Pin vendor skills for CC lane messaging, evals and logs - #852

Scope

Pin the maintainers' hcom-agent-messaging, promptfoo-evals and loki skills for command-center and native lane work. Their descriptions add 890 characters; the repository counter reports Claude 10,374/10,500 and Codex 10,055. Keep promql deferred to the owner's cap decision and keep the runtime-worker selection at 134 skills with explicit exclusions for these three lane picks.

The decision compares each vendor workflow with native documentation/operation routes and maintained community definitions. Promptfoo's skill uses the supported profile's 0.123.1 source revision; its entire folder is identical at 0.124.0, so the correction preserves the instructions and listing totals.

• Base commit: 28af9b9321d0492f6cdabe75091376560e7cdc4d.
• Lane: lane:foundation.
• Owned paths: the central skill manifest, both listing templates, worker skill manifest/README, lifecycle source/task catalog, refreshed foundation citation, renderer and affected tests, dated decision, and evidence registry hashes.

When loki appears in the native Claude skillOverrides map, the renderer's service-name check treats that key as a skill identifier. Actual Loki endpoints, MCP server references and override values remain checked for missing service wiring. The scan does not change the rendered configuration or declare Loki wired.

SOTA sources

• aannoo/hcom@b2a7c192003e7fd67ed93265289e4ac36276f965, release v0.7.28: skills/hcom-agent-messaging/SKILL.md and LICENSE.
• promptfoo/promptfoo@34f74d34e140b5e17d23770dfb2340057b1936b8, release 0.123.1: .claude/skills/promptfoo-evals/SKILL.md, its references and LICENSE. Whole folder tree 5c0e65e6c185b6a1ea6212626b8de5442193ed76 is identical at 0.124.0.
• grafana/skills@1ccacf29049fde66637fe01ab93a83a772da323b: skills/grafana-lgtm/loki/SKILL.md and LICENSE.
• Existing pinned install route: vercel-labs/skills@7407f3893ad4dceab546ac002c3ef806e4000c73, v1.7.0, as documented by adoption/skills/lifecycle.md.
• Existing integration reference: new_wsl_client_config.py at 0a243fc, its native settings/template contract and unchanged whole-word scanner; supported JSON parsing uses Python's standard json module.
• Scoped alternatives: wshobson/agents@46891e7e60da0e52baf1050b7b6391b64e84c6d9, evaluation and observability definitions; grafana/mcp-grafana@7514746a763b794ead31902b7821bf73280503b4, LogQL native operations; hcom bootstrap/help and Promptfoo MCP docs at their selected vendor pins. The decision names their coverage and selection-specific overturn conditions.

Evidence-class table

Local commands run

python3 -m unittest tests.test_skills_manifest tests.test_skills_status tests.test_landscape_sweep_skills tests.test_runtime_worker_skills
exit 0: 232 tests run, 2 skipped, 0 failures

python3 scripts/validate.py
exit 0: status passed; 69 components, 10,822 hashed files, 4 profiles, 226 receipts

git diff --check
exit 0

The existing renderer regression and endpoint/MCP/value controls also pass (four focused native methods). The decision retains failed conditions from initial local and hosted validation, including the source/task projections and the skill/service namespace collision. Marketplace scan verdicts remain Unknown; their links are locators.

Decision record

docs/decisions/2026-10-08-skills-cc-lanes-picks.md records the scoped source comparison, supported Promptfoo revision, counters, source-review correction, worker exclusions, inverse and per-selection overturn conditions. Applicability is source evidence; comparative outcomes and client invocation acceptance remain unmeasured.

Host evidence

Installation and invocation are deferred to the designated host shell outside Claude after this PR lands (CC plan row 31). This PR records no new skill use, evaluation, component install or live client settings change. The paper-runtime freeze and quiet window remain binding.

Checklist

• Vendor definitions are referenced at immutable commits; no body is vendored or rewritten.
• No GitHub Actions workflow changed.
• No secret value or private native transcript is committed.
• No paid hosting, subscription or billing surface introduced.
• Peer files and worktrees preserved.