A real CLI fixture reproduced an infinite allocation loop from an existing unsafe numeric ID. Reject unsafe IDs and overflow without writing markers; 26 workflow fixtures, changed-code coverage and validators pass.
Preserve full contributor history and current catalog. Actual process workflows cover concurrency, recovery, sprint planning and read-only status. Bound registry symlinks, counts and lock waits; preserve manually curated trigger provenance.
Add Arabic (ar) localization guide and glossary, register the locale:ar component and docs-ar module across install manifests, and wire test coverage.
Contributed-by: @taljeri (taljeri)
Signed-off-by: taljeri <318237806+taljeri@users.noreply.github.com>
A non-numeric, negative, or exponent Points value was persisted and
silently skewed the derived sprint total (bogus -> 0, -3, 1e3 -> 1000)
with no drift reported. parseStory now enforces the documented values,
so apply rejects the batch and status reports the invalid story.
Resolve the Greptile findings on 74262955:
- Refuse symlinked .stories/, epics/, sprints/, .txn/, .ids/ and
symlinked ledger files, so no read or write leaves .stories/.
- Recovery accepts only regular backup-<n> files in .txn/, validates the
whole journal before restoring, and never writes through a planted
restore.tmp.
- Remove a stale lock only under .lock.break after a re-read, so a live
lock is never deleted; a leftover .lock.break times out (exit 3)
instead of spinning.
- apply enforces one-step-forward status transitions, new stories start
as todo, and Sprint must be unassigned or an existing sprint file.
- Refuse a batch that names the same file twice (e.g. a\b vs a/b).
Symlink tests skip on Windows when symlink creation returns EPERM.
Route every .stories/ write through skills/story-lifecycle/scripts/ledger.js:
- exclusive per-ledger lock; a second writer waits, then exits 3 without writing
- story IDs reserved with exclusive-create markers in the git common dir, so
concurrent agents and worktrees of one clone never share an ID
- journaled batches: stage, journal, rename; derived epic/sprint tables are
regenerated inside the batch; an interrupted batch is rolled back by the
next write command or `recover`; `status` reports it only when no live
writer holds the lock
Bound the ledger to an opt-in planning projection that is never canonical
ECC Task/Evidence/Completion/Integration state, and state that .stories/
follows the checkout.
tests/docs/story-lifecycle-ledger.test.js exercises create, concurrent
create, concurrent cross-worktree allocation, lock contention, overwrite
refusal, interrupted-batch recovery, sprint planning, status drift and
reconcile, and path confinement. Also refresh the skill-triggers manifest
digest for 294 skills.
Pin the core steering files to `inclusion: always`, check every steering
file's frontmatter against the .kiro/README.md table, and require the
fields each inclusion mode needs.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Use literal matching for the forbidden documentation endpoint, pin lifecycle mode/content assertions to one descriptor, and inject parent races through the staged descriptor without forwarding arbitrary file-creation flags.
Resolve#2957 using the verified MCP reference memory package, native session scheduling, supported CLI invocation and documented computer-use integration. Incorporates the corrective direction from #2977 and #2958, including package-version pinning and regression checks for executable examples.
Co-authored-by: ilkmajans-cpu <ilkmajans-cpu@users.noreply.github.com>
Co-authored-by: kavish-19 <63698788+kavish-19@users.noreply.github.com>
* feat(skills): add dev-team skill — multi-persona collaborative session
Adds skills/dev-team/SKILL.md, a community skill inspired by the
BMAD Method's "party mode": PM, Architect, Developer, and QA respond
to the same topic in parallel, then a synthesis step names tensions
explicitly instead of averaging them.
Reads PROJECT-CONTEXT.md from the repo root when present, and offers
to generate it when missing, folding in the closed project-context
skill's (#2310) generation workflow per affaan-m's review — that
skill's premise (every agent reads the file) wasn't implemented
anywhere, so the capability now lives directly in the one skill that
actually reads it.
Rebuilt on current upstream/main as a skill-only diff: the shared
format-code.ts Windows fix and github-coordination branch-coverage
tests that were previously bundled here (and duplicated across the
story-lifecycle and project-context sibling PRs) now live in #2459.
* fix(manifests): register dev-team skill in workflow-quality install module
* fix(docs): repair README lint errors and Windows hook-install path regression
Fixes CI inherited from the README 2.1 restructure (19b05476):
- MD058: blank lines around tables (delegation map, Codex role configs)
- MD001: Option A/B headings under Ecosystem Tools h2 jump to h4
- MD024: duplicate 'What's included' headings (Codex, Copilot sections)
- restore %USERPROFILE%\\.claude escaping required by
tests/scripts/manual-hook-install-docs.test.js
* feat(skills): address review — trust boundary, harness-neutral I/O, contract test
Address maintainer review on #2309:
- untrusted-context boundary now travels with every persona prompt:
inline label on the context section, personas marked analysis-only
with no state-changing tool use
- personas receive a bounded declarative summary (≤150 words, fixed
fields, secrets and imperative content stripped) — never the raw
PROJECT-CONTEXT.md
- context loading uses harness-native file tools; POSIX-only
'test -f && cat' removed
- all references resolve on main: story-lifecycle follow-up replaced
with /plan and epic-* commands, ecc:plan-prd corrected to the
/plan-prd command; boundary vs team-builder and council made explicit
- added tests/docs/dev-team-skill.test.js contract test (roles,
parallel dispatch, synthesis guardrails, trust boundary, registration)
* docs: refresh Turkish skill count
* ci: retrigger checks (flaky stop-hooks-stdout timeout on macos node20 npm cell)
---------
Co-authored-by: haelyra <49814733+haelyra@users.noreply.github.com>
Address maintainer review on #2311:
- story file is the single authoritative status record; epic/sprint
tables are derived and reconciled; todo → in-progress → review → done
with done gated on confirmed merge to main
- implement lane: tdd-workflow first, language reviewer +
verification-loop before a story reaches review
- naming/path contract (slug, story-id, sprint validation), resolved-path
confinement under .stories/, untrusted-content handling, no silent
overwrites, harness-native file operations (no POSIX-only shell)
- documented boundary and handoff to issue-backed epic-* coordination
- replaced references that do not resolve on main; added
tests/docs/story-lifecycle-skill.test.js contract test
Graduate 2.0.0-rc.1 to stable. Bump version across package, plugin,
marketplace, OpenCode, agent metadata, VERSION, and all localized docs.
Add 2.0.0 release notes + README sections (en/zh/pt-BR/tr), CHANGELOG
entry, and the ECC community Discord bot (dependency-free gateway client
+ guild command registrar). Update copilot-support and release-surface
tests for the sponsored-review migration and the 2.0.0 surface.
* docs(claude): install manual skills at top level
* test(docs): guard Claude manual skill install path
* test(docs): detect PowerShell/$HOME nested skill-install paths
Address CodeRabbit on #2160: the nested-path regression guard only matched
Unix `mkdir`/`cp` with `~`, so a reintroduced PowerShell `Copy-Item ...
$HOME/.claude/skills/ecc` (or backslash-separated) form would have slipped
through. Extend the pattern to also cover `Copy-Item`/`New-Item` (and the
`md`/`copy`/`cpi` aliases), accept `$HOME` as an alternative to `~`, allow both
`/` and `\` separators, and match case-insensitively.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
haelyra