Add the dev-workflow:sparring advisory skill (0.14.0)

AGENTS.md

@@ -41,7 +41,7 @@ scripts/check-version-bump.test.sh # its regression suite — policy/operational
 plugins/dev-workflow/
   .claude-plugin/plugin.json      # metadata only — no component keys (invariant 6)
   CHANGELOG.md                    # every manifest version, newest first
-  skills/{intake,harden-finding}/SKILL.md
+  skills/{intake,harden-finding,sparring}/SKILL.md
   agents/finding-triage.md        # read-only PR-comment checker (convention-loaded)
   commands/{workflow-init,process-pr-review,claude-init}.md
   hooks/{hooks.json,codex-gate.sh,codex-gate.test.sh}

README.md

@@ -20,6 +20,7 @@ Why each of these, and how to adapt them: [`docs/coding-workflow.md`](docs/codin
 |---|---|
 | `dev-workflow:intake` | skill — a raw idea or voice transcript (German or English) becomes a reviewable story. Captures WHAT and WHY; refuses to invent the parts that aren't there. |
 | `dev-workflow:harden-finding` | skill — one review finding becomes a lint rule, type constraint, test, or documented convention, at the right rung, recorded in the ledger. |
+| `dev-workflow:sparring` | skill — invoked by name only, in a chat you open for advice: investigates read-only, checks agent reports against the current files, and drafts bounded prompts for a coding agent to run elsewhere. It advises; it does not implement, commit, or run review gates. |
 | `/dev-workflow:process-pr-review` | command — validates PR bot comments against the code and your invariants, replies to each, fixes regressions, tracks pre-existing issues. |
 | `dev-workflow:finding-triage` | agent — read-only, fresh context, judges whether one PR-bot claim is actually true of the code. Used by the PR processor; never counts as a review gate. |
 | `/dev-workflow:workflow-init` | command — scaffolds the per-project files, then interviews you to write `AGENTS.md`. |

docs/architecture.md

@@ -20,7 +20,7 @@ scripts/check-version-bump.sh     # invariant 12, PR-only, mechanically (+ .test
 plugins/dev-workflow/
   .claude-plugin/plugin.json
   CHANGELOG.md                    # every manifest version, newest first
-  skills/{intake,harden-finding}/SKILL.md
+  skills/{intake,harden-finding,sparring}/SKILL.md
   agents/finding-triage.md
   commands/{workflow-init,process-pr-review,claude-init}.md
   hooks/{hooks.json,codex-gate.sh,codex-gate.test.sh}

docs/hardening-log.md

@@ -126,3 +126,4 @@ escape `\|`, one line), `source` (gate-a|gate-b|bot|manual),
 | 2026-09-02 | docs-drift | seventh occurrence: PR #26 (CodeRabbit) — the dark-factory vision document, sitting on the same branch, still said the kit "has a fixed 3-pass floor", listed the review-economics story as "in flight" twice, and made both claims about the very change the branch ships. Every sentence was true when written and false the moment the branch merged. NEW SUB-SHAPE, and it is why this row exists rather than a note: the standing lens was carried on this cycle and the falsified file is one the diff never touches — it is not in the changed-path set, so nothing scoped to the diff could reach it, and the lens's own recipe (grep for where each changed value is described elsewhere) was run against `CLAUDE.md`'s vocabulary and not against the branch's other documents | bot | major | 1 prose | The lens now names the branch, not the diff, as its search surface: a document added or edited **anywhere on the same branch** can be falsified by a change it does not contain, and a co-shipped design document describing the current state of the thing being changed is the likeliest instance. PRIOR ROW: 2026-08-16 docs-drift (1 prose), and 2026-08-04 (P std) whose guard asks what the diff changes the size, value or position of — this finding is INSIDE that guard and outside its reach at once: the value did change and was described elsewhere, but "elsewhere" was scoped to the changed paths by everyone who ran it, including me. Repaired at the same rung, not escalated. NO DETERMINISTIC RUNG EXISTS: nothing can tell that a design document's description of current state went stale, and widening the grep to the whole branch is a recipe a human runs. It raises the floor and does not close the class |
 | 2026-09-02 | verification-masks-failure | fifth occurrence: PR #26 (CodeRabbit) — Plan C task 25's completion assert tested only that the provisional wording was ABSENT (`grep -c … -eq 0`). A replacement that deleted the provisional passage and wrote no closed record at all would have passed it, which is precisely the outcome the task exists to prevent. The task did run correctly this cycle, so the mask never fired; it was found by reading, not by failing | bot | major | 4 test | The assert gained a positive arm beside the negative one: the closed curves must be PRESENT, with a cardinality floor (`grep -cE '^Findings( +[0-9]+,?)+' … -ge 3`). PRIOR ROWS under this fingerprint all share one shape — a check whose only assertion is that something is gone. WHAT GENERALIZES: an absence assert is half a check whenever the edit it guards is a replacement rather than a deletion, and the missing half is always the same one. This row's remedy is specific to task 25; the general form belongs to the loop-rule consolidation story, which owns the plan-assert conventions |
 | 2026-09-25 | missing-input-validation | first row of this base class here: PR #27 (Greptile P1, thread 4091660211) — `/dev-workflow:claude-init` filled an unconstrained project name into the create command's shell here-document; a name with a line break could put the fixed delimiter on its own line, end the document early and run the rest of the name and the template as shell. Confirmed as transport under sh and dash with a harmless marker, not as an end-to-end command run | bot | blocker | 1 prose | claude-init.md *Writing* step 2 now states the rule (one line, no Unicode `Cc` character, every name source, ask on failure, nothing sanitized) and gives a Python check for a directory-derived name; spec §2 carries it. AGENTS.md Don'ts gains the class-level rule: data spliced into shell source a prompt tells the agent to run must be bounded, with the rule, the check and the failure path stated. Does NOT guard: the rule is agent-followed — the create script does not validate the name, and a user-given name is checked by reading. NO DETERMINISTIC RUNG EXISTS: nothing mechanical can tell which prompt text becomes shell source; it is a reading check |
+| 2026-09-30 | docs-drift | eighth occurrence: PR #32 (Greptile P2) — the sparring-skill spec said "The eight walkthrough scenarios … the last two were added by pass 1" above a list numbering twelve; the second Gate-A repair round added 9–12 and left the count sentence. Gate-A spec pass 3 had already found it and collected it as a NIT, so detection held and only the collect-only triage let it ship. Fixed in the same PR (the sentence now says twelve and names which round added which). | bot | nit | 1 prose | No new text: the existing guard already covers it — CLAUDE.md §5 Gate-B lens, "Name what this diff changes the size, value or position of … and grep for where each is described elsewhere", which a Gate-A repair that grows an enumerated list should apply to its own count sentence. NO DETERMINISTIC RUNG EXISTS for this shape: the rung-2 count lint (2026-07-26 row) matches only the "all N checklist items" spelling, and docs/superpowers/ is excluded from it on purpose as dated records. Recorded so the recurrence count stays true; escalate if a count-vs-list drift ships from a shipped prompt rather than a historical artifact. PRIOR ROW: 2026-09-02 docs-drift (1 prose). |

docs/sparring-briefing.md

@@ -101,9 +101,17 @@ over "the report says". Decisions the human makes on your recommendation must
 end up in the repo (spec decision records, todos triggers, ledger rows) — a
 decision that lives only in this chat does not exist.
 
-## What this document is not
+## What this document is, and what the plugin ships
 
-Not a plugin feature, not scaffolded by `/workflow-init`, and not a template —
-it is one project's hand-written instance. If the pattern proves itself across
-several projects, promoting it to a scaffolded template is a todos entry with a
-trigger, not a reflex.
+This document is still one project's hand-written instance: not scaffolded by
+`/workflow-init`, not a template, and not read by any plugin component.
+
+**The role itself was promoted.** `dev-workflow:sparring` ships the advisory posture as an
+explicitly invoked skill, so a consumer project gets the front door without getting this
+repository's documentation. That promotion happened by a maintainer's decision, not because
+a recorded trigger fired — the earlier text asked for a todos entry with a trigger, and
+there was none. Recorded here so the history is not tidier than it was.
+
+The skill reads an optional `docs/SPARRING-PARTNER.md` for local context and treats its
+absence as ordinary. This briefing stays where it is, for this repository, and nothing
+scaffolds it.