Independent local Codex review PASS at 73b07f8d17, no P0/P1. Independent 66 tests and strict validation of 810 skills passed. CI run 34683976362 passed; all 48 current checks green. Incomplete memory reads fail closed with safe MCP diagnostics; canonical guidance synchronized across harness skill copies. Rollback: revert this squash commit. No deployment or installation claim.
Independent local Codex review PASS at 472cfa94fb, no P0/P1. Independent retrospective, CLI, envelope and capsule tests: 73 passed. CI run 34664487219 attempt 2 passed all 42 jobs. Read-only offline capsule grouping only; no provenance, scoring, execution or promotion claim. Rollback: revert this squash commit.
Exact-head independent local Codex review PASS with no P0/P1. CI run 34680860653 attempt 2 passed at 0707cd431c. Includes HTTP/schema failure handling, coalesced sampling cache and regression tests. Disclosed P2 follow-ups remain in the merge-queue receipt. Rollback: revert this squash commit. No deployment or publication claim.
Adds skills/rails-patterns alongside laravel-patterns and django-patterns: directory contract, skinny controllers with service objects, form and query objects, idiomatic ActiveRecord, background jobs, ViewComponent, Hotwire, and the Rails 8 Solid stack. Decisions defer to rules/ruby/patterns.md. Registered in install-modules (framework-language), agent.yaml, package files, and every skill count (292) across plugin, marketplace, AGENTS and README variants. Independent exact-head review passed with no P0/P1; validate-skills, catalog:check, install manifests, plugin manifest, unicode and personal-path checks all pass; CI 44/44 at the head.
* feat: bundle standalone taste distillation and application workflows
* docs: fix imported taste skill markdown lint
* docs: align Turkish agent catalog with taste skills
* refactor: make ECC the canonical reusable video engine
* fix: preserve video duration when applying image overlays
* fix: preserve background colors in image compositing
* fix: report best-effort duration targets and shortfalls
* feat: ship verified Fusion presets with compatibility provenance
* feat(tasteforge): preserve native edits in application bundles
* feat(tasteforge): compile local preservation without hosted input
* fix: update js-yaml to patched 4.3.2
* test: report bounded Stop wrapper failure diagnostics
* fix(tasteforge): fail closed on unsafe output names, missing overlays and cadence
- cli: default report and spec paths are derived from pack name and profile
genre; require the manifest's name pattern before using either as a
filename part so a traversal string cannot write outside cwd/out.
- apply_local: a pack without cadence.json, or with no measured shots and
no explicit mean_shot, raises instead of silently planning 1.0s shots and
reporting a measured cadence.
- legacy apply: a missing overlay aborts before any paid upload; forge()
would have rejected it after every take was generated.
- requirements-live: pin fal-client>=0.13.0, the first release whose
subscribe() accepts client_timeout.
Addresses the five P1 findings from the independent review of #3033.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015fxHRsydPqEcYngGbqkgt1
---------
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
Addresses the review on #3039. Four findings, all of them real.
Skills-first (Greptile P2). AGENTS.md says commands/ exists for compatibility and
the direction is skills-first, so the workflow now lives in skills/token-card
and commands/token-card.md is a thin shim pointing at it — 70 lines down to 28.
Unpinned remote code (CodeRabbit major, Greptile P1, CWE-494). The workflow ran
`npx -y @tokenchit/cli@latest` and handed whatever the registry currently serves
read access to local session logs. It is pinned to 0.7.0, the skill says to raise
the pin knowingly, gives the `npm view … dist.integrity` check, and step 1 is now
an explicit confirmation before the first download on a machine.
The "no network request" claim was false as written (both bots). `sync` sends
nothing, but the npx invocation around it is a registry download, and the
sentence read as though the whole step were offline. It now separates the two.
`--dry-run` wrote a file (Greptile P2). Step 1 created `.tokenchit.json` via
`init` before `sync --dry-run` ran, so a documented no-op mutated the tree.
Initialisation is skipped on a dry run and reported as prospective instead.
The README offer was unreachable (Greptile P2). "Stop after step 3" sat directly
below step 4, so the step that puts the card in the README — the whole point —
could never run. The boundary moved to after step 4; publishing still requires
being asked for by name.
Wiring: agent.yaml skills list, manifests/install-modules.json under
operator-workflows (beside cost-tracking and ecc-tools-cost-audit), and
package.json `files`, which the npm-publish-surface test requires to track the
module graph. `yarn install --mode=update-lockfile` leaves yarn.lock byte
identical, so nothing to commit there. docs/tr/AGENTS.md carries two skill counts
the catalog sync does not reach, both 286 -> 287.
npm test: 4396 passed, 0 failed. markdownlint clean on both files.
Greptile's review asked for committed coverage and installer parity; this
makes the hooks installable through ECC's own machinery instead of a
copy-paste doc:
- manifests/install-modules.json: new module hermes-hooks (kind hooks,
targets hermes + openclaw, paths hooks/hermes + docs/HERMES-HOOKS.md,
light/stable, defaultInstall). Disjoint from hooks-runtime, which stays
Claude/Cursor/OpenCode/CodeBuddy — the Hermes target gets hooks support
without inheriting the Claude-format hook graph.
- manifests/install-profiles.json: full profile gains hermes-hooks (validator
requires full to include every module).
- docs/HERMES-HOOKS.md: install section now leads with
./install.sh --target hermes --modules hermes-hooks --enable-hooks; the
manual block registers from the landed ~/.hermes/hooks/hermes/ paths. The
installer never edits config.yaml — registration stays operator-owned.
- tests/hermes-hooks.test.js: installer-integration case (14 total) drives
the real installer into a throwaway HOME and proves the LANDED guard
blocks an eslint.config edit.
Validated: install-manifests (37 modules), no-personal-paths, markdownlint,
14/14 tests. E2E on a throwaway HOME: module lands both scripts + doc and
the landed guard emits a block decision.
Greptile + CodeRabbit review of #3019:
- config-protection: compare basenames case-insensitively (macOS/Windows
resolve ESLINT.CONFIG.JS to the protected eslint.config.js) and use lstat
so a dangling symlink to a protected name still blocks (os.path.exists
follows the link and returns False).
- Both hooks: fail-open stays, silence goes — every swallowed path now
writes a one-line stderr diagnostic.
- config-protection: sys.stdout.write instead of print() per repo Python
style; block decisions carry a trailing newline.
- New tests/hermes-hooks.test.js: 13 cases through the real scripts via
spawnSync — block (all names, case variants, dangling symlink, edits[],
per-tool), allow (normal source, new config, non-edit tools), fail-open
with diagnostics (malformed payload, missing path, unreadable file).
- docs: absolute-path copy-paste block via $HOME (CodeRabbit: /Users/YOU
placeholders were unverifiable), self-contained block-case proof that
creates its target, pointer to the committed suite.
Hermes ships its own shell-hook system (hooks: block in config.yaml,
Claude-compatible JSON payloads, per-tool matchers, consent allowlist),
and the hermes install target deliberately ships no hook runtime — so
Hermes operators get rules/skills/commands with zero hooks. This ports
the two harness-independent ECC hooks as self-contained Python scripts
with no ECC runtime dependency:
- config-protection: blocks edits to existing lint/format configs and
ratchet baselines (pre_tool_call)
- check-console-log: warns on console.log() in edited TS/JS (post_tool_call)
Includes install, consent, and verification steps in docs/HERMES-HOOKS.md.
The Turkish translations of the longform, security, and shortform guides
linked images with `../assets/...`, which resolves to a non-existent
`docs/assets/` directory, so every embedded image rendered as broken.
Assets live at the repository root (`assets/`), so from `docs/tr/` the
correct relative prefix is `../../assets/`. This matches the canonical
root guides (`./assets/`) and the Spanish (`docs/es/`) and Simplified
Chinese (`docs/zh-CN/`) translations, which already use `../../assets/`.
Fixes 26 image/asset links across the three guides.
Keep the contributor's corrected Haiku and Fable/Mythos tiers, update the live Sonnet and Opus rows against the current official pricing contract, and mirror the same numeric changes in the Japanese and Chinese tables.
Keep the duplicate estimator and its tests deleted as landed through #2866, while carrying the contributor's pricing-table correction forward and refreshing the documented live model rows against the current official pricing contract.
Dante