Preserve PR #2968 contributor history, verified upstream claims, and target-specific metadata. Rebind the existing trigger registry metadata after the merge, retaining current trigger phrases and generation provenance. Portable Bun 1.4.2 isolation and parallel-timing examples passed; all five Markdown files and context profiles validated.
Preserve PR #2943 contributor history and rebind the existing trigger manifest to the 294-skill registry without changing trigger phrases or model provenance. Validated real read-only audit CLI, 66 focused Python tests, 239 full Python tests, five Node surface checks, catalog, install manifests, and context projections.
The gateguard SKILL.md note changes the skill registry digest, so
ci/context-profiles.test.js reported the skill triggers manifest as
stale. Update the digest the way the earlier registry binding
refreshes did; the triggers themselves are unchanged.
* chore: retire the Everything Claude Code name, ECC only
Replace the expanded product name and the everything-claude-code slug
with ECC across READMEs, translated docs, harness folders, skills,
commands, scripts and examples. Repo URLs now point at affaan-m/ECC.
Rename repo-internal artifacts to ecc forms (ecc-conventions skill,
ecc-guardrails, ecc-research-playbook, ecc-team-config, ecc-instincts
with ecc-* ids) and update .claude/ecc-tools.json.
Legacy install ids, plugin dirs, package names and MCP prefixes stay
where existing installs resolve against them. The codex global-state
check and harness-audit repo detection accept the new name first and
the legacy one as a fallback. The Discord bot prefers ~/GitHub/ECC and
falls back to the nested legacy checkout path.
Refresh the skill-triggers registryDigest for the changed skill text.
* fix(ecc-tools): drop managed paths to the removed Claude repo skill
.claude/skills/<repo-skill>/SKILL.md was deleted in #2770 but stayed listed in
ecc-tools.json and the team config. Remove those entries and point the Claude
Code adapter at the existing .agents/skills/ecc-conventions/SKILL.md.
pi/core and the bundled blueprint skill now refer to the project as ECC only;
the generated README no longer expands the name. Profile contents, package
name and paths are unchanged (123 skills, 24 commands).
The release workflows poll npm for up to five minutes after publish before
verifying the artifact. In 2.2.2 the check gave up after about 30 seconds while
npm was still processing, failing the run before latest was promoted and the
GitHub Release was created.
Version metadata synced to 2.2.3 with CHANGELOG, translated release headings
and release notes; skill-triggers registryDigest updated for the blueprint text.
Preserve the Bengali and MyBatis catalog additions, keep Laravel storage examples disk-consistent, isolate ECC 2 test configuration with private permissions, and verify every command-referenced runtime script is published.
Addresses review feedback on #3277: the previous commit sandboxed the
primary config path, but Config::global_config_paths() also reads the
legacy $HOME/.claude/ecc2.toml. A test that called Config::load() would
pick up (or fail on a malformed) developer-local legacy config.
Under cfg(test), legacy_global_config_path() now resolves inside the same
per-test-thread scratch root as config_path().
Proof of red (new test, before the fix):
$ cargo test legacy_config_path_under_test
running 1 test
test config::tests::legacy_config_path_under_test_is_sandboxed_away_from_user_home ... FAILED
failures:
---- config::tests::legacy_config_path_under_test_is_sandboxed_away_from_user_home stdout ----
tests must never read the real legacy user config, got /Users/<me>/.claude/ecc2.toml
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
failures:
config::tests::legacy_config_path_under_test_is_sandboxed_away_from_user_home
test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 491 filtered out; finished in 0.00s
error: test failed, to rerun pass `--bin ecc-tui`
After the fix:
$ cargo test legacy_config_path_under_test
test config::tests::legacy_config_path_under_test_is_sandboxed_away_from_user_home ... ok
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 491 filtered out
$ cargo test # full suite
test result: ok. 491 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out
Refs #3276
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011Y54kLgLGzLGqAxwLMFEc9
Dashboard tests that spawn sessions reach Config::save() through
auto_split_layout_after_spawn, which wrote to the developer's real
~/Library/Application Support/ecc2/config.toml. The fixture's db_path
pointed at a deleted temp dir, so the next `cargo run` failed with
"unable to open database file".
Under cfg(test), config_root() now returns a per-test-thread scratch
directory that is removed when the thread exits, so no test can reach
the real user config.
Fixes#3276
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011Y54kLgLGzLGqAxwLMFEc9
`package.json` `files[]` enumerates each top-level `scripts/*.js` by hand, and
`scripts/github-coordination.js` was never added. npm therefore drops it from
the tarball while `scripts/lib/` still ships wholesale, so only the CLI entry
disappears.
All seven `/epic-*` commands ship in `commands/` and each instructs the agent
to run:
node scripts/github-coordination.js <command> <issue> --repo <owner/repo>
so anyone who installs from npm -- including the documented
`npm i -g ecc-universal` path -- gets seven commands that cannot run:
Error: Cannot find module '.../ecc-universal/scripts/github-coordination.js'
It works from a git clone, which is what masked it locally.
Add the missing `files[]` entry, the matching publish-surface allowlist entry in
`tests/scripts/npm-publish-surface.test.js` (CONTRIBUTING asks for both), and a
guard test that fails when any published command invokes a `scripts/*.js` that
the publish surface does not cover. The guard reproduces this exact bug: with
`package.json` reverted it fails naming only `github-coordination.js`.
Refs #3270
The secure-storage example authorized `download` against a raw path string
taken from the request and generated the temporary URL before the check.
A string argument never resolves to a policy, and authorizing a
client-supplied path teaches an IDOR-prone pattern.
Bind a model (Document), authorize against it first, then sign the URL for
the stored path on the s3 disk configured just below. pi/core regenerated
via scripts/build-pi-core.js; skill-triggers registryDigest rebound.
getDefaultClaudeAgentDataHome ignored CLAUDE_CONFIG_DIR and always returned ~/.claude, so sessions with a relocated Claude config dir wrote ECC data to the wrong place when ECC_AGENT_DATA_HOME was unset. Fixes#3266.
Adds a curated, Pi-native, skills+prompts-only profile at pi/core/ for downstream packagers that mirror GitHub Releases.
- manifests/pi-core.json: explicit include lists, per-item exclusion reasons, curation rules, safety allowlists; every root skill and command must be classified.
- scripts/build-pi-core.js regenerates pi/core deterministically (package.json from VERSION, LICENSE, README.md, CURATION.md, skills/, commands/); --check fails CI on drift. council is renamed ecc-council inside pi/core only.
- Safety checks: no callable endpoints outside the allowlist, no npx/curl|sh/pip install, no secrets, no absolute home paths, no symlinks, valid frontmatter, no duplicate names.
- CI: build + drift check and an offline Pi CLI load test of pi/core.
- Release: VERSION, package.json and pi/core/package.json at 2.2.2, CHANGELOG, tag-triggered release verification, and a two-week cadence in CONTRIBUTING.md.
pi/core: 123 of 293 skills and 24 of 94 commands; 35,006 characters of skill description text.
haelyra