/issue/milestone ops for git.mosaicstack.dev
- mosaic-woodpecker: pipeline status, trigger, CI wait
- mosaic-deploy: full end-to-end deploy flow (push → CI → merge → redeploy)
- mosaic-orchestrator: mission init/run/status + worker launch rules
feat: add mosaic-tools skill (fleet toolkit fast path) (#1) 63e77887a8
fix: quote SKILL.md descriptions containing colons (silent skill-load failure) (#3) 4d8ddb9a0a
fold: absorb mosaicstack/agent-skills into the framework skills tree 5e58597dbe 
Fold the agent-skills repository into the monorepo as the shipped canonical
skills package (plan 2026-08-19 phase D1, decision S19: single package, single
install, single command).

History is preserved by rewriting each commit's paths from skills/ to
packages/mosaic/framework/skills/ (git fast-export/import) and merging the
rewritten history with --allow-unrelated-histories, so the original commits
with their authors, dates, and messages remain reachable. Blob content is
untouched by the rewrite; tree fidelity was verified blob-sha-for-blob-sha.

This change must be merged with a real merge commit (not squash) or the
history link is destroyed.
skills: sanitize operator-identity tokens from folded ops skills d2eeb64433 
Four folded skills carried operator identity tokens that the sanitization
gate (verify-sanitized.sh) forbids in the public framework package:

- kickstart: template path pointed at a private brain checkout; now uses the
  framework-shipped $MOSAIC_HOME/templates/docs/TASKS.md.template
- mosaic-deploy: dropped one estate-specific stack-name row from the example
  table
- mosaic-portainer, mosaic-woodpecker: credentials now name the framework
  credentials store (load_credentials <service>) instead of a private
  checkout path

Estate-specific values can live in a skills-local override, which the linker
applies with precedence over canonical skills.
format: apply repo prettier (3.8.1) to the folded skills tree 1a822493ba 
963 markdown files reformatted with the repository's pinned prettier so
pnpm format:check covers the folded tree like every other repo file.

The formatter's embedded-language pass also normalized code fences
(TS semicolons, closed HTML tags in examples, lowercased CSS hex colors,
one renumbered list that skipped an index). Alphanumeric token deltas vs
the fold commit were audited file-by-file; all are formatter-equivalent
markup normalizations plus the four sanitized skills.
skills: single install path — canonical skills ship with the framework 1556982dbc 
Phase D2 of plan 2026-08-19: single package, single install, single command.

The framework installer already treats skills/** as a shipped, manifest-owned
framework subtree, so the folded skills now install into
$MOSAIC_HOME/skills with the rest of the framework — no second repository,
no separate sync step:

- mosaic-sync-skills (bash + powershell): the fetch machinery is gone (clone,
  pull, dirty-state migration, rsync from sources/agent-skills). The script
  now only links installed skills into runtime homes. --link-only is a compat
  no-op; --no-link exits having nothing to do.
- catalog.ts: the sources/agent-skills fallback is dead and removed.
- install.sh, launch.ts, defaults/README.md, README.md, skills/README.md:
  references to the second repo rewritten to describe the shipped path.

Verified: clean install into a fresh MOSAIC_HOME produces 102 skills with no
sources/ directory; the linker then links the selected skills into the four
runtime homes with no git involvement.
skills: promote ms-unslop from skills-local into the package d5f3fae896 
Phase D3 of plan 2026-08-19 (decision S21): skills-local is the local test
bed; promote individually as each proves out. ms-unslop is the only one of
the seven local skills with working enforcement evidence — a checker
(tools/unslop-hook/unslop-check.js), a machine-source list (lists.json), a
19-test suite, a measured corpus, and a regression fixture.

The checker itself stays fleet-local for now (it binds to a specific
harness extension surface); this promotes the skill document only.

Gates verified on the moved file: sanitization denylist clean, prettier
3.8.1 clean (6730 chars was fred's measure at assignment; 7249 as shipped
today — both pass).
format: cover folded skills' js/ts scripts with repo prettier
ci/woodpecker/pr/ci Pipeline was successful
Details
95d5cb32d4 
The repo format:check glob covers ts/js alongside md; four non-markdown
scripts inside the folded tree were flagged after the md pass. Same pinned
prettier 3.8.1, same markup-only class (verified: node --check still passes
on the js files).
rev-code-01 approved these changes 2026-08-19 20:02:46 +00:00
rev-code-01 left a comment
Member
Copy Link
Copy Source

APPROVED — rev-code-01, independent review of head 95d5cb3 (brief: brain repo fleet/agents/rev-code-01/notes/pr1319-brief.md).

Verified by measurement:

  • Merge constraint is factual: repo default_merge_style=merge; next's precedent is merge commits (the PR's own merge base fe4fa20 is one); the preserved-history payload below is exactly what squash would destroy. Merge via API Do: merge + head pin (pr-merge.sh enforces squash and will refuse); queue guard first.
  • Fold shape: 5e58597 is a true two-parent merge; 1395 entries vs parent 1, all status A, 0 non-addition entries. (Reviewer note: a naive numstat read counts 56 binary .ttf files as "deletions" — they are - columns, not deletions.)
  • History preservation, independently verified against a fresh clone of mosaicstack/agent-skills: 16/16 authors/emails/dates/messages identical; all 101 skill-dir tree shas and the README blob sha identical on both sides; fold's only delta vs the rewritten tip is the pre-existing mosaic-context-refresh skill; --follow reaches the original commits.
  • Sanitize: d2eeb64 is exactly the 4 described edits; verify-sanitized.sh passes on the PR tree; CI sanitization step green; no operator-identity tokens remain at 95d5cb3 (sweep measured).
  • Clean install (isolated fake HOME): rc 0, no sources/ dir, installed = package tree exactly: 103 skill dirs + README; linker links all four MOSAIC_HOME runtime homes with ownership-based pruning (#1087 guards present); whitelist links exactly the listed skills on fresh targets; --no-link exits clean.
  • Format: pinned 3.8.1 via node_modules (no npx); repo-glob prettier --check passes over the folded tree; sampled diffs are mechanical.
  • ms-unslop: 7249 chars as claimed; clean under the fleet's own unslop gate.
  • CI: pipeline 2526 terminal success (install, sanitization, upgrade-guard, typecheck, lint, format, test).

Findings:

  • N1 (should-fix, docs): PR body says "102 skills (101 folded + mosaic-context-refresh)" — measured 103: this PR's own ms-unslop promotion adds one. Please correct the body line before merging.
  • S1 (suggestion, rev-security ground): estate infra references (10.1.1.x, w-docker0, host rows) ship in the package via the mosaic-* skills. All pre-exist publicly in agent-skills, so nothing new is disclosed here; referred to rev-security for the archive/freeze decision.

Merge to author/Jason as real merge with head pin. Thanks — the two review-critical flags in the request were accurate and checkable.

**APPROVED** — rev-code-01, independent review of head 95d5cb3 (brief: brain repo `fleet/agents/rev-code-01/notes/pr1319-brief.md`). Verified by measurement: - **Merge constraint is factual**: repo default_merge_style=merge; next's precedent is merge commits (the PR's own merge base fe4fa20 is one); the preserved-history payload below is exactly what squash would destroy. Merge via API `Do: merge` + head pin (pr-merge.sh enforces squash and will refuse); queue guard first. - **Fold shape**: 5e58597 is a true two-parent merge; 1395 entries vs parent 1, all status A, 0 non-addition entries. (Reviewer note: a naive numstat read counts 56 binary .ttf files as "deletions" — they are `-` columns, not deletions.) - **History preservation, independently verified against a fresh clone of mosaicstack/agent-skills**: 16/16 authors/emails/dates/messages identical; all 101 skill-dir tree shas and the README blob sha identical on both sides; fold's only delta vs the rewritten tip is the pre-existing mosaic-context-refresh skill; `--follow` reaches the original commits. - **Sanitize**: d2eeb64 is exactly the 4 described edits; verify-sanitized.sh passes on the PR tree; CI sanitization step green; no operator-identity tokens remain at 95d5cb3 (sweep measured). - **Clean install (isolated fake HOME)**: rc 0, no sources/ dir, installed = package tree exactly: **103 skill dirs** + README; linker links all four MOSAIC_HOME runtime homes with ownership-based pruning (#1087 guards present); whitelist links exactly the listed skills on fresh targets; --no-link exits clean. - **Format**: pinned 3.8.1 via node_modules (no npx); repo-glob prettier --check passes over the folded tree; sampled diffs are mechanical. - **ms-unslop**: 7249 chars as claimed; clean under the fleet's own unslop gate. - **CI**: pipeline 2526 terminal success (install, sanitization, upgrade-guard, typecheck, lint, format, test). Findings: - **N1 (should-fix, docs)**: PR body says "102 skills (101 folded + mosaic-context-refresh)" — measured 103: this PR's own ms-unslop promotion adds one. Please correct the body line before merging. - **S1 (suggestion, rev-security ground)**: estate infra references (10.1.1.x, w-docker0, host rows) ship in the package via the mosaic-* skills. All pre-exist publicly in agent-skills, so nothing new is disclosed here; referred to rev-security for the archive/freeze decision. Merge to author/Jason as real merge with head pin. Thanks — the two review-critical flags in the request were accurate and checkable.
fargo merged commit 840c2b0d96 into next 2026-08-19 20:08:11 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
rev-code-01
Labels
Clear labels
bug
Defect in framework tooling or delivered code
 fleet-enhancement
Fleet-wide reliability/speed/cost improvements surfaced by the nightly enhance pass
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
code-infra-01 (Mosaic fleet seat code-infra-01) fargo fred gate-merge-01 (Mosaic fleet seat gate-merge-01) happy jason.woltje (Jason Woltje) merge-gate ops-01 (Mosaic fleet seat ops-01) ops-02 (Mosaic fleet seat ops-02) ops-03 (Mosaic fleet seat ops-03) ops-ci-01 (Mosaic fleet seat ops-ci-01) ops-deploy-01 (Mosaic fleet seat ops-deploy-01) pepper rev-code-01 rev-code-02 rev-security-01 rev-security-02 rev-security-03 (Mosaic fleet seat rev-security-03) sanity scooby (Scooby) scrappy shaggy tiny velma veronica (Mosaic fleet seat veronica) vision woodpecker
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#1319