The old harness scored occurrences of words like VERIFICAR, so its score
measured wording, and it failed on a fresh clone. The lint checks frontmatter,
size limits, references and links; test_gate.py exercises the gate and hooks
on a throwaway repo; check_upstream.py flags vendored skills behind upstream.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
wf-frontend had no skill that generates new UI with taste, only ones that
audit it. design-taste-frontend covers new screens and
redesign-existing-projects covers upgrading existing ones.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
The Quick start told Hermes users to copy the workflows as loose .md files
into ~/.hermes/skills/software-development/. Hermes indexes skills by
walking for SKILL.md, so those files were never listed and never loaded.
Reproduced with the real loader (agent.skill_utils.iter_skill_index_files)
against a scratch HERMES_HOME: the documented command indexed 0 of 5
workflows, the loop now documented indexes 5 of 5.
- README.md / README.pt-BR.md: one loop for both agents, with SKILLS_DIR
swapped for Claude Code; install verification hint (hermes skills list).
- README layout tree: five workflows (wf-readme.md was missing), the whole
vendored skills/ tree, and the actual qa/ contents.
- The snapshot provenance claim listed base-364/v2/v3/v4 as if they lived
in qa/snapshots/, but only baseline-final.json is committed; corrected,
and it is now named as the file the gates read.
- Documented that api-security-review is two unrelated skills sharing one
name (OWASP vendored vs apisec-inc external).
- docs/SKILLS.md: the Claude Code block did mkdir -p "~/.claude/..." with
the tilde inside quotes, which creates a literal "~" directory instead of
expanding; replaced with $HOME. Also corrected the claim that only Claude
Code needs a per-skill directory.
Verified: installing from both documented blocks into a scratch HOME yields
15/15 skills indexed and carries the support files along.
Copia local (nao fork, nao submodule) de safedeps, sca-audit,
secrets-scan, code-review-security, api-security-review,
web-security-review, cve-triage, patch-prioritization,
dependency-scanning e hermaguard -- commit exato de origem e licenca
de cada uma em skills/NOTICE.md. Elimina o passo de clone externo
pro pilar de seguranca do wf-security-review: git clone deste repo
ja traz tudo funcional.
Corrige tambem o comando de instalacao pro Claude Code nos dois
READMEs e no docs/SKILLS.md: Claude Code exige um diretorio por
skill (skills/<nome>/SKILL.md), nao aceita os .md soltos que o
comando antigo copiava -- confirmado testando a instalacao real.
New wf-readme workflow (grounded README creation/audit/rewrite) built on
readme-crafter, good-readme and curating-readme skills. Validated with the
QA harness: 302.3 -> 379.0 on the same ruler, all phases verified, no
false-positive skill refs.
Applied it to this repo: audit-repo.sh scan, link/TOC/em-dash validation,
added CONTRIBUTING.md (gap the workflow flagged) and wired the docs.
Add pbakaus/impeccable (v4.1.1, 23 design commands, 59 deterministic
anti-slop rules) to the frontend workflow and READMEs.
Document the QA harness measurements in both READMEs: before/after
workflow scores on the same ruler (total +98.6%), the four green gates,
the meta-tests, and what the refinement added. Full snapshot history
is in qa/snapshots/.
Four SKILL.md-based workflows for agent-driven development: frontend/UI,
backend/API, architecture, and security code review.
Each workflow defines phases with verification steps, acceptance criteria
and hard rules so agents deliver work that can be checked instead of
asserted. The security review consults live sources (OSV.dev, GitHub
Advisory, NVD) because model CVE knowledge is frozen at training cutoff.
Includes a QA harness (qa/) that scores workflows on 30+ criteria, a
non-regression gate, and meta-tests that corrupt the harness to prove it
detects regressions.
Evandro