The old harness scored occurrences of words like VERIFICAR, so its score
measured wording, and it failed on a fresh clone. The lint checks frontmatter,
size limits, references and links; test_gate.py exercises the gate and hooks
on a throwaway repo; check_upstream.py flags vendored skills behind upstream.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
wf-frontend had no skill that generates new UI with taste, only ones that
audit it. design-taste-frontend covers new screens and
redesign-existing-projects covers upgrading existing ones.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The Quick start told Hermes users to copy the workflows as loose .md files
into ~/.hermes/skills/software-development/. Hermes indexes skills by
walking for SKILL.md, so those files were never listed and never loaded.
Reproduced with the real loader (agent.skill_utils.iter_skill_index_files)
against a scratch HERMES_HOME: the documented command indexed 0 of 5
workflows, the loop now documented indexes 5 of 5.
- README.md / README.pt-BR.md: one loop for both agents, with SKILLS_DIR
swapped for Claude Code; install verification hint (hermes skills list).
- README layout tree: five workflows (wf-readme.md was missing), the whole
vendored skills/ tree, and the actual qa/ contents.
- The snapshot provenance claim listed base-364/v2/v3/v4 as if they lived
in qa/snapshots/, but only baseline-final.json is committed; corrected,
and it is now named as the file the gates read.
- Documented that api-security-review is two unrelated skills sharing one
name (OWASP vendored vs apisec-inc external).
- docs/SKILLS.md: the Claude Code block did mkdir -p "~/.claude/..." with
the tilde inside quotes, which creates a literal "~" directory instead of
expanding; replaced with $HOME. Also corrected the claim that only Claude
Code needs a per-skill directory.
Verified: installing from both documented blocks into a scratch HOME yields
15/15 skills indexed and carries the support files along.
Copia local (nao fork, nao submodule) de safedeps, sca-audit,
secrets-scan, code-review-security, api-security-review,
web-security-review, cve-triage, patch-prioritization,
dependency-scanning e hermaguard -- commit exato de origem e licenca
de cada uma em skills/NOTICE.md. Elimina o passo de clone externo
pro pilar de seguranca do wf-security-review: git clone deste repo
ja traz tudo funcional.
Corrige tambem o comando de instalacao pro Claude Code nos dois
READMEs e no docs/SKILLS.md: Claude Code exige um diretorio por
skill (skills/<nome>/SKILL.md), nao aceita os .md soltos que o
comando antigo copiava -- confirmado testando a instalacao real.
New wf-readme workflow (grounded README creation/audit/rewrite) built on
readme-crafter, good-readme and curating-readme skills. Validated with the
QA harness: 302.3 -> 379.0 on the same ruler, all phases verified, no
false-positive skill refs.
Applied it to this repo: audit-repo.sh scan, link/TOC/em-dash validation,
added CONTRIBUTING.md (gap the workflow flagged) and wired the docs.
Add pbakaus/impeccable (v4.1.1, 23 design commands, 59 deterministic
anti-slop rules) to the frontend workflow and READMEs.
Document the QA harness measurements in both READMEs: before/after
workflow scores on the same ruler (total +98.6%), the four green gates,
the meta-tests, and what the refinement added. Full snapshot history
is in qa/snapshots/.
Two versions (EN primary, PT-BR). Hero with badges, TOC, per-skill
explanations with links to each skill's owner, security rationale,
quick start, QA harness section and repo layout.
Removed AI-isms and em-dashes flagged by avoid-ai-writing checks.
Evandro