Skip to content

feat: adopt the uniform setup contract across 17 shape-B plugins - #360

Merged
kyle-sexton merged 1 commit into
mainfrom
feat/setup-contract-shape-b
Jul 19, 2026
Merged

feat: adopt the uniform setup contract across 17 shape-B plugins#360
kyle-sexton merged 1 commit into
mainfrom
feat/setup-contract-shape-b

Conversation

@kyle-sexton

Copy link
Copy Markdown
Contributor

Summary

Tranche 3 of wave #314 (epic #313, dim 8): all 17 remaining shape-B setups onto the uniform check/apply contract — refactors that preserve each plugin's own verification logic, plus two creates where the audit showed the listing was imprecise (claude-config shipped no setup; kindle-dedrm's setup was a router action, now a dedicated skill with the router delegating to it).

Plugin Version Notable
machine-health 0.6.0 interview → apply path; non-interactive disable/deprecate/demote/approve args
source-control 0.9.0 carry-in: stale install --config reconfigure advice → fresh-install-only semantics
toolchain 0.4.0 delivers the apply action its 0.3.0 entry forecast; per-ecosystem non-interactive scope
claude-config 0.6.0 CREATE (audit: no setup shipped); README gains the bash prereq (dim-10 nit)
claude-ops 0.12.0 freshness riders preserved verbatim; evals re-routed to explicit apply
skill-quality 0.5.0 fixes README's dim-6 mis-framing of settings writes
songwriting 0.5.0 one deliberate interactive exception: destructive-collision confirmation
ai-briefing 0.6.0 verify+install fusion split (apply install-build-deps); 4 stale cross-refs in generate updated
context7 0.4.0 CLI/MCP dual-path check; apply install-cli gated
discovery 0.7.0 gains the missing non-interactive arg path
knowledge 0.8.0 ingest provisioners behind apply install-deps (verified standalone + idempotent)
code-tidying / codebase-health 0.5.0 lanes / merged-config checks split from interview
kindle-dedrm 0.4.0 dedicated setup skill; pinned-tag + Key_Finder guards untouched (referenced, not restated)
planning 0.20.0 two-concern check incl. standards-index version delta; toggle carries --config semantics
repo-fleet-hygiene 0.2.0 check split over existing arg grammar
work-items 0.11.0 probes the tracker-seam gates as authoritative, never restates them

Contract refinements from tranches 1–2 embedded throughout: opt-in absence = INFO vs broken = FAIL; verify-after-remediation; secrets presence-only; env-var changes defer verification to a fresh session; --config fresh-install-only reconfigure guidance; non-interactive with complete arguments. Write-behavior evals re-routed to explicit apply. Root README catalog regenerated.

With this PR, 27 of 31 plugins conform. Remaining: bug-report + miro (check-only carve-out PR with its one-line doctrine sanction), disk-hygiene + guardrails (deferred for the #286/#305 lanes), then the contract-gate check/apply rule as the closing tranche.

Verification

  • validate-plugins.sh (incl. regenerated catalog), validate-plugin-contracts.mjs (31 setup skills, 1537 files), markdownlint (725 files), typos: all green locally. Agents additionally ran skill-quality checks on the six plugins in group D (all PASS).

Related

No linked issue: tranche 3 of #314 — the issue closes with the wave's final tranche.

🤖 Generated with Claude Code

Tranche 3 of wave #314 (epic #313, dim 8): every existing off-contract
setup skill refactored onto check/apply, preserving each plugin's own
verification logic, state locations, and reference chains — plus two
creates where the audit showed gaps behind the issue's shape-B listing
(claude-config had no setup at all; kindle-dedrm's setup was a router
action, now a dedicated skill with the router delegating).

machine-health 0.6.0, source-control 0.9.0 (stale install --config
reconfigure advice replaced with fresh-install-only semantics),
toolchain 0.4.0, claude-config 0.6.0 (+ README bash prereq, audit
dim-10 nit), claude-ops 0.12.0, skill-quality 0.5.0, songwriting 0.5.0
(one deliberate interactive exception: destructive-collision
confirmation on override overwrite/removal), ai-briefing 0.6.0
(verify+install fusion split into check + apply install-build-deps;
four stale --with-build-deps cross-refs in the generate skill updated),
context7 0.4.0, discovery 0.7.0 (gains the non-interactive arg path),
knowledge 0.8.0 (provisioners pulled behind apply install-deps),
code-tidying 0.5.0, codebase-health 0.5.0, kindle-dedrm 0.4.0,
planning 0.20.0, repo-fleet-hygiene 0.2.0, work-items 0.11.0.

Contract refinements from tranches 1-2 are embedded throughout:
opt-in absence = INFO vs broken = FAIL, verify-after-remediation,
secrets presence-only, env-var changes defer verification to a fresh
session, --config fresh-install-only reconfigure guidance, and
non-interactive execution when complete arguments are supplied.
Write-behavior evals re-routed from bare setup to explicit apply.
Root README catalog regenerated for the two changed descriptions.

## Related

- Part of #314
- Part of #313

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@kyle-sexton
kyle-sexton enabled auto-merge (squash) July 19, 2026 01:30
@claude

claude Bot commented Jul 19, 2026

Copy link
Copy Markdown

Claude finished @kyle-sexton's task in 3m 25s —— View job


PR Review: feat/setup-contract-shape-b

  • Gather context and understand the request
  • Review new files (claude-config/setup SKILL.md, kindle-dedrm/setup SKILL.md + evals)
  • Spot-check modified SKILL.md files for contract consistency
  • Review evals changes for correctness
  • Check version bumps, CHANGELOGs, and README updates
  • Check for security/config issues
  • Post comprehensive review feedback

Summary

This is a clean, internally consistent tranche. The uniform check/apply contract is applied correctly and consistently across all 17 plugins. The two new files (claude-config/setup and kindle-dedrm/setup) are well-structured and match the contract. No blocking issues found.


Contract Conformance

The following invariants were verified across all reviewed SKILL.md files and are consistently applied:

  • opt-in absence = INFO, broken = FAIL — e.g. knowledge/setup correctly classifies missing node deps as INFO (each ingest skill self-provisions), machine-health/setup classifies absent overlay as INFO (default in effect), codebase-health/setup classifies absent config as INFO (audit re-infers).
  • verify-after-remediation — every apply path re-runs the relevant probe after a mutation and reports its actual result, never trusting exit codes alone. Consistently present.
  • secrets presence-onlykindle-dedrm/setup line 64 explicitly says "Report the key store dedrm.json presence-only — never print its contents"; context7/setup lines 51-52 say "Report presence only — never print or echo the value."
  • env-var changes defer to fresh sessionknowledge/setup and context7/setup both correctly instruct to "defer verification to that fresh session; do not claim a change this session."
  • --config fresh-install-onlymachine-health, planning, knowledge, claude-ops, source-control, context7 all carry the pattern "Headless: --config only applies on a fresh install (ignored once installed), so reconfigure via uninstall + reinstall."
  • non-interactive when action is given — confirmed in check/apply action routing across machine-health, source-control, claude-ops, context7, knowledge, songwriting, and the new files.

New Files

plugins/claude-config/skills/setup/SKILL.md (permalink)

Well-structured for a "guidance-and-verify only" setup (no config to write, just CLI prereqs to check). Two notable strengths:

  1. The jq-vs-curl scoping is correctly asymmetric: missing jq is FAIL (blocks ALL three skills); missing curl is FAIL but scoped ("only the plugin-drift check... The rest of audit and the other two skills still run — say so in the remediation line"). This is the right distinction.
  2. The Bash-shell probe (item 3) is classified as INFO (with a FAIL condition only if no bash is resolvable) — correctly avoids over-failing on a guaranteed-present shell.

The README update (plugins/claude-config/README.md line 104-106) correctly documents these prerequisites and points users to /claude-config:setup.

plugins/kindle-dedrm/skills/setup/SKILL.md (permalink)

The interactivity section is unusually important here and handled correctly: it distinguishes irreducibly-interactive steps (UAC/EULA, sign-in race window, Calibre GUI, keyfinder VBS) from automatable steps (artifact download, firewall rule, ICACLS lock). The former become CHECKPOINT hand-offs, not interview prompts. This is the right call.

The "follow workflow.md by reference, do not restate" approach (lines 70-71) correctly keeps the pinned-tag fallback and Key_Finder empty-match guard as single owners in one place. The evals verify this precisely:

  • Eval 2 checks apply download follows references/workflow.md Step 1 and refuses a URL with the placeholder still in place.
  • Eval 3 checks that automated mutations (firewall, ICACLS) are verified by re-running the status probe, not by exit code.

The router skill (kindle-dedrm/SKILL.md) is consistently updated: the description, action table, and action section all route setup to the dedicated skill.


Notable Observations

claude-ops/setup/SKILL.md — inline verification date
Line 18:

Official contract (verified 2026-07-18):

The PR description flags this as a "freshness rider preserved verbatim," so this is an intentional design choice. Worth noting that this date stamp embeds a staleness claim in skill content — a future update to the docs-reference URL won't automatically invalidate or update the date. Other plugins that cite the same URL (e.g. knowledge/setup line 17) omit the date, which ages better. Low risk since this skill's behavior (never writing the option) is stable, but the inconsistency is worth tracking as a pattern for the wave's final tranche.

codebase-health/setup/SKILL.md — relative template link
Line 91:

[`${CLAUDE_PLUGIN_ROOT}/skills/setup/templates/config-template.md`](templates/config-template.md)

The link text uses ${CLAUDE_PLUGIN_ROOT} while the href uses a relative path templates/config-template.md. This resolves relative to the skill file location (skills/setup/), so the effective path is skills/setup/templates/config-template.md — consistent with the link text. Not a bug, but if the template is ever relocated, the relative href would silently break without a test catching it. The ${CLAUDE_PLUGIN_ROOT} form in both positions would be more robust. This pattern pre-dates this PR (it's in a modified file), so it's out of scope for this tranche, but flagging for awareness.

source-control/setup/SKILL.md — staged-file verification sequence
Lines 186–206: The inline Bash sequence with comments explaining git check-ignore -v exit code semantics and the XY porcelain status distinction is technically correct and the explanation is genuinely non-obvious. The comment correctly distinguishes that git ls-files --error-unmatch exits 0 for already-tracked files on reconfiguration runs, making it unreliable for staged-content confirmation. Good defensive instruction.

work-items/setup/SKILL.md — exact-match guard on reconciliation
Lines 143–153: The instruction to "filter the results to the one whose title equals [Maintenance] {old title} exactly" before reconciling a renamed or dropped row correctly prevents substring matches from causing wrong reconciliations. The example in the prose ("returns a longer item when the old title was Review CI") makes the invariant concrete and catches a real failure mode.


Security

No concerns. Secrets handling is consistently presence-only. The kindle-dedrm setup correctly scopes personal-use and explicitly states "never sends any script, key, or extracted file off the user's machine." The machine-health/setup non-interactive write paths (disable=, deprecate=, demote=, approve=) include a rejection path for unknown IDs ("Reject an argument targeting an unknown check id or remediation with the same message check would give"), which prevents dangling entries without a write.


Version Bumps and Changelogs

Spot-checked source-control (0.8.x → 0.9.0) and planning (0.19.x → 0.20.0) — version bumps are consistent with the notable changes described. The CHANGELOG entries match what was described in the PR body. kindle-dedrm correctly gets a larger bump (0.3.x → 0.4.0) reflecting the dedicated skill creation.


Overall

Approve. Tranche 3 of the shape-B wave is correctly implemented. The two new files are contract-conformant. Contract refinements from tranches 1–2 (INFO vs FAIL, verify-after-remediation, secrets presence-only, env-var deferral, --config fresh-install-only) are embedded consistently. No blocking issues.

@kyle-sexton
kyle-sexton merged commit fe28ffa into main Jul 19, 2026
14 checks passed
@kyle-sexton
kyle-sexton deleted the feat/setup-contract-shape-b branch July 19, 2026 01:32

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6bad08e00e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment on lines +27 to +30
Action routing: no argument or `check` runs the check; `apply` runs the check first, then
remediation. When `apply` carries a `subject_pattern=` argument it writes the convention
non-interactively; with no arguments in an interactive session it runs the convention interview
below.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Update setup eval prompts to request apply

The new dispatcher makes a bare /source-control:setup run the read-only check, but all six existing setup evals still invoke it without apply; several then expect an interview or a write to .claude/source-control.md (for example evals 2, 4, and 6). Those evaluations will now exercise only check and fail or stop validating the configuration path. Update their prompts to /source-control:setup apply (and likewise update the other unchanged setup eval suites that still expect mutation from a bare invocation).

Useful? React with 👍 / 👎.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant