Treat non-2xx activity responses as feed errors, preserve non-Markdown Copilot agent assets, and apply the reviewed reference escape parity correction with regenerated bindings. Allow the test runner to drain piped output on its existing success or failure exit status. Validate installed workflows and bounded real Node20/24 pipe regressions.
Carry forward PR #3055 at 92f53c4c onto ef648e01, preserving contributor attribution and current main. Focused maintainer fixes reuse shared input ceilings, preserve late root context through outer bootstrap, bound frontmatter before immutable parsing, and assert real oversized input in the limits workflow.
Preserve PR #2968 contributor history, verified upstream claims, and target-specific metadata. Rebind the existing trigger registry metadata after the merge, retaining current trigger phrases and generation provenance. Portable Bun 1.4.2 isolation and parallel-timing examples passed; all five Markdown files and context profiles validated.
Third upstream sync for PR #2914: main c05b2d66 (rename chore #3330, 17
skill files) re-staled the generated skill-triggers registryDigest. Sole
conflict resolved by keeping our pretty-printed manifest + triggers and
recomputing registryDigest over the merged tree via the repo's own
context-pack-registry chain (validated by reproducing both sides'
committed digests on their own trees first). Gates: validate-context-
profiles PASS, plan-orchestrate tests fail 0, full run-all.js clean.
* chore: retire the Everything Claude Code name, ECC only
Replace the expanded product name and the everything-claude-code slug
with ECC across READMEs, translated docs, harness folders, skills,
commands, scripts and examples. Repo URLs now point at affaan-m/ECC.
Rename repo-internal artifacts to ecc forms (ecc-conventions skill,
ecc-guardrails, ecc-research-playbook, ecc-team-config, ecc-instincts
with ecc-* ids) and update .claude/ecc-tools.json.
Legacy install ids, plugin dirs, package names and MCP prefixes stay
where existing installs resolve against them. The codex global-state
check and harness-audit repo detection accept the new name first and
the legacy one as a fallback. The Discord bot prefers ~/GitHub/ECC and
falls back to the nested legacy checkout path.
Refresh the skill-triggers registryDigest for the changed skill text.
* fix(ecc-tools): drop managed paths to the removed Claude repo skill
.claude/skills/<repo-skill>/SKILL.md was deleted in #2770 but stayed listed in
ecc-tools.json and the team config. Remove those entries and point the Claude
Code adapter at the existing .agents/skills/ecc-conventions/SKILL.md.
pi/core and the bundled blueprint skill now refer to the project as ECC only;
the generated README no longer expands the name. Profile contents, package
name and paths are unchanged (123 skills, 24 commands).
The release workflows poll npm for up to five minutes after publish before
verifying the artifact. In 2.2.2 the check gave up after about 30 seconds while
npm was still processing, failing the run before latest was promoted and the
GitHub Release was created.
Version metadata synced to 2.2.3 with CHANGELOG, translated release headings
and release notes; skill-triggers registryDigest updated for the blueprint text.
payOnce reserved MAX_AMOUNT before awaiting confirmation but only released
it when confirmWithUser returned false. A prompt that threw (timeout, closed
window) or a challenge the payment policy rejected before signing kept the
reservation, so five such failures exhausted SESSION_CAP with zero payments.
Track per call whether a request carrying PAYMENT-SIGNATURE / X-PAYMENT was
actually sent, and release the reservation in a finally block unless it was.
A sent signed request may settle, so it stays counted even if the response
fails. The reservation still happens before any await, so concurrent calls
cannot overrun the cap. Mirrored in ja-JP and zh-CN.
Preserve the Bengali and MyBatis catalog additions, keep Laravel storage examples disk-consistent, isolate ECC 2 test configuration with private permissions, and verify every command-referenced runtime script is published.
The secure-storage example authorized `download` against a raw path string
taken from the request and generated the temporary URL before the check.
A string argument never resolves to a policy, and authorizing a
client-supplied path teaches an IDOR-prone pattern.
Bind a model (Document), authorize against it first, then sign the URL for
the stored path on the s3 disk configured just below. pi/core regenerated
via scripts/build-pi-core.js; skill-triggers registryDigest rebound.
Second upstream sync this cycle: main c70874fa (#3264, curated pi/core
skills + 2.2.2 release sync) touches manifests/context-packs/skill-triggers@1.json,
the same field this branch bumps.
Resolution: main's manifest (293 canonical skills, triggers 32) with
registryDigest recomputed over the merged tree via the repo's own chain
(scripts/lib/context-pack-registry.js -> digestObject). Algorithm
validated first: the same computation reproduces main's committed digest
on main's tree and the prior head's committed digest on that tree exactly.
Verification: node scripts/ci/validate-context-profiles.js (293 skills,
triggers 32/293) OK; plan-orchestrate registry fixtures pass; full
node tests/run-all.js = 704 passed / 0 failed.
Adds a curated, Pi-native, skills+prompts-only profile at pi/core/ for downstream packagers that mirror GitHub Releases.
- manifests/pi-core.json: explicit include lists, per-item exclusion reasons, curation rules, safety allowlists; every root skill and command must be classified.
- scripts/build-pi-core.js regenerates pi/core deterministically (package.json from VERSION, LICENSE, README.md, CURATION.md, skills/, commands/); --check fails CI on drift. council is renamed ecc-council inside pi/core only.
- Safety checks: no callable endpoints outside the allowlist, no npx/curl|sh/pip install, no secrets, no absolute home paths, no symlinks, valid frontmatter, no duplicate names.
- CI: build + drift check and an offline Pi CLI load test of pi/core.
- Release: VERSION, package.json and pi/core/package.json at 2.2.2, CHANGELOG, tag-triggered release verification, and a two-week cadence in CONTRIBUTING.md.
pi/core: 123 of 293 skills and 24 of 94 commands; 35,006 characters of skill description text.
- Problem: main d30588f9 (integrate-reviewed-followups) added a skill and
bumped the skill-triggers registryDigest, conflicting with this branch's
own digest refresh for the plan-orchestrate SKILL.md edit.
- Fix: take main's manifest and recompute registryDigest over the merged
tree via scripts/lib/context-pack-registry.js; triggers, triggersDigest
and generatedAt untouched.
- Verification: environment reproduces both sides' committed digests on
their own trees; merged-tree digest a6b6bce7...; validate-context-profiles
293 skills OK; plan-orchestrate registry fixtures 8/8; full
node tests/run-all.js = 704 passed / 0 failed.
haelyra