feat(skills): add removed maturity tier and retire owasp-docker#1444
feat(skills): add removed maturity tier and retire owasp-docker#1444WilliamBerryiii merged 8 commits intomainfrom
Conversation
- add `removed` value to skill-frontmatter and collection-manifest schemas - mark owasp-docker SKILL.md as removed and not user-invocable - filter removed items in collection helpers, plugin gen, and extension prep - drop owasp-docker from security and hve-core-all collections and plugins - add Pester coverage for the new tier; refs #1442 🗑️ - Generated by Copilot
…cker-add-removed-maturity
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #1444 +/- ##
=======================================
Coverage 87.63% 87.63%
=======================================
Files 65 65
Lines 10119 10152 +33
=======================================
+ Hits 8868 8897 +29
- Misses 1251 1255 +4
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Advisory review — this PR is from a maintainer. Findings are informational only.
Review Overview
This PR cleanly implements the removed maturity tier as a first-class source-level exclusion mechanism, retires owasp-docker from all distribution channels, and provides comprehensive Pester coverage across collection helpers, extension preparation, plugin generation, and schema enforcement. The issue acceptance criteria (Issue #1442) are fully met, and the approach — enforcing exclusion at the source frontmatter level to prevent re-introduction by auto-generators — is sound.
Issue Alignment ✅
Issue: #1442 — Remove owasp-docker skill and introduce 'removed' maturity tier
All acceptance criteria are satisfied:
plugins/**/skills/security/owasp-docker/symlinks removed.removedaccepted in both schema enums (collection-manifest and skill-frontmatter).- Re-running the generator does not re-introduce the skill (
Update-HveCoreAllCollectionnow filters removed items). SKILL.mddocuments the licensing rationale via an inline YAML comment.- No agent or prompt in the shipped surface advertises
owasp-docker.
PR Template Compliance ✅
Description is complete and well-written. Issue reference (Closes #1442) is present. Type of Change checkboxes (new feature, breaking change, documentation update, prompt/agent/skill, script/automation) accurately reflect the diff. Sample Prompts section is populated for the AI artifact changes. Testing section documents 2036 passing tests and the pre-existing validate:skills failure is correctly disclosed with a note that it is unrelated and tracked separately. All required checklist items are checked, with the one unchecked validate:skills item transparently explained.
Coding Standards ✅ (with two minor notes — see inline comments)
The PowerShell conventions are followed throughout: copyright headers, #Requires -Version 7.0, [CmdletBinding()], comment-based help with .SYNOPSIS, .DESCRIPTION, .PARAMETER, .OUTPUTS, and Export-ModuleMember listing. One new test file (Schemas-RemovedMaturity.Tests.ps1) has two minor convention deviations flagged in the inline comments: incorrect #Requires / copyright ordering, and missing -Tag 'Unit' on Describe blocks.
Code Quality ✅
Get-ArtifactSourceMaturity: Regex(?s)^---\s*\r?\n(.*?)\r?\n---is correct and handles the YAML comment present inowasp-docker/SKILL.mdsinceConvertFrom-Yamlstrips comments before parsing. The null-return path for missing files, missing frontmatter, and malformed YAML is well-guarded.Test-ArtifactRemoved: Thin, single-responsibility wrapper — correct. PowerShell's-eqis case-insensitive by default, which is a reasonable tolerance here given schema validation enforces the lowercaseremovedvalue at the source.Prepare-Extension.ps1: All four discovery functions (Get-DiscoveredAgents,Get-DiscoveredPrompts,Get-DiscoveredInstructions,Get-DiscoveredSkills) now filter removed artifacts. The skill discovery correctly passes$_.Directory.FullName(the skill directory) rather than theSKILL.mdpath, which aligns with the directory-resolution branch inGet-ArtifactSourceMaturity.Update-HveCoreAllCollection: The additional guard runs before the deprecated-item filter, which is the correct ordering to prevent re-introduction by the all-collection generator.- Collection manifests / plugin outputs: Removal of the
owasp-dockerentry fromhve-core-allandsecuritymanifests is consistent and complete.
Action Items
- (Minor) Fix
#Requires/ copyright order inscripts/tests/linting/Schemas-RemovedMaturity.Tests.ps1(see inline comment, line 4). - (Minor) Add
-Tag 'Unit'to bothDescribeblocks inscripts/tests/linting/Schemas-RemovedMaturity.Tests.ps1(see inline comment, line 14).
Both items are low-risk corrections to a new test file before merge.
… `removed` marker - remove `maturity` field from skill frontmatter; collections own status - add `maturity: removed` collection-yaml marker; Update-HveCoreAllCollection excludes it - mark owasp-docker as removed via collection yaml (license-incompatible) - add Pester coverage for removed-maturity exclusion - document Removed Artifacts section in docs/architecture/ai-artifacts.md Refs: #1445 #1446 🧹 - Generated by Copilot
There was a problem hiding this comment.
Advisory review, this PR is from a maintainer. Findings are informational only.
Review Summary
This PR implements the removed maturity tier across the schema, collection manifests, tooling, tests, and documentation, and uses it to retire the owasp-docker skill — a well-scoped, well-executed change. The PR description is complete, the linked issue (#1442) is fully addressed in scope, and the template is filled correctly. Most of the implementation is clean and consistent with existing patterns.
One important gap worth addressing before this lands is described below, alongside two lower-priority observations.
Issue Alignment
✅ Addresses all requirements from #1442:
- Schema updated to include
removedat both collection and item levels owasp-dockermarkedmaturity: removedinsecurity.collection.ymlUpdate-HveCoreAllCollectionguard added to skipremoveditems during plugin generation- Narrative references to
owasp-dockerscrubbed from agent, prompt, and documentation files - Plugin outputs regenerated
No scope creep and no missing acceptance criteria detected.
PR Template Compliance
✅ All required sections present and filled.
✅ Type-of-change checkboxes match the actual diff (Copilot skill, Copilot agent, Copilot prompt, Copilot instructions all changed; corresponding checkboxes checked).
✅ Testing section describes specific commands and observed results.
✅ AI Artifact Contributions checklist items checked.
Code Quality
⚠️ Important: Re-discovery gap in hve-core-all.collection.yml
See inline comment on collections/hve-core-all.collection.yml:588.
Update-HveCoreAllCollection (called by Generate-Plugins.ps1:205) discovers artifacts by scanning .github/skills/ on disk and defaults any item not already in the manifest to maturity: 'stable'. Because the owasp-docker entry was deleted from hve-core-all rather than retained with maturity: removed, the guard at CollectionHelpers.psm1:518 will never fire for it — the item is invisible to the check, and the next npm run plugin:generate will silently re-add owasp-docker to hve-core-all with maturity: stable.
Suggested fix: retain the entry in hve-core-all.collection.yml with maturity: removed:
- path: .github/skills/security/owasp-docker
kind: skill
maturity: removedThis is consistent with the documentation added in this PR ("Every collection that references the artifact must carry the same marker") and makes the guard function as designed on every subsequent invocation.
💡 Minor: removed guard pattern is inconsistent with deprecated
See inline comment on scripts/collections/Modules/CollectionHelpers.psm1:518.
deprecated items use a named helper (Test-ArtifactDeprecated) and a running counter ($deprecatedCount) surfaced in summary output. removed items use an inline string comparison and no counter. The linked issue called for a Test-ArtifactRemoved helper. Neither is blocking, but aligning the pattern would improve maintainability.
💡 Minor: New test covers "item already in manifest with maturity: removed" but not "item absent from manifest"
See inline comment on scripts/tests/collections/CollectionHelpers.Tests.ps1:644.
The test exercises the guard correctly for items pre-seeded in hve-core-all with maturity: removed. A complementary test starting with an hve-core-all that does not mention the artifact at all would cover the other critical path and lock down the full contract.
Coding Standards
✅ PowerShell files include copyright headers in correct position.
✅ #Requires -Modules Pester appears before the copyright header in the new test file, matching the Pester instructions.
✅ New functions include comment-based help with .SYNOPSIS, .DESCRIPTION, .PARAMETER, .OUTPUTS.
✅ $TestDrive usage in existing tests is consistent; the new Find-CollectionManifests test uses the same manual temp-dir pattern already established in that file.
✅ Schema files are valid JSON with correct enum additions.
✅ YAML comments inside SKILL.md frontmatter (between user-invocable and metadata) are syntactically valid.
Action Items
- [Recommended] Retain
owasp-dockerinhve-core-all.collection.ymlwithmaturity: removedto ensure the permanent guard fires on all futureplugin:generateruns. - [Optional] Introduce
Test-ArtifactRemovedhelper and$removedCountmetric to match thedeprecatedpattern. - [Optional] Add a test case for the "artifact on disk but absent from hve-core-all" scenario to fully cover the re-discovery guard contract.
- skip removed items in themed-collection membership check (Check 4) - skip removed items in on-disk orphan check (Check 1) - aligns validator with Update-HveCoreAllCollection exclusion behavior 🛠️ - Generated by Copilot
There was a problem hiding this comment.
Advisory review — this PR is from a maintainer. Findings are informational only.
Review Summary
This is a well-scoped, thoughtfully executed change. The removed maturity tier is enforced consistently across five distinct surfaces (collection helpers, validation, extension packaging, plugin generation, and schema), and the documentation and test coverage are proportionate to the mechanism's complexity. The PR description aligns cleanly with the linked issue (#1442), and all acceptance criteria are met.
Two inline comments are posted above. An additional observation follows below.
Issue Alignment ✅
All items in the issue scope table are addressed. The deliberate decision to keep maturity out of per-artifact frontmatter (deviating from the issue's mention of skill-frontmatter.schema.json) is clearly justified in docs/architecture/ai-artifacts.md — the collection YAML is the single source of truth. That reasoning is sound and the documentation explains it well.
PR Template Compliance ✅
All required sections are filled. The unchecked validate:skills item is appropriately annotated as a pre-existing failure unrelated to this change.
Coding Standards
⚠️ Test file header ordering (inline comment posted)
scripts/tests/linting/Schemas-RemovedMaturity.Tests.ps1 places the copyright header before #Requires -Modules Pester. Per pester-tests.instructions.md, the #Requires statement must appear first. Every other test file in scripts/tests/ follows this pattern; this new file is the only exception.
Documentation
⚠️ Exclusion mechanism table credits wrong function (inline comment posted)
docs/architecture/ai-artifacts.md line 460 attributes the extension packaging exclusion to Get-AllowedMaturities, but the explicit enforcement added by this PR is in Test-CollectionMaturityEligible. Get-AllowedMaturities excludes removed by omission (the tier was never in its return list), which is correct behavior, but the documentation should credit the function that was actually changed and that provides the active guard.
Code Quality
💡 Missing test coverage for Validate-Collections.ps1 orphan check changes
Validate-Collections.ps1 has non-trivial new logic for the removed tombstone case — the orphan check at lines 406–420 now distinguishes between an artifact with no active themed occurrences (all removed) and a genuine orphan. Validate-Collections.Tests.ps1 has zero references to removed and no test exercising this path.
The tombstone-skip branch and the check-4 update ($activeThemedMatches) are both new code paths. A test that constructs a collection with a removed item in a themed manifest absent from hve-core-all, runs Invoke-CollectionValidation, and asserts zero errors would close this gap. Existing tests pass, but this specific scenario is untested.
Minor Observations
scripts/tests/collections/CollectionHelpers.Tests.ps1ends with two trailing blank lines after the last test block (lines 660–661). The rest of the file uses a single trailing newline. Non-blocking.- The YAML comment added in
owasp-docker/SKILL.mdfrontmatter is technically valid, but the rationale is invisible in the rendered Markdown view. Consider adding a brief> [!NOTE]admonition in the skill body for human-facing discoverability, since this skill is kept on disk specifically for historical reference.
Action Items
| Priority | Item |
|---|---|
| Low | Fix #Requires ordering in Schemas-RemovedMaturity.Tests.ps1 |
| Low | Correct function name in ai-artifacts.md exclusion table |
| Low | Add Validate-Collections.Tests.ps1 coverage for removed tombstone orphan skip |
- expand collection markdown tables with full agent/prompt rosters - sync plugin readmes with regenerated content 📚 - Generated by Copilot
There was a problem hiding this comment.
Advisory review, this PR is from a maintainer. Findings are informational only.
Review Summary
This is a well-structured PR. The removed maturity tier is correctly threaded through all four enforcement surfaces (collection validation, plugin generation, extension packaging, and collection helpers), and the design rationale for choosing collection-YAML as the single source of truth over per-artifact frontmatter is sound and well-documented. Test coverage is comprehensive across all modified scripts.
Four minor advisory findings are inline-commented; none are blocking.
Issue Alignment ✅
PR closely implements every item in the issue #1442 scope table. One deliberate deviation: the issue spec listed adding a maturity property to skill-frontmatter.schema.json, but the PR intentionally omits this to keep the collection YAML as the unambiguous source of truth. The decision is documented clearly in docs/architecture/ai-artifacts.md and the PR description. The skill-frontmatter.schema.json diff only adds a trailing newline (fixing a pre-existing "no newline at EOF" warning).
PR Template Compliance ✅
All required sections are completed. The unchecked npm run validate:skills item is correctly annotated with a pre-existing failure rationale unrelated to this PR.
Coding Standards
Four minor findings (see inline comments):
scripts/tests/linting/Schemas-RemovedMaturity.Tests.ps1—#Requires -Modules Pesterappears after the copyright header; perpester-test.instructions.mdit must come first.scripts/tests/linting/Schemas-RemovedMaturity.Tests.ps1—Describeblock is missing-Tag 'Unit'.scripts/tests/collections/CollectionHelpers.Tests.ps1— NewDescribeblock is missing-Tag 'Unit'.docs/architecture/ai-artifacts.md— The "Collection-YAML Marker" code example uses.github/skills/security/owasp-docker/SKILL.mdbut collection entries use the directory path (no/SKILL.mdsuffix), matching actual usage insecurity.collection.yml.
Code Quality ✅
Implementation correctness: The removed check is correctly ordered before deprecated in Update-HveCoreAllCollection, preventing re-introduction by the auto-generator. The Validate-Collections.ps1 orphan-and-cross-collection logic is correct: $activeThemedMatches properly gates the "missing from hve-core-all" error, and the tombstone path ($themedRemoved && !$themedActive) correctly suppresses the orphan failure.
Observation — Validate-Collections.ps1 test coverage gap: The most complex new logic (the $activeThemedMatches hunk at line ~373 and the tombstone orphan path at line ~406) doesn't have dedicated tests in this PR. Existing tests run against a live collection graph and likely exercise these paths indirectly (via the owasp-docker tombstone in security.collection.yml), but an isolated unit test for the two new conditional branches in Validate-Collections.ps1 would make future regressions immediately diagnosable. Worth a follow-up ticket.
Trailing blank lines: CollectionHelpers.Tests.ps1 adds two empty lines at the end of the new Describe block. Minor, but inconsistent with the single-trailing-newline convention.
Security ✅
No new dependencies. The license-incompatibility guard is effective: the removed tier creates an unconditional exclusion at every build stage so the CC-BY-NC-SA-4.0 artifact cannot be reintroduced by tooling drift.
- regenerate plugin README outputs after channel-based maturity changes - run format:tables to normalize markdown table formatting 🔧 - Generated by Copilot
There was a problem hiding this comment.
Advisory review, this PR is from a maintainer. Findings are informational only.
Overview
This is a well-scoped, cleanly implemented PR. The removed maturity tier is correctly wired through all four distribution surfaces (collection auto-discovery, plugin generation, extension packaging, and collection validation), the schema changes are consistent, and the documentation accurately describes the invariant. Issue #1442's scope table is fully satisfied.
Issue Alignment ✅
Closes #1442. All items in the issue's scope table are addressed:
- Schema enums updated in both
collection-manifest.schema.jsonandskill-frontmatter.schema.json CollectionHelpers.psm1skipsremovedbefore the existingdeprecatedbranchFind-CollectionManifests.ps1,Prepare-Extension.ps1,Generate-Plugins.ps1each guard onremovedValidate-Collections.ps1updated with tombstone-aware orphan and themed-collection checksowasp-docker/SKILL.mdannotated; collection YAML entries updated in bothsecurity.collection.ymland the regeneratedhve-core-allmanifests- Agent and prompt narratives scrubbed of
owasp-dockerreferences - Plugin symlinks removed from
plugins/hve-core-allandplugins/security
No scope creep detected.
PR Template Compliance ✅
All required sections are filled. The unchecked validate:skills item is explained inline (pre-existing failure on customer-card-render, unrelated to this change) — acceptable.
Coding Standards
Two convention deviations in the new test file scripts/tests/linting/Schemas-RemovedMaturity.Tests.ps1 (inline comments filed above):
- Header order (line 1–4): Copyright block precedes
#Requires -Modules Pester. The Pester testing instructions require#Requiresto be the very first line. - Missing
-Tag 'Unit'(line 12):Describeblocks require-Tag 'Unit'per the Pester instructions. The co-locatedFind-CollectionManifests.Tests.ps1applies the tag correctly.
Neither issue affects test execution, but both deviate from the repository's stated conventions.
Code Quality ✅
- The
removedcheck inUpdate-HveCoreAllCollectioncorrectly precedes the existingdeprecatedguard — ordering is intentional and consistent with the tier hierarchy. Validate-Collections.ps1's tombstone bypass logic ($activeThemedMatches/$themedRemoved) is sound: it allows a skill to exist in a themed collection asremovedwithout triggering the canonical-orphan error, while still failing for genuinely orphaned active items.Select-CollectionItemsByChannelnaturally excludesremovedviaGet-AllowedCollectionMaturities(confirmed by the new tests inGenerate-Plugins.Tests.ps1); no redundant item-level guard needed.- The YAML comment added inside
owasp-docker/SKILL.mdfrontmatter is valid YAML and serves as useful in-file rationale. Standard YAML parsers andgray-matter-style frontmatter extractors handle inline comments correctly.
Documentation ✅
The maturity lifecycle diagram update (deprecated → removed → [*]) and the new "Removed Artifacts" section in ai-artifacts.md are accurate and consistent with the implementation. The release-process table row for removed correctly reflects "Neither" channel inclusion.
Security ✅
No new credentials, secrets, or privilege-escalation paths. The change exclusively removes a CC-BY-NC-SA-4.0 artifact from distribution — a positive security/licensing hygiene action.
…llection tooling - mark owasp-docker removed and propagate maturity into hve-core-all - skip removed items during plugin generation - add rai-risk-classification instructions to data-science, project-planning, security - update Validate-Collections script and tests - add Test-RemovedMaturityExclusion regression test 🛡️ - Generated by Copilot
There was a problem hiding this comment.
Advisory review, this PR is from a maintainer. Findings are informational only.
Overview
This PR introduces the removed maturity tier to retire owasp-docker from all distribution channels while preserving its source for historical reference. The implementation is consistent, well-tested, and cleanly separated across schemas, collection validation, plugin generation, and extension packaging. The linked issue's acceptance criteria are fully addressed.
Issue Alignment
✅ Closes #1442. All three requirements are satisfied:
owasp-dockeris no longer shipped in any collection, plugin, or extension — enforced bymaturity: removedinsecurity.collection.ymland the tombstone removal fromhve-core-all.collection.yml.- The permanent guard in
Update-HveCoreAllCollection(maturity propagation with strictest-wins logic) prevents re-discovery by auto-generators. - All narrative references (
security-reviewer.agent.md,codebase-profiler.agent.md,skill-assessor.agent.md,finding-deep-verifier.agent.md,security-review.prompt.md,CUSTOM-AGENTS.md) are scrubbed.
PR Template Compliance
✅ Description is substantive and clearly explains intent, execution flow, and success indicators.
✅ Closes #1442 is present.
✅ Type of Change checkboxes are checked and match the actual diff contents.
✅ Testing section documents npm run test:ps (2036/0) and npm run lint:all results.
✅ The unchecked validate:skills item is appropriately annotated as a pre-existing, unrelated failure.
Coding Standards
scripts/tests/linting/Schemas-RemovedMaturity.Tests.ps1— the copyright header appears before#Requires -Modules Pester. Every other test file in the repository and the pester instructions specify the reverse ordering.Test-RemovedMaturityExclusion.Tests.ps1, added in the same PR, correctly follows the convention.
Code Quality
✅ Schema changes are minimal and accurate — removed is added to both the collection-level and item-level maturity enums in collection-manifest.schema.json, with updated descriptions. The skill-frontmatter.schema.json change is a no-op (trailing newline only), consistent with the documented design that artifact frontmatter intentionally does not carry a maturity field.
✅ Update-HveCoreAllCollection maturity propagation — the strictest-maturity-wins logic (removed > deprecated > preview > stable) is correct. The loop correctly iterates all source collection manifests to propagate tombstones into the aggregated manifest.
✅ Validate-Collections.ps1 tombstone exemptions — both Check 4 (themed-but-absent-from-canonical) and the orphan check are correctly gated on $activeThemedMatches / $themedRemoved to avoid false positives for intentional tombstones.
✅ Test coverage is thorough: unit tests cover all four modified scripts (CollectionHelpers, Validate-Collections, Find-CollectionManifests, Prepare-Extension), the two new schema tests validate enum inclusion, and Test-RemovedMaturityExclusion.Tests.ps1 provides a regression guard against leaked plugin artifacts.
💡 Advisory Observations
Undisclosed bundled scope: The PR includes changes not mentioned in the PR description or in Issue #1442:
rai-risk-classification.instructions.mdis added todata-science,project-planning, andsecuritycollection YAMLs and regenerated plugins.Validate-Collections.ps1addsrai-planningto$sharedSubdomainFoldersto suppress validation warnings for that new addition.
These changes appear correct in isolation — the rai-planning subdomain exemption is needed precisely because those items are now referenced in collections — but their absence from the PR description and linked issue makes the PR harder to audit. Future PRs bundling unrelated collection additions alongside a focused infrastructure change would benefit from an "Additional Changes" section in the description.
Action Items
- Fix header order in
scripts/tests/linting/Schemas-RemovedMaturity.Tests.ps1(see inline comment). This is the only actionable finding; everything else is informational.
- rename $matches automatic variable in Test-RemovedMaturityExclusion.Tests.ps1 - add rai-planning item to hve-core-all manifest fixture to satisfy orphan check 🛠️ - Generated by Copilot
There was a problem hiding this comment.
Advisory review — this PR is from a maintainer. Findings are informational only.
Overview
This PR cleanly implements the removed maturity tier and retires owasp-docker from all distribution surfaces. The design decision to make removed a collection-manifest-only marker (rather than a per-artifact frontmatter field) is well-reasoned and consistently applied across schema validation, plugin generation, extension packaging, and the hve-core-all aggregation step. Test coverage is thorough, the regression guard in Test-RemovedMaturityExclusion.Tests.ps1 is a solid safety net, and the rai-risk-classification distribution additions are a clean, self-contained addition.
Issue Alignment ✅
PR fully addresses #1442:
removedtier added to both schema enums (collection-level and item-level).owasp-dockerretired fromsecurity,hve-core-all, all plugin outputs, agent narratives, and prompts.- Auto-generator cannot re-introduce the skill via
Update-HveCoreAllCollection. SKILL.mdcarries a YAML comment documenting the CC-BY-NC-SA-4.0 incompatibility rationale.
⚠️ Design deviation from issue scope table: The issue proposed addingGet-ArtifactSourceMaturityandTest-ArtifactRemovedas named functions inCollectionHelpers.psm1. The PR instead inlines the propagation logic directly inUpdate-HveCoreAllCollection. This is a valid trade-off — the end-to-end regression test compensates for the lack of unit-testable named functions — but worth noting in case reviewers expected those symbols to exist.
PR Template Compliance ✅
All required sections are filled. Checked types (New feature, Breaking change, Documentation update, AI Artifacts) match the actual diff. The explicit note on validate:skills being pre-existing and unrelated is well-documented.
Coding Standards
⚠️ Test header ordering — Schemas-RemovedMaturity.Tests.ps1
See inline comment at line 1. #Requires -Modules Pester must precede the copyright block in test files. This is the only test file in the PR with the wrong ordering.
💡 Stale docstring — Update-HveCoreAllCollection
.SYNOPSIS still reads "Auto-updates hve-core-all.collection.yml with all non-deprecated artifacts" and .DESCRIPTION still says "excludes deprecated items". Now that removed items are also excluded, both should say "non-deprecated, non-removed" (or similar). Not a blocking issue, but the docstring will mislead the next reader.
.SYNOPSIS
Auto-updates hve-core-all.collection.yml with all active (non-deprecated, non-removed) artifacts.
.DESCRIPTION
Discovers all artifacts from .github/ directories, excludes deprecated and removed items,
and rewrites the hve-core-all collection manifest. ...💡 $maturityRank missing experimental — undocumented intent
See inline comment at line 513 of CollectionHelpers.psm1. The omission is functionally correct but would benefit from a single-line comment explaining that it's intentional.
Code Quality ✅
No bugs, security issues, or performance concerns found. The strictest-maturity-wins algorithm is correct. The $sharedSubdomainFolders hashtable in Validate-Collections.ps1 is a clean generalisation of the previous single-string guard.
Action Items
| Priority | Item |
|---|---|
| 🔧 Minor | Fix #Requires / copyright ordering in Schemas-RemovedMaturity.Tests.ps1 |
| 💡 Advisory | Update Update-HveCoreAllCollection docstring to mention removed exclusion |
| 💡 Advisory | Add clarifying comment to $maturityRank about the intentional absence of experimental |
## Pre-Release 3.3.101 ### ✨ Features - add removed maturity tier and retire owasp-docker (#1444) - add evaluation dataset creator (#1279) - align RAI planner with guide, remove scoring, improve UX (#1287) - add PSGallery staleness check and BOM cleanup (#1379) - ISA-95 network planner agent (#1177) - auto-generate collection.md with maturity filtering (#1316) - add folder-consistency check and standardize WARN outp… (#1350) - add synth-data-generate prompt to data-science collection (#1419) - add canonical deck workflow and customer-card rendering for design thinking (#1413) - add Figma MCP integration for DT artifact export (#1222) - introduce `owasp-docker` (#1245) - replace hve-core-specific references with portable discovery-based language (#1335) - introduce `owasp-cicd` (#1246) - add secure-by-design knowledge skill (#1223) - introduce `owasp-infrastructure` (#1244) - introduce `owasp-mcp` (#1207) - add OutputPath parameter to Invoke-LinkLanguageCheck.ps1 (#1229) - add -OutputPath parameter to Validate-SkillStructure.ps1 (#1225) - add maintainer-only skip-review label guard (#1293) - add extension collections overview and integrate into getting started flow (#950) - add agentic workflows for automated issue triage, implementation, PR review, dependency review, and doc-staleness detection (#1219) - consolidate package-lock.json version sync into Update-VersionFiles.ps1 (#1240) - add standards code review agent and full review orchestrator (#1174) - standardize pytest-mock as Python mocking framework (#1170) - add Jira backlog workflows and Jira/GitLab skills (#978) - add centralized version bump script and supply-chain attestation (#1183) ### 🐛 Bug Fixes - pin PowerShell-Yaml to 0.4.7 across all install sites (#1378) - close fork-PR/workflow-file-PR secret-strip gap and normalize upload-artifact version (#1421) - replace stream-based lookahead with array indexing in list-changed-files.sh (#1376) - centralize ISO 8601 timestamp regex in CIHelpers (#1343) - update stale documentation date in release-process.md (#1363) - pin basic-ftp to 5.3.0 to resolve GHSA-rp42-5vxx-qpwr (#1374) - add bot filter to dependency PR review workflow (#1362) - resolve pip-audit findings in powerpoint, gitlab, and jira skill lock files (#1360) - standardize Timestamp JSON key casing across all lint result files (#1314) - add synchronize trigger to PR Review workflow (#1323) - standardize timestamp in Validate-SkillStructure.ps1 to use Get-StandardTimestamp (#1280) - add parallel subagent dispatch and structured JSON contracts to code-review-full (#1304) - standardize timestamp in SecurityHelpers.psm1 to use Get-StandardTimestamp (#1284) - standardize timestamps in Test-DependencyPinning.ps1 and SecurityClasses.psm1 (#1282) - derive collection artifact counts from YAML at build time (#1275) - standardize timestamp in FrontmatterValidation.psm1 to use Get-StandardTimestamp (#1285) - standardize timestamp in Markdown-Link-Check.ps1 to use Get-StandardTimestamp (#1283) - escape hyphens in Mermaid diagram on Collections page (#1262) - add summary timestamp to PSScriptAnalyzer output (#1211) - fix plugin compatibility and robustness for coding-standards code review agents (#1289) - standardize timestamp in Test-CopyrightHeaders.ps1 to use Get-StandardTimestamp (#1278) - standardize timestamp in Invoke-YamlLint.ps1 to use Get-StandardTimestamp (#1270) - standardize timestamp in Invoke-LinkLanguageCheck.ps1 to use Get-StandardTimestamp (#1264) - fix dependency-review path filters and sparse-checkout cone mode (#1259) - replace invalid bare tool names with official tool identifiers (#1198) - fix broken links and remove orphaned reference in code review docs (#1257) - exclude Python env dirs from skill validation warnings (#1255) - pin happy-dom and serialize-javascript to resolve Dependabot vulnerabilities (#1253) - remove Mermaid diagram and add missing collection cards (#1247) - disable MCP servers by default to prevent token limit errors (#1144) - sync package-lock.json after pre-release version bump (#1236) - separate mermaid node declarations and add dynamic diagram generation with tests (#1215) - replace anchor links in meeting-analyst with bold text references (#1201) - remove recursive symlinks in jira and gitlab skill directories (#1233) - validate-installation scripts now check .github/skills directory (#1010) (#1206) - resolve npm audit vulnerabilities via dependency overrides (#1200) - add post-release triggers to scorecard workflow (#1186) - add missing .md extensions to relative links in agent documentation (#1180) ### 📚 Documentation - broaden Security Review description beyond OWASP (#1385) - document maintainer advisory mode and skip-review label guard (#1386) - document ExcludePaths/OutputPath for Invoke-LinkLanguageCheck (#1383) - CLI getting-started: clarify plugin install commands as alternatives (-all vs base) (#1251) ### ♻️ Refactoring - align agent and prompt folder names to collection identifier (#1210) ### 🔧 Maintenance - pin PSScriptAnalyzer to 1.25.0 and sync stale workflow version comments (#1389) - bump lxml from 6.0.2 to 6.1.0 in /.github/skills/experimental/powerpoint (#1424) - bump @vscode/vsce from 3.7.1 to 3.9.1 in the npm-dependencies group (#1390) - bump the github-actions group across 1 directory with 7 updates (#1391) - bump follow-redirects from 1.15.11 to 1.16.0 in /docs/docusaurus (#1356) - upgrade Node.js from 20 to 24 and bump cspell to v10 (#1353) - bump basic-ftp from 5.2.0 to 5.2.1 (#1324) - update github/gh-aw-actions requirement to 536ea1bad8c6715d098a9dc1afea8d403733acfe in the github-actions group across 1 directory (#1298) - update security instruction attributions and compliance (#1294) - bump the npm-dependencies group with 2 updates (#1297) - pre-release 3.3.41 (#1252) - streamline RAI Planner phase structure and documentation (#1273) - bump happy-dom from 20.8.8 to 20.8.9 in /docs/docusaurus (#1237) - pre-release 3.3.27 (#1191) - bump pygments from 2.19.2 to 2.20.0 in /.github/skills/gitlab/gitlab (#1234) - bump path-to-regexp from 0.1.12 to 0.1.13 in /docs/docusaurus (#1226) - bump the github-actions group with 4 updates (#1231) - add missing folders and alphabetize location lists (#1193) - bump brace-expansion (#1224) - bump handlebars from 4.7.8 to 4.7.9 in /docs/docusaurus (#1217) - bump brace-expansion from 5.0.3 to 5.0.5 in /docs/docusaurus (#1213) - pre-release 3.3.10 (#1187) - bump markdownlint-cli2 from 0.21.0 to 0.22.0 in the npm-dependencies group (#1175) - bump the github-actions group with 3 updates (#1176) - pre-release 3.3.1 (#1165) --- *Managed automatically by pre-release workflow.* Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
6 participants
Description
Introduces a new
removedmaturity tier that soft-retires GHCP skills from collection bundling, plugin generation, and extension packaging while preserving source files in the repository for historical reference. Applies the new tier to theowasp-dockerskill, whose CC-BY-NC-SA-4.0 source license is incompatible with extension distribution. Removes downstream references in the security reviewer agents, the security review prompt, thehve-core-allandsecuritycollection manifests, and the regenerated plugin outputs. Backed by JSON schema updates and Pester coverage across collection helpers, extension preparation, plugin generation, and schema enforcement.Also propagates
maturity: removedfrom source collections through thehve-core-allaggregation step (strictest-maturity wins), adds a defensive Pester regression test, and bundles in unrelated working-tree updates that landed alongside this branch: distribution of therai-risk-classificationinstructions to thedata-science,project-planning, andsecuritycollections, plus refinements toValidate-Collections.ps1and its tests.Related Issue(s)
Closes #1442
Type of Change
Select all that apply:
Code & Documentation:
Infrastructure & Configuration:
AI Artifacts:
prompt-builderagent and addressed all feedback.github/instructions/*.instructions.md).github/prompts/*.prompt.md).github/agents/*.agent.md).github/skills/*/SKILL.md)Other:
.ps1,.sh,.py)Sample Prompts (for AI Artifact Contributions)
User Request:
"Run a security review on this repository."
Execution Flow:
security-revieweragent loads its skills list. With this PR,owasp-dockeris no longer present in the resolution constants, the skills enum, or the codebase-profiler technology signal table.codebase-profilersubagent walks the repository for technology signals. Docker-related files (Dockerfile,docker-compose.*,.dockerignore,Containerfile,docker-bake.hcl) no longer trigger inclusion of the retired skill.skill-assessorandfinding-deep-verifiersubagents validate against the reduced skill enum.removed, and thehve-core-allaggregation step now propagates the strictest source maturity so retired items cannot leak back in.Output Artifacts:
plugins/hve-core-all/andplugins/security/no longer containskills/security/owasp-dockersymlinks.plugins/{data-science,project-planning,security}/now include therai-risk-classificationinstructions.Success Indicators:
npm run plugin:validatepasses with no references toowasp-docker.npm run validate:skillspasses with the newmaturity: removedvalue accepted by the skill frontmatter schema.npm run test:pspasses the newSchemas-RemovedMaturityandTest-RemovedMaturityExclusiontests and the extended collection, extension, and plugin test suites.Testing
npm run test:ps— passes including the newTest-RemovedMaturityExclusion.Tests.ps1regression coverage.npm run lint:all— pre-existing warning surfaced incustomer-card-rendertemplates/that is unrelated to this change; no new failures introduced by this branch.npm run plugin:generate+npm run plugin:validate— 13 plugins generated, 241 items inhve-core-all, zeroowasp-dockerreferences inplugins/.plugins/{hve-core-all,security}/skills/security/owasp-dockersymlinks are removed and that collection markdown/yaml files no longer reference the skill.Checklist
Required Checks
AI Artifact Contributions
/prompt-analyzeto review contributionprompt-builderreviewRequired Automated Checks
The following validation commands must pass before merging:
npm run lint:mdnpm run spell-checknpm run lint:frontmatternpm run validate:skills— pre-existing failure oncustomer-card-rendertemplates/subdirectory; unrelated to this PR and should be tracked separately.npm run lint:md-linksnpm run lint:psnpm run plugin:generate(drift folded into merge commit)npm run docs:test(102/102 passing)Security Considerations
Additional Notes
The intentional breaking change retires the
owasp-dockerskill from distribution due to its CC-BY-NC-SA-4.0 source license. Source files remain in.github/skills/security/owasp-docker/for historical reference but are excluded from collection bundling, plugin generation, and extension packaging via the newremovedmaturity tier anduser-invocable: falseflag.The latest commit on this branch additionally:
maturity: removedfrom source collections into the auto-generatedhve-core-allcollection so retired items are filtered before plugin generation.scripts/tests/plugins/Test-RemovedMaturityExclusion.Tests.ps1to prevent future regressions where retired skills reappear in generated plugins.rai-risk-classificationinstructions to thedata-science,project-planning, andsecuritycollections (with regenerated plugin outputs).scripts/collections/Validate-Collections.ps1and its Pester tests.