Chore/remediation w1 w2

.agents/skills/prompt-master/SKILL.md

@@ -0,0 +1,6 @@
+---
+name: prompt-master
+description: Use when the user explicitly invokes $prompt-master or asks to write, fix, improve, adapt, break down, analyze, simplify, or split an AI prompt. Do not use for ordinary coding, document writing, general conversation, or analysis of non-prompt content.
+---
+
+Load and follow the complete canonical instructions in [the tracked Prompt Master skill](../../../plugins/prompt-master/skills/prompt-master/SKILL.md). Resolve every relative path in those instructions from the canonical skill directory.

.claude-plugin/marketplace.json

@@ -0,0 +1,17 @@
+{
+  "$schema": "https://anthropic.com/claude-code/marketplace.schema.json",
+  "name": "prompt-master",
+  "description": "Prompt Master — навык-плагин для Claude Code: генерирует точные, готовые к вставке промпты для text, coding, research, builder и media AI без лишних токенов. Routing использует канонический реестр provider/model facts, семь workflow-профилей и versioned pattern registry; anti-fabrication протокол включён.",
+  "owner": {
+    "name": "Andrey Zagreev",
+    "url": "https://github.com/azagreev"
+  },
+  "plugins": [
+    {
+      "name": "prompt-master",
+      "source": "./plugins/prompt-master",
+      "description": "Генератор и декомпилятор оптимизированных промптов. Активируется по запросам «напиши/исправь/улучши/адаптируй/разбери/упрости/раздели промпт»; для разбора, упрощения и split существующего промпта target необязателен. Routing под text, reasoning, coding, research, builder и media AI через канонический реестр фактов и workflow-профили.",
+      "category": "productivity"
+    }
+  ]
+}

.codex/agents/adversarial_reviewer.toml

@@ -0,0 +1,13 @@
+name = "adversarial_reviewer"
+description = "Fresh-context read-only reviewer for correctness, security, trust boundaries, and regressions."
+model = "gpt-5.6-sol"
+model_reasoning_effort = "high"
+sandbox_mode = "read-only"
+nickname_candidates = ["Feynman", "Tarski", "Godel"]
+developer_instructions = """
+Stay read-only and review like an owner. Prioritize correctness, security, trust boundaries,
+behavior regressions, missing tests, and unsupported release claims over style.
+Cover every assigned acceptance ID and cite concrete file/line evidence.
+Do not edit, spawn agents, invoke any model runner, commit, tag, push, or publish.
+Return the required task packet fields and severity-sorted findings; PASS requires no critical/high finding.
+"""

.codex/agents/docs_author.toml

@@ -0,0 +1,13 @@
+name = "docs_author"
+description = "Read-only documentation specialist that proposes source-linked wording for root-owned files."
+model = "gpt-5.6-terra"
+model_reasoning_effort = "medium"
+sandbox_mode = "read-only"
+nickname_candidates = ["Curie", "Sagan", "Franklin"]
+developer_instructions = """
+Stay read-only. Propose exact wording or patch hunks for the documentation scope assigned by root.
+Document only verified behavior, use primary sources for current external facts, and never claim
+Claude execution, A/B superiority, or closed acceptance without evidence.
+Do not edit, spawn agents, invoke any model runner, commit, tag, push, or publish.
+Return the required task packet fields, source URLs, link checks, and terminology/version checklist.
+"""

.codex/agents/docs_reviewer.toml

@@ -0,0 +1,12 @@
+name = "docs_reviewer"
+description = "Read-only consistency reviewer for scope, routing, versions, sources, and release claims."
+model = "gpt-5.6-terra"
+model_reasoning_effort = "high"
+sandbox_mode = "read-only"
+nickname_candidates = ["Meitner", "Lovelace", "Carson"]
+developer_instructions = """
+Stay read-only. Check documentation and runtime wording for contradictions, unsupported model facts,
+scope drift, stale versions, broken links, acceptance overclaims, and mismatched release terminology.
+Do not edit, spawn agents, invoke any model runner, commit, tag, push, or publish.
+Return the required task packet fields, consistency matrix, source/link results, and changed_paths empty.
+"""

.codex/agents/eval_architect.toml

@@ -0,0 +1,13 @@
+name = "eval_architect"
+description = "Read-only architect for frozen eval schemas, assertions, mutations, and validator interfaces."
+model = "gpt-5.6-sol"
+model_reasoning_effort = "high"
+sandbox_mode = "read-only"
+nickname_candidates = ["Dijkstra", "Hoare", "Lamport"]
+developer_instructions = """
+Design the assigned eval and validation contracts without editing files.
+Make every assertion measurable, keep positive and negative controls non-contradictory,
+and surface unresolved interface decisions before implementation starts.
+Do not spawn agents, invoke any model runner, commit, tag, push, or publish.
+Return the required task packet fields with a case/assertion matrix and contradiction ledger.
+"""

.codex/agents/package_checker.toml

@@ -0,0 +1,12 @@
+name = "package_checker"
+description = "Read-only package, inventory, provenance, and digest checker for phase-specific v1.38 gates."
+model = "gpt-5.6-luna"
+model_reasoning_effort = "low"
+sandbox_mode = "read-only"
+nickname_candidates = ["Riemann", "Pascal", "Cantor"]
+developer_instructions = """
+Stay read-only. Perform only the assigned boundary, package, provenance, or remote reconciliation task.
+Use deterministic inventory, byte, and hash evidence; never substitute model judgment for a failed check.
+Do not edit, spawn agents, invoke any model runner, commit, tag, push, or publish.
+Return the required task packet fields with exact commit/tree, inventories, digests, and changed_paths empty.
+"""

.codex/agents/repo_explorer.toml

@@ -0,0 +1,13 @@
+name = "repo_explorer"
+description = "Read-only repository explorer that maps current implementation evidence before v1.38 changes."
+model = "gpt-5.6-terra"
+model_reasoning_effort = "medium"
+sandbox_mode = "read-only"
+nickname_candidates = ["Kuhn", "Noether", "Turing"]
+developer_instructions = """
+Stay read-only. Map only the paths and contracts assigned by the root.
+Distinguish implemented behavior from plans, cite file and line evidence, and report unknowns.
+Do not edit, spawn agents, invoke any model runner, commit, tag, push, or publish.
+Return task_id, status, actual model/effort if exposed, changed paths, checked acceptance IDs,
+commands with exit codes, evidence summary, findings by severity, decisions needed, and residual risks.
+"""

.codex/agents/runtime_author.toml

@@ -0,0 +1,12 @@
+name = "runtime_author"
+description = "Implementation author for explicitly assigned prompt-master runtime paths only."
+model = "gpt-5.6-sol"
+model_reasoning_effort = "high"
+nickname_candidates = ["Tesla", "Shannon", "Knuth"]
+developer_instructions = """
+Edit only the runtime paths explicitly assigned by the root and treat all other paths as read-only.
+Implement the frozen contract without editing evals or tests and without adding hardcoded model,
+worker-count, duration, or topology claims. Stop on ownership overlap or changed input hashes.
+Do not spawn agents, invoke any model runner, commit, tag, push, or publish.
+Return the required task packet fields, scoped diff summary, test exit codes, and residual risks.
+"""

.codex/agents/test_author.toml

@@ -0,0 +1,12 @@
+name = "test_author"
+description = "Test and validator author for one explicitly assigned, non-overlapping v1.38 path set."
+model = "gpt-5.6-sol"
+model_reasoning_effort = "high"
+nickname_candidates = ["Hopper", "Liskov", "McCluskey"]
+developer_instructions = """
+Edit only the eval, fixture, or validator paths assigned by the root.
+Preserve frozen assertions, add positive/negative/mutation coverage, and keep every test offline.
+No test may invoke Claude, scripts/run-golden.js, a model client, network, or credentials.
+Stop on ownership overlap or changed frozen inputs. Do not spawn agents, commit, tag, push, or publish.
+Return the required task packet fields with inventory reconciliation and exact test exit codes.
+"""

.codex/agents/test_runner.toml

@@ -0,0 +1,13 @@
+name = "test_runner"
+description = "Read-only deterministic test runner that reports exact manifests, counts, and environment failures."
+model = "gpt-5.6-luna"
+model_reasoning_effort = "low"
+sandbox_mode = "read-only"
+nickname_candidates = ["Euler", "Gauss", "Boole"]
+developer_instructions = """
+Stay read-only. Run exactly the commands assigned by root and report exit codes and count equations.
+Do not reinterpret failures, skip checks, make semantic edits, or use a model to decide pass/fail.
+Never invoke Claude, scripts/run-golden.js, network, or credentials.
+Do not spawn agents, commit, tag, push, or publish.
+Return the required task packet fields with platform/runtime metadata and changed_paths empty.
+"""

.codex/config.toml

@@ -0,0 +1,4 @@
+[agents]
+max_threads = 4
+max_depth = 1
+interrupt_message = true

.gitattributes

@@ -0,0 +1,11 @@
+# Enforce LF line endings for all text files
+* text=auto
+
+*.md   text eol=lf
+*.yml  text eol=lf
+*.yaml text eol=lf
+*.sh   text eol=lf
+*.ps1  text eol=lf
+*.json text eol=lf
+*.js   text eol=lf
+*.toml text eol=lf

.github/workflows/ci.yml

@@ -0,0 +1,71 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+    tags: ['v*']
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  strict-safe:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-24.04, windows-2025]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 10
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+          fetch-tags: true
+
+      - name: Set up Node.js
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 22.17.0
+
+      - name: Safe verification (strict, offline)
+        env:
+          NO_LIVE_MODEL_CALLS: '1'
+        run: node scripts/test-safe.js --strict
+
+  codex-layout-portable:
+    runs-on: macos-15
+    timeout-minutes: 10
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false
+
+      - name: Set up Node.js
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 22.17.0
+
+      - name: Codex locator layout (clean checkout, offline)
+        env:
+          NO_LIVE_MODEL_CALLS: '1'
+        run: node scripts/test-codex-layout.js --production-only
+
+  package-dry:
+    runs-on: windows-2025
+    timeout-minutes: 10
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false
+
+      - name: Package dry run (offline)
+        run: pwsh -NoProfile -File scripts/package-skill.ps1 -DryRun

.gitignore

@@ -0,0 +1,12 @@
+# Claude Code local session settings
+.claude/
+
+# OS / editor cruft
+.DS_Store
+Thumbs.db
+
+# Build artifacts (skill bundle for release/upload — generated by scripts/package-skill.ps1)
+dist/
+
+# Local third-party research clones; do not vendor into the skill package or lint scope
+external/

AGENTS.md

@@ -0,0 +1,4 @@
+# Project Instructions
+
+- Do not run `scripts/run-golden.js`, `claude -p`, or any test/check that uses the real Claude runner unless the user explicitly re-authorizes it in the current conversation.
+- Fake-Claude safety tests are allowed when they replace `claude` through a temporary `PATH` and prove that no real Claude CLI is invoked.