Repository navigation
feat(app-control): add /app-control:map refresh - #9934
Conversation
…I and safety sections Map create discovers the repository over fixed rows before asking anything, asks only the residue (through /planning:interview when installed), writes the control skill and proves it once through /app-control:drive. The contract gains config layering, driver CLI and safety-floor sections. The 16 map-features cases and the unsafe-location case are ported, and six new cases cover discovery order, recipients, sign-in lockout, unattended stops, evidence survival and config layers. Refs: #9581 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0177ybXguBnnGV4UTksrdzd9
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0177ybXguBnnGV4UTksrdzd9
…harpen the map eval cases Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0177ybXguBnnGV4UTksrdzd9
…its graders Discovery stays read-only; the check that the app runs goes through /app-control:drive and its cleanup, and the no-orphan check covers every launch record drive wrote. The writer case can now fail its Write grader, the config and recipient regex graders match only what a correct answer says, case 12 keeps its refresh-skill expectation, and the run-/verify location rule states our reason in our words. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0177ybXguBnnGV4UTksrdzd9
… pin the control-skill location - --dir accepts only another .claude/skills/control-<slug> directory, the one place drive looks; real paths of the target, ignore file and pointer target must stay inside the repository. - The generated driver CLI applies the safety floors from config committed at HEAD and refuses a loosening from the local, environment or flag layers with exit 4; send, sign-in and write steps are CLI commands. Credentials always come from environment variables. - One sign-in rule first: any failure counts, one attempt per account per create run across every drive call, one capped rerun. No state file. - Explicit drive call sequence with the app slug and one --out per drive run outside the checkout; the no-orphan check matches pid, start time and command-line hash. - Hub last in the write order, resumable partial create, config/.gitignore checked with git check-ignore, unattended create is a dry run. - Hub table gains the app, driving tool and Attended runs only. rows. - Evals: id 12's always-true expectation replaced, the ported location case no longer forbids writing in its prompt, and the recipient and config cases grade the CLI as the enforcer. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0177ybXguBnnGV4UTksrdzd9
…ecipient case's phrasing check
The plugin description now names /app-control:map beside drive, with the catalog row
regenerated. The recipient case's regex also accepts a negation pointing back at the
allowlist ("isn't on it"), and its judge accepts an allowlist that stays empty until
committed at HEAD; both edits were made after a first run (regex failed 3 of 3 on
phrasing while the reply refused the unlisted recipient through the CLI).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0177ybXguBnnGV4UTksrdzd9
…haracter limit Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0177ybXguBnnGV4UTksrdzd9
…efaults are committed Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0177ybXguBnnGV4UTksrdzd9
… map create Name the caller as the keeper of the per-run sign-in count, pass --unattended through to drive, launch nothing while a side-effect or shared-system row is open, recommend only safe values for safety questions, report discovered secrets by file and key, real-path check every written file, test the CLI's floor refusals in the proof, align the README and eval graders with the contract, and fix the upstream record's line citations. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0177ybXguBnnGV4UTksrdzd9
Carry the untrusted-content framing spine verbatim, give the driver CLI a side-effect-free config command and test the floors through it with an exit-4-only pass, let the Floors check decide a resumed CLI, derive the drive selector from the resolved --dir slug, and skip the start check when drive would pick another app's sole control skill. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0177ybXguBnnGV4UTksrdzd9
check-map.sh reports a control skill's structural contract breaks as `<rule> | <path> | <detail>` lines (index to folders, sections, entry-point markers, links, shared/ use and why line, source globs), never edits, and exits 0 with findings. The map body's check action runs it, then judges copied recipes. Three eval cases cover a dead index line, a missing not-driven reason and a copied recipe, each with no file change. Refs: #9582 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0177ybXguBnnGV4UTksrdzd9
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0177ybXguBnnGV4UTksrdzd9
…contract check-map.sh's shared-use and shared-why rules now point at the contract's "Shared items" section instead of being the only home for the convention. Refs: #9582 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0177ybXguBnnGV4UTksrdzd9
Refresh keeps a control skill in line with the app: skip check, a read-only source wave in waves of at most six, a live pass through /app-control:drive under the Ready/cleanup/evidence invariants, and triage into doc drift, driver gap and product regression. Changes go out on control-skill-upkeep/<skill slug> through one pull request; legacy testing feature maps and flat feature files convert in the same pull request. Ports upkeep-skip.sh and its test, the 11 refresh cases and the confines-edits case, and adds five new cases. Refs: #9583 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ding .claude Inside an enclosing git repository, the git top level is not the project, so every index source glob looked dead. The default root is now the directory holding .claude/ (the git top level only for a directory outside .claude/skills/), the contract says sources are relative to it, and the no-shell fallback reports only what the rules find. The check evals now require the action's `<rule> | <path> | <detail>` line, which a run without the skill does not produce. Refs: #9582 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
map-legacy-flat-map-migrates seeded files into a repository with no commit, so the refresh correctly stopped as blocked at the skip check. The scaffold now initializes a repository when none exists and commits the seeded tree on main with a fixed author and date. Refs: #9583 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…tory map uses <slug> for the app slug, so `control-skill-upkeep/<skill slug>` read as control-skill-upkeep/clockwork. Name it control-skill-upkeep/control-<slug> everywhere, with the never-form beside the example, and move the cursor-pstack citation of the conversion section to its new lines. Refs: #9583 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…epository `git rev-parse --git-dir || git init` committed into an enclosing repository when the scaffold ran inside one. Init here unless this directory is already a repository's top level. Refs: #9583 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Keep refresh in map's argument-hint with unspaced alternatives, and mark the literal backticks in the source-wave scaffold for shellcheck. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Main now holds map create (#9628) and map check (#9921) squashed. Their files take main's version; refresh composes onto main's SKILL.md, evals.json, README and the cursor-pstack record. The released map-create fragment and a sample for a grader main renamed are removed, and the cheat sheet is regenerated. Refs: #9583 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Ported-case non-inferiority (skill-creator
Suite mean 97.73 before and after; no case lost, none dropped. Non-inferior under skill-criteria step 6.
|
A reply that read only SKILL.md planned to edit cli/ and re-drive on an unattended pass, because the rule lived only in refresh.md's triage table. The hub now says an unattended pass reports the fix unwritten and drives nothing again. A flat feature file's conversion also updates its hub index line. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
"The send failure is a driver gap" matched no branch of the names-* graders. A branch for the class right after "is" or "as" covers it, while "is not a" still fails; pass and fail samples cover both. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… blocked An unattended pass now reports a driver-gap fix unwritten. Ending it clean would record the pass and let the next one skip the unfixed gap, so it ends blocked and records nothing. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…asses class(?:es|ed) matches what classe[sd] matched; labelled becomes labeled. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Local code and security reviews ran at ready, because
Evals at 726e4b6 (
The last commit, ce769c8, changes only the outcome rule for an unwritten driver gap; no case grades that outcome word. |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
claude-review reviewed I found no issues in the incremental change, which covers the 8 files that changed since 3410a23. I read
No hold. The change spends no billed resources. |
|
claude-security-review reviewed No security findings in the incremental change since 3410a23. What changed
Instruction-exception check
Other files
critical-findings: 0 |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: edf85d76c8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Drive reads only control skills, so a legacy conversion's live pass had nothing to drive. The conversion is now written first, uncommitted on the upkeep branch, and both passes read the converted control skill. A pass that stops before the commit leaves those files in the working tree and names them. The legacy migration eval asks for the step order and judges it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…li/ steps The Config bullet called any write with no cli/ a driver gap, wider than the contract's "writes to an environment or external system", so a refresh read a click on the app's own scratch data as a gap and ended blocked. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… specifies Plugin evals load no source-control plugin, and refresh step 6.4 then leaves the commit on the upkeep branch and reports the pull request as still to open. The grader and expected outcome now ask for that; a separate branch or pull request still fails. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
An entry already marked not driven is recorded state. Only a cli/ command the live pass found failing or missing, and left unwritten, ends the pass blocked. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…e pass stops An attended pass now shows the planned conversion and asks before the first write. A pass that stops before its commit moves the files back and returns to its starting branch, so the checkout is clean for the next run. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…lat case The stricter wording failed a reply that stated step 6.4's plugin-absent branch as a condition. Either route on the one upkeep branch passes; a separate branch or pull request still fails. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…y map A refresh now refuses to convert a tracked legacy map with uncommitted changes, copies the legacy directory outside the checkout before the conversion's first write, and lists every path the conversion creates. The undo unstages and deletes those paths and copies the legacy files back from the copy instead of restoring from HEAD, so it works for an untracked map and leaves the tree as it was before the pass. A new eval case covers the dirty-map refusal. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Closes #9583
Summary
Adds the
refreshaction to/app-control:map, so the map's only writer also keeps a control skill current. It portstesting:refresh-feature-mapsteps 1-6 and their outcomes (clean,changed,blocked), and adds a source wave capped at 6, one live pass through/app-control:drive, and triage of each problem as doc drift, driver gap or product regression.Fix
map refreshedits only the control skill's directory and commits oncontrol-skill-upkeep/<slug>. An existingfeature-map-upkeep/<slug>branch is reported, never adopted.features/<f>.mdmap is migrated to a folder in the same upkeep PR.upkeep-skip.shand its test are copied intomap/scripts/. No script-fingerprint verbs.feature-map-maintainer-confines-editsare ported. Five cases are new: one per triage class,legacy-flat-map-migratesandsource-wave-capped-at-six. One app-control changelog fragment (minor).Verification
bash plugins/app-control/skills/map/scripts/upkeep-skip.test.shexits 0.check-map.test.shprints "37 cases, 0 failed".scripts/check-line-citations.pyexits 0./skill-quality:check mapPASS (0 errors)./evals:validateexits 0.grep -n 'control-skill-upkeep/' plugins/app-control/skills/map/SKILL.mdmatches line 185.grep -n -i fingerprinton the same file prints nothing.claude plugin eval, Claude Code 2.1.310, 3 runs per arm, judge opus, no Bash, all VALID. New cases with the plugin vs without: doc drift 1.00/0.17, driver gap 1.00/0.00, product regression 1.00/0.00, legacy-flat-map-migrates 1.00/0.25, source-wave-capped-at-six 1.00/0.50. Portedfeature-map-maintainer-confines-edits, run concurrently: before (testing@db62cbf3f) 1.00, after 1.00.evals.json, whichclaude plugin evaldoes not run) were run concurrently before and after with blind graders: suite mean 97.73 on both sides, no case lost or dropped. The evidence is in a PR comment.Related
map checklanded in feat(app-control): add /app-control:map check #9921.🤖 Generated with Claude Code