Changelog

All notable changes to the CometWeb Agent Skills bundle are documented here. The format follows Keep a Changelog; repository tags use vMAJOR.MINOR.PATCH.

[Unreleased]

• Add opt-in three-arm evaluation plans with distinct native/tools/skill payloads, counterbalanced order and retained partial/error receipts. Preserve legacy two-arm plans; full-host helper execution still requires its own evidence.

• Add read-only candidate-bound GitHub change reports using trusted base tooling; missing model evidence remains NOT_RUN rather than behavioral PASS.

• Separate pinned task outcomes from structural grading. Add a synthetic 102-case, 51-family cohort with frozen splits and output-free review packets; independent validation and comparative task qualification remain unestablished.

• Add privacy-filtered OTLP receipt exports, identity-bound resource drift and a canary-probed, bounded macOS Python-helper backend; no automatic promotion.

• Resolve four diagnostic routing gaps without tuning the frozen holdout; retain native activation as a separate measurement.

• Record source freshness findings and affected dependencies, with a separate read-only scheduled report rather than blocking unrelated pull requests.

• Extend the disposable QA example with durable SQLite readback, access checks, browser reload/cleanup and checkpoint/retry/cancellation failure tests.

• Reject nonportable/colliding archive paths and malformed alias metadata; bind installation acceptance receipts to actual archive bytes and staged source.

• Consolidate content review under content-reviewer 1.8.0; retain content-roaster 7.0.0 as its adversarial-profile and legacy-v6 adapter. Preserve both wire contracts and validators; do not auto-convert verdicts. Keep the shared reviewer optional; comparative task-success advantage remains unestablished.

• Generate alias-specific routing text and dependency edges. Selective and pinned installs include canonical dependencies within their transaction; skill-orchestrator-multiagent 1.2.5 gains the same dependency metadata.

• Shorten science-roaster 6.2.0 to a methodology/evidence checklist; make reviewer roles, ledgers and v6 reporting conditional. Correct the research-program handoff while preserving scripts, schemas and shared procedures.

• Shorten repo-roaster 6.2.0 to evidence, counterevidence and repair checks; make role-based procedures and full v6 reporting conditional. Keep it optional and preserve wire contracts and shared roaster procedures.

• Fix quadratic control-pattern matching in all three source scanners without changing detection semantics, credential redaction or checked file reads. Add long-input and detection regression tests; retain the fix in content-roaster 7.0.0 and the science-roaster 6.2.0 update.

Catalog, optional workflows and local examples

• Retire cometweb-context as a discoverable skill while retaining its source map, helper scripts, tests and formal ContextEnvelope contract in resources/context. Preserve semantic CW-AIP validation and archive the original routing holdout before the roster-only rebase.

• Shorten web-app-auditor 1.6.0, content-roaster 6.2.0, quality-loop-operator 1.8.0, ai-humanize 2.7.0, release-readiness 1.4.0 and brief-architect 1.9.0. Keep formal contracts available for their consumers and avoid routine extra review stages.

• Correct short-profile stage selection in the quality-loop kernel. Retain native-model-first selection and optional workflow/contract adapters without claiming task qualification or changing host invocation policy.

• Add a synthetic QA/repair/retest example with a Node test gate in the shared runner. Prepare Node in both validation and package-attestation workflows; keep browser interaction and deployment evidence separate from policy tests.

• Carry standalone resources in host-smoke staging and continue excluding ignored private bindings from those staged plugin payloads.

• Distinguish knowledge basis and consumer purpose; rerun controlled local fact checks at the research/Council receiver, compiler and completion gate. Keep nonfact premises, inference caveats and explicit trial safeguards intact through typed handoffs, structural grading and unreviewed WhyKit drafts. Legacy scope remains unassessed; no current-world, model-quality or execution proof is implied.

• Refuse READY evidence envelopes with unverified material facts or unassessed material inferences; retain nonready reports and unknown supporting claims without claiming independent fact checks or inference dependency assessment.

• Mark all current packages as experimental DEVELOPMENT in self-contained maturity metadata, registry/catalog projections, ZIP manifests and CLI output. New scaffolds remain SCAFFOLD and development-only; supplied QUALIFIED labels cannot grant task qualification. Preserve unclassified historical ZIP inspection.

• Recheck clean Git source and release archive provenance before cache reuse, including a concurrent winner; a cached development ZIP cannot gain a clean versioned release receipt.

• Add the existing catalog owner/result/consumer map, task decision tree and task-specific installation selections; keep profiles and framework overlays opt-in.

• Correct bundled competitor-profiling handoff classification in Competitive Intelligence and Product Teardown.

• Validate canonical and legacy contradiction states without letting a resolved alias erase an explicit unresolved material state. Require typed records for the same claim as accepted contradictory evidence in full envelope admission, including the output grader; preserve declared resolved and nonready controls.

• Reject known generated skill author prompts at plugin admission and versioned packaging, including wrapped text and existing archive reuse. Development archives remain unassessed; scaffold detection does not establish task quality.

Security and correctness

• Refuse malformed judge/execution flags, uncalibrated performed model grades, empty case identities and nonfinite promotion bounds. Validate planned policy without claiming execution; equal pass rates cannot be called improvement.

• Distinguish missing task-relevant evidence from unauthorized access in rubric design and judge calibration. Agreement and valid metadata are not source truth.

• Separate public-example, private-workspace and single-project context scopes. Skip local overlays and repository inspection for public examples, bind project source references, and reject declared source/fact/wrapper sensitivity downgrades. Public context wrappers now require explicit public-example scope; legacy payloads with omitted scope remain private. Labels do not establish semantic privacy, tenant authorization or permission to publish.

• Mark unassessed host outputs explicitly instead of passing them by default; resolve the multiagent alias to its canonical output rubric and retain canary failures when no rubric exists. Check joined tokens consistently without treating schema-less canary JSON as legacy text lines.

• Distinguish missing, matching and different reported effort observations in scorecards without claiming cross-model effort equivalence.

• Validate loaded real-host plans and generate run paths independently of task IDs. Capture host streams with a live quota, private output permissions and POSIX process-group cleanup; unsupported cleanup platforms explicitly return NOT_RUN.

• Separate native-cap USD admission from estimated budgets. Unknown costs remain unknown, and usage-based estimates cannot release native budget reservations.

• Add body-only word-range checks to prose writing and rewriting, and exact-rational displayed-calculation checks to ebook preparation. Checks cover supplied inputs, not semantic fidelity or source truth.

• Reject special files before ebook manifest reads and fingerprinting; require revalidation of unresolved changed specialist stages before quality-loop completion.

• Reject malformed repair and quality-loop enum fields with structured validation errors.

• Redact detected credentials across all source scanner output categories and diagnostics; distinguish truncated, skipped and complete eligible-file scans.

• Fail real_host_eval --execute when no host ran. Forward host-native effort explicitly and report missing observations instead of claiming controlled A/B.

• Require section evidence mappings in complete competitor profiles, consistent research stage/target handoffs, and validated full envelopes for typed workflows.

• Classify receipt-only, schema-validated and domain-accepted completions without treating any of them as external-write authority.

Distribution and qualification

• Add selective --skill installation and clean-source --ref verification; document and test rollback through a detached reviewed commit.
• Prepare draft GitHub Releases from fully gated, attested tag artifacts, with versioned ZIP names, a checksum manifest, source commit and SBOM.
• Add required Python 3.14 runtime lanes and experimental Python 3.15 lanes. Local results and hosted CI remain separate evidence surfaces.
• Reject scaffold markers in skill-local JSON evals during the existing release maturity gate and clarify package/contract tests versus live task success.

Added

• Shared error envelope for skill kernels. tooling/kernel_error_envelope.py (run under pytest as tooling/tests/test_kernel_error_envelope.py) holds every payload-taking kernel to one refusal shape: any JSON value gets an object back, a non-object payload is refused with exactly one <name>:not-object error and a non-passing status, every refusal carries the keys the skill's other refusals carry, and each script with a behaviour suite refuses null, a list or a string without a traceback. CONTRIBUTING.md documents the envelope; 17 skills were brought into line with it.

• Multi-format output grading. A rubric can declare formats, each detected from the output's first line and graded with its own sections, checks and IDs. Competitive Intelligence grades its seven report formats and Customer Ops its eleven plus the machine-readable record. tooling/grade_output.py --explain points each issue at the rubric line that defines it and the excerpt that triggered it, and KERNEL_MISMATCH cross-checks compare the prose against what the skill's kernel computes for an accepted payload. check_code defaults and null IDs are handled consistently.

• Real-host evaluation kit. tooling/real_host_eval.py plans tasks from the repository's own eval cases (never the frozen holdout), runs them through a host CLI in headless mode with the plugin staged or absent, grades routing and output from the transcripts and reports pass rates with Wilson 95% intervals. run is a dry run that prints commands and an estimated cost; it starts nothing without --execute and explicit task and spend caps. See docs/REAL-HOST-EVALS.md. It is never part of check_all.py.

• Vocabulary reference. docs/VOCABULARY.md lists every verdict, status and severity enum by owning skill and protocol schema, with the boundary mappings between them; tooling/tests/test_vocabulary_doc.py fails when the document and the contracts disagree or a line mixes the Council and release spellings.

• Tooling inventory. docs/TOOLING.md describes every script under tooling/, the gate that runs it and what it reads and writes; tooling/tests/test_tooling_inventory.py fails on a missing row or a gate column that disagrees with check_all.py.

• Council phrasings. Polish and English explicit requests to the Council ("Rada niech oceni", "let the council decide", hand-over and agenda forms) route to ai-council, and denied patterns keep look-alikes out.

• Dismissed clauses in routing. A new dismissed block in registry/routing-policy.json demotes a skill whose every signal sits in a clause saying the activity is done or not wanted ("the audit is already done", "nie jest potrzebny"), in Polish and English; docs/ROUTING.md documents it and --explain shows the dismissed spans. Remaining limits are recorded in evals/routing/known-gaps.json.

• CW-AIP v2 conformance: valid/decision-council-no-go.json and invalid/decision-council-hyphen-verdict.json.

• Lexical routing fallback. tooling/route_skill.py ranks skills with a deterministic, standard-library BM25 ranker over each skill's description ("Do not use" sentences count against a skill), owns, trigger examples and a per-skill lexicon, configured by the lexical block in registry/routing-policy.json. It decides only when the routing signals are silent or near-tied, never after an explicit invocation, and abstains unless one skill leads clearly. --explain shows each term's contribution; --lexical / --no-lexical override the policy switch for one call. On the frozen 144-prompt holdout, read once after tuning, routing reached 132/144 (91.7%), up from 112/144; the tuned suites still pass at 100%.

• Output grading for 29 skills. evals/output/ now holds 671 golden good and broken outputs covering 29 skills, and every one of the 632 rubric rules is pinned by a broken case. A sidecar can recompute the verdict with the skill's own kernel, so prose that disagrees with what the kernel computes fails. Skills without a rubric are listed in NOT_GRADED with a reason.

• Behavior suites. 31 skills ship an offline behavior suite (evals/behavior/<skill>/suite.json, cometweb.behavior-suite/v1) that runs each script and pins its exit code and output; the behavior_evals gate requires a suite for every skill that ships scripts, and tooling/new_skill.py writes a placeholder one.

• skill_package_tests gate: the per-skill package tests (eval harnesses, front-door rules, script CLIs, manifests) run on their own in the fast gate set, bringing check_all.py to 33 gates.

• The Cursor plugin ships a generated rule, rules/cometweb-agent-skills.mdc, that routes requests to the bundled skills.

• tooling/plugin_release.py --bump patch|minor|major raises the plugin version from the merge base's, writes it to every manifest, pyproject.toml and uv.lock, and records the shipped set.

• One contract per skill. Every skill ships references/contract.json (cometweb.skill-contract/v1) listing each payload field and enum once, bound to the script constant that enforces it and the reference that documents it. The skill_contracts gate fails when a script reads an undeclared key, an enum drifts from its constant, a reference names a field the contract lacks or spells a value differently, or an eval case that must conform (conform: always) expects a pass on off-contract input. tooling/new_skill.py writes a contract for new skills, and tooling/skill_contracts.py --draft <skill> starts one for an existing skill.

• Frozen routing holdout. evals/routing/holdout.json holds 144 prompts (100 positive, 26 near-miss, 18 no-skill; 100 English, 44 Polish) written before the routing signals were read, pinned by sha256 in holdout.lock.json. The routing_holdout gate fails on any edit and on any holdout prompt that also appears in a set used for tuning, and tooling/routing_holdout.py reports aggregates only. Measured on it, routing went from 93/144 (64.6%) to 112/144 (77.8%) this release; the tuned suites pass at 100%, so expect unseen prompts to land nearer the holdout figure.

• Output grading. tooling/grade_output.py grades a skill's actual output against its output contract offline. evals/output/ holds golden good and deliberately broken outputs for eight skills (ai-council, content-roaster, evidence-researcher, product-operator, release-readiness, repo-roaster, seo-geo-aeo-maxxing, web-app-auditor); the output_grading gate requires the good ones to pass and each broken one to fail with its exact codes. See docs/OUTPUT-GRADING.md.

• Host smoke test. tooling/host_smoke.py loads the plugin in the real Claude Code and Codex CLIs against a staged copy with an isolated home directory, without calling a model: manifest validation, install, the model-visible skill list, and whether a host shortens descriptions. Cursor is checked statically against its documented plugin format.

• sast gate: repository semgrep rules for Python and shell under tooling/sast/, run offline with an exactly pinned engine installed from the lock's hashes into its own environment; each rule is tested against positive and negative cases on every run.

• runtime_deps_locked gate (tooling/audit_deps.py): every dependency a skill declares in RUNTIME.json or requirements.txt must be locked at a version inside its declared range, so pip-audit --require-hashes covers it.

• sbom gate (tooling/sbom.py): a CycloneDX 1.6 SBOM of the plugin, with each skill's package digest and the optional libraries skills declare. The attest-packages workflow builds it, attests it against the packages and uploads it with them.

• docs/ROUTING.md explains how a prompt is matched to a skill, the routing policy blocks, the known gaps and how to add a case; a test keeps its policy block names in step with registry/routing-policy.json.

• tooling/check_all.py runs every repository gate (33 of them) from one list, in parallel, with a summary table. CI calls check_all.py --ci, which fails on a missing tool instead of skipping it; --fast runs the quick gates, --fix reruns the generators first and never records a baseline. An optional .pre-commit-config.yaml runs the fast gates on every commit.

• Plugin version gate: tooling/plugin_release.py and registry/plugin-release.json require a new plugin version whenever a shipped skill is added, removed or changes its VERSION, because Claude Code and Codex refresh an installed plugin only when its version changes. The plugin version is now 2.2.0 in every manifest.

• tooling/new_skill.py registers the new skill by default: registry entry, README catalog row, placeholder routing cases and this skill's baseline rows. The scaffold ships a small output-contract validator whose eval harness holds every guard, so check_all.py --fast passes straight away; it prints each file it wrote and what is still placeholder. --no-register writes the package only.

• Multi-step requests ("audit the signup flow, then gate the release", Polish "a po nim", "na tej podstawie") route to skill-orchestrator, and the route result lists the specialist for each step under sequence.

• extras/cursor-routing.mdc and extras/AGENTS.snippet.md are generated from the registry, as is the package list in the host plugin manifests.

• SECURITY.md describes the threat model for skills that read untrusted content, and evals/routing/adversarial-suite.json holds 20 injection-style routing cases, run by the routing_adversarial gate.

• Routing coverage enforces Polish floors per skill through each case's lang.

• Every host installer accepts --dry-run (run all checks, print the plan, write nothing) and --uninstall (remove only links into this checkout's skills/). All six hosts share one code path in scripts/lib/install.sh; rerunning an install prunes links to retired skills, and install-all.sh previews every host before changing any of them.

• tooling/routing_coverage.py --check reports positive and negative routing cases per skill, enforces a per-skill floor, and rejects duplicate IDs, near-identical prompts and prompts copied from registry examples. evals/routing/known-gaps.json records prompts the router still misroutes; a gap that starts passing fails the check until it is promoted to the suite.

• CW-AIP v1 and v2 conformance fixtures (valid and invalid) under fixtures/cwaip-v{1,2}/conformance/, run against the validators in the test suite. The multiagent envelope gate now accepts v2 envelopes.

• The README skill catalog is generated from registry/skills.json and registry/readme-catalog.json by generate_adapters.py, and repository Markdown links are checked by the test suite.

• tooling/new_skill.py --root scaffolds into another checkout.

• Public safety scanning flags personal email addresses (RFC 2606 domains and the project contact are allowed), any home-directory path with a real account name, signed JWTs, and Stripe, npm, PyPI, GitLab, Hugging Face, Slack app and Azure storage credentials.

• The router ignores routing signals inside a refused clause ("do not review the codebase, just fix the test", "nie rób przeglądu repo, tylko…"), in English and Polish. Scope ends at the clause, so "don't hold back: roast this repo" still routes. Rules live in registry/routing-policy.json under negation.

• tooling/routing_coverage.py --confusion reports misroutes and false positives over every labelled prompt in the repository, split into stable tune and holdout halves.

• Per-skill tests/front-door-rules.json inventories, checked by tooling/tests/test_front_door_rules.py: every must-keep rule has to stay in the file it is listed under, a rule moved to a reference needs a pointer with a load trigger in SKILL.md, and every normative sentence in a front door has to be inventoried. The three roasters, Product Operator, Release Readiness, Customer Ops, Product Teardown and Competitive Intelligence use it.

• Every bundled skill script answers --help with exit 0 and rejects unknown arguments; tooling/tests/test_skill_script_cli_contract.py checks all of them and that each script imports only the standard library, its siblings or dependencies declared in RUNTIME.json. A runtime-matrix workflow runs the skills that declare dependencies against those dependencies alone.

• Draft CW-AIP v2 schemas for the reserved artifact, snapshot and specialist-handoff kinds, with fixtures.

• Tests that the paths in registry/hosts.json exist and that an installer rerun over an older install upgrades it cleanly.

Changed

• Plugin 2.4.0. A minor release: 20 skills change version, with feedback-integrator 1.8.0 gaining behaviour and the rest receiving fixes (ai-council 5.2.4, longform-publisher 1.1.4, portfolio-operator 1.2.4, quality-loop-operator 1.7.4, seo-geo-aeo-maxxing 1.3.4 and the other skills aligned with the shared error envelope).

• Faster check_all.py. installation_acceptance builds and installs every package in parallel from one clean copy of the checkout, eval_strength runs the mutants of a package side by side, behaviour suites run in parallel, a deferred gate stops the per-skill tests from running twice in a full run, and sast reuses a clean result while its inputs are unchanged (--ci always rescans). A full --ci run took 69 s of wall time on the reference machine.

• behavior_evals runs with --require-runtime under --ci: a case whose script needs an uninstalled RUNTIME.json package fails there instead of being skipped.

• Longform Publisher 1.1.4 freeze exception. The description is 539 characters with the "Do not use" boundary kept, each reference is loaded only when its stage needs it instead of all seven on every run, and twelve front door rules are pinned by tests/test_longform_front_door.py.

• Routing: the content-roaster strength floor is 17, and --check fails a floor that sits far below the measured value.

• Removed the disabled tooling/publish_public_dry_run.py and its empty registry/public-allowlist.json; publishing is a reviewed pull request.

• The eval-strength baseline for content-reviewer is 42 of 42 guards (was 43 of 43): the entry point no longer branches on whether the payload holds findings, so that guard is gone, not unpinned.

• Plugin 2.3.0. A minor release: skills gain behavior suites, sharper front doors and fixes below. Each changed skill's VERSION moves by one patch release with one changelog entry; the shipped set is recorded in registry/plugin-release.json.

• Codex installs to ~/.agents/skills, the user skills directory Codex documents. scripts/install-codex.sh moves the links an earlier install made in ~/.codex/skills and leaves other entries there alone; CODEX_SKILLS_DIR still selects another directory.

• The Cursor plugin manifest keeps only documented keys, and tooling/host_smoke.py checks manifests against those key sets.

• Front doors of 19 skills were corrected where they disagreed with the kernels (for example content-writer uses EVIDENCE_REQUIRED, feedback-integrator records runtime drift as HOST, release-readiness spells N/A as na, content-reviewer lists unverifiable claims under verify[], skill-evaluator reports SPEC_ONLY when nothing ran), and reference tables say when to read each file. Six descriptions were shortened to at most 540 characters so the "Do not use" clause survives the Codex skill list.

• Skill contracts give a reason for every internal key, support lists and parent-qualified enums, and the eval-strength default floor is 0.92.

• A release tag must match VERSION; CONTRIBUTING documents the release steps and the README covers plugin installation. Gate errors say what to run.

• tooling/new_skill.py writes an untrusted-content section and tests/front-door-rules.json for a new skill.

• seo-geo-aeo-maxxing 1.3.2 (plugin 2.2.1): live source registry re-verified against first-party sources on 2026-10-03, including the new Search Console "Search generative AI features" control; freshness tests derive their dates from the registry so a refresh no longer breaks them.

• Plugin 2.2.0. Every skill's VERSION moves by one patch release for the contract, documentation and kernel fixes below; the shipped set is recorded in registry/plugin-release.json.

• Routing suite grew from 284 to 690 cases; about 25 skills gained Polish routing signals, and signals were tuned on fresh prompts written before each change. Two prompts the router still misroutes are recorded in evals/routing/known-gaps.json.

• Each skill description states its "Do not use" boundary right after the opening sentence. Codex shortens descriptions to fit a shared skill-list budget, and the boundary used to sit at the end, where it was cut first.

• Every agents/openai.yaml is regenerated: Codex's default_prompt names the skill as $skill-id and stays within 160 characters, and a test routes each prompt to its own skill.

• registry/hosts.json records each host's frontmatter limits, and the compatibility gate checks every skill against all nine host profiles. Claude Code's description limit is 1,536 characters.

• README counts, the skill-count badge and the documentation index are generated or checked against the tree.

• Ten more front doors were cut, and every SKILL.md is now at most 12,000 bytes. Together the front doors are about 6 KB smaller than before this release even with the untrusted-content block added to 31 of them; every must-keep rule is listed in the skill's tests/front-door-rules.json.

• Eval strength: 835 of 889 reachable guards are held (was 765). Cases pin exact error lists rather than only a verdict, and a harness below its floor (0.85 by default, higher for some skills) fails the gate. eval_strength.py refuses a harness that holds no guard at all.

• Codex short_description values are generated to fit the 25-64 characters Codex shows.

• CONTRIBUTING describes the single check_all.py flow.

• Broadened deterministic routing evaluation to 284 cases, including natural Polish requests and positive coverage for every catalog skill. The proxy is not a substitute for model or host-level routing acceptance.

• Roaster routing signals now pair adversarial verbs (roast, tear apart, red-team, stress-test, brutal critique, Polish zroastuj/upiecz/rozjedź) with each roaster's own objects. Deterministic-proxy recall on the skills' trigger evals rose from 5, 3 and 9 of 18 to 15, 16 and 15 of 18 for content-, repo- and science-roaster, with no new false positives; routing_coverage.py --check now enforces those floors, and a scope guard keeps live-UX roasts with web-app-auditor.

• The three roasters now verify all ten shared scripts and protocol references for byte-level drift, not only two scripts.

• Expanded Product Operator and Longform Publisher golden cases around evidence freshness, readiness, derived-artifact lineage, and manuscript placeholders.

• CI now extracts every skill ZIP and executes available offline eval/smoke entrypoints outside the checkout, including positive and negative multiagent validator checks. Local validation also gates all shared roaster resources.

• Package attestation now requires the full local gate, tree/history safety scans and extracted-package helper checks before building release artifacts.

• Skill descriptions for evidence-researcher, longform-publisher, competitive-intelligence, design-partner-finder, ebook-publisher, product-operator, release-readiness, science-roaster and web-app-auditor are host-neutral, state when not to use the skill, and no longer route to packages this catalog does not ship. Customer Ops replaces its restated per-mode procedures with one table that points at the existing references.

• Unit tests run in parallel (pytest -n auto). Workflow permissions are scoped to the job that needs them, third-party actions are pinned by commit, and matrix values reach shell steps through environment variables.

• Routing signals for 18 skills are narrower: bare nouns such as "ebook", "canonical", "blocker" or "orchestrate" no longer claim a prompt without the skill's verb or object, so a file conversion, a single canonical-tag edit or a Docker compose request reaches no skill. parse_description reads SKILL.md with a YAML parser, as hosts do.

• The roaster front doors (6.1.0) are 35–42% smaller; the step procedure moved to references/workflow.md per roaster and review setup to a shared references/review-operations.md. Product Operator 2.4.0, Release Readiness 1.3.0, Customer Ops 2.2.0, Product Teardown 1.2.0 and Competitive Intelligence 1.1.0 moved detail behind their front doors the same way.

• tooling/eval_strength.py finds guards the AST way and measures 888 guards (was 359); 765 are held by the skills' own harnesses after new eval cases for benchmark-curator, content-writer, feedback-integrator, rubric-designer, product-operator and longform-publisher.

• The multiagent CW-AIP gate checks v1 envelopes against their kind schemas, requires a v1 payload, and rejects a GO/GO_WITH_CONTROLS verdict that lists blockers. CW-AIP spec revisions 1.0.1 and 2.0.1.

• YAML frontmatter and host metadata are read with yaml.safe_load plus a duplicate-key pass; no nosec suppression remains.

• The OpenAI marketplace manifest declares its install policy and category.

• Ruff 0.16.10 and four development dependency patch updates.

Fixed

• ai-council writes NO-GO while the CW-AIP v2 DecisionEnvelope schema accepts only NO_GO, so a Council verdict copied into a v2 envelope failed validation. The kernel's gate now also prints envelope_verdict in the schema spelling, envelope_verdict() performs the mapping and refuses anything that is not a Council verdict, and the output contract states the rule.

• Release Readiness verdicts were written in the Council's spelling (NO-GO, GO-NO_GO) in portfolio-operator, quality-loop-operator and seo-geo-aeo-maxxing references; they now read NO_GO.

• Kernels that died with a traceback on a non-object payload or a wrong-typed field (among them portfolio-operator, quality-loop-operator, feedback-integrator, content-writer, repair-operator and rubric-designer) now return the shared error envelope.

• skill-orchestrator: a goal of only whitespace raised a traceback; it is now a usage error.

• rubric-designer: a rubric without mode hashed differently from the same rubric with the explicit STANDARD default; an omitted mode now hashes as STANDARD. Recorded hashes all used an explicit mode and are unchanged.

• release-readiness: bootstrap_manifest.py rejected an unrecognized scope key with a message saying the key "was ignored"; it now says the key is not accepted.

• The three roasters' select_review_packs.py accepted any --profile; it now refuses profiles the package's validator rejects.

• The sast gate no longer fails on a file deleted in the working tree, and the test harness no longer reuses a module cached from another skill.

• Removed tooling/integration_preview.py, its test and the stale document describing it.

• Many skill kernels and validators failed open on values outside their documented lists: an unknown or lower-case enum (a risk surface, a tier, a finding severity, a commitment state, a reconciliation status) was silently treated as a default instead of rejected. They now return a field-specific error, and eval cases pin each one. Among them: AI Council read a caller-supplied reversibility: "irreversible" as reversible and routed risk_surfaces: ["Legal"] to no legal gatekeeper; competitive intelligence scored an unknown competitor_tier as tier 1 or tier 3; SEO+GEO+AEO let a check row override registry fields such as weight.

• References now name every key each kernel reads and every value it accepts; more than a hundred keys were read by kernels but documented nowhere, and several references used names or values the scripts never accepted.

• The roaster report schemas no longer require fields their validators treat as optional, so a report the validator passed cannot fail the schema.

• Release Readiness rejects GO/GO_WITH_CONTROLS next to a BLOCK or COUNSEL_REQUIRED gate in any letter case, defers on pending, denied, expired or incomplete risk acceptances, and reports unread scope keys as scope_warnings. The multiagent envelope gate rejects the same Council and release verdicts. CW-AIP spec 2.0.2.

• AI Council's freshness gate no longer clears evidence in which no row is material.

• generate_adapters.py rendered a new skill's compatibility row as unsupported on the first run and only fixed it on a second.

• Longform Publisher names DERIVED_QA_FAILED when optional QA ran and failed (frozen-release exception 1.1.2, which also covers its untrusted-content block).

• The shared orchestrator reference ran two scripts that ship only with skill-orchestrator-multiagent from the wrong package; each command now changes into that package first.

• Skill docs no longer name nine tooling scripts that do not exist.

• Customer Ops loads its trigger-specific references only when the trigger applies.

• Product Operator's report validator accepted an action confidence outside 0–1; its kernel rejects a non-object coverage and a string depends_on (which was read letter by letter as dependencies) instead of crashing.

• Release Readiness documented commercial_model while the engine read scope.commercial, so a paid release lost its billing gate; the engine now accepts the alias and rejects the two keys disagreeing.

• Longform Publisher reports a wrongly typed nested report field as FIELD_TYPE_INVALID:<field> instead of a traceback (frozen-release exception 1.1.2). score_maxx.py and compare_scores.py reject malformed score files with a message instead of a traceback, and Web App Auditor's validate_report.py --help works without jsonschema.

• Installers skip a skill directory that holds only __pycache__ residue (what git pull leaves after a skill is retired) instead of failing, and a Cursor routing rule linked to the legacy extras/cursor-routing.mdc is re-pointed to the generated rule.

• Validators no longer pass malformed input: the coverage ledger rejects non-object rows, blank evidence references and unknown check IDs with a specific message; the decision validator rejects GO while human approval is required, pending or denied, and duplicate gate_id rows. Envelope and ledger CLIs print FAIL: with a reason instead of a traceback, and validate_evidence_envelope.py / validate_decision_envelope.py --help print usage instead of treating the flag as a file name.

• doctor.py reports skills that are missing from the registry, missing from disk or not installed instead of returning a clean result.

• The standard-library fallback in tooling/validate_envelope.py refuses schemas that use keywords it cannot enforce rather than ignoring them.

• sync_skill_registry.py --apply no longer reverts routing signals and descriptions that had been edited only in registry/skills.json; a test now requires the command to be a no-op on the committed registry.

• Per-skill INSTALL.md files named scripts/package-releases.sh, which does not exist; they now give the tooling/package_skill.py command, and a test checks that every repository path they name exists.

• The shared roaster handoff contract no longer cites a nonexistent integration/validate_handoff.py.

• Behavior evals and the orchestrator drift-guard tests no longer depend on the contributor's git configuration or mutate the checkout while other tests read it. The blind eval report carries a fixture fingerprint that ignores the run timestamp.

• Install targets that contain a .. path component are rejected in the shared helper, including CURSOR_RULES_DIR. Absolute directories without .. still install.

• A near-tie between incompatible specialists returns ambiguous instead of silently picking one skill. use <skill-id> counts as an explicit invoke.

• Product Operator's install note uses ~/.codex/skills, the same Codex path as the root installer.

• Host installers reject conflicting directories, files, and foreign symlinks by default before linking any skill. With SKILLS_REPLACE_CONFLICTS=1, conflicting entries are moved to a dated backup and canonical links are recreated idempotently across supported hosts.

• Installers reject incomplete skill packages before changing any host target.

• The multiagent envelope validator bundles its schema and fails closed when the schema or jsonschema is missing; its alias dependency is explicit.

• The canonical orchestrator ZIP no longer contains an unresolved repository-only documentation link.

• Installers reject targets overlapping their source skill tree, including symlink aliases, before moving a package. The multiagent install guide now states its sibling-skill and Python dependency requirements.

• Product Operator golden evals now pin snapshot hash and state fingerprint tampering. Skill Auditor routing covers additional Polish paraphrases with adjacent negative controls.

• Product Operator no longer promotes actions whose prerequisites are missing; its golden suite now covers 60 cases, including dependency chains, cycles, STOP/LATER exclusions, plan caps, and malformed candidate records.

• Product Operator 2.3.1 preserves DECISION NOW through report generation and bilingual rendering; inferred action types no longer crash the brief bridge.

Security

• Canary files for prompt-injection checks: grade_output.py --new-canary writes a token split into parts, --plant appends the planted instruction to a copy of a test input, and --canary-file fails a report that joins the token anywhere, so a report that only quotes the instruction is not flagged.

• Workspace JSON written by the competitive-intelligence kernel goes through tempfile.mkstemp in the target directory (unpredictable name, O_EXCL, mode 0600) and os.replace, not a predictable <file>.tmp that a planted symlink could redirect. The install scripts create temporary files with mktemp.

• The roasters' scan_source_risks.py walks with directory descriptors (os.fwalk), opens each file with O_NOFOLLOW | O_NONBLOCK and checks type and size on the open descriptor, so a file swapped for a symlink or FIFO after listing is skipped rather than followed or blocked on.

• SECURITY.md lists the supported versions and a disclosure timeline with target response and fix times.

• Every skill's front door carries the same short untrusted-content block: inspected content is data, not instructions; no commands, installs or links because that content asks; no secrets, credentials or unnecessary personal data in outputs, and no entering credentials the user did not supply; user confirmation before any external side effect. Tests pin the wording and each rule.

• The router ignores text after an override phrase ("ignore previous instructions", "zignoruj poprzednie instrukcje") and inside quotes, fences and blockquotes when deciding invocations, signals and multi-step sequences, strips zero-width characters, and reports override_suspected.

• Repo Roaster's inventory_repo.py runs git with hooks, fsmonitor, external diff and textconv disabled, refuses option-shaped refs, and reads manifests only as regular files under 1 MB, never through a symlink.

2.0.1 - 2026-09-22

Added

• Integrated the quality workflow package set: artifact acceptance, briefing, content writing/review, repair, benchmark and rubric design, feedback integration, quality-loop operations, skill auditing, and skill evaluation.
• Added dedicated content-roaster, science-roaster, and repo-roaster packages from Roaster Suite 6.0.0, with the quality bundle's duplicate copies intentionally excluded so each skill ID has one canonical version.
• Expanded the canonical marketplace bundle from 18 to 32 skills and refreshed registry metadata, host adapters, routing docs, package manifests, and context budget baselines.

Verification

• The imported packages retain their own references, deterministic helpers, eval fixtures, and tests; the source bundles' root CI and release tooling are not copied into this repository.
• Static package integrity, public-tree safety, registry consistency, and the full local validation suite remain release gates; static checks do not claim live-host behavioral lift.

2.0.0 - 2026-09-19

Added

• ebook-publisher, longform-publisher, portfolio-operator, and cometweb-context, bringing the canonical bundle to 18 skills.
• Cross-runtime installation and generated adapters for Cursor, Claude Code, Codex, Qwen, Qoder, and Lingma.
• CW-AIP v2 schemas and validators for evidence, decisions, releases, reviews, and multi-skill handoffs, while retaining the documented v1 compatibility surface.
• Approval-gated deterministic skill packages, reviewer bundles, public-tree safety scanning, and history scanning with no bypass flag.
• A 12-gate local validator covering repository integrity, generated adapters, routing, behavior, context budgets, eval strength, security, compilation, and the full test suite.
• Context-budget baselines that fail on unreviewed front-door growth without pretending there is one universal token ceiling.
• Mutation-style eval-strength baselines that measure whether each deterministic rule is actually held by a failing case rather than counting green examples.
• tooling/new_skill.py, package-layout contracts, registry consistency checks, executable-bit checks, documentation indexes, issue forms, contributor and security policies.
• A deterministic tooling/whykit_draft.py boundary that validates finalized CW-AIP v2 evidence and decision envelopes and emits explicit, unreviewed WhyKit drafts without mutating a vault or allocating ledger IDs.

Changed

• CometWeb-io/agent-skills is the single public canonical source. The former private-source/public-mirror workflow and its sync tooling are retired.
• Tracked context bindings use public placeholders; local paths belong only in ignored *.local.json and *.local.txt overlays.
• registry/skills.json remains the metadata source of truth; marketplace manifests, host adapters, compatibility tables, and generated documentation are checked against it.
• Large skill front doors were deduplicated against their own references while preserving binding safety rules and execution order.
• CI remains one Python 3.12 validation job. The duplicate PR-only workflow and recurring dependency bots are removed to avoid repeated runner cost.
• GitHub Actions are pinned to reviewed commit SHAs; full history safety remains a local pre-release gate rather than an every-push workflow.

Fixed

• Local validation now passes under the declared pytest import mode; shared test fixtures no longer depend on importing sibling test modules.
• Routing metadata and examples no longer send long-form publishing work to release readiness or point the orchestrator at a script in another package.
• Context scoring and freshness defaults use UTC rather than the runner's local timezone, and Council recency no longer uses naive UTC datetimes.
• All documented contributor commands now map to tools that actually exist.
• Qwen, Qoder, and Lingma installers retain executable file modes in Git.
• The Codex installer no longer deletes an existing real skill directory; all host installers fail safely until the user moves a collision aside.
• Missing package icons, dead readiness locals, incomplete exception chaining, and low-visibility subprocess coverage were corrected.
• Package case-collision checks run on case-insensitive macOS filesystems instead of skipping the risk they exist to detect.
• The retired ai-antipattern-writing package cannot reappear through registry, adapter, or legacy-package synchronization.
• CW-AIP v2 validation remains complete without the optional jsonschema package, loads typed validators without module-name collisions, and rejects ambiguous JSON before rendering a WhyKit draft.
• WhyKit draft output treats producer prose as inert data, preserves decision approval metadata in provenance, and refuses to overwrite existing files.

Verification

• The full deterministic test suite passes with zero failures, errors, or skips.
• All 12 local validation gates pass.
• Current-tree and full-history public-safety scans pass.
• Deterministic routing, package, adapter, context-budget, and eval-strength checks are part of the release candidate.

1.0.6 - 2026-08-26

Added

• Envelope validator for multiagent handoffs (validate_envelope.py).
• Multiagent smoke walkthrough and demo Evidence Pack.

Changed

• Multiagent documentation now covers cloud subagents and step validation.

1.0.5 - 2026-08-26

Added

• scripts/install-codex.sh installs all skills into Codex.

1.0.4 - 2026-08-26

Added

• skill-orchestrator-multiagent for isolated specialist execution.

Changed

• Routing distinguishes single-thread and multiagent orchestration.

1.0.3 - 2026-08-26

Added

• skill-orchestrator for multi-skill CW-AIP workflows.

1.0.2 - 2026-08-26

Added

• scripts/install-claude.sh installs all skills into Claude Code.

Changed

• Installation and architecture documentation covers Cursor, Claude Code, and ChatGPT-compatible hosts.

1.0.1 - 2026-08-26

Added

• Branded demo, root installation guide, issue/PR templates, and release-bundle support files.

1.0.0 - 2026-08-25

Added

• Twelve public skills with deterministic kernels and CI.
• CW-AIP v1 interchange protocol and JSON Schemas.
• Routing evaluation suite, validators, installers, safety checks, and release packages.