Skip to content

feat: add fable-5-playbook plugin - #59

Merged
kyle-sexton merged 2 commits into
mainfrom
feat/publish-fable-5-playbook
Jul 11, 2026
Merged

feat: add fable-5-playbook plugin#59
kyle-sexton merged 2 commits into
mainfrom
feat/publish-fable-5-playbook

Conversation

@kyle-sexton

@kyle-sexton kyle-sexton commented Jul 11, 2026

Copy link
Copy Markdown
Contributor

Closes melodic-software/medley#1293.

Publishes the fable-5-playbook plugin per docs/MIGRATION-PLAYBOOK.md (per-plugin gate + acceptance security review).

What ships

  • plugins/fable-5-playbook/ — one knowledge skill (/fable-5-playbook:fable-5-playbook): Claude Fable 5's operating doctrine, authored by Fable 5 as introspected standing instructions. Core doctrine arms the session on invocation; twelve trigger-routed chapters under context/ (calibration, reasoning-moves, problem-framing, planning, execution, debugging, orchestration, verification, communication, recovery, context-economy, trust-and-authority) plus context/opus-adaptation.md for non-Fable models.
  • Marketplace entry: category: learning, tags knowledge + component tags. Explicit version: 0.1.0 in plugin.json only.
  • The source skill was already repo-agnostic (no repo-specific paths, tools, or slash references); the only content deltas from the source are the frontmatter description compressed to two sentences and one typo fix (mis-framedmisframed).

Gate evidence

  • claude plugin validate ./plugins/fable-5-playbook --strict — PASS; claude plugin validate . --strict (catalog) — PASS
  • claude plugin details token cost: ~207 tok always-on, ~4.7k on-invoke (single skill)
  • markdownlint 0 errors (15 files); typos clean; editorconfig-checker clean
  • --plugin-dir smoke test in a clean non-source repo — PASS: skill invoked, answered the four meta-rules (Precedence, One home per doctrine, Model adaptation, Silent application), namespace confirmed as fable-5-playbook:fable-5-playbook

Security review (playbook acceptance)

  • Pure knowledge skill: no hooks, no MCP servers, no agents, no userConfig, no scripts, no state, zero network access.
  • Cache isolation: all references are skill-internal (context/*.md self-citations); no ../ reach-outs.
  • No PII / secrets.

Merge note: open PRs #53, #56, #57 also touch marketplace.json + root README.md — merge serially; later ones rebase/merge the two shared files (this branch is based on post-context7 main, so it conflicts only with those unmerged siblings).


Note

Low Risk
Markdown-only plugin packaging and catalog updates; no executable code, credentials, or runtime side effects beyond skill text loaded into Claude Code.

Overview
Adds the fable-5-playbook plugin to the marketplace and root catalog — a pure knowledge skill (no hooks, MCP, scripts, or userConfig) that arms sessions with Claude Fable 5’s operating doctrine.

SKILL.md loads core standing instructions on invoke (bare / full / chapter name), defines four meta-rules, effort floors, a chapter routing table, and cites twelve on-demand context/*.md chapters (calibration through trust-and-authority) plus mandatory opus-adaptation.md for non-Fable models. Plugin README.md and plugin.json (0.1.0, learning category) document install and scope.

Reviewed by Cursor Bugbot for commit 03fa989. Bugbot is set up for automated code reviews on this repo. Configure here.

Ships Claude Fable 5's operating doctrine as an on-demand knowledge
skill: core standing instructions plus twelve trigger-routed chapters
and an Opus-adaptation chapter for non-Fable models. The source skill
was already repo-agnostic; the only content deltas are a description
compressed to two sentences and one typo fix (misframed).

Co-Authored-By: Claude <noreply@anthropic.com>
@cursor

cursor Bot commented Jul 11, 2026

Copy link
Copy Markdown

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_1f826892-9eb2-471b-8680-bb8696fb89ce)

@claude

claude Bot commented Jul 11, 2026

Copy link
Copy Markdown

Claude finished @kyle-sexton's task in 4m 0s —— View job


PR Review — feat/publish-fable-5-playbook

  • Gather context and read changed files
  • Review plugin.json manifest schema and metadata
  • Review marketplace.json entry
  • Review SKILL.md core doctrine content
  • Review context/ chapter files for correctness and consistency
  • Cross-check against CLAUDE.md design rules and playbook gate
  • Security review validation
  • Post final review findings

Overview

Solid PR. The content — 13 chapter files plus core doctrine — is high-quality, internally consistent, and follows the playbook's design rules for naming, scoping, and structure. The security posture is clean: pure knowledge skill, no hooks, no MCP servers, no userConfig, no scripts, zero network footprint. Gate evidence (validate, markdownlint, typos, smoke test) is thorough.

Two things need attention before merge, one substantive and one minor.


Finding 1 — Context file paths are not ${CLAUDE_PLUGIN_ROOT}-qualified (Medium)

File: plugins/fable-5-playbook/skills/fable-5-playbook/SKILL.md

The chapter routing table instructs the model to read files like context/calibration.md, context/problem-framing.md, etc. using bare relative paths. Meta-rule 3 also says read context/opus-adaptation.md NOW. These are model-level read instructions — when a trigger fires mid-session, the model must call the Read tool with a full path.

The CLAUDE.md design rule is explicit: "reference only files inside the plugin via ${CLAUDE_PLUGIN_ROOT}". The book-distill plugin (the closest structural analog) follows this correctly — it references its bundled template as ${CLAUDE_PLUGIN_ROOT}/skills/book-distill/templates/checklist.md. The migration playbook's cache-isolation caveat says the same: "Fix: bundle dependencies inside the plugin and reference them via ${CLAUDE_PLUGIN_ROOT}."

The concern: the smoke test confirmed the core doctrine loads and the four meta-rules answer correctly — but those answers are entirely within the SKILL.md body. The test did not exercise a mid-session trigger that lazy-loads a chapter (e.g., first code edit → execution.md). In an installed plugin at ~/.claude/plugins/cache/fable-5-playbook/…, the model may not be able to resolve context/calibration.md without the fully-qualified path.

Recommended fix — qualify all chapter references in the routing table and meta-rule 3:

`${CLAUDE_PLUGIN_ROOT}/skills/fable-5-playbook/context/problem-framing.md`

…and similarly for every entry in the routing table and for the context/opus-adaptation.md reference in meta-rule 3.

Fix this →


Finding 2 — New "learning" category not used elsewhere in the catalog (Low)

File: .claude-plugin/marketplace.json line 109

The entry uses "category": "learning", which is a new category not present in any other plugin. The most comparable plugin — book-distill — uses "category": "knowledge". Introducing a one-off category fragments discoverability; a user browsing by category won't find fable-5-playbook alongside book-distill.

Using "category": "knowledge" would be consistent with the catalog's existing taxonomy.

Fix this →


Minor notes (no action required)

  • plugin.json description length. At ~226 characters it's notably longer than book-distill (133) and context7 (182). Functional, but may truncate in some UIs. Consider trimming the chapter list from the description and relying on the README.
  • "fable-5" tag missing from marketplace entry. plugin.json keywords include "fable-5" but the marketplace tags array doesn't. Minor discoverability gap.
  • opus-adaptation.md title vs. routing table. The file is titled "Running this playbook on Claude Opus 4.8" but the SKILL.md routing table says any non-Fable model should read it. The file's opening paragraph handles this gracefully ("If you are not Claude Opus 4.8: … apply the method"), so this is not a bug — just a slight mismatch between the title and the broader intent stated in the SKILL.md.

Security review (per playbook acceptance gate)

Surface Verdict
Code execution (hooks/scripts) ✅ None
Remote MCP servers ✅ None
userConfig / credential handling ✅ None
Cache isolation ⚠️ Context file references need ${CLAUDE_PLUGIN_ROOT} (Finding 1)
Data egress / telemetry ✅ None
Provenance / third-party trust ✅ Author matches; MIT; no SaaS delegation

Finding 1 is the only open item before this can ship.

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Stale comment

Risk: medium. Cursor Bugbot did not complete (check skipped due to usage limit), so automated review is incomplete. Human review is needed before merge.

Open in Web View Automation 

Sent by Cursor Approval Agent: Pull Request Router and Approver

…playbook

# Conflicts:
#	.claude-plugin/marketplace.json
#	README.md
@cursor

cursor Bot commented Jul 11, 2026

Copy link
Copy Markdown

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_935ed33c-4be3-4483-83ac-7e7ddf72d5c7)

@claude

claude Bot commented Jul 11, 2026

Copy link
Copy Markdown

Claude finished @kyle-sexton's task in 1m 40s —— View job


PR Review — feat/publish-fable-5-playbook

  • Gather context and read CLAUDE.md guidelines
  • Read plugin.json manifest
  • Read marketplace.json entry
  • Read SKILL.md core doctrine
  • Review context/ chapter files
  • Cross-check design rules, security review, and prior findings
  • Post final review

Overview

The plugin itself is high quality — pure knowledge skill with clean security posture, no hooks, no MCP servers, no userConfig, no state, zero network footprint. The content (core doctrine + 12 chapters + opus-adaptation) is internally consistent, well-structured, and follows the playbook's design rules for scoping and naming.

One blocking issue from the prior review remains unresolved. One finding from the prior review was incorrect and is retracted below.


Finding 1 — Context file paths not ${CLAUDE_PLUGIN_ROOT}-qualified (Blocking — still unresolved)

File: plugins/fable-5-playbook/skills/fable-5-playbook/SKILL.md

The routing table (lines 127–141) instructs the model to read chapter files as bare relative paths — context/calibration.md, context/problem-framing.md, etc. Meta-rule 3 (line 17) similarly says read context/opus-adaptation.md NOW.

CLAUDE.md's design rule is explicit: "reference only files inside the plugin via ${CLAUDE_PLUGIN_ROOT}". When installed at ~/.claude/plugins/cache/fable-5-playbook/…, the model must call Read with a fully-qualified path. A bare relative path will not resolve in that cache context.

The smoke test confirmed the core doctrine and four meta-rules answer correctly — but that is because those answers are entirely within the SKILL.md body itself. It did not exercise a mid-session trigger that lazy-loads a chapter, which is the path that actually fails.

Fix — qualify every context/*.md reference in the routing table and meta-rule 3 with ${CLAUDE_PLUGIN_ROOT}/skills/fable-5-playbook/:

`${CLAUDE_PLUGIN_ROOT}/skills/fable-5-playbook/context/problem-framing.md`

Apply to all 13 entries: the 12 routing table rows and the context/opus-adaptation.md reference in meta-rule 3.

Fix this →


Correction to prior review — Finding 2 retracted

The prior review flagged "category": "learning" as a new, inconsistent category. This was incorrect. Reading the current marketplace.json, both thariq-skills (line 108) and boris (line 113) already use "category": "learning". The fable-5-playbook entry is consistent with the existing catalog taxonomy. No change needed.


Minor notes (no action required)

  • "fable-5" tag gap. plugin.json keywords include "fable-5" but the marketplace tags array omits it. Minor discoverability gap — worth adding to the marketplace entry alongside "doctrine".
  • plugin.json description length. At ~226 characters, it's the longest description in the catalog. Functional, but may truncate in some UIs. The chapter list could move to the README.
  • opus-adaptation.md title vs. intent. The file is titled "Running this playbook on Claude Opus 4.8" but the routing table and meta-rule 3 direct any non-Fable model to read it. The opening preamble handles this gracefully — not a bug, just worth noting for a future title revision.

Security review

Surface Verdict
Code execution (hooks/scripts) ✅ None
Remote MCP servers ✅ None
userConfig / credential handling ✅ None
Cache isolation ⚠️ Context paths need ${CLAUDE_PLUGIN_ROOT} (Finding 1)
Data egress / telemetry ✅ None
Third-party trust / PII ✅ None

One open item: qualify the context file paths, then this is ready to ship.


@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Risk: medium. Cursor Bugbot did not complete successfully (check skipped), so automated review is incomplete. Human review is needed before merge; no reviewers were assigned because no suitable non-author reviewers are available in this repository.

Open in Web View Automation 

Sent by Cursor Approval Agent: Pull Request Router and Approver

@kyle-sexton
kyle-sexton merged commit 5d7724f into main Jul 11, 2026
22 checks passed
@kyle-sexton
kyle-sexton deleted the feat/publish-fable-5-playbook branch July 11, 2026 11:45

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 03fa9893a7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".


## Externalize conclusions when they stabilize

- **Write each expensive conclusion to a durable work note the moment it stabilizes** — not at session end, when the middle of the session is already degraded and the note becomes a reconstruction of what you think you knew.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Route durable notes outside consumer repos

When this chapter fires for a long session or a conclusion that took more than ~5 tool calls, the skill makes writing a “durable work note” mandatory, but the plugin has no configured/documented storage path and its README describes it as having no state. In a marketplace install, a model following this instruction in an arbitrary consumer project has to choose where to create or update that note, which can leave unexpected untracked or committed artifacts in the user’s repo even though they only loaded a knowledge skill. Please make the note write ask-first/configured, or route it to a documented plugin data location.

Useful? React with 👍 / 👎.

kyle-sexton added a commit that referenced this pull request Jul 11, 2026
Closes melodic-software/medley#1296.

Publishes the `firecrawl` plugin per `docs/MIGRATION-PLAYBOOK.md`
(per-plugin gate + acceptance security review).

## What ships

- `plugins/firecrawl/` — one skill (`/firecrawl:firecrawl`): wraps the
`firecrawl-cli` binary for
scrape/search/crawl/map/parse/interact/agent/monitor with the core
write-to-disk-then-Read pattern (results land in tempfiles via `-o`; the
agent reads only the needed slice — 32–35× token savings vs the MCP per
the Scalekit benchmark cited in the skill).
- `context/commands.md` (full flag tables, carried verbatim),
`context/configuration.md` + `context/update-flow.md` (adapted
repo-agnostic).
- Maintainer-facing `scripts/update.sh` (`--check` read-only CLI-version
+ upstream-SHA drift report; `--apply` npm upgrade + `UPSTREAM.md`
rewrite behind approval gates; never touches SKILL.md — content
integration is a gated manual step) with a new self-contained
`update.test.sh` (17 checks, network-free).
- `UPSTREAM.md` sidecar (SHA-tracking sync state + rollback version).
- Marketplace entry: `category: utilities`. Explicit `version: 0.1.0` in
`plugin.json` only.

## Gate evidence

- `claude plugin validate ./plugins/firecrawl --strict` — PASS; catalog
`--strict` — PASS
- `claude plugin details` token cost: **~253 tok always-on**, ~4.9k
on-invoke
- `update.test.sh` 17/17 PASS; shellcheck (repo rcfile) clean; shfmt
clean; markdownlint 0 errors; typos clean; editorconfig-checker clean
- Smoke test via `--plugin-dir` — PASS: skill body loaded, answered the
write-to-disk flag (`-o`) from the body, namespace confirmed as
`firecrawl:firecrawl`. The smoke run surfaced two real
headless-permission defects that are fixed in this PR: a
credential-shaped `printenv FIRECRAWL_API_KEY` preamble line was
rejected by permission preflight (removed — `firecrawl --status` already
reports auth), and the status/sync preamble lines needed narrow
`allowed-tools` grants (`Bash(command -v firecrawl*)`, `Bash(firecrawl
--status*)`, `Bash(grep -m1 *UPSTREAM.md*)`). Caveat: in a fully
sandboxed scratch dir the preamble lines may still fall back to their
error text; the skill body loads and functions regardless.

## Security review (playbook acceptance)

- No hooks, no MCP servers, no agents, no `userConfig`.
- Data egress (normal invocation): the user-installed `firecrawl-cli`
calls `api.firecrawl.dev` (or a self-hosted `FIRECRAWL_API_URL`) — that
is the plugin's documented purpose. The credential is the consumer-owned
`FIRECRAWL_API_KEY` env var; never stored in or written by the plugin.
Env-var auth is preferred over `firecrawl login`/`config` explicitly to
avoid a second credential store.
- Data egress (update path, maintainer-invoked only):
`registry.npmjs.org` (version metadata) + `www.firecrawl.dev` (upstream
skill source, hashed in a tmpdir). `npm install -g` and any SKILL.md
rewrite sit behind two explicit approval gates; `--check` is read-only.
- The skill hard-prohibits `firecrawl init` (would install a parallel
MCP + skill copy) and documents the login/config divergence risk.
- Cache isolation: script resolves paths relative to itself; preamble
reads its own `UPSTREAM.md` via the skill-dir substitution; no `../`
reach-outs.
- No PII / secrets.

Merge note: open PRs #53, #56, #57, #59 also touch `marketplace.json` +
root `README.md` — merge serially; later ones need a conflict-merge of
the two shared files.

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Medium Risk**
> New plugin steers agents toward external Firecrawl API egress and
credit use via a user-installed CLI and `FIRECRAWL_API_KEY`; maintainer
`--apply` runs `npm install -g`, but there are no hooks/MCP and updates
are gated.
> 
> **Overview**
> **Adds a new `firecrawl` plugin** to the marketplace and root catalog,
shipping `/firecrawl:firecrawl` as the maintained `firecrawl-cli`
integration (scrape, search, crawl, map, parse, interact, agent,
monitor) instead of the Firecrawl MCP.
> 
> The skill centers on **write-to-disk then `Read`** (`-o` tempfiles)
with escalation tables for when to use Firecrawl vs WebFetch, narrow
**`allowed-tools`** for the status/sync preamble (`firecrawl --status`,
`UPSTREAM.md` grep), and prohibitions against `firecrawl init` /
login-style config drift. Supporting **`context/`** docs cover flags,
env defaults, and the maintainer update pipeline; **`UPSTREAM.md`**
records upstream SHA and CLI rollback versions.
> 
> **Maintainer tooling:** `scripts/update.sh` (`--check` read-only drift
vs npm + upstream skill; `--apply` global `npm install` + `UPSTREAM.md`
rewrite only, not `SKILL.md`) and network-free **`update.test.sh`**
regression checks.
> 
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
3184b4e. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

Co-authored-by: Claude <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant