Skip to content

Commit c70874f

Browse files
authored
feat(pi): curated pi/core skills+prompts profile, CI load test, and 2.2.2 release sync (#3264)
Adds a curated, Pi-native, skills+prompts-only profile at pi/core/ for downstream packagers that mirror GitHub Releases. - manifests/pi-core.json: explicit include lists, per-item exclusion reasons, curation rules, safety allowlists; every root skill and command must be classified. - scripts/build-pi-core.js regenerates pi/core deterministically (package.json from VERSION, LICENSE, README.md, CURATION.md, skills/, commands/); --check fails CI on drift. council is renamed ecc-council inside pi/core only. - Safety checks: no callable endpoints outside the allowlist, no npx/curl|sh/pip install, no secrets, no absolute home paths, no symlinks, valid frontmatter, no duplicate names. - CI: build + drift check and an offline Pi CLI load test of pi/core. - Release: VERSION, package.json and pi/core/package.json at 2.2.2, CHANGELOG, tag-triggered release verification, and a two-week cadence in CONTRIBUTING.md. pi/core: 123 of 293 skills and 24 of 94 commands; 35,006 characters of skill description text.
1 parent d30588f commit c70874f

203 files changed

Lines changed: 55411 additions & 2 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/ci.yml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -239,6 +239,44 @@ jobs:
239239
run: node scripts/ci/validate-no-personal-paths.js
240240
continue-on-error: false
241241

242+
pi-core:
243+
name: Pi Core Profile
244+
runs-on: ubuntu-latest
245+
timeout-minutes: 10
246+
247+
steps:
248+
- name: Checkout
249+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
250+
with:
251+
persist-credentials: false
252+
253+
- name: Setup Node.js
254+
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
255+
with:
256+
node-version: '20.x'
257+
258+
# Rebuild runs frontmatter validation and the pi/core safety checks
259+
# (no callable endpoints, no runtime downloads, no secrets, no absolute
260+
# home paths, no symlinks, no duplicate skill names); the diff check
261+
# proves the committed profile is up to date.
262+
- name: Rebuild pi/core and verify it is up to date
263+
run: |
264+
node scripts/build-pi-core.js
265+
git diff --exit-code pi/core
266+
267+
- name: Install Pi coding agent CLI
268+
run: npm install --global --ignore-scripts --no-audit --no-fund @mariozechner/[email protected]
269+
270+
# --extension only loads a package's pi.extensions entries; pi/core is a
271+
# skills+prompts-only package, so the equivalent --skill/--prompt-template
272+
# resource flags are used. The load-test script additionally asserts via
273+
# RPC that every curated command actually loaded.
274+
- name: Offline load test with the Pi CLI
275+
run: |
276+
PI_OFFLINE=1 pi --offline --mode rpc --no-session --no-context-files --no-extensions \
277+
--skill pi/core/skills --prompt-template pi/core/commands </dev/null >/dev/null
278+
node scripts/ci/pi-core-load-test.js
279+
242280
python-tests:
243281
name: Python Lint, Type Check & Test
244282
runs-on: ubuntu-latest

‎.github/workflows/release.yml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,22 @@ jobs:
8484
exit 1
8585
fi
8686
87+
- name: Verify VERSION matches tag
88+
env:
89+
TAG_NAME: ${{ github.ref_name }}
90+
run: |
91+
TAG_VERSION="${TAG_NAME#v}"
92+
FILE_VERSION=$(tr -d '[:space:]' < VERSION)
93+
if [ "$TAG_VERSION" != "$FILE_VERSION" ]; then
94+
echo "::error::Tag version ($TAG_VERSION) does not match VERSION ($FILE_VERSION)"
95+
exit 1
96+
fi
97+
98+
# pi/core/package.json derives its version from VERSION, so a current
99+
# profile also proves pi/core is in sync with the tag.
100+
- name: Verify pi/core profile is current
101+
run: node scripts/build-pi-core.js --check
102+
87103
- name: Verify release metadata stays in sync
88104
run: node tests/plugin-manifest.test.js
89105

‎CHANGELOG.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,14 @@
22

33
## 2.2.2 - 2026-09-15
44

5+
### Added
6+
7+
#### Pi core profile
8+
9+
- Add `pi/core/`, a curated Pi-native skills+prompts-only profile for downstream packagers that mirror GitHub Releases: 123 portable engineering skills and 24 pure prompt-workflow commands, no extensions, no hooks, no runtime downloads, and no network or SaaS dependencies. The profile is generated deterministically from the explicit include/exclude lists in `manifests/pi-core.json` by `scripts/build-pi-core.js` and committed so release tarballs contain it verbatim; `pi/core/CURATION.md` lists every excluded skill and command with its reason.
10+
- The build fails on safety violations: non-allowlisted URL hosts, pipe-to-shell or fetch-and-run download forms, secrets or tokens, absolute per-user home paths, symlinks, invalid SKILL.md frontmatter, and duplicate skill names. The `council` skill ships as `ecc-council` inside pi/core to avoid catalog name clashes.
11+
- CI rebuilds pi/core and verifies it is committed up to date, then installs the Pi coding agent CLI and proves the profile loads fully offline (`PI_OFFLINE=1`), asserting every curated command is actually registered. The release workflow verifies VERSION matches the tag and that pi/core is current.
12+
513
### Fixed
614

715
#### Packaging

‎CONTRIBUTING.md‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ Thanks for wanting to contribute! This repo is a community resource for Claude C
1414
- [MCP and documentation (e.g. Context7)](#mcp-and-documentation-eg-context7)
1515
- [Cross-Harness and Translations](#cross-harness-and-translations)
1616
- [Pull Request Process](#pull-request-process)
17+
- [Releases](#releases)
1718

1819
---
1920

@@ -484,6 +485,27 @@ Run `npm test` locally. It is the same gauntlet CI runs, and it catches almost e
484485

485486
---
486487

488+
## Releases
489+
490+
Releases are cut on a regular cadence, roughly every two weeks, plus out-of-band
491+
patches for security or data-loss fixes.
492+
493+
1. Sync the version everywhere: `VERSION`, `package.json`, and (via
494+
`node scripts/build-pi-core.js`) `pi/core/package.json`.
495+
2. Update `CHANGELOG.md` and write reviewed release notes at
496+
`docs/releases/<version>/release-notes.md` (required by the release workflow).
497+
3. Tag `vX.Y.Z` on `main` and push the tag. The `release.yml` workflow verifies
498+
the tag is exactly on `origin/main`, checks the VERSION/pi/core sync, tests
499+
the exact packed artifact on Linux, macOS, and Windows, publishes to npm with
500+
provenance, verifies registry bytes, and creates the GitHub Release from the
501+
reviewed notes.
502+
503+
Tags and GitHub Releases are immutable once published: downstream packagers poll
504+
`/releases`, download `archive/refs/tags/vX.Y.Z.tar.gz`, and pin its sha256.
505+
Never move or re-tag a published version; ship a new patch version instead.
506+
507+
---
508+
487509
## Guidelines
488510

489511
### Do
Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
# ECC 2.2.2
2+
3+
ECC 2.2.2 adds `pi/core`, a curated Pi-native skills+prompts-only profile built for
4+
downstream packagers that mirror GitHub Releases, plus a set of packaging, memory,
5+
hooks, and Windows compatibility fixes.
6+
7+
## Pi core profile
8+
9+
`pi/core/` is a self-contained package (`ecc-pi-core`) that mirrors of the release
10+
tarball can copy directly: no build step, no extensions, no hooks, no runtime
11+
downloads, and no network or SaaS dependencies.
12+
13+
- 123 curated skills (language and framework patterns, testing/TDD, code review,
14+
non-offensive security review, planning, refactoring, docs, and git/PR workflows)
15+
and 24 prompt commands that are pure prompt workflows.
16+
- Generated deterministically from the explicit include/exclude lists in
17+
`manifests/pi-core.json` by `scripts/build-pi-core.js` and committed, so the
18+
release tarball contains it verbatim. `pi/core/CURATION.md` lists every excluded
19+
skill and command with its reason; the `council` skill ships as `ecc-council`
20+
inside pi/core to avoid catalog name clashes.
21+
- The build fails on safety violations: non-allowlisted URL hosts, pipe-to-shell
22+
or fetch-and-run download forms, secrets or tokens, absolute per-user home
23+
paths, symlinks, invalid SKILL.md frontmatter, and duplicate skill names.
24+
- CI rebuilds pi/core on every PR and verifies it is up to date, then installs
25+
the Pi coding agent CLI and proves the profile loads fully offline
26+
(`PI_OFFLINE=1`), asserting that every curated command actually registers.
27+
- The release workflow additionally verifies that `VERSION` matches the tag and
28+
that pi/core is current before publishing.
29+
30+
Downstream consumption: poll `/releases`, download
31+
`archive/refs/tags/vX.Y.Z.tar.gz`, pin its sha256, copy `pi/core/`, and load it
32+
offline with `pi --offline --skill pi/core/skills --prompt-template pi/core/commands`.
33+
34+
## Packaging
35+
36+
- The compiled OpenCode payload is explicitly included in the npm package, and
37+
packing is verified from a clean state with lifecycle scripts enabled.
38+
39+
## Memory and MCP
40+
41+
- Incomplete memory reads are distinguished from missing records, and directory
42+
traversal failures are classified.
43+
- The reserved `_meta` parameter is accepted on memory MCP ping requests.
44+
45+
## Hooks and Windows compatibility
46+
47+
- `hooks.json` stays within Claude Code's schema; stable hook metadata moved into
48+
a validated sidecar.
49+
- The no-verify guard handles stuck optional values and long-option prefixes.
50+
- Windows linter paths and ESLint 9 are supported, and settings updates tolerate
51+
missing Windows device IDs while retaining full-precision inode checks.
52+
53+
## Workflow guidance, catalog, and dependency security
54+
55+
- Epic sync filters issues by label; dependency bumps no longer document
56+
auto-merge; naming and Boolean guidance is language-neutral; the `prp-pr`
57+
command alias is distinguished; Rails skill discovery, invoice tax calculation
58+
order, and framework documentation were corrected; Serply and Squish catalog
59+
entries were removed.
60+
- `lru` updated to 0.18.2 (RUSTSEC-2026-0253) and `js-yaml` to 4.3.2
61+
(GHSA-2883-xcg3-v3hh).
Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
{"coverage":{"skills":293,"withTriggers":32},"generatedAt":"2026-09-24T23:51:22.784Z","id":"skill-triggers@1","model":{"effort":null,"id":"hand-seeded","source":"manual-curation-pending-regeneration"},"registryDigest":"9577e4e4d33f6fe2ec0312506fa23e0165685947f8e36c6c6dc2236bfee46813","schemaVersion":1,"triggers":{"skill:api-connector-builder":["add api integration","new provider connector","match existing integration pattern"],"skill:api-design":["rest endpoint design","pagination api","status codes","api versioning","rate limiting api","resource naming","filtering api","api error responses","offset pagination","limit query parameter","pagination defaults"],"skill:backend-patterns":["express api","node backend architecture","nextjs api routes","server side patterns","data access layer","static file server","url path handling","file server"],"skill:browser-qa":["deployed feature test","visual regression screenshots","core web vitals check","axe accessibility audit","ship do not ship","staging verification"],"skill:canary-watch":["post deploy monitoring","smoke test url","production url check","console errors production","sse stream check","after deploy verification"],"skill:code-tour":["onboarding walkthrough","explain subsystem","architecture tour","pr walkthrough","rca tour"],"skill:coding-standards":["code review standards","naming conventions","readability review","immutability conventions","fix naming typo","export naming","consistent exports"],"skill:content-hash-cache-pattern":["cache file processing","content addressed cache","sha256 hash cache"],"skill:database-migrations":["zero downtime migration","schema change production","add column large table","backfill data","expand contract","concurrent index","migration rollback","prisma migration","django migration"],"skill:deployment-patterns":["ci cd setup","dockerize app","health checks","rollback strategy","production readiness","deploy pipeline","containerize application"],"skill:design-system":["design tokens","visual consistency audit","css custom properties","ui audit","design system bootstrap"],"skill:django-patterns":["django orm","drf api","django rest framework","django caching","django signals","django middleware"],"skill:django-security":["django authentication","csrf protection","sql injection prevention","xss prevention","django deployment security","role based access control","authorization middleware","permissions checks"],"skill:docker-patterns":["dockerfile review","docker compose setup","container security","multi service orchestration"],"skill:error-handling":["error types","retry logic","circuit breaker","user facing errors","exception handling patterns","typed errors","error boundaries","go error handling","custom error class","error codes","config validation"],"skill:evm-token-decimals":["token decimals","wei conversion","erc20 balance off","bridge token precision"],"skill:frontend-a11y":["aria attributes","screen reader support","focus management","semantic html","form labeling","keyboard navigation react","a11y lint errors"],"skill:git-workflow":["merge vs rebase","commit conventions","resolve merge conflict","branching strategy","clean up commits","pull request cleanup","git history tidy"],"skill:hexagonal-architecture":["ports and adapters","dependency injection boundaries","decouple domain from io"],"skill:kubernetes-patterns":["kubernetes manifests","kubectl debugging","pod probes","k8s rbac","autoscaling config","configmap secrets"],"skill:orch-fix-defect":["fix a bug","broken behavior","regression fix","reproduce bug","defect repair"],"skill:postgres-patterns":["slow postgres query","query optimization","index design","rls policies","supabase schema","postgres indexing","database performance","schema design postgres","postgres driver","node postgres","query planner"],"skill:python-patterns":["pythonic code","pep 8","type hints python","python code review","idiomatic python"],"skill:python-testing":["pytest fixtures","mocking python","parametrized tests","coverage python","tdd python"],"skill:redis-patterns":["cache aside pattern","distributed lock","redis rate limiting","cache invalidation"],"skill:regex-vs-llm-structured-text":["parse invoice","extract receipt data","text extraction pipeline","parse form fields","cheap document parser","extract table data","parse log lines","parse access logs","common log format","log line parsing"],"skill:rust-patterns":["rust ownership","borrow checker","rust error handling","traits rust","rust concurrency","idiomatic rust"],"skill:search-first":["find existing library","npm package research","before writing custom code","evaluate existing tools","add dependency research"],"skill:security-review":["security audit","authentication review","sanitize user input","secrets handling","payment security checklist","prevent injection attacks","secure api endpoints","authn authz review","vulnerability checklist","input validation security","parameterized queries","sql injection"],"skill:security-scan":["audit claude config","claudemd security","mcp server audit","agentshield scan","hook configuration audit","settings json security"],"skill:tdd-workflow":["write test first","failing test","red green refactor","test driven development","regression test first","write a regression test"],"skill:verification-loop":["pre pr checks","verification report","quality gates","build lint test coverage","before creating a pr"]},"triggersDigest":"25b97a9e06fc336c7cf95ab854ed1a41033a54bcd6e1fb1cf69dc906332462aa"}
1+
{"coverage":{"skills":293,"withTriggers":32},"generatedAt":"2026-09-24T23:51:22.784Z","id":"skill-triggers@1","model":{"effort":null,"id":"hand-seeded","source":"manual-curation-pending-regeneration"},"registryDigest":"05b0793ddaad74a794b6f7fcb4f4704b0c1ddeba4edec8347859eebbc394c47e","schemaVersion":1,"triggers":{"skill:api-connector-builder":["add api integration","new provider connector","match existing integration pattern"],"skill:api-design":["rest endpoint design","pagination api","status codes","api versioning","rate limiting api","resource naming","filtering api","api error responses","offset pagination","limit query parameter","pagination defaults"],"skill:backend-patterns":["express api","node backend architecture","nextjs api routes","server side patterns","data access layer","static file server","url path handling","file server"],"skill:browser-qa":["deployed feature test","visual regression screenshots","core web vitals check","axe accessibility audit","ship do not ship","staging verification"],"skill:canary-watch":["post deploy monitoring","smoke test url","production url check","console errors production","sse stream check","after deploy verification"],"skill:code-tour":["onboarding walkthrough","explain subsystem","architecture tour","pr walkthrough","rca tour"],"skill:coding-standards":["code review standards","naming conventions","readability review","immutability conventions","fix naming typo","export naming","consistent exports"],"skill:content-hash-cache-pattern":["cache file processing","content addressed cache","sha256 hash cache"],"skill:database-migrations":["zero downtime migration","schema change production","add column large table","backfill data","expand contract","concurrent index","migration rollback","prisma migration","django migration"],"skill:deployment-patterns":["ci cd setup","dockerize app","health checks","rollback strategy","production readiness","deploy pipeline","containerize application"],"skill:design-system":["design tokens","visual consistency audit","css custom properties","ui audit","design system bootstrap"],"skill:django-patterns":["django orm","drf api","django rest framework","django caching","django signals","django middleware"],"skill:django-security":["django authentication","csrf protection","sql injection prevention","xss prevention","django deployment security","role based access control","authorization middleware","permissions checks"],"skill:docker-patterns":["dockerfile review","docker compose setup","container security","multi service orchestration"],"skill:error-handling":["error types","retry logic","circuit breaker","user facing errors","exception handling patterns","typed errors","error boundaries","go error handling","custom error class","error codes","config validation"],"skill:evm-token-decimals":["token decimals","wei conversion","erc20 balance off","bridge token precision"],"skill:frontend-a11y":["aria attributes","screen reader support","focus management","semantic html","form labeling","keyboard navigation react","a11y lint errors"],"skill:git-workflow":["merge vs rebase","commit conventions","resolve merge conflict","branching strategy","clean up commits","pull request cleanup","git history tidy"],"skill:hexagonal-architecture":["ports and adapters","dependency injection boundaries","decouple domain from io"],"skill:kubernetes-patterns":["kubernetes manifests","kubectl debugging","pod probes","k8s rbac","autoscaling config","configmap secrets"],"skill:orch-fix-defect":["fix a bug","broken behavior","regression fix","reproduce bug","defect repair"],"skill:postgres-patterns":["slow postgres query","query optimization","index design","rls policies","supabase schema","postgres indexing","database performance","schema design postgres","postgres driver","node postgres","query planner"],"skill:python-patterns":["pythonic code","pep 8","type hints python","python code review","idiomatic python"],"skill:python-testing":["pytest fixtures","mocking python","parametrized tests","coverage python","tdd python"],"skill:redis-patterns":["cache aside pattern","distributed lock","redis rate limiting","cache invalidation"],"skill:regex-vs-llm-structured-text":["parse invoice","extract receipt data","text extraction pipeline","parse form fields","cheap document parser","extract table data","parse log lines","parse access logs","common log format","log line parsing"],"skill:rust-patterns":["rust ownership","borrow checker","rust error handling","traits rust","rust concurrency","idiomatic rust"],"skill:search-first":["find existing library","npm package research","before writing custom code","evaluate existing tools","add dependency research"],"skill:security-review":["security audit","authentication review","sanitize user input","secrets handling","payment security checklist","prevent injection attacks","secure api endpoints","authn authz review","vulnerability checklist","input validation security","parameterized queries","sql injection"],"skill:security-scan":["audit claude config","claudemd security","mcp server audit","agentshield scan","hook configuration audit","settings json security"],"skill:tdd-workflow":["write test first","failing test","red green refactor","test driven development","regression test first","write a regression test"],"skill:verification-loop":["pre pr checks","verification report","quality gates","build lint test coverage","before creating a pr"]},"triggersDigest":"25b97a9e06fc336c7cf95ab854ed1a41033a54bcd6e1fb1cf69dc906332462aa"}

0 commit comments

Comments
 (0)