A skill cannot restrict a subagent's tools - that is harness configuration, not
something SKILL.md can assert. Reframed both worker rules as things the
coordinator must SAY in the worker's prompt: name the coordinator's own model
explicitly on every spawn and bring in no other model, and tell the worker it is
reading rather than editing, then verify the tree is unchanged at the end.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01G42vsxSKL7je39AsHZ5aJm
I had only used one repo's per-category survival table plus the other's
aggregate numbers, and had not looked at the shipping repos' fix history at
all. Reading all 105 planted bugs per-bug, and four weeks of real fixes,
changed four things.
Taxonomy is now thirteen lenses:
- Lens 10 (representation and information loss) is promoted to the
highest-frequency class in every corpus and given three named sub-shapes:
the nullish family (pending/absent/empty/zero/false/failed collapsing into
each other), projection and field-set drift (a producer quietly stops
emitting a field, consumers degrade instead of failing), and unresolved
values stored as resolved ones. Plus the cast/any/suppression tell - an
annotation on a boundary marks where two sides disagreed and someone
silenced the compiler.
- Lens 12 gains reachability: a predicate nothing can satisfy, a handler never
wired, a scheduler never started. Reads as correct code; common in the wild.
- Lens 13, verification and observability, is new: the check that cannot fail,
the oracle measuring the wrong thing, the effect whose absence nothing would
notice. It carries a note on WHY it is new - a planted defect is detectable
by construction, so silent failure is systematically absent from planted
corpora and heavily represented in real fix histories. A checklist trained
only on planted bugs will never prompt you to look here.
Refutation gains "absorption is not prevention": a cache that usually holds, a
retry that usually succeeds, a default that is usually right - none of those
refute a finding, they postpone it. Drop only on a mechanism that makes the
execution impossible. Corollary: "works nearly always" describes a race.
Parallelism gains two constraints:
- One model. Fan-out is for coverage, not a second opinion; workers run the
coordinator's model. A single foreign worker makes a measured result
unattributable. The independent second-model pass stays where it belongs,
as an explicit /ship-check step.
- Read-only workers. Read, search, navigate - no writes, edits or mutating
commands. A worker that can edit drifts from reviewing into silently fixing,
and the tree must end identical to how it started or findings cannot be
checked against it.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01G42vsxSKL7je39AsHZ5aJm
Restructure, per the ask that code review be the parent and the other two
dimensions its sub-cases:
- SKILL.md gains a "one engine, three anchors" section. Correctness is the
core and stays inline; performance and security move to their own reference
files, loaded only when selected.
- references/performance-review.md (new) — a universal, stack-agnostic core
(repeated work, growth relationships, retention, copying, contention,
amplification) plus the three-part bar for a performance finding. Defers the
database/web checklist to /performance-audit-static instead of restating it.
- references/security-review.md (new) — trust boundaries and sinks for code
with no web surface, and the one rule that INVERTS relative to correctness:
attacker-equals-victim refutes a security finding but never a correctness
one. Defers the full procedure to /security-audit-static.
- Both audit commands now say they are the specialisation behind their
sub-case, so the narrow entry points still lead back to the skill.
ship-check gains two stages it was missing:
- Step 3, correctness review — the pass neither audit performs: logic and
state defects that compile clean and pass the suite.
- Step 6, independent unsteered review — a fresh session of a second model
(Codex or equivalent), given no checklist and no prior findings, with the
subject computed from a diff rather than described. Every finding is
hand-verified against the code before it enters the packet, since an
unsteered reviewer carries no refutation discipline of its own. The packet
reports whether it ran clean or did not run at all - those are different
signals.
Also carries the working-tree edits already in progress: model-and-orchestration
guidance on both audits, the OWASP A02/A06/A09 backstop, CSP in the
output-encoding bullet, the prompt-injection/agent-abuse bullet, and the Audit
Provenance section (now also naming the second model).
No version bump - not tested against the benchmark yet.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01G42vsxSKL7je39AsHZ5aJm
NOT RELEASED. No version bump - versions stay at 2.0.0 across all 9 plugins and
marketplace.json, because bumping is the release action and this ships only after
it has been tested. On a branch for the same reason.
WHY A SKILL AND NOT A FOURTH COMMAND. /security-audit-static is already mature -
sink analysis, self-refutation with attacker/victim rules, OWASP backstop, fan-out.
Rebuilding that inside something new would duplicate it. The hole in this plugin is
CORRECTNESS: there is no bug-finding review at all. So this is one skill with three
independently activated dimensions that defers to the existing command for security
and points at intended-vs-implemented for the doc-vs-code axis.
THE ANCHOR IS THE AGREEMENT, NOT THE FILE. The defects reviewers miss are rarely
visible inside one file - they are disagreements between two participants that each
read sensibly alone. Engine: map a flow, identify an obligation, inspect EVERY
participant, construct a violating execution, trace the consequence, refute, report.
Two lenses get a forced probe rather than a checklist mention: authority
reconciliation (a requested value is not an applied value) and identity correlation
(is the key unique, stable and live under overlap and reuse).
Refutation discipline is deliberately stricter than the security command's: a
correctness defect can harm only the person who triggered it and still be serious,
so the attacker/victim test does not transfer, and 'keep unless disproved' is too
permissive. Keep / Drop / Unresolved, with unresolved kept out of the findings list.
Parallelism fans out over complete flows, never over files - partitioning by file is
exactly the split that hides cross-boundary defects. Overlapping reads are allowed
and encouraged.
Coverage reports work performed in four states; zero findings is not 'not covered'.
Co-designed with GPT-6 Astra (Codex CLI). Contains no project-specific content: no
repo names, no paths, no bug identifiers, no defect text - verified by scan.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01G42vsxSKL7je39AsHZ5aJm
Codex CLI (0.136+) reads the same .claude-plugin/marketplace.json as Claude
Code, so PM Skills installs natively via `codex plugin marketplace add` — no
file-copying required.
- Add a first-class "Codex CLI (OpenAI)" install section (marketplace add +
per-plugin `codex plugin add`).
- Note the difference vs. Claude Code: skills work and are invocable by name;
`/slash` commands install but do not run as Codex slash commands.
- Document an optional path: ask Codex to convert the bundled command files
into skills (best-effort, model-driven).
- Remove the now-inaccurate "copy skills to .codex/skills/ — Skills only" row
from the "Other AI assistants" table.
Docs-only; no plugin/marketplace contents changed (counts unchanged, no
version bump). Validator: all 9 plugins pass.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Delete .docs/images/plugins-overview.webp (already replaced by plugins.png in v2.0.0).
- Delete .docs/images/how-skills-work.webp and its reference in README.md.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Introduce repo-level guidance for AI agents:
- CLAUDE.md: single source of truth (structure, design rules, versioning,
operational procedures). 65 skills, 36 commands, 8 plugins.
- AGENTS.md: thin pointer to CLAUDE.md for non-Claude agents.
- .gitignore: stop ignoring CLAUDE.md (now public); ignore CLAUDE.local.md
and keep ignoring _Internal/ (maintainer-only, never published).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Relocate image assets into .docs/images and update README image references accordingly. Four files were renamed/moved: add-marketplace.webp, how-skills-work.webp, plugins-overview.webp, and pm-skills-install.gif; README.md paths were updated to point to .docs/images/*. Keeps documentation assets organized under .docs/images.
Pawel HurynandClaude Opus 5