You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@magpie.apache.org by gi...@apache.org on 2026/10/16 04:36:47 UTC
(magpie) branch chore/bump-hook-npm-pins updated (a884eb29 -> 5b0e663d)
This is an automated email from the ASF dual-hosted git repository.
github-actions[bot] pushed a change to branch chore/bump-hook-npm-pins
in repository https://gitbox.apache.org/repos/asf/magpie.git
discard a884eb29 chore: bump npm pins in prek hooks
add 405b2f56 test: isolate container-gateway and symlink-lint fixtures from the host (#1608)
add f6d2b7e9 fix(release-management): accept calendar-date release versions (#1605)
add 2343a412 docs(contributing):swap out link-check and swap in lychee (#1612)
add 4ff0cabb fix(setup): treat method:local as adopted without drift in drift-check (#1614)
add 0c8319fa chore: address CodeQL notes in contributor-metrics, jira, reproducible-archive, vetted-ops (#1611)
add 413677c3 docs(contributing): describe the real eval fixture layout (#1613)
add b69c395c Correct plugin sources in marketplace.json (#1622)
add f416ad46 ci: cancel superseded pull request runs (#1616)
add 8493b0fd build(deps): bump oauthlib 3.3.1 -> 4.0.0 in uv.lock (#1610)
add 0de32188 feat(tools/vcs): implement the Subversion backend (#1609)
add 7ed0d3fd fix(pr-management-stats): keep the parity tests from publishing a gist (#1603)
add 0a1f044e chore: bump dev version to 0.9.0.dev202610140816 (#1627)
add 18071993 setup: read-only vetted ops must never prompt (#1640)
add da21b622 spec: sync the specs with the 57 commits since the last sync (#1643)
add 5826a915 ci: retry a workspace check once when it crashes (#1644)
add b4fca1e7 docs: name skills the way a marketplace install invokes them (#1642)
add de44063d chore(deps): bump the python-deps group across 1 directory with 5 updates (#1632)
add 462253db chore(deps): bump apache/infrastructure-actions/allowlist-check (#1631)
add 786d4474 chore(deps): bump https://github.com/crate-ci/typos (#1630)
add 3846714d fix(keys-sync): require a compliant signing-capable key for the verdict (#1635)
add b298450a Docs/issue 1069 mailing lists (#1629)
add ea07a9fe fix(setup): detect the security list on adopt instead of assuming one (#1623)
add 5ef20f03 fix(issue-reassess-stats): pin nature counting in step-2 classify eval spec (#1615)
add d09de641 fix(keys-sync): report GPG execution failures (#1634)
add 41f1cb40 fix(setup): run check-upgrade.sh via bash to avoid execute permission dependency (#1645)
add b1f6e340 fix(keys-sync): use datetime.UTC in the near-expiry test (ruff UP017) (#1646)
add b947598a fix(agent-guard): recognize the +refspec force spelling in the empty-rebase guard (#1607)
add d91bb8e1 feat(security): security-tracker contract with local-files and private Jira backends (#1647)
add 7f4ec6dc feat(setup): offer roborev as a companion and wire its sandbox exclusion (#1648)
add 5b0e663d chore: bump npm pins in prek hooks
This update added new revisions after undoing existing revisions.
That is to say, some revisions that were in the old version of the
branch are not in the new version. This situation occurs
when a user --force pushes a change and generates a repository
containing something like this:
* -- * -- B -- O -- O -- O (a884eb29)
\
N -- N -- N refs/heads/chore/bump-hook-npm-pins (5b0e663d)
You should already have received notification emails for all of the O
revisions, and so the following emails describe only the N revisions
from the common base, B.
Any revisions marked "omit" are not gone; other references still
refer to them. Any revisions marked "discard" are gone forever.
No new revisions were added by this update.
Summary of changes:
.claude-plugin/marketplace.json | 26 +-
.claude-plugin/plugin.json | 2 +-
.codex-plugin/plugin.json | 2 +-
.github/labeler.yml | 8 +
.github/workflows/asf-allowlist-check.yml | 5 +-
.github/workflows/codeql.yml | 4 +
.github/workflows/pre-commit.yml | 4 +
.github/workflows/rat.yml | 4 +
.github/workflows/sandbox-lint.yml | 4 +
.github/workflows/skill-and-tool-validator.yml | 4 +
.github/workflows/skill-token-count.yml | 3 +
.github/workflows/tests.yml | 4 +
.github/workflows/zizmor.yml | 4 +
.pre-commit-config.yaml | 16 +-
AGENTS.md | 4 +-
CONTRIBUTING.md | 14 +-
README.md | 4 +-
ai-tutors/lesson-07-writing-portable-skills.md | 4 +-
apm.yml | 2 +-
assets/quickstart/README.md | 8 +-
assets/quickstart/demo.svg | 2 +-
assets/quickstart/magpie-setup.svg | 8 +-
assets/quickstart/step-adopt.svg | 2 +-
assets/quickstart/walkthrough/3-scaffolded.svg | 2 +-
assets/quickstart/walkthrough/3-scaffolded.txt | 2 +-
assets/quickstart/walkthrough/5-adopt-promotes.svg | 2 +-
assets/quickstart/walkthrough/5-adopt-promotes.txt | 2 +-
assets/quickstart/wizard/contributor-growth.svg | 6 +-
assets/quickstart/wizard/issue.svg | 6 +-
assets/quickstart/wizard/mentoring.svg | 6 +-
assets/quickstart/wizard/pr-management.svg | 6 +-
assets/quickstart/wizard/release-management.svg | 6 +-
assets/quickstart/wizard/repo-health.svg | 6 +-
assets/quickstart/wizard/security.svg | 6 +-
docs/adapters/registry.md | 2 +-
docs/contributor-growth/README.md | 11 +-
.../2026-10-15-security-tracker-backends-plan.md | 47 ++
.../2026-10-15-security-tracker-backends.md | 179 +++++
docs/designs/README.md | 1 +
docs/index.md | 2 +
docs/issue-management/README.md | 9 +-
docs/labels-and-capabilities.md | 9 +-
docs/mailing-lists.md | 54 ++
docs/mentoring/README.md | 9 +-
docs/mode-economics.md | 2 +-
docs/pairing/README.md | 12 +-
docs/pr-management/README.md | 19 +-
docs/quick-start.md | 21 +-
docs/quick-start/first-run.md | 8 +-
docs/quick-start/two-ways.md | 2 +-
docs/release-management/README.md | 9 +-
docs/repo-health/README.md | 9 +-
docs/security/README.md | 14 +-
docs/setup/README.md | 9 +-
docs/setup/agentic-overrides.md | 22 +-
docs/setup/companion-skills.md | 46 ++
docs/setup/individual-use.md | 8 +-
docs/setup/marketplace.md | 16 +-
docs/setup/per-role-mcp-access.md | 4 +-
docs/setup/privacy-llm.md | 2 +-
docs/setup/sandbox-troubleshooting.md | 12 +-
docs/setup/secure-agent-setup.md | 177 ++++-
docs/setup/team-adoption.md | 6 +-
docs/setup/uninstall.md | 20 +-
docs/skill-sources/README.md | 4 +-
docs/skill-sources/authoring-a-source.md | 8 +-
docs/utilities/README.md | 2 +-
docs/vendor-neutrality.md | 29 +-
gemini-extension.json | 2 +-
marketplace.json | 50 +-
organizations/independent/organization.md | 1 +
plugin.json | 2 +-
.../.claude-plugin/plugin.json | 2 +-
.../magpie-agent-guard/.claude-plugin/plugin.json | 2 +-
.../tools/agent-guard/src/agent_guard/__init__.py | 8 +-
.../.claude-plugin/plugin.json | 2 +-
.../skills/activity-sweep/SKILL.md | 16 +-
.../skills/calibrate/SKILL.md | 18 +-
.../skills/candidate-screen/SKILL.md | 16 +-
.../skills/committer-onboarding/SKILL.md | 16 +-
.../skills/contributor-to-committer/SKILL.md | 16 +-
.../skills/identity-map/SKILL.md | 16 +-
.../skills/nomination/SKILL.md | 16 +-
.../skills/onboarding-concierge/SKILL.md | 16 +-
.../skills/sentiment/SKILL.md | 16 +-
plugins/magpie-issue/.claude-plugin/plugin.json | 2 +-
plugins/magpie-issue/skills/backlog-stats/SKILL.md | 16 +-
plugins/magpie-issue/skills/deduplicate/SKILL.md | 16 +-
plugins/magpie-issue/skills/fix-workflow/SKILL.md | 16 +-
.../magpie-issue/skills/reassess-stats/SKILL.md | 16 +-
plugins/magpie-issue/skills/reassess/SKILL.md | 16 +-
plugins/magpie-issue/skills/reproducer/SKILL.md | 16 +-
plugins/magpie-issue/skills/stale-sweep/SKILL.md | 16 +-
plugins/magpie-issue/skills/triage/SKILL.md | 16 +-
.../magpie-mentoring/.claude-plugin/plugin.json | 2 +-
.../skills/good-first-issue-author/SKILL.md | 16 +-
.../skills/good-first-issue-sweep/SKILL.md | 16 +-
.../skills/newcomer-issue-explainer/SKILL.md | 16 +-
plugins/magpie-mentoring/skills/welcome/SKILL.md | 16 +-
plugins/magpie-pairing/.claude-plugin/plugin.json | 2 +-
.../skills/multi-agent-review/SKILL.md | 16 +-
plugins/magpie-pairing/skills/self-review/SKILL.md | 16 +-
.../.claude-plugin/plugin.json | 2 +-
.../skills/code-review/SKILL.md | 16 +-
.../skills/code-review/adversarial.md | 12 +-
.../magpie-pr-management/skills/mentor/SKILL.md | 16 +-
.../skills/pr-stale-sweep/SKILL.md | 16 +-
.../magpie-pr-management/skills/pr-triage/SKILL.md | 16 +-
.../skills/pre-first-pr-check/SKILL.md | 16 +-
.../skills/quick-merge/SKILL.md | 16 +-
.../skills/reviewer-routing/SKILL.md | 16 +-
.../skills/stack-review/SKILL.md | 16 +-
plugins/magpie-pr-management/skills/stats/SKILL.md | 16 +-
.../.claude-plugin/plugin.json | 2 +-
.../skills/announce-draft/SKILL.md | 18 +-
.../skills/archive-sweep/SKILL.md | 16 +-
.../skills/audit-report/SKILL.md | 18 +-
.../skills/keys-sync/SKILL.md | 16 +-
.../skills/keys-sync/scripts/check_key.py | 238 ++++--
.../skills/keys-sync/tests/test_check_key.py | 456 +++++++++++-
.../skills/prepare/SKILL.md | 18 +-
.../skills/promote/SKILL.md | 18 +-
.../skills/rc-cut/SKILL.md | 18 +-
.../skills/verify-rc/SKILL.md | 18 +-
.../skills/vote-draft/SKILL.md | 18 +-
.../skills/vote-tally/SKILL.md | 18 +-
.../magpie-repo-health/.claude-plugin/plugin.json | 2 +-
.../skills/audit-finding-fix/SKILL.md | 16 +-
.../skills/ci-runner-audit/SKILL.md | 16 +-
.../skills/dependency-audit/SKILL.md | 16 +-
.../skills/dependency-license-audit/SKILL.md | 16 +-
.../skills/flaky-test-triage/SKILL.md | 16 +-
.../skills/license-compliance-audit/SKILL.md | 16 +-
.../skills/workflow-security-audit/SKILL.md | 16 +-
plugins/magpie-security/.claude-plugin/plugin.json | 2 +-
.../magpie-security/skills/cve-allocate/SKILL.md | 39 +-
.../skills/issue-deduplicate/SKILL.md | 39 +-
plugins/magpie-security/skills/issue-fix/SKILL.md | 39 +-
.../skills/issue-import-from-md/SKILL.md | 39 +-
.../skills/issue-import-from-pr/SKILL.md | 39 +-
.../skills/issue-import-from-scan/SKILL.md | 39 +-
.../skills/issue-import-via-forwarder/SKILL.md | 39 +-
.../magpie-security/skills/issue-import/SKILL.md | 39 +-
.../skills/issue-invalidate/SKILL.md | 39 +-
plugins/magpie-security/skills/issue-sync/SKILL.md | 39 +-
.../magpie-security/skills/issue-triage/SKILL.md | 39 +-
.../magpie-security/skills/model-prepare/SKILL.md | 16 +-
.../magpie-security/skills/model-update/SKILL.md | 16 +-
.../magpie-security/skills/model-verify/SKILL.md | 16 +-
.../skills/tracker-stats-dashboard/SKILL.md | 39 +-
plugins/magpie-setup/.claude-plugin/plugin.json | 2 +-
plugins/magpie-setup/hooks/drift-check.test.ts | 15 +
plugins/magpie-setup/hooks/drift-check.ts | 11 +-
plugins/magpie-setup/hooks/hooks.json | 2 +-
.../skills/isolated-setup-doctor/SKILL.md | 4 +-
.../skills/isolated-setup-install/SKILL.md | 69 +-
.../isolated-setup-install/optional-steps.md | 213 +++++-
.../skills/isolated-setup-update/SKILL.md | 24 +-
.../skills/isolated-setup-verify/SKILL.md | 32 +-
.../isolated-setup-verify/conditional-checks.md | 93 ++-
plugins/magpie-setup/skills/privacy-llm/SKILL.md | 4 +-
plugins/magpie-setup/skills/setup/SKILL.md | 4 +-
plugins/magpie-setup/skills/setup/adopt.md | 24 +-
plugins/magpie-setup/skills/setup/config.md | 53 +-
plugins/magpie-setup/skills/setup/install.md | 47 +-
plugins/magpie-setup/skills/setup/locks.md | 4 +-
plugins/magpie-setup/skills/setup/reconcile.md | 14 +-
.../setup/setup_preflight/isolated_fingerprint.py | 2 +-
.../setup/setup_preflight/sections/step-10.md | 2 +-
.../setup/setup_preflight/sections/step-3.md | 2 +-
.../setup/setup_preflight/sections/step-4.md | 6 +-
.../setup/setup_preflight/sections/step-7.md | 2 +-
plugins/magpie-setup/skills/setup/upgrade.md | 33 +-
plugins/magpie-setup/skills/setup/verify.md | 16 +-
plugins/magpie-setup/skills/status/render.md | 8 +-
plugins/magpie-setup/templates/README.md | 2 +-
plugins/magpie-setup/templates/project.md | 30 +-
plugins/magpie-setup/templates/release-build.md | 3 +-
plugins/magpie-setup/templates/skill-sources.md | 6 +-
.../magpie-utilities/.claude-plugin/plugin.json | 2 +-
.../magpie-utilities/skills/list-skills/SKILL.md | 16 +-
.../skills/optimize-skill/SKILL.md | 16 +-
.../skills/report-framework-issue/SKILL.md | 16 +-
.../skills/skill-reconciler/SKILL.md | 16 +-
.../magpie-utilities/skills/write-skill/SKILL.md | 16 +-
.../magpie-vetted-ops/.claude-plugin/plugin.json | 2 +-
pyproject.toml | 3 +-
tools/agent-guard/README.md | 4 +-
tools/agent-guard/src/agent_guard/__init__.py | 8 +-
tools/agent-guard/tests/test_guards.py | 34 +
tools/agent-isolation/README.md | 2 +-
tools/agent-isolation/sandbox-add-project-root.sh | 6 +-
tools/asf-svn/source-control.md | 18 +-
tools/container-gateway/tests/test_layers.py | 16 +
tools/contributor-metrics/tests/test_fetch.py | 4 +-
tools/dev/README.md | 5 +-
tools/dev/blocks/both-stores-collision.md | 2 +-
tools/dev/blocks/tracker-backend.md | 17 +
tools/dev/check-skill-config.py | 9 +-
tools/dev/companion-skills.json | 34 +
tools/dev/preflight-block.md | 14 +-
tools/dev/render-preflight-fixtures.py | 185 +++++
tools/dev/render-wizard.py | 20 +-
tools/dev/run-workspace-check.sh | 45 +-
tools/dev/tests/test_render_preflight_fixtures.py | 83 +++
tools/forgejo/source-control.md | 3 +-
tools/github/source-control.md | 3 +-
tools/jira/README.md | 67 +-
tools/jira/pyproject.toml | 9 +-
tools/jira/src/jira_bridge/markup.py | 175 +++++
tools/jira/src/jira_bridge/rest.py | 99 ++-
tools/jira/src/jira_bridge/security_tracker.py | 807 ++++++++++++++++++++
tools/jira/src/jira_bridge/tracker_client.py | 273 +++++++
tools/jira/tests/conftest.py | 122 +++
tools/jira/tests/test_markup.py | 98 +++
tools/jira/tests/test_rest.py | 93 ++-
tools/jira/tests/test_security_tracker.py | 815 +++++++++++++++++++++
tools/local-tracker/README.md | 168 +++++
tools/{bitbucket => local-tracker}/pyproject.toml | 9 +-
.../src/magpie_local_tracker/__init__.py | 7 +
.../local-tracker/src/magpie_local_tracker/cli.py | 405 ++++++++++
.../src/magpie_local_tracker/descriptor.py | 135 ++++
.../src/magpie_local_tracker/detect.py | 281 +++++++
.../src/magpie_local_tracker/metadata.py | 189 +++++
.../src/magpie_local_tracker/sections.py | 188 +++++
.../src/magpie_local_tracker/store.py | 507 +++++++++++++
.../local-tracker/src/magpie_local_tracker/vcs.py | 141 ++++
tools/local-tracker/tests/test_local_tracker.py | 336 +++++++++
tools/permission-audit/README.md | 6 +-
.../pr-management/tests/stats/test_json_parity.py | 15 +
tools/privacy-llm/checker/README.md | 2 +-
tools/release-config/README.md | 2 +-
.../release-config/src/release_config/preflight.py | 12 +-
.../release-config/src/release_config/versions.py | 28 +-
tools/release-config/tests/test_load.py | 13 +-
tools/release-config/tests/test_preflight.py | 14 +
.../tests/test_reproducible_archive.py | 5 +-
tools/sandbox-lint/README.md | 12 +
tools/sandbox-lint/src/sandbox_lint/__init__.py | 91 +++
tools/sandbox-lint/tests/test_validator.py | 101 +++
tools/security-tracker/README.md | 60 ++
tools/security-tracker/contract.md | 211 ++++++
tools/setup-preflight/README.md | 6 +-
.../src/skill_and_tool_validator/__init__.py | 1 +
tools/skill-evals/README.md | 6 +-
.../step-2-classify/fixtures/output-spec.md | 2 +
.../evals/non-asf-profile-smoke/README.md | 10 +-
.../case-2-non-asf-no-area-match/expected.json | 8 +-
.../evals/setup-isolated-setup-install/README.md | 3 +-
.../case-1-roborev-installed}/case-meta.json | 0
.../case-1-roborev-installed/expected.json | 1 +
.../fixtures/case-1-roborev-installed/report.md} | 7 +-
.../fixtures/case-2-roborev-absent/case-meta.json | 1 +
.../fixtures/case-2-roborev-absent/expected.json | 1 +
.../fixtures/case-2-roborev-absent}/report.md | 3 +-
.../case-3-operator-wants-allow/case-meta.json | 1 +
.../case-3-operator-wants-allow/expected.json | 1 +
.../fixtures/case-3-operator-wants-allow/report.md | 5 +
.../case-4-macos-wants-hook/case-meta.json | 1 +
.../fixtures/case-4-macos-wants-hook/expected.json | 1 +
.../fixtures/case-4-macos-wants-hook/report.md | 6 +
.../case-5-linux-wants-hook/case-meta.json | 1 +
.../fixtures/case-5-linux-wants-hook/expected.json | 1 +
.../fixtures/case-5-linux-wants-hook/report.md | 6 +
.../step-roborev-exclusion/fixtures/output-spec.md | 28 +
.../fixtures/step-config.json | 2 +-
.../fixtures/user-prompt-template.md | 2 +-
.../evals/setup-isolated-setup-verify/README.md | 6 +-
.../case-11-roborev-review-allowed/expected.json | 15 +
.../report.md | 35 +-
.../case-12-roborev-shared-hook/expected.json | 15 +
.../fixtures/case-12-roborev-shared-hook/report.md | 67 ++
.../case-13-roborev-dir-writable/expected.json | 15 +
.../case-13-roborev-dir-writable/report.md | 63 ++
.../case-14-roborev-mcp-server/expected.json | 15 +
.../report.md | 31 +-
.../case-15-roborev-write-only/expected.json | 15 +
.../report.md | 29 +-
.../step-1-classify/fixtures/output-spec.md | 4 +-
.../fixtures/case-6-roborev-findings/expected.json | 9 +
.../report.md | 5 +-
tools/skill-evals/evals/setup/README.md | 5 +-
.../case-1-dedicated-list-listed}/case-meta.json | 0
.../case-1-dedicated-list-listed/expected.json | 1 +
.../case-1-dedicated-list-listed/report.md | 11 +
.../case-2-no-dedicated-list}/case-meta.json | 0
.../case-2-no-dedicated-list/expected.json | 1 +
.../fixtures/case-2-no-dedicated-list/report.md | 10 +
.../fixtures/case-3-non-asf}/case-meta.json | 0
.../fixtures/case-3-non-asf/expected.json | 1 +
.../fixtures/case-3-non-asf/report.md | 5 +
.../case-4-conflicting-evidence}/case-meta.json | 0
.../case-4-conflicting-evidence/expected.json | 1 +
.../fixtures/case-4-conflicting-evidence/report.md | 11 +
.../adopt-security-list/fixtures/output-spec.md | 26 +
.../adopt-security-list/fixtures/step-config.json | 4 +
.../fixtures/user-prompt-template.md | 9 +
.../setup/preflight-floor/fixtures/assertions.json | 6 +
.../fixtures/case-1-at-floor/report.md | 21 +
.../fixtures/case-1-at-floor/state.json | 25 +
.../fixtures/case-2-below-floor/report.md | 38 +
.../fixtures/case-2-below-floor/state.json | 20 +
.../fixtures/case-3-plugin-missing/report.md | 34 +
.../fixtures/case-3-plugin-missing/state.json | 16 +
.../fixtures/case-4-foreign-marketplace/report.md | 30 +
.../fixtures/case-4-foreign-marketplace/state.json | 16 +
.../fixtures/case-5-no-claude-cli/expected.json | 2 +-
.../fixtures/case-5-no-claude-cli/report.md | 21 +
.../fixtures/case-5-no-claude-cli/state.json | 11 +
.../fixtures/case-6-unadopted/expected.json | 2 +-
.../fixtures/case-6-unadopted/report.md | 24 +
.../fixtures/case-6-unadopted/state.json | 17 +
.../report.md | 48 ++
.../state.json | 25 +
.../case-8-unknown-plugin-list/expected.json | 2 +-
.../fixtures/case-8-unknown-plugin-list/report.md | 21 +
.../fixtures/case-8-unknown-plugin-list/state.json | 11 +
.../setup/preflight-floor/fixtures/output-spec.md | 8 +-
.../case-meta.json | 0
.../expected.json | 1 +
.../case-1-claude-code-roborev-missing/report.md | 17 +
.../case-meta.json | 1 +
.../case-2-roborev-already-installed/expected.json | 1 +
.../case-2-roborev-already-installed/report.md | 17 +
.../case-3-harness-not-covered/case-meta.json | 1 +
.../case-3-harness-not-covered/expected.json | 1 +
.../fixtures/case-3-harness-not-covered/report.md | 16 +
.../case-4-codex-family-not-paired/case-meta.json | 1 +
.../case-4-codex-family-not-paired/expected.json | 1 +
.../case-4-codex-family-not-paired/report.md | 16 +
.../case-5-codex-pr-management/case-meta.json | 1 +
.../case-5-codex-pr-management/expected.json | 1 +
.../fixtures/case-5-codex-pr-management/report.md | 16 +
.../fixtures/output-spec.md | 26 +
.../fixtures/step-config.json | 4 +
.../fixtures/user-prompt-template.md | 10 +
.../case-1-roborev-missing}/case-meta.json | 0
.../fixtures/case-1-roborev-missing/expected.json | 1 +
.../fixtures/case-1-roborev-missing/report.md | 20 +
.../fixtures/case-2-roborev-present/case-meta.json | 1 +
.../fixtures/case-2-roborev-present/expected.json | 1 +
.../fixtures/case-2-roborev-present/report.md | 20 +
.../case-3-roborev-declined-before/case-meta.json | 1 +
.../case-3-roborev-declined-before/expected.json | 1 +
.../case-3-roborev-declined-before/report.md | 21 +
.../fixtures/output-spec.md | 26 +
.../fixtures/step-config.json | 0
.../fixtures/user-prompt-template.md | 10 +
tools/spec-loop/.last-sync | 2 +-
tools/spec-loop/specs/adapters.md | 39 +-
tools/spec-loop/specs/adoption-and-setup.md | 110 ++-
tools/spec-loop/specs/adversarial-review.md | 27 +-
tools/spec-loop/specs/agent-isolation-sandbox.md | 43 +-
tools/spec-loop/specs/container-gateway.md | 6 +-
tools/spec-loop/specs/contributor-growth.md | 47 +-
tools/spec-loop/specs/copilot-runtime.md | 5 +-
tools/spec-loop/specs/cve-tooling.md | 20 +-
tools/spec-loop/specs/marketplace-distribution.md | 39 +-
tools/spec-loop/specs/meta-and-quality-tooling.md | 32 +-
tools/spec-loop/specs/pr-management-family.md | 82 ++-
tools/spec-loop/specs/project-agnosticism.md | 4 +-
.../specs/release-management-lifecycle.md | 8 +
tools/spec-loop/specs/reviewer-routing.md | 93 ++-
tools/spec-loop/specs/sandbox-diagnostics.md | 43 +-
tools/spec-loop/specs/security-issue-lifecycle.md | 14 +
tools/spec-loop/specs/vetted-command-surface.md | 44 ++
tools/symlink-lint/tests/test_symlink_lint.py | 15 +-
tools/vcs/README.md | 81 +-
tools/vcs/pyproject.toml | 2 +-
tools/vcs/src/magpie_vcs/__init__.py | 348 +++++++--
tools/vcs/tests/test_vcs.py | 293 +++++++-
.../src/vendor_neutrality_score/__init__.py | 4 +
tools/vetted-ops/README.md | 76 +-
tools/vetted-ops/src/vetted_ops/cli.py | 53 +-
tools/vetted-ops/src/vetted_ops/config.py | 71 ++
tools/vetted-ops/src/vetted_ops/ops.py | 158 +++-
.../vetted-ops/src/vetted_ops/tracker_backends.py | 188 +++++
tools/vetted-ops/tests/test_procedures.py | 3 +-
tools/vetted-ops/tests/test_tracker_backends.py | 417 +++++++++++
tools/vetted-ops/tests/test_vetted_ops.py | 10 +
uv.lock | 533 +++++++-------
381 files changed, 12399 insertions(+), 1556 deletions(-)
create mode 100644 docs/designs/2026-10-15-security-tracker-backends-plan.md
create mode 100644 docs/designs/2026-10-15-security-tracker-backends.md
create mode 100644 docs/mailing-lists.md
mode change 100755 => 100644 plugins/magpie-release-management/skills/keys-sync/scripts/check_key.py
create mode 100644 tools/dev/blocks/tracker-backend.md
create mode 100644 tools/dev/render-preflight-fixtures.py
create mode 100644 tools/dev/tests/test_render_preflight_fixtures.py
create mode 100644 tools/jira/src/jira_bridge/markup.py
create mode 100644 tools/jira/src/jira_bridge/security_tracker.py
create mode 100644 tools/jira/src/jira_bridge/tracker_client.py
create mode 100644 tools/jira/tests/conftest.py
create mode 100644 tools/jira/tests/test_markup.py
create mode 100644 tools/jira/tests/test_security_tracker.py
create mode 100644 tools/local-tracker/README.md
copy tools/{bitbucket => local-tracker}/pyproject.toml (85%)
create mode 100644 tools/local-tracker/src/magpie_local_tracker/__init__.py
create mode 100644 tools/local-tracker/src/magpie_local_tracker/cli.py
create mode 100644 tools/local-tracker/src/magpie_local_tracker/descriptor.py
create mode 100644 tools/local-tracker/src/magpie_local_tracker/detect.py
create mode 100644 tools/local-tracker/src/magpie_local_tracker/metadata.py
create mode 100644 tools/local-tracker/src/magpie_local_tracker/sections.py
create mode 100644 tools/local-tracker/src/magpie_local_tracker/store.py
create mode 100644 tools/local-tracker/src/magpie_local_tracker/vcs.py
create mode 100644 tools/local-tracker/tests/test_local_tracker.py
create mode 100644 tools/security-tracker/README.md
create mode 100644 tools/security-tracker/contract.md
copy tools/skill-evals/evals/{ci-runner-audit/step-reporting/fixtures/case-2-no-security-overclaim => setup-isolated-setup-install/step-roborev-exclusion/fixtures/case-1-roborev-installed}/case-meta.json (100%)
create mode 100644 tools/skill-evals/evals/setup-isolated-setup-install/step-roborev-exclusion/fixtures/case-1-roborev-installed/expected.json
copy tools/skill-evals/evals/{issue-triage/step-4-compose-comment/fixtures/user-prompt-template.md => setup-isolated-setup-install/step-roborev-exclusion/fixtures/case-1-roborev-installed/report.md} (66%)
create mode 100644 tools/skill-evals/evals/setup-isolated-setup-install/step-roborev-exclusion/fixtures/case-2-roborev-absent/case-meta.json
create mode 100644 tools/skill-evals/evals/setup-isolated-setup-install/step-roborev-exclusion/fixtures/case-2-roborev-absent/expected.json
copy tools/skill-evals/evals/{ci-runner-audit/step-scope-selection/fixtures/case-3-full-apache-org => setup-isolated-setup-install/step-roborev-exclusion/fixtures/case-2-roborev-absent}/report.md (51%)
create mode 100644 tools/skill-evals/evals/setup-isolated-setup-install/step-roborev-exclusion/fixtures/case-3-operator-wants-allow/case-meta.json
create mode 100644 tools/skill-evals/evals/setup-isolated-setup-install/step-roborev-exclusion/fixtures/case-3-operator-wants-allow/expected.json
create mode 100644 tools/skill-evals/evals/setup-isolated-setup-install/step-roborev-exclusion/fixtures/case-3-operator-wants-allow/report.md
create mode 100644 tools/skill-evals/evals/setup-isolated-setup-install/step-roborev-exclusion/fixtures/case-4-macos-wants-hook/case-meta.json
create mode 100644 tools/skill-evals/evals/setup-isolated-setup-install/step-roborev-exclusion/fixtures/case-4-macos-wants-hook/expected.json
create mode 100644 tools/skill-evals/evals/setup-isolated-setup-install/step-roborev-exclusion/fixtures/case-4-macos-wants-hook/report.md
create mode 100644 tools/skill-evals/evals/setup-isolated-setup-install/step-roborev-exclusion/fixtures/case-5-linux-wants-hook/case-meta.json
create mode 100644 tools/skill-evals/evals/setup-isolated-setup-install/step-roborev-exclusion/fixtures/case-5-linux-wants-hook/expected.json
create mode 100644 tools/skill-evals/evals/setup-isolated-setup-install/step-roborev-exclusion/fixtures/case-5-linux-wants-hook/report.md
create mode 100644 tools/skill-evals/evals/setup-isolated-setup-install/step-roborev-exclusion/fixtures/output-spec.md
copy tools/skill-evals/evals/setup-isolated-setup-install/{step-hardware-key => step-roborev-exclusion}/fixtures/step-config.json (54%)
copy tools/skill-evals/evals/setup-isolated-setup-install/{step-hardware-key => step-roborev-exclusion}/fixtures/user-prompt-template.md (75%)
create mode 100644 tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-11-roborev-review-allowed/expected.json
copy tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/{case-10-working-dirs-missing => case-11-roborev-review-allowed}/report.md (56%)
create mode 100644 tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-12-roborev-shared-hook/expected.json
create mode 100644 tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-12-roborev-shared-hook/report.md
create mode 100644 tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-13-roborev-dir-writable/expected.json
create mode 100644 tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-13-roborev-dir-writable/report.md
create mode 100644 tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-14-roborev-mcp-server/expected.json
copy tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/{case-10-working-dirs-missing => case-14-roborev-mcp-server}/report.md (54%)
create mode 100644 tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/case-15-roborev-write-only/expected.json
copy tools/skill-evals/evals/setup-isolated-setup-verify/step-1-classify/fixtures/{case-10-working-dirs-missing => case-15-roborev-write-only}/report.md (54%)
create mode 100644 tools/skill-evals/evals/setup-isolated-setup-verify/step-2-recommend/fixtures/case-6-roborev-findings/expected.json
copy tools/skill-evals/evals/setup-isolated-setup-verify/step-2-recommend/fixtures/{case-1-all-pass => case-6-roborev-findings}/report.md (54%)
copy tools/skill-evals/evals/{ci-runner-audit/step-reporting/fixtures/case-2-no-security-overclaim => setup/adopt-security-list/fixtures/case-1-dedicated-list-listed}/case-meta.json (100%)
create mode 100644 tools/skill-evals/evals/setup/adopt-security-list/fixtures/case-1-dedicated-list-listed/expected.json
create mode 100644 tools/skill-evals/evals/setup/adopt-security-list/fixtures/case-1-dedicated-list-listed/report.md
copy tools/skill-evals/evals/{ci-runner-audit/step-reporting/fixtures/case-2-no-security-overclaim => setup/adopt-security-list/fixtures/case-2-no-dedicated-list}/case-meta.json (100%)
create mode 100644 tools/skill-evals/evals/setup/adopt-security-list/fixtures/case-2-no-dedicated-list/expected.json
create mode 100644 tools/skill-evals/evals/setup/adopt-security-list/fixtures/case-2-no-dedicated-list/report.md
copy tools/skill-evals/evals/{ci-runner-audit/step-reporting/fixtures/case-2-no-security-overclaim => setup/adopt-security-list/fixtures/case-3-non-asf}/case-meta.json (100%)
create mode 100644 tools/skill-evals/evals/setup/adopt-security-list/fixtures/case-3-non-asf/expected.json
create mode 100644 tools/skill-evals/evals/setup/adopt-security-list/fixtures/case-3-non-asf/report.md
copy tools/skill-evals/evals/{ci-runner-audit/step-reporting/fixtures/case-2-no-security-overclaim => setup/adopt-security-list/fixtures/case-4-conflicting-evidence}/case-meta.json (100%)
create mode 100644 tools/skill-evals/evals/setup/adopt-security-list/fixtures/case-4-conflicting-evidence/expected.json
create mode 100644 tools/skill-evals/evals/setup/adopt-security-list/fixtures/case-4-conflicting-evidence/report.md
create mode 100644 tools/skill-evals/evals/setup/adopt-security-list/fixtures/output-spec.md
create mode 100644 tools/skill-evals/evals/setup/adopt-security-list/fixtures/step-config.json
create mode 100644 tools/skill-evals/evals/setup/adopt-security-list/fixtures/user-prompt-template.md
create mode 100644 tools/skill-evals/evals/setup/preflight-floor/fixtures/case-1-at-floor/state.json
create mode 100644 tools/skill-evals/evals/setup/preflight-floor/fixtures/case-2-below-floor/state.json
create mode 100644 tools/skill-evals/evals/setup/preflight-floor/fixtures/case-3-plugin-missing/state.json
create mode 100644 tools/skill-evals/evals/setup/preflight-floor/fixtures/case-4-foreign-marketplace/state.json
create mode 100644 tools/skill-evals/evals/setup/preflight-floor/fixtures/case-5-no-claude-cli/state.json
create mode 100644 tools/skill-evals/evals/setup/preflight-floor/fixtures/case-6-unadopted/state.json
create mode 100644 tools/skill-evals/evals/setup/preflight-floor/fixtures/case-7-legitimate-url-alarming-context/state.json
create mode 100644 tools/skill-evals/evals/setup/preflight-floor/fixtures/case-8-unknown-plugin-list/state.json
copy tools/skill-evals/evals/{ci-runner-audit/step-reporting/fixtures/case-2-no-security-overclaim => setup/step-m5-companion-offer/fixtures/case-1-claude-code-roborev-missing}/case-meta.json (100%)
create mode 100644 tools/skill-evals/evals/setup/step-m5-companion-offer/fixtures/case-1-claude-code-roborev-missing/expected.json
create mode 100644 tools/skill-evals/evals/setup/step-m5-companion-offer/fixtures/case-1-claude-code-roborev-missing/report.md
create mode 100644 tools/skill-evals/evals/setup/step-m5-companion-offer/fixtures/case-2-roborev-already-installed/case-meta.json
create mode 100644 tools/skill-evals/evals/setup/step-m5-companion-offer/fixtures/case-2-roborev-already-installed/expected.json
create mode 100644 tools/skill-evals/evals/setup/step-m5-companion-offer/fixtures/case-2-roborev-already-installed/report.md
create mode 100644 tools/skill-evals/evals/setup/step-m5-companion-offer/fixtures/case-3-harness-not-covered/case-meta.json
create mode 100644 tools/skill-evals/evals/setup/step-m5-companion-offer/fixtures/case-3-harness-not-covered/expected.json
create mode 100644 tools/skill-evals/evals/setup/step-m5-companion-offer/fixtures/case-3-harness-not-covered/report.md
create mode 100644 tools/skill-evals/evals/setup/step-m5-companion-offer/fixtures/case-4-codex-family-not-paired/case-meta.json
create mode 100644 tools/skill-evals/evals/setup/step-m5-companion-offer/fixtures/case-4-codex-family-not-paired/expected.json
create mode 100644 tools/skill-evals/evals/setup/step-m5-companion-offer/fixtures/case-4-codex-family-not-paired/report.md
create mode 100644 tools/skill-evals/evals/setup/step-m5-companion-offer/fixtures/case-5-codex-pr-management/case-meta.json
create mode 100644 tools/skill-evals/evals/setup/step-m5-companion-offer/fixtures/case-5-codex-pr-management/expected.json
create mode 100644 tools/skill-evals/evals/setup/step-m5-companion-offer/fixtures/case-5-codex-pr-management/report.md
create mode 100644 tools/skill-evals/evals/setup/step-m5-companion-offer/fixtures/output-spec.md
create mode 100644 tools/skill-evals/evals/setup/step-m5-companion-offer/fixtures/step-config.json
create mode 100644 tools/skill-evals/evals/setup/step-m5-companion-offer/fixtures/user-prompt-template.md
copy tools/skill-evals/evals/{ci-runner-audit/step-reporting/fixtures/case-2-no-security-overclaim => setup/step-upgrade-companion-offer/fixtures/case-1-roborev-missing}/case-meta.json (100%)
create mode 100644 tools/skill-evals/evals/setup/step-upgrade-companion-offer/fixtures/case-1-roborev-missing/expected.json
create mode 100644 tools/skill-evals/evals/setup/step-upgrade-companion-offer/fixtures/case-1-roborev-missing/report.md
create mode 100644 tools/skill-evals/evals/setup/step-upgrade-companion-offer/fixtures/case-2-roborev-present/case-meta.json
create mode 100644 tools/skill-evals/evals/setup/step-upgrade-companion-offer/fixtures/case-2-roborev-present/expected.json
create mode 100644 tools/skill-evals/evals/setup/step-upgrade-companion-offer/fixtures/case-2-roborev-present/report.md
create mode 100644 tools/skill-evals/evals/setup/step-upgrade-companion-offer/fixtures/case-3-roborev-declined-before/case-meta.json
create mode 100644 tools/skill-evals/evals/setup/step-upgrade-companion-offer/fixtures/case-3-roborev-declined-before/expected.json
create mode 100644 tools/skill-evals/evals/setup/step-upgrade-companion-offer/fixtures/case-3-roborev-declined-before/report.md
create mode 100644 tools/skill-evals/evals/setup/step-upgrade-companion-offer/fixtures/output-spec.md
copy tools/skill-evals/evals/setup/{upgrade-adoption-split => step-upgrade-companion-offer}/fixtures/step-config.json (100%)
create mode 100644 tools/skill-evals/evals/setup/step-upgrade-companion-offer/fixtures/user-prompt-template.md
create mode 100644 tools/vetted-ops/src/vetted_ops/tracker_backends.py
create mode 100644 tools/vetted-ops/tests/test_tracker_backends.py