[PR] Sync specs with contributed functionality [magpie]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk opened a new pull request, #1452:
URL: https://github.com/apache/magpie/pull/1452

   <!-- SPDX-License-Identifier: Apache-2.0
        https://www.apache.org/licenses/LICENSE-2.0 -->
   
   ## Summary
   
   - Brings `tools/spec-loop/specs/` back in line with everything merged to `main` since the last sync marker.
     The previous marker (`bcd8b7f2`) was 65 commits behind `main`, up to and including #1451.
     `tools/spec-loop/.last-sync` now points at `da660f14`.
   - This is specs only: 33 spec files plus the marker.
     No skill, tool, or doc outside `tools/spec-loop/specs/` changes.
   - The main themes:
     - Skills moved into per-family plugin directories, and the project templates moved into the `magpie-setup` plugin.
     - New contributor-growth skills and tools: calibrate, candidate-screen, identity-map, contributor-metrics, and `contract:chat`.
     - The adversarial-review rollout.
     - The read-only GitLab bridge.
     - The `github-rollup` subcommands, and the `vetted-op-tracker` entry point that the security skills now write through (#1448, #1451).
     - The security-family split, fixes, fetch-once-per-run batching, and pre-flight no-op skips (#1435–#1449).
     - The Vulnogram token flow.
     - Setup and sandbox changes: `gh api` asks only on writes, the read-only allow set ships to adopters, commit attribution is a project choice, and working-directory grants.
     - Per-skill token stamps.
     - Along the way, stale paths, counts, statuses, and known gaps are corrected.
   
   ## Type of change
   
   - [x] Documentation (`docs/`, `README.md`, `CONTRIBUTING.md`)
   - [x] Other: spec-loop specs and sync marker
   
   ## Test plan
   
   - [x] `prek run --all-files` passes
   - [x] Every claim was checked against the code on `main` at `da660f14`, not inferred from commit messages alone.
     Where a commit message and the code disagreed, the spec follows the code.
     Example: after #1448 the security skills did not yet call `vetted-op-tracker`, so the spec recorded a gap until #1451 closed it.
   
   ## RFC-AI-0004 compliance
   
   Not applicable; this documents shipped behaviour and changes no behaviour.
   
   ## Notes for reviewers (optional)
   
   The sync surfaced defects in code and docs outside the spec directory.
   They are recorded as *Known gaps* in the relevant specs where they apply, and are left for follow-up PRs:
   
   - `reviewer-routing` tells users to run `privacy-llm-check --list`; the checker has no `--list` flag.
   - `.apache-magpie-overrides/release-management-config.md` (from #1412) is the unfilled `Apache Foo` template.
     Per-file resolution makes it shadow Magpie's real ATR config in `projects/magpie/`.
   - `tools/github/status-rollup.md` still shows only the `uv run … github-rollup` CLI, not `vetted-op-tracker`.
   - `tools/gitlab/tool.md` still describes the `ceil(limit / 100)` paging that #1441 replaced.
   - The `isolated-setup-doctor` and `isolated-setup-verify` headings say 8 probes and 12 checks; there are 9 and 15.
   - `contributor-identity-map`, `onboarding-concierge`, and `sentiment` do not declare `organization: ASF`.
   - `docs/contributor-growth/README.md` lists `committer-onboarding` as Triage (its mode is Meta) and gives two different skill counts.
   - `tools/cve-tool-vulnogram/oauth-api` docstrings still name a real CVE ID and another project's product names.
   
   Suggested labels: `family:docs`, `family:tools`.
   
   ---
   
   Generative AI tooling was used to author this PR: Claude Code (Claude Opus 5).
   
   🤖 Generated with [Claude Code](https://claude.com/claude-code)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Sync specs with contributed functionality [magpie]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk merged PR #1452:
URL: https://github.com/apache/magpie/pull/1452


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org