The old harness scored occurrences of words like VERIFICAR, so its score
measured wording, and it failed on a fresh clone. The lint checks frontmatter,
size limits, references and links; test_gate.py exercises the gate and hooks
on a throwaway repo; check_upstream.py flags vendored skills behind upstream.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
opencode reads the same SKILL.md files but needs its own subagent format and a
TypeScript plugin for the guard, formatter and gate, so install.py converts the
agents and points the copies at this checkout.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Each workflow was ~300 lines of grep-count "VERIFICAR" steps and ran every
phase for every request. Phases now state their minimum tier, checks are the
quality gate plus real tools, detail moved to references/, and machine-specific
paths and non-public skills are gone. Security references move to OWASP Top
10:2025, ASVS 5.0 and the OWASP LLM Top 10.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Every workflow used to run all of its phases for any request, so a one-line
fix paid the cost of a feature. dev-router classifies the request into tiers
0-3 with security triggers that raise the tier, and picks the workflow,
agents and gate tier. Agents get only the tools their role needs.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Workflows move to skills/<name>/SKILL.md so the repo installs as a plugin.
scripts/quality-gate runs only the checks of the requested tier on the diff
and reports missing tools as unverified instead of passing them. Hooks block
stopping on a failed or stale gate, guard destructive shell commands and
format edited files with the project's own formatter.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
wf-frontend had no skill that generates new UI with taste, only ones that
audit it. design-taste-frontend covers new screens and
redesign-existing-projects covers upgrading existing ones.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Evandro