From f1a287703a14c52e897674c65f225fdd9df0d6a9 Mon Sep 17 00:00:00 2001 From: Jarek Potiuk Date: Sun, 3 May 2026 19:40:36 +0200 Subject: [PATCH] feat(skills): hook every framework skill into override-consultation protocol MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Each of the 15 framework skills (excluding setup-steward, the bootstrap that is itself the override-management mechanism) now declares an `## Adopter overrides` section that pins the skill into the agentic-overrides protocol documented in docs/setup/agentic-overrides.md. The standard block in every skill: ## Adopter overrides Before running the default behaviour documented below, this skill consults [`.apache-steward-overrides/.md`](../../../docs/setup/agentic-overrides.md) in the adopter repo if it exists, and applies any agent-readable overrides it finds. See [`docs/setup/agentic-overrides.md`](../../../docs/setup/agentic-overrides.md) for the contract — what overrides may contain, hard rules, the reconciliation flow on framework upgrade, upstreaming guidance. **Hard rule**: agents NEVER modify the snapshot under `/.apache-steward/`. Local modifications go in the override file. Framework changes go via PR to `apache/airflow-steward`. Skills updated (15): setup-isolated-setup-install security-issue-import setup-isolated-setup-update security-issue-import-from-md setup-isolated-setup-verify security-issue-import-from-pr setup-shared-config-sync security-issue-invalidate security-issue-sync pr-management-code-review security-cve-allocate pr-management-stats security-issue-deduplicate pr-management-triage security-issue-fix Skill not updated: setup-steward — the bootstrap skill is itself the override-management mechanism. Overriding it would create a chicken-and-egg. Per-skill substitution: the bracketed link target carries the specific skill name (e.g. `pr-management-triage.md` for the pr-management-triage skill), so adopter overrides land in the right file by convention. Insertion site is the line immediately before the first `##` section in each SKILL.md — after the detail-files table where present, before any `## Golden rules` / `## Inputs` / `## Prerequisites` section. doctoc TOCs regenerated. Generated-by: Claude Code (Claude Opus 4.7) --- .../skills/pr-management-code-review/SKILL.md | 19 +++++++++++++++++++ .claude/skills/pr-management-stats/SKILL.md | 19 +++++++++++++++++++ .claude/skills/pr-management-triage/SKILL.md | 19 +++++++++++++++++++ .claude/skills/security-cve-allocate/SKILL.md | 19 +++++++++++++++++++ .../security-issue-deduplicate/SKILL.md | 19 +++++++++++++++++++ .claude/skills/security-issue-fix/SKILL.md | 19 +++++++++++++++++++ .../security-issue-import-from-md/SKILL.md | 19 +++++++++++++++++++ .../security-issue-import-from-pr/SKILL.md | 19 +++++++++++++++++++ .claude/skills/security-issue-import/SKILL.md | 19 +++++++++++++++++++ .../skills/security-issue-invalidate/SKILL.md | 19 +++++++++++++++++++ .claude/skills/security-issue-sync/SKILL.md | 19 +++++++++++++++++++ .../setup-isolated-setup-install/SKILL.md | 19 +++++++++++++++++++ .../setup-isolated-setup-update/SKILL.md | 19 +++++++++++++++++++ .../setup-isolated-setup-verify/SKILL.md | 19 +++++++++++++++++++ .../skills/setup-shared-config-sync/SKILL.md | 19 +++++++++++++++++++ 15 files changed, 285 insertions(+) diff --git a/.claude/skills/pr-management-code-review/SKILL.md b/.claude/skills/pr-management-code-review/SKILL.md index 71f8c8d19..436bd4789 100644 --- a/.claude/skills/pr-management-code-review/SKILL.md +++ b/.claude/skills/pr-management-code-review/SKILL.md @@ -60,6 +60,25 @@ Detail files in this directory break the logic out topic-by-topic: --- +## Adopter overrides + +Before running the default behaviour documented +below, this skill consults +[`.apache-steward-overrides/pr-management-code-review.md`](../../../docs/setup/agentic-overrides.md) +in the adopter repo if it exists, and applies any +agent-readable overrides it finds. See +[`docs/setup/agentic-overrides.md`](../../../docs/setup/agentic-overrides.md) +for the contract — what overrides may contain, hard +rules, the reconciliation flow on framework upgrade, +upstreaming guidance. + +**Hard rule**: agents NEVER modify the snapshot under +`/.apache-steward/`. Local modifications +go in the override file. Framework changes go via PR +to `apache/airflow-steward`. + +--- + ## Adopter configuration This skill resolves project-specific content from the adopter's diff --git a/.claude/skills/pr-management-stats/SKILL.md b/.claude/skills/pr-management-stats/SKILL.md index 657e3f613..d696feffe 100644 --- a/.claude/skills/pr-management-stats/SKILL.md +++ b/.claude/skills/pr-management-stats/SKILL.md @@ -46,6 +46,25 @@ Detail files: --- +## Adopter overrides + +Before running the default behaviour documented +below, this skill consults +[`.apache-steward-overrides/pr-management-stats.md`](../../../docs/setup/agentic-overrides.md) +in the adopter repo if it exists, and applies any +agent-readable overrides it finds. See +[`docs/setup/agentic-overrides.md`](../../../docs/setup/agentic-overrides.md) +for the contract — what overrides may contain, hard +rules, the reconciliation flow on framework upgrade, +upstreaming guidance. + +**Hard rule**: agents NEVER modify the snapshot under +`/.apache-steward/`. Local modifications +go in the override file. Framework changes go via PR +to `apache/airflow-steward`. + +--- + ## Adopter configuration This skill reads the same area-label prefix and triage-marker diff --git a/.claude/skills/pr-management-triage/SKILL.md b/.claude/skills/pr-management-triage/SKILL.md index 8599d55aa..9345bb552 100644 --- a/.claude/skills/pr-management-triage/SKILL.md +++ b/.claude/skills/pr-management-triage/SKILL.md @@ -69,6 +69,25 @@ directory break the logic out topic-by-topic: --- +## Adopter overrides + +Before running the default behaviour documented +below, this skill consults +[`.apache-steward-overrides/pr-management-triage.md`](../../../docs/setup/agentic-overrides.md) +in the adopter repo if it exists, and applies any +agent-readable overrides it finds. See +[`docs/setup/agentic-overrides.md`](../../../docs/setup/agentic-overrides.md) +for the contract — what overrides may contain, hard +rules, the reconciliation flow on framework upgrade, +upstreaming guidance. + +**Hard rule**: agents NEVER modify the snapshot under +`/.apache-steward/`. Local modifications +go in the override file. Framework changes go via PR +to `apache/airflow-steward`. + +--- + ## Adopter configuration This skill resolves project-specific content from the adopter's diff --git a/.claude/skills/security-cve-allocate/SKILL.md b/.claude/skills/security-cve-allocate/SKILL.md index 5fc31b3c0..c1e6d4fbd 100644 --- a/.claude/skills/security-cve-allocate/SKILL.md +++ b/.claude/skills/security-cve-allocate/SKILL.md @@ -88,6 +88,25 @@ change comment must all follow the link-form convention from --- +## Adopter overrides + +Before running the default behaviour documented +below, this skill consults +[`.apache-steward-overrides/security-cve-allocate.md`](../../../docs/setup/agentic-overrides.md) +in the adopter repo if it exists, and applies any +agent-readable overrides it finds. See +[`docs/setup/agentic-overrides.md`](../../../docs/setup/agentic-overrides.md) +for the contract — what overrides may contain, hard +rules, the reconciliation flow on framework upgrade, +upstreaming guidance. + +**Hard rule**: agents NEVER modify the snapshot under +`/.apache-steward/`. Local modifications +go in the override file. Framework changes go via PR +to `apache/airflow-steward`. + +--- + ## Inputs - **Issue number** (required) — `#242`, `242`, or a full diff --git a/.claude/skills/security-issue-deduplicate/SKILL.md b/.claude/skills/security-issue-deduplicate/SKILL.md index 5d88b622c..1ec6cdb17 100644 --- a/.claude/skills/security-issue-deduplicate/SKILL.md +++ b/.claude/skills/security-issue-deduplicate/SKILL.md @@ -62,6 +62,25 @@ explicitly. --- +## Adopter overrides + +Before running the default behaviour documented +below, this skill consults +[`.apache-steward-overrides/security-issue-deduplicate.md`](../../../docs/setup/agentic-overrides.md) +in the adopter repo if it exists, and applies any +agent-readable overrides it finds. See +[`docs/setup/agentic-overrides.md`](../../../docs/setup/agentic-overrides.md) +for the contract — what overrides may contain, hard +rules, the reconciliation flow on framework upgrade, +upstreaming guidance. + +**Hard rule**: agents NEVER modify the snapshot under +`/.apache-steward/`. Local modifications +go in the override file. Framework changes go via PR +to `apache/airflow-steward`. + +--- + ## Inputs | Selector | Resolves to | diff --git a/.claude/skills/security-issue-fix/SKILL.md b/.claude/skills/security-issue-fix/SKILL.md index 7695cb90e..1e1f35fb2 100644 --- a/.claude/skills/security-issue-fix/SKILL.md +++ b/.claude/skills/security-issue-fix/SKILL.md @@ -75,6 +75,25 @@ absolute rule in --- +## Adopter overrides + +Before running the default behaviour documented +below, this skill consults +[`.apache-steward-overrides/security-issue-fix.md`](../../../docs/setup/agentic-overrides.md) +in the adopter repo if it exists, and applies any +agent-readable overrides it finds. See +[`docs/setup/agentic-overrides.md`](../../../docs/setup/agentic-overrides.md) +for the contract — what overrides may contain, hard +rules, the reconciliation flow on framework upgrade, +upstreaming guidance. + +**Hard rule**: agents NEVER modify the snapshot under +`/.apache-steward/`. Local modifications +go in the override file. Framework changes go via PR +to `apache/airflow-steward`. + +--- + ## Inputs Before running the skill, you need: diff --git a/.claude/skills/security-issue-import-from-md/SKILL.md b/.claude/skills/security-issue-import-from-md/SKILL.md index 4e9368e8f..e2b305e56 100644 --- a/.claude/skills/security-issue-import-from-md/SKILL.md +++ b/.claude/skills/security-issue-import-from-md/SKILL.md @@ -87,6 +87,25 @@ in the proposal so the user can scan and override. --- +## Adopter overrides + +Before running the default behaviour documented +below, this skill consults +[`.apache-steward-overrides/security-issue-import-from-md.md`](../../../docs/setup/agentic-overrides.md) +in the adopter repo if it exists, and applies any +agent-readable overrides it finds. See +[`docs/setup/agentic-overrides.md`](../../../docs/setup/agentic-overrides.md) +for the contract — what overrides may contain, hard +rules, the reconciliation flow on framework upgrade, +upstreaming guidance. + +**Hard rule**: agents NEVER modify the snapshot under +`/.apache-steward/`. Local modifications +go in the override file. Framework changes go via PR +to `apache/airflow-steward`. + +--- + ## Prerequisites Before running, the skill needs: diff --git a/.claude/skills/security-issue-import-from-pr/SKILL.md b/.claude/skills/security-issue-import-from-pr/SKILL.md index 4d718345a..b67e494db 100644 --- a/.claude/skills/security-issue-import-from-pr/SKILL.md +++ b/.claude/skills/security-issue-import-from-pr/SKILL.md @@ -83,6 +83,25 @@ neutral bug-fix language, no `CVE-`, no *"vulnerability"* or --- +## Adopter overrides + +Before running the default behaviour documented +below, this skill consults +[`.apache-steward-overrides/security-issue-import-from-pr.md`](../../../docs/setup/agentic-overrides.md) +in the adopter repo if it exists, and applies any +agent-readable overrides it finds. See +[`docs/setup/agentic-overrides.md`](../../../docs/setup/agentic-overrides.md) +for the contract — what overrides may contain, hard +rules, the reconciliation flow on framework upgrade, +upstreaming guidance. + +**Hard rule**: agents NEVER modify the snapshot under +`/.apache-steward/`. Local modifications +go in the override file. Framework changes go via PR +to `apache/airflow-steward`. + +--- + ## Prerequisites Before running, the skill needs: diff --git a/.claude/skills/security-issue-import/SKILL.md b/.claude/skills/security-issue-import/SKILL.md index 7fb023c80..549d564e7 100644 --- a/.claude/skills/security-issue-import/SKILL.md +++ b/.claude/skills/security-issue-import/SKILL.md @@ -96,6 +96,25 @@ applies in full. --- +## Adopter overrides + +Before running the default behaviour documented +below, this skill consults +[`.apache-steward-overrides/security-issue-import.md`](../../../docs/setup/agentic-overrides.md) +in the adopter repo if it exists, and applies any +agent-readable overrides it finds. See +[`docs/setup/agentic-overrides.md`](../../../docs/setup/agentic-overrides.md) +for the contract — what overrides may contain, hard +rules, the reconciliation flow on framework upgrade, +upstreaming guidance. + +**Hard rule**: agents NEVER modify the snapshot under +`/.apache-steward/`. Local modifications +go in the override file. Framework changes go via PR +to `apache/airflow-steward`. + +--- + ## Prerequisites Before running, the skill needs: diff --git a/.claude/skills/security-issue-invalidate/SKILL.md b/.claude/skills/security-issue-invalidate/SKILL.md index d84cb307e..15c131dc6 100644 --- a/.claude/skills/security-issue-invalidate/SKILL.md +++ b/.claude/skills/security-issue-invalidate/SKILL.md @@ -76,6 +76,25 @@ do not reach out to the PR author through any channel. --- +## Adopter overrides + +Before running the default behaviour documented +below, this skill consults +[`.apache-steward-overrides/security-issue-invalidate.md`](../../../docs/setup/agentic-overrides.md) +in the adopter repo if it exists, and applies any +agent-readable overrides it finds. See +[`docs/setup/agentic-overrides.md`](../../../docs/setup/agentic-overrides.md) +for the contract — what overrides may contain, hard +rules, the reconciliation flow on framework upgrade, +upstreaming guidance. + +**Hard rule**: agents NEVER modify the snapshot under +`/.apache-steward/`. Local modifications +go in the override file. Framework changes go via PR +to `apache/airflow-steward`. + +--- + ## Prerequisites Before running, the skill needs: diff --git a/.claude/skills/security-issue-sync/SKILL.md b/.claude/skills/security-issue-sync/SKILL.md index a866ca096..eddfc3fd9 100644 --- a/.claude/skills/security-issue-sync/SKILL.md +++ b/.claude/skills/security-issue-sync/SKILL.md @@ -83,6 +83,25 @@ the security framing of a public PR. --- +## Adopter overrides + +Before running the default behaviour documented +below, this skill consults +[`.apache-steward-overrides/security-issue-sync.md`](../../../docs/setup/agentic-overrides.md) +in the adopter repo if it exists, and applies any +agent-readable overrides it finds. See +[`docs/setup/agentic-overrides.md`](../../../docs/setup/agentic-overrides.md) +for the contract — what overrides may contain, hard +rules, the reconciliation flow on framework upgrade, +upstreaming guidance. + +**Hard rule**: agents NEVER modify the snapshot under +`/.apache-steward/`. Local modifications +go in the override file. Framework changes go via PR +to `apache/airflow-steward`. + +--- + ## Inputs Before running the skill, you need a **selector** that resolves to one diff --git a/.claude/skills/setup-isolated-setup-install/SKILL.md b/.claude/skills/setup-isolated-setup-install/SKILL.md index 06105b647..781e01a12 100644 --- a/.claude/skills/setup-isolated-setup-install/SKILL.md +++ b/.claude/skills/setup-isolated-setup-install/SKILL.md @@ -42,6 +42,25 @@ can say *"set up the secure agent setup"* in a fresh session and land in the right step-by-step flow without first reading the document. +## Adopter overrides + +Before running the default behaviour documented +below, this skill consults +[`.apache-steward-overrides/setup-isolated-setup-install.md`](../../../docs/setup/agentic-overrides.md) +in the adopter repo if it exists, and applies any +agent-readable overrides it finds. See +[`docs/setup/agentic-overrides.md`](../../../docs/setup/agentic-overrides.md) +for the contract — what overrides may contain, hard +rules, the reconciliation flow on framework upgrade, +upstreaming guidance. + +**Hard rule**: agents NEVER modify the snapshot under +`/.apache-steward/`. Local modifications +go in the override file. Framework changes go via PR +to `apache/airflow-steward`. + +--- + ## Golden rules - **Do not auto-run privilege-elevating commands.** Anything that diff --git a/.claude/skills/setup-isolated-setup-update/SKILL.md b/.claude/skills/setup-isolated-setup-update/SKILL.md index 8ac504bbd..e9c15cd88 100644 --- a/.claude/skills/setup-isolated-setup-update/SKILL.md +++ b/.claude/skills/setup-isolated-setup-update/SKILL.md @@ -32,6 +32,25 @@ setup. It walks the canonical update-check at and surfaces what is older / newer / has drifted, without applying any change. +## Adopter overrides + +Before running the default behaviour documented +below, this skill consults +[`.apache-steward-overrides/setup-isolated-setup-update.md`](../../../docs/setup/agentic-overrides.md) +in the adopter repo if it exists, and applies any +agent-readable overrides it finds. See +[`docs/setup/agentic-overrides.md`](../../../docs/setup/agentic-overrides.md) +for the contract — what overrides may contain, hard +rules, the reconciliation flow on framework upgrade, +upstreaming guidance. + +**Hard rule**: agents NEVER modify the snapshot under +`/.apache-steward/`. Local modifications +go in the override file. Framework changes go via PR +to `apache/airflow-steward`. + +--- + ## Golden rules - **Read-only.** This skill does not bump the manifest, does not diff --git a/.claude/skills/setup-isolated-setup-verify/SKILL.md b/.claude/skills/setup-isolated-setup-verify/SKILL.md index 7ab30b1f4..3cf3d66fc 100644 --- a/.claude/skills/setup-isolated-setup-verify/SKILL.md +++ b/.claude/skills/setup-isolated-setup-verify/SKILL.md @@ -32,6 +32,25 @@ runs the checklist documented in and reports each check's status to the user with concrete evidence (file paths, command output, version strings). +## Adopter overrides + +Before running the default behaviour documented +below, this skill consults +[`.apache-steward-overrides/setup-isolated-setup-verify.md`](../../../docs/setup/agentic-overrides.md) +in the adopter repo if it exists, and applies any +agent-readable overrides it finds. See +[`docs/setup/agentic-overrides.md`](../../../docs/setup/agentic-overrides.md) +for the contract — what overrides may contain, hard +rules, the reconciliation flow on framework upgrade, +upstreaming guidance. + +**Hard rule**: agents NEVER modify the snapshot under +`/.apache-steward/`. Local modifications +go in the override file. Framework changes go via PR +to `apache/airflow-steward`. + +--- + ## Golden rules - **Read-only.** This skill does not edit any file, copy any diff --git a/.claude/skills/setup-shared-config-sync/SKILL.md b/.claude/skills/setup-shared-config-sync/SKILL.md index c58f031bc..b99cda21d 100644 --- a/.claude/skills/setup-shared-config-sync/SKILL.md +++ b/.claude/skills/setup-shared-config-sync/SKILL.md @@ -36,6 +36,25 @@ the framework's example `sync.sh` runs on a timer — that direction pulls *upstream* into the local clone; this skill pushes *local* modifications upstream. +## Adopter overrides + +Before running the default behaviour documented +below, this skill consults +[`.apache-steward-overrides/setup-shared-config-sync.md`](../../../docs/setup/agentic-overrides.md) +in the adopter repo if it exists, and applies any +agent-readable overrides it finds. See +[`docs/setup/agentic-overrides.md`](../../../docs/setup/agentic-overrides.md) +for the contract — what overrides may contain, hard +rules, the reconciliation flow on framework upgrade, +upstreaming guidance. + +**Hard rule**: agents NEVER modify the snapshot under +`/.apache-steward/`. Local modifications +go in the override file. Framework changes go via PR +to `apache/airflow-steward`. + +--- + ## Hardcoded path The sync repo lives at `~/.claude-config/`. This is the convention