Adopt 14 doctrine rules from 2026-07-24 starred-repo mining pass (Tier-1)

[F-e-u-e-r]

Summary

Tier-1 adoptions from a 2026-07-24 mining pass over the owner's starred agent-skill repositories (Verification & QA / Security / Planning / Design categories, ~27 repos across 10 mining agents). ~14 doctrine rules across five opus-pack skills — ideas only, no third-party text; each new behavioral rule ships unprobed with a Provenance entry and a README acknowledgement (EN + zh-Hant), with round-5 probe debt tracked in the pack's private evals ledger.

Companion coverage fix in .github/checks.py (two-sided proven).

What's adopted (dup-check trimmed the shortlist ~18 → ~14; some "novel" candidates proved already covered once read against full skill text)

• operational-rigor — hidden-directive unicode sweep extended to the Unicode Tag Block (U+E0000–E007F, an ASCII-smuggling vector) in both the §2 doctrine and .github/checks.py; a self-severing-channel one-way-door rule (conditioned on no independent recovery path + authorization); a labelled-degraded-fallback rule.
• delegation-and-review — no-silent-backfill of a failed delegate; fix-the-contract-before-compute (scoped to contract-slack, not capability, failures); prefer a genuinely read-only critic (a sandbox or an agent with no mutation-capable tool, since Bash mutates too), routing a write-capable critic to an independent copy; worker Rules bullet extended to no-commit/push/merge.
• ground-truth-gates — for an automated gate, deterministic block-on-fail with independent recompute (review/adjudication gates, including this pack's own cross-model-review and design-review-gate, explicitly carved out); external-ground-truth anchoring where mutual agreement stands in for correctness/freshness (pure consistency checks left legitimate); an optional-feature global-guard opt-in (authorized global policy controls carved out — they are meant to be universal).
• skill-authoring — memory-by-future-reach three-tier taxonomy (task / session / durable spec); catalog-scale trigger-collision measurement + mitigation ladder.
• security-architect — a prompt-embedded guardrail is not an enforced control, and the denial-of-wallet unbounded-tool-loop class (cumulative budget + iteration cap + per-action authorization); SSRF clause sharpened to name the cloud metadata endpoint.

Trojan finding

One surveyed source was judged a live trojan — it instructs the reading agent to self-propagate routing rules into ~/.claude/CLAUDE.md, auto-register an offensive MCP server, flip the authorization default to "assume authorized", and apply an agent-obedience-engineering playbook (attention-decay layout, an excuse-rebuttal table, fabricated authority citations). Nothing was adopted from it; a contamination check confirmed the payload never executed (~/.claude/CLAUDE.md and ~/.claude/mcp.json do not exist). The finding reinforced operational-rigor §2's "self-described security tools earn stricter scrutiny" — the 4th community "security" skill judged trojan across two audit passes. It is not named here, following the pack's existing public pattern.

License ceilings

Ideas-only throughout. Hard ideas-only (no text under any circumstance): Trellis (AGPL-3.0), matlab-agentic-toolkit (MathWorks field-of-use), a Superpowers GPT-5.6 port (no license), claude-task-master (MIT + Commons Clause), vercel-labs/agent-skills (MIT declared in README, no LICENSE file).

Gate

Four-round cross-family review — grok-4.5 high + gpt-5.6-luna ultra + gpt-5.6-sol max every round, each reviewer in an isolated context on a self-contained packet.

• R1 — 16 must-fixes, converging on one mechanism: rules stated too absolutely without carve-outs. Notable catches: a global-guard opt-in that as written would silently disable an authorized global secret scanner; verbatim source phrasing that broke the ideas-only invariant; a mislabeled source license (an agent had missed a README-declared license).
• R2 — grok + luna PROCEED; sol max caught cross-skill contradictions the other lenses missed (a deterministic-gate rule that contradicted this pack's own review gates) plus residual verbatim source text.
• R3 — all three families converged on residual verbatim source phrasing; cleared by independent rephrasing plus a systematic n-gram sweep over the source files (which caught one further reviewer-unnamed residual).
• R4 — all three PROCEED.

.github/checks.py green throughout; every finding reproduced before folding; disposition ledger kept per round.

🤖 Generated with Claude Code

https://claude.ai/code/session_01GhLu6NCGzM9HxnqNb87MAx