Skip to content

feat: init runtime prompt, complete the devague chain, bind the associate lane - #2

Merged
OriNachum merged 2 commits into
mainfrom
feat/init-runtime-prompt-and-devague-chain
Sep 5, 2026
Merged

feat: init runtime prompt, complete the devague chain, bind the associate lane#2
OriNachum merged 2 commits into
mainfrom
feat/init-runtime-prompt-and-devague-chain

Conversation

@OriNachum

Copy link
Copy Markdown
Contributor

What this does

Three things that turned out to be one thing: this repo was a guild create scaffold whose CLAUDE.md was still the /init seed, whose devague skill chain was missing a leg and split across two upstreams, and whose culture.yaml named a model it does not run on.

1. Completed the devague chain

Added validate-delivery (leg 7) — the missing step between assign-to-workforce and summarize-delivery. Without it, summarize-delivery had to make delivery claims with no filed evidence behind them.

Re-vendored all eight chain skills from devague 0.24.1. Previously think / spec-to-plan / assign-to-workforce cited guildmaster's re-broadcast while the other four cited devague directly. The chain is one workflow — syncing it from two upstreams let three legs lag the other five by a re-broadcast cycle. All eight now cite the origin, and guildmaster's copies carry added scripts/ wrappers the originals don't have, which is the second reason not to cite them.

Verified byte-identical to origin for seven; assign-to-workforce differs by exactly the documented agexdevex re-application (2 occurrences). The re-sync script in docs/skill-sources.md now re-applies it automatically.

2. Bound the agent to the lane it actually runs on

culture.yaml: model: sakamakismile/Qwen3.6-27B-Text-NVFP4-MTPmodel: associate.

That pin was never a decision made for this agent — it's the culture-agent-template default carried by ~50 sibling repos in the workspace, and it names the cortex checkpoint.

associate is a first-class lobes role — the tenth Colleague-facing lobe (lobes/roles.py), backed by nvidia/NVIDIA-Nemotron-3.5-Lightning-30B-A3B-NVFP4, defined there as worker minus repo_action: it executes, drafts, inspects and calls tools, then hands the result back rather than enacting it. Its forbidden set — final_decision, security_decision, code_authoring, repo_action — is this repo's remit stated in someone else's registry.

Naming the role rather than the checkpoint is deliberate: the gateway resolves it to whichever box hosts it, so the lane can move or re-checkpoint without touching this repo.

Measured topology:

colleague default base_url  http://localhost:8001/v1
  └─ lobes gateway (DGX Spark)
       ASSOCIATE_FEASIBLE=false   ASSOCIATE_PEER_PROXY=true
       ASSOCIATE_PEER_ORIGIN=<orin>:8000
         └─ Jetson AGX Orin 64GB, shape `orin-associate`
              associate: feasible=true ready=true loaded=true

Verified live: model=associate through the gateway returns completions served by the Lightning checkpoint.

3. Re-initialized CLAUDE.md and rewrote README.md

CLAUDE.md now carries the four load-bearing CLI contract invariants, the four places that must stay in sync when adding a verb (and why the rubric gate fails otherwise), build/test/lint/publish commands, the skills convention, the ../.worktrees.associate/ rule, the steward doctor invariants, and the runtime topology.

README.md is rewritten reader-facing on the devague README model — mermaid diagram of the chain and its three human gates, verb/skill/tooling tables.

Honest about state

Both docs say plainly that the harness itself is not built: no read verb, no summarize verb, no find verb, no web fetch. Nothing here takes work off colleague yet. The CHANGELOG.md entries before 0.8.0 are template history with names substituted, not things that happened in this repo — also recorded.

The seed additionally claimed this repo satisfies prompt-file-present via CLAUDE.md + backend: claude. It does not: backend: colleague, so AGENTS.colleague.md is the resident prompt and CLAUDE.md is for Claude Code sessions working on the repo.

Recorded, not worked around

A fleet-side defect, deliberately not compensated for in repo code: the Orin advertises the associate lane on its /v1/models under the checkpoint id, while the gateway's ASSOCIATE_SERVED_NAME=associate. probe_peer_ready compares exactly those two strings, so the readiness probe fails — the gateway reports ready=false, loaded=false and omits the role from its own /v1/models, even though the data plane proxies it correctly. The lane works when addressed explicitly but is invisible to model discovery. Fix belongs in the deployment env.

One inherited inconsistency also left recorded rather than guessed at: the remember skill's SKILL.md frontmatter describes a private home-dir memory default that its own scripts/remember.sh overrides to public/in-repo. The script is authoritative; the fix goes upstream in eidetic-cli.

Sibling alignment (devex pr delta)

Triaged; two candidates for follow-up issues, not yet filed:

  • devague — its assign-to-workforce still says agex pr open in 2 places. The CLI was renamed to devex, so every consumer re-applies the same patch on every sync. Fixing it upstream retires the one adaptation in this repo's ledger.
  • lobes-cli — the served-name asymmetry above: the Orin advertises cortex by role name but the associate lane by checkpoint id. Arguably a gateway-side consistency bug, not just deployment config.

No sibling needs a change to merge this.

Verification

  • uv run pytest -n auto — 22 passed

  • uv run teken cli doctor . --strict — 26/26 PASS

  • black / isort / flake8 / bandit — clean

  • markdownlint-cli2 — 0 errors

  • devex pr lint — no violations

  • uv run associate doctor — healthy

  • Version bumped 0.7.0 → 0.8.0

  • associate (Claude)

…iate lane

Re-initializes CLAUDE.md from the /init seed into a full runtime prompt,
re-vendors all eight devague-chain skills from their origin, and points
culture.yaml at the lobes `associate` role the agent actually runs on.

Skills:
- Add `validate-delivery` (leg 7) — the missing step between
  assign-to-workforce and summarize-delivery. Without it summarize-delivery
  made delivery claims with no filed evidence behind them.
- Re-vendor all eight chain skills from devague 0.24.1. Previously three
  (think, spec-to-plan, assign-to-workforce) cited guildmaster's re-broadcast
  while the rest cited devague directly; the chain is one workflow and two
  upstreams let three legs lag the other five by a re-broadcast cycle.
  Verified byte-identical to origin except the documented agex -> devex
  re-application in assign-to-workforce (2 occurrences).

Identity:
- culture.yaml: model `sakamakismile/Qwen3.6-27B-Text-NVFP4-MTP` ->
  `associate`. That pin was the culture-agent-template default carried by
  ~50 sibling repos, and it names the *cortex* checkpoint. `associate` is a
  first-class lobes role backed by
  nvidia/NVIDIA-Nemotron-3.5-Lightning-30B-A3B-NVFP4, defined in
  lobes/roles.py as `worker` MINUS `repo_action`. Naming the role rather
  than the checkpoint lets the lane move boxes without touching this repo.
  Verified live: model=associate through the gateway returns completions
  served by the Lightning checkpoint.

Docs:
- CLAUDE.md: the four load-bearing CLI contract invariants, the four places
  that must stay in sync when adding a verb, build/test/lint/publish
  commands, the skills convention, the ../.worktrees.associate/ rule, the
  steward doctor invariants, and the measured runtime topology. States
  plainly that the harness itself (read/summarize/find) is not built yet.
- README.md: rewritten reader-facing on the devague model.
- docs/skill-sources.md: eight chain rows in flow order, an eight-skill
  divergence section, devague and eidetic added to prerequisites.

Records rather than works around a fleet-side defect: the Orin advertises
the associate lane under its checkpoint id while the gateway's
ASSOCIATE_SERVED_NAME=associate, so probe_peer_ready fails and the role is
omitted from /v1/models despite the data plane proxying it correctly.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XnbT37FDJGW1rFcgTXPe5C
@OriNachum

Copy link
Copy Markdown
Contributor Author

/agentic_review

@qodo-code-review

Copy link
Copy Markdown

PR Summary by Qodo

Complete the devague workflow and bind the associate runtime role

✨ Enhancement 📝 Documentation ⚙️ Configuration changes 🕐 40+ Minutes

Grey Divider

AI Description

• Adds behavioral delivery validation to complete the eight-leg devague workflow.
• Re-vendors the complete skill chain directly from devague 0.24.1.
• Replaces scaffold documentation and binds execution to the portable associate role.
Diagram

graph TD
  S["Scope"] --> T["Think"] --> C["Challenge"] --> P["Spec to Plan"] --> A["Assign Workforce"] --> D["Deviate"] --> V["Validate Delivery"] --> Z["Summarize Delivery"]
Loading
High-Level Assessment

Vendoring all eight workflow legs directly from their devague origin is the most coherent approach under the repository's cite-don't-import policy. Continuing to source three legs through guildmaster was considered but would retain re-broadcast lag and introduce wrapper differences for method-only skills. The documented, automated agex to devex re-application keeps the sole consumer-specific adaptation reproducible.

Files changed (18) +2130 / -284

Enhancement (9) +1408 / -142
SKILL.mdExpand workforce assignment into a durable, evidence-aware execution leg +251/-31

Expand workforce assignment into a durable, evidence-aware execution leg

• Documents enriched task briefs, repository-scoped worktrees, durable split-plan artifacts, immediate lapse reporting, and the post-merge validation handoff. Updates provenance to cite devague directly while retaining the documented 'devex' adaptation.

.claude/skills/assign-to-workforce/SKILL.md

assign-to-workforce.shGenerate enriched split plans and durable assignment artifacts +456/-30

Generate enriched split plans and durable assignment artifacts

• Extends 'split-plan' with task metadata, deliverables, model proposals, and an optional '--write' artifact. Preserves edited owner/model assignments across regeneration and safely renders free-form plan content as markdown.

.claude/skills/assign-to-workforce/scripts/assign-to-workforce.sh

SKILL.mdAlign challenge guidance with the complete workflow +40/-8

Align challenge guidance with the complete workflow

• Adds the validation leg to the documented chain, next-move guidance, and immediate reasoning-lapse filing. Clarifies the challenge skill's neighboring workflow stages and deterministic recording boundaries.

.claude/skills/challenge/SKILL.md

SKILL.mdRoute execution deviations through delivery validation +24/-8

Route execution deviations through delivery validation

• Updates the method to eight legs and directs completed execution through 'validate-delivery' before summarization. Adds explicit neighboring-leg and immediate-recording guidance.

.claude/skills/deviate/SKILL.md

SKILL.mdAdd scalable read-only scope exploration guidance +76/-10

Add scalable read-only scope exploration guidance

• Introduces inline exploration for small surveys and read-only subagent fan-out for broader ones, while reserving devague mutations for the main agent. Documents question provenance, scope amendments, and next-move hints.

.claude/skills/scope/SKILL.md

SKILL.mdDocument richer plans and verbatim workforce briefs +129/-19

Document richer plans and verbatim workforce briefs

• Adds task instructions, amendments, deferrals, live coverage, deliverables, and enriched waves metadata to the planning method. Clarifies honest coverage, export hygiene, workflow handoffs, and direct devague provenance.

.claude/skills/spec-to-plan/SKILL.md

SKILL.mdGround delivery summaries in validation and lapse evidence +55/-15

Ground delivery summaries in validation and lapse evidence

• Places summarization after 'validate-delivery' and incorporates approved reasoning lapses into delivery-claim confidence. Updates read-only CLI boundaries, chain ordering, and current-spec projection guidance.

.claude/skills/summarize-delivery/SKILL.md

SKILL.mdExpand specification framing and challenge handoff guidance +135/-21

Expand specification framing and challenge handoff guidance

• Documents scope provenance, claim instructions and amendments, decision resolution, convergence warnings, and export hygiene. Routes converged specifications through 'challenge' before planning and updates direct-origin provenance.

.claude/skills/think/SKILL.md

SKILL.mdAdd the behavioral delivery validation skill +242/-0

Add the behavioral delivery validation skill

• Introduces leg seven of the devague workflow, running behavioral tests agent-side and filing obligations, evidence, failures, and behavioral deltas through record-only CLI moves. It supports complete, partial, and failed runs before handing evidence to delivery summarization.

.claude/skills/validate-delivery/SKILL.md

Documentation (6) +678 / -109
spec-to-plan.shCorrect the spec-to-plan provenance broadcaster +1/-1

Correct the spec-to-plan provenance broadcaster

• Changes the script comment from steward to guildmaster to match the current devague broadcast path.

.claude/skills/spec-to-plan/scripts/spec-to-plan.sh

think.shCorrect the think skill provenance broadcaster +1/-1

Correct the think skill provenance broadcaster

• Updates the script's provenance comment to identify guildmaster rather than steward as the broadcaster.

.claude/skills/think/scripts/think.sh

CHANGELOG.mdDocument the 0.8.0 workflow and runtime changes +105/-0

Document the 0.8.0 workflow and runtime changes

• Adds release notes for delivery validation, direct devague synchronization, the associate role binding, and the rewritten runtime and reader documentation. It also records the known fleet-side model-discovery defect.

CHANGELOG.md

CLAUDE.mdReplace the bootstrap seed with a complete repository guide +371/-19

Replace the bootstrap seed with a complete repository guide

• Rewrites the placeholder into a runtime-oriented contributor guide covering project status, model topology, CLI contracts, development commands, skill provenance, worktrees, and memory conventions. It explicitly distinguishes the resident colleague prompt from Claude Code guidance.

CLAUDE.md

README.mdDescribe the scaffold, runtime role, and complete skill workflow +113/-29

Describe the scaffold, runtime role, and complete skill workflow

• Reframes the project around the associate lobes role while clearly stating that the harness verbs are not implemented yet. Adds the eight-leg workflow, available CLI and skills, tooling prerequisites, and contribution expectations.

README.md

skill-sources.mdSynchronize provenance for the complete devague chain +87/-59

Synchronize provenance for the complete devague chain

• Records all eight skills as direct devague 0.24.1 vendors in workflow order and adds 'validate-delivery'. The resync procedure now copies the chain atomically and automatically reapplies the two 'agex' to 'devex' substitutions.

docs/skill-sources.md

Other (3) +44 / -33
culture.yamlBind the agent to the associate lobes role +12/-1

Bind the agent to the associate lobes role

• Replaces the inherited cortex checkpoint identifier with the portable 'associate' role. Comments document role resolution, current hosting topology, and the role's non-enacting responsibility boundary.

culture.yaml

pyproject.tomlBump the package version to 0.8.0 +1/-1

Bump the package version to 0.8.0

• Advances the project version from 0.7.0 to 0.8.0 for the workflow and configuration release.

pyproject.toml

uv.lockRefresh the lockfile for version 0.8.0 +31/-31

Refresh the lockfile for version 0.8.0

• Updates the editable associate package entry to version 0.8.0 while retaining the existing development dependency set.

uv.lock

@qodo-code-review

qodo-code-review Bot commented Sep 5, 2026

Copy link
Copy Markdown

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📜 Skill insights (0)

Grey Divider


Action required

1. Runtime prompt violates role ✓ Resolved 🐞 Bug ≡ Correctness
Description
Selecting the associate role activates a lane whose documented forbidden capabilities include
code_authoring and repo_action, but the actual colleague runtime prompt explicitly directs it to
use write_file, edit_file, and run_command. The resident can therefore enact repository
changes despite the role's defining hand-back-only restriction.
Code

culture.yaml[15]

+  model: associate
Evidence
The changed configuration selects associate; CLAUDE.md defines that role as forbidding code
authoring and repository actions and identifies AGENTS.colleague.md as the active resident prompt,
while that prompt explicitly grants write, edit, and command tools.

culture.yaml[13-15]
CLAUDE.md[59-66]
CLAUDE.md[98-103]
AGENTS.colleague.md[3-10]

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The selected `associate` role forbids code authoring and repository actions, while the active colleague runtime prompt authorizes writing, editing, and command execution.

## Issue Context
`backend: colleague` makes `AGENTS.colleague.md` the resident runtime prompt. Update the runtime instructions and, where configurable locally, tool permissions so the resident may inspect and draft but must hand results back without modifying repositories or enacting decisions.

## Fix Focus Areas
- culture.yaml[13-15]
- AGENTS.colleague.md[3-10]
- CLAUDE.md[59-66]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools


2. Deliverables failures are hidden ✗ Dismissed 🐞 Bug ☼ Reliability
Description
split-plan discards stderr and converts every nonzero devague plan deliverables result into an
“older devague” hint, including invalid-plan, configuration, permission, and other operational
failures. It then exits successfully—and in --write mode persists an artifact without the real end
state—so gate approval can proceed from incomplete information.
Code

.claude/skills/assign-to-workforce/scripts/assign-to-workforce.sh[R276-278]

+    deliverables_out="$("${DEVAGUE[@]}" plan deliverables "${extra_args[@]}" 2>/dev/null)"
+    deliverables_rc=$?
+    set -e
Evidence
The command redirects stderr to /dev/null, records only its status, and maps every failure to the
same compatibility hint. By contrast, the preceding waves invocation captures and returns its real
error, while the skill documentation describes this fallback only for an older CLI lacking the verb.

.claude/skills/assign-to-workforce/scripts/assign-to-workforce.sh[267-287]
.claude/skills/assign-to-workforce/scripts/assign-to-workforce.sh[144-160]
.claude/skills/assign-to-workforce/scripts/assign-to-workforce.sh[320-335]
.claude/skills/assign-to-workforce/SKILL.md[379-384]

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The split-plan wrapper treats every deliverables failure as an unsupported-command compatibility case and suppresses the actual diagnostic.

## Issue Context
Capture stderr separately. Degrade only when the CLI specifically reports that `plan deliverables` is unavailable; otherwise print the diagnostic, return the original nonzero status, and do not write an incomplete gate artifact.

## Fix Focus Areas
- .claude/skills/assign-to-workforce/scripts/assign-to-workforce.sh[267-287]
- .claude/skills/assign-to-workforce/scripts/assign-to-workforce.sh[320-324]
- .claude/skills/assign-to-workforce/scripts/assign-to-workforce.sh[581-603]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools


3. Validation commands remain provisional ✗ Dismissed 🐞 Bug ≡ Correctness
Description
The new validation leg instructs agents to execute oblige, evidence, and delta command shapes
while explicitly admitting their flags are illustrative placeholders awaiting another schema task.
Following this skill against the declared devague installation can therefore fail or file records
incorrectly, preventing the newly required validation handoff.
Code

.claude/skills/validate-delivery/SKILL.md[R91-93]

+minimal placeholders while the underlying schema lands in a parallel task;
+treat the verb names as stable and the flags as illustrative, and reconcile
+against `devague explain <move>` once that task merges.
Evidence
The skill itself states that the command shapes are placeholders and the flags illustrative, but
immediately publishes them as its CLI surface and later tells agents to run them. The repository
only declares a PATH-level devague prerequisite and does not pin or bundle an implementation that
establishes this provisional syntax.

.claude/skills/validate-delivery/SKILL.md[86-106]
.claude/skills/validate-delivery/SKILL.md[144-173]
docs/skill-sources.md[195-201]
CLAUDE.md[298-305]
pyproject.toml[14-17]

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The new skill exposes provisional devague command shapes as executable workflow steps even though their schema has not landed or been verified.

## Issue Context
Replace placeholders with the exact command surface supported by the declared minimum devague version. Verify the commands end-to-end and keep the prerequisite version, command table, and worked example synchronized; if the schema is unavailable, do not add this leg as an executable skill yet.

## Fix Focus Areas
- .claude/skills/validate-delivery/SKILL.md[86-106]
- .claude/skills/validate-delivery/SKILL.md[144-173]
- docs/skill-sources.md[195-201]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools



Remediation recommended

4. Resync can delete skills ✓ Resolved 🐞 Bug ☼ Reliability
Description
The documented re-sync loop deletes each local skill before confirming that its sibling source
exists or that copying succeeds, and it has no fail-fast behavior. In the explicitly supported
standalone-clone case, a missing ../devague checkout therefore leaves vendored skills deleted
while the loop continues.
Code

docs/skill-sources.md[R177-179]

+for s in $CHAIN; do
  rm -rf .claude/skills/$s
  cp -R ../devague/.claude/skills/$s .claude/skills/
Evidence
The added loop performs rm -rf before cp -R and lacks set -e or explicit checks. CLAUDE.md
separately warns that the referenced sibling paths are not guaranteed to exist in standalone clones.

docs/skill-sources.md[168-189]
CLAUDE.md[22-25]

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The re-sync procedure destructively removes vendored skills before validating all source directories and does not stop when a copy fails.

## Issue Context
Make the snippet fail fast, verify every source before changing the repository, copy into temporary directories first, and replace existing skills only after all copies succeed.

## Fix Focus Areas
- docs/skill-sources.md[168-189]
- CLAUDE.md[22-25]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools


5. culture.yaml lacks Claude backend ✗ Dismissed 📘 Rule violation § Compliance
Description
The updated configuration selects the associate model while retaining backend: colleague and
provides no top-level backend: claude. This violates the required Claude backend configuration.
Code

culture.yaml[15]

+  model: associate
Evidence
PR Compliance ID 3115649 requires a top-level backend: claude. The updated file instead contains
only an agents entry configured with backend: colleague, and the changed model: associate
binds the new configuration to that noncompliant backend.

Rule 3115649: Require culture.yaml to set backend to claude
culture.yaml[12-15]

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`culture.yaml` does not define the required top-level `backend: claude`; its only backend remains the agent-level `colleague` value.

## Issue Context
PR Compliance ID 3115649 requires the top-level `backend` value to be exactly `claude`. Ensure the model and surrounding configuration remain valid after changing the backend.

## Fix Focus Areas
- culture.yaml[1-15]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools


6. Gate artifact writes nonatomically ✗ Dismissed 🐞 Bug ☼ Reliability
Description
The durable split record is overwritten directly with Path.write_text, which truncates the
existing file before the replacement is complete. An interruption or write failure can therefore
destroy the human-edited Owner/Model assignments that the new feature promises to preserve across
regeneration.
Code

.claude/skills/assign-to-workforce/scripts/assign-to-workforce.sh[R606-608]

+out_dir.mkdir(parents=True, exist_ok=True)
+action = "updated" if out_path.exists() else "wrote"
+out_path.write_text(content, encoding="utf-8")
Evidence
The script first reads prior assignments from the destination, then calls write_text directly on
that same path with no temporary-file replacement. The skill describes the output as a durable
gate-2 record and promises that human assignment edits survive regeneration.

.claude/skills/assign-to-workforce/scripts/assign-to-workforce.sh[489-517]
.claude/skills/assign-to-workforce/scripts/assign-to-workforce.sh[605-609]
.claude/skills/assign-to-workforce/SKILL.md[144-151]

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The script truncates and rewrites the durable gate artifact in place, risking loss of preserved human assignments on interruption or write failure.

## Issue Context
Render into a temporary file in `docs/plans`, flush it, and atomically replace the destination only after the complete write succeeds. Preserve destination permissions where appropriate and clean up the temporary file on failure.

## Fix Focus Areas
- .claude/skills/assign-to-workforce/scripts/assign-to-workforce.sh[489-517]
- .claude/skills/assign-to-workforce/scripts/assign-to-workforce.sh[605-609]
- .claude/skills/assign-to-workforce/SKILL.md[144-151]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools


View medium (1)
7. Multiline summaries corrupt artifact ✗ Dismissed 🐞 Bug ≡ Correctness
Description
split-plan --write inserts an untrusted task summary directly into an ATX heading, but
safe_heading() does not normalize newlines. A multiline summary can introduce arbitrary headings
(including ## Task assignments), producing a malformed split artifact and causing a later
regeneration to read the wrong assignment block.
Code

.claude/skills/assign-to-workforce/scripts/assign-to-workforce.sh[R563-564]

+        summary = meta.get("summary") or "(no summary recorded)"
+        lines.append(f"### {tid} — {safe_heading(summary)}")
Evidence
The new writer obtains summary from the waves payload and interpolates it directly after ###.
Its heading sanitizer has no newline replacement or validation, while the read-back parser
identifies the assignment section solely by the literal ## Task assignments heading; therefore a
newline-bearing summary can create structural headings that change what is parsed on the next run.

.claude/skills/assign-to-workforce/scripts/assign-to-workforce.sh[449-486]
.claude/skills/assign-to-workforce/scripts/assign-to-workforce.sh[489-517]
.claude/skills/assign-to-workforce/scripts/assign-to-workforce.sh[561-565]

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`split-plan --write` embeds task summaries in Markdown headings without handling embedded newlines. This permits plan metadata to alter the generated document structure and can interfere with `parse_existing_assignments()` on a subsequent run.

## Issue Context
`safe_heading()` only applies punctuation, autolink, and inline Markdown escaping; it leaves newline characters intact. Task summaries are then interpolated into `###` headings.

## Fix Focus Areas
- `.claude/skills/assign-to-workforce/scripts/assign-to-workforce.sh[449-486]`
- `.claude/skills/assign-to-workforce/scripts/assign-to-workforce.sh[561-565]`
- `.claude/skills/assign-to-workforce/scripts/assign-to-workforce.sh[489-517]`

Normalize heading metadata to a single line (or reject/control-escape line breaks) before interpolation. Apply the same rule to the plan title, and preserve full multiline task content only in an explicitly indented/body-safe section if needed.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools


Grey Divider

Context sources
✅ Compliance rules (platform): 3 rules
✅ Skills: cicd
Review mode: 🧠 Deep: This is a dense, cross-cutting change spanning eight workflow skills, executable wrappers, runtime/model configuration, and repository instructions, creating many independent opportunities for subtle behavior, integration, and provenance errors.

Grey Divider

Tip of the day
💡 Did you know, you can keep summaries lean with Finding overflow, which tucks the rest behind 'View more'

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

Grey Divider

Qodo Logo

Comment thread culture.yaml
Comment thread culture.yaml
Comment thread .claude/skills/validate-delivery/SKILL.md
Comment thread .claude/skills/assign-to-workforce/scripts/assign-to-workforce.sh
Comment thread docs/skill-sources.md Outdated
Comment thread .claude/skills/assign-to-workforce/scripts/assign-to-workforce.sh
Comment thread .claude/skills/assign-to-workforce/scripts/assign-to-workforce.sh
…-safe

Addresses Qodo review comments 3941632225 and 3941632235 on PR #2.

- AGENTS.colleague.md: the `associate` lobes role forbids `repo_action` and
  `code_authoring`, but the resident prompt directed the agent to use
  write_file / edit_file / run_command — so binding culture.yaml to the role
  created a resident that could enact repo changes despite the role's
  hand-back-only definition. The prompt now names the permitted and forbidden
  sets explicitly and states that having a tool is not authorization to use
  it; drafts go back in the `finish` payload.

- docs/skill-sources.md: the re-sync loop deleted each vendored skill before
  confirming its source existed, with no fail-fast — in the standalone-clone
  case (no ../devague) it stripped all eight chain skills and copied nothing
  back. Now runs under `set -euo pipefail`, verifies every source first, and
  stages all copies before swapping any.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XnbT37FDJGW1rFcgTXPe5C
@sonarqubecloud

sonarqubecloud Bot commented Sep 5, 2026

Copy link
Copy Markdown

@OriNachum
OriNachum merged commit ffe2afc into main Sep 5, 2026
8 checks passed
@OriNachum
OriNachum deleted the feat/init-runtime-prompt-and-devague-chain branch September 5, 2026 19:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant