From dbfe01e384071e008365b74f502a1e4bd3c0704a Mon Sep 17 00:00:00 2001 From: Jarek Potiuk Date: Mon, 4 May 2026 11:41:59 +0200 Subject: [PATCH] feat(skills): wire drift check into every framework skill's pre-flight MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Mirror of #39's override-consultation hook for the new drift-detection mechanism that landed in #40. Every framework skill (excluding setup-steward, which IS the drift mechanism) now declares a `## Snapshot drift` section right after its `## Adopter overrides` section. The standard block in every skill: ## Snapshot drift Also at the top of every run, this skill compares the gitignored `.apache-steward.local.lock` (per-machine fetch) against the committed `.apache-steward.lock` (the project pin). On mismatch the skill surfaces the gap and proposes [`/setup-steward upgrade`]. The proposal is non-blocking — the user may defer if they want to run with the local snapshot for now. Drift severity: - method or URL differ → ✗ full re-install - ref differs → ⚠ sync needed - svn-zip SHA-512 mismatches → ✗ security-flagged 15 skills updated: setup-isolated-setup-install security-issue-import setup-isolated-setup-update security-issue-import-from-md setup-isolated-setup-verify security-issue-import-from-pr setup-shared-config-sync security-issue-invalidate security-issue-sync pr-management-code-review security-cve-allocate pr-management-stats security-issue-deduplicate pr-management-triage security-issue-fix Skill not updated: setup-steward — IS the bootstrap + upgrade + verify + override-management skill; the drift check it would perform is the same one its `verify` sub-action exposes. The hook is documented behaviour, not runtime injection. A skill that has the `## Snapshot drift` section commits to performing the check when invoked. Future tooling can enforce mechanically; for now the convention is binding via the published contract. Generated-by: Claude Code (Claude Opus 4.7) --- .../skills/pr-management-code-review/SKILL.md | 23 +++++++++++++++++++ .claude/skills/pr-management-stats/SKILL.md | 23 +++++++++++++++++++ .claude/skills/pr-management-triage/SKILL.md | 23 +++++++++++++++++++ .claude/skills/security-cve-allocate/SKILL.md | 23 +++++++++++++++++++ .../security-issue-deduplicate/SKILL.md | 23 +++++++++++++++++++ .claude/skills/security-issue-fix/SKILL.md | 23 +++++++++++++++++++ .../security-issue-import-from-md/SKILL.md | 23 +++++++++++++++++++ .../security-issue-import-from-pr/SKILL.md | 23 +++++++++++++++++++ .claude/skills/security-issue-import/SKILL.md | 23 +++++++++++++++++++ .../skills/security-issue-invalidate/SKILL.md | 23 +++++++++++++++++++ .claude/skills/security-issue-sync/SKILL.md | 23 +++++++++++++++++++ .../setup-isolated-setup-install/SKILL.md | 23 +++++++++++++++++++ .../setup-isolated-setup-update/SKILL.md | 23 +++++++++++++++++++ .../setup-isolated-setup-verify/SKILL.md | 23 +++++++++++++++++++ .../skills/setup-shared-config-sync/SKILL.md | 23 +++++++++++++++++++ 15 files changed, 345 insertions(+) diff --git a/.claude/skills/pr-management-code-review/SKILL.md b/.claude/skills/pr-management-code-review/SKILL.md index 436bd4789..039c92723 100644 --- a/.claude/skills/pr-management-code-review/SKILL.md +++ b/.claude/skills/pr-management-code-review/SKILL.md @@ -79,6 +79,29 @@ to `apache/airflow-steward`. --- +## Snapshot drift + +Also at the top of every run, this skill compares the +gitignored `.apache-steward.local.lock` (per-machine +fetch) against the committed `.apache-steward.lock` +(the project pin). On mismatch the skill surfaces the +gap and proposes +[`/setup-steward upgrade`](../setup-steward/upgrade.md). +The proposal is non-blocking — the user may defer if +they want to run with the local snapshot for now. See +[`docs/setup/install-recipes.md` § Subsequent runs and drift detection](../../../docs/setup/install-recipes.md#subsequent-runs-and-drift-detection) +for the full flow. + +Drift severity: + +- **method or URL differ** → ✗ full re-install needed. +- **ref differs** (project bumped tag, or `git-branch` + local is behind upstream tip) → ⚠ sync needed. +- **`svn-zip` SHA-512 mismatches the committed + anchor** → ✗ security-flagged; investigate before + upgrading. + +--- ## Adopter configuration This skill resolves project-specific content from the adopter's diff --git a/.claude/skills/pr-management-stats/SKILL.md b/.claude/skills/pr-management-stats/SKILL.md index d696feffe..b1e881916 100644 --- a/.claude/skills/pr-management-stats/SKILL.md +++ b/.claude/skills/pr-management-stats/SKILL.md @@ -65,6 +65,29 @@ to `apache/airflow-steward`. --- +## Snapshot drift + +Also at the top of every run, this skill compares the +gitignored `.apache-steward.local.lock` (per-machine +fetch) against the committed `.apache-steward.lock` +(the project pin). On mismatch the skill surfaces the +gap and proposes +[`/setup-steward upgrade`](../setup-steward/upgrade.md). +The proposal is non-blocking — the user may defer if +they want to run with the local snapshot for now. See +[`docs/setup/install-recipes.md` § Subsequent runs and drift detection](../../../docs/setup/install-recipes.md#subsequent-runs-and-drift-detection) +for the full flow. + +Drift severity: + +- **method or URL differ** → ✗ full re-install needed. +- **ref differs** (project bumped tag, or `git-branch` + local is behind upstream tip) → ⚠ sync needed. +- **`svn-zip` SHA-512 mismatches the committed + anchor** → ✗ security-flagged; investigate before + upgrading. + +--- ## Adopter configuration This skill reads the same area-label prefix and triage-marker diff --git a/.claude/skills/pr-management-triage/SKILL.md b/.claude/skills/pr-management-triage/SKILL.md index 9345bb552..b18f6ca7c 100644 --- a/.claude/skills/pr-management-triage/SKILL.md +++ b/.claude/skills/pr-management-triage/SKILL.md @@ -88,6 +88,29 @@ to `apache/airflow-steward`. --- +## Snapshot drift + +Also at the top of every run, this skill compares the +gitignored `.apache-steward.local.lock` (per-machine +fetch) against the committed `.apache-steward.lock` +(the project pin). On mismatch the skill surfaces the +gap and proposes +[`/setup-steward upgrade`](../setup-steward/upgrade.md). +The proposal is non-blocking — the user may defer if +they want to run with the local snapshot for now. See +[`docs/setup/install-recipes.md` § Subsequent runs and drift detection](../../../docs/setup/install-recipes.md#subsequent-runs-and-drift-detection) +for the full flow. + +Drift severity: + +- **method or URL differ** → ✗ full re-install needed. +- **ref differs** (project bumped tag, or `git-branch` + local is behind upstream tip) → ⚠ sync needed. +- **`svn-zip` SHA-512 mismatches the committed + anchor** → ✗ security-flagged; investigate before + upgrading. + +--- ## Adopter configuration This skill resolves project-specific content from the adopter's diff --git a/.claude/skills/security-cve-allocate/SKILL.md b/.claude/skills/security-cve-allocate/SKILL.md index c1e6d4fbd..78ca386a1 100644 --- a/.claude/skills/security-cve-allocate/SKILL.md +++ b/.claude/skills/security-cve-allocate/SKILL.md @@ -107,6 +107,29 @@ to `apache/airflow-steward`. --- +## Snapshot drift + +Also at the top of every run, this skill compares the +gitignored `.apache-steward.local.lock` (per-machine +fetch) against the committed `.apache-steward.lock` +(the project pin). On mismatch the skill surfaces the +gap and proposes +[`/setup-steward upgrade`](../setup-steward/upgrade.md). +The proposal is non-blocking — the user may defer if +they want to run with the local snapshot for now. See +[`docs/setup/install-recipes.md` § Subsequent runs and drift detection](../../../docs/setup/install-recipes.md#subsequent-runs-and-drift-detection) +for the full flow. + +Drift severity: + +- **method or URL differ** → ✗ full re-install needed. +- **ref differs** (project bumped tag, or `git-branch` + local is behind upstream tip) → ⚠ sync needed. +- **`svn-zip` SHA-512 mismatches the committed + anchor** → ✗ security-flagged; investigate before + upgrading. + +--- ## Inputs - **Issue number** (required) — `#242`, `242`, or a full diff --git a/.claude/skills/security-issue-deduplicate/SKILL.md b/.claude/skills/security-issue-deduplicate/SKILL.md index 1ec6cdb17..6c74eec6f 100644 --- a/.claude/skills/security-issue-deduplicate/SKILL.md +++ b/.claude/skills/security-issue-deduplicate/SKILL.md @@ -81,6 +81,29 @@ to `apache/airflow-steward`. --- +## Snapshot drift + +Also at the top of every run, this skill compares the +gitignored `.apache-steward.local.lock` (per-machine +fetch) against the committed `.apache-steward.lock` +(the project pin). On mismatch the skill surfaces the +gap and proposes +[`/setup-steward upgrade`](../setup-steward/upgrade.md). +The proposal is non-blocking — the user may defer if +they want to run with the local snapshot for now. See +[`docs/setup/install-recipes.md` § Subsequent runs and drift detection](../../../docs/setup/install-recipes.md#subsequent-runs-and-drift-detection) +for the full flow. + +Drift severity: + +- **method or URL differ** → ✗ full re-install needed. +- **ref differs** (project bumped tag, or `git-branch` + local is behind upstream tip) → ⚠ sync needed. +- **`svn-zip` SHA-512 mismatches the committed + anchor** → ✗ security-flagged; investigate before + upgrading. + +--- ## Inputs | Selector | Resolves to | diff --git a/.claude/skills/security-issue-fix/SKILL.md b/.claude/skills/security-issue-fix/SKILL.md index 1e1f35fb2..3d8ca2b1c 100644 --- a/.claude/skills/security-issue-fix/SKILL.md +++ b/.claude/skills/security-issue-fix/SKILL.md @@ -94,6 +94,29 @@ to `apache/airflow-steward`. --- +## Snapshot drift + +Also at the top of every run, this skill compares the +gitignored `.apache-steward.local.lock` (per-machine +fetch) against the committed `.apache-steward.lock` +(the project pin). On mismatch the skill surfaces the +gap and proposes +[`/setup-steward upgrade`](../setup-steward/upgrade.md). +The proposal is non-blocking — the user may defer if +they want to run with the local snapshot for now. See +[`docs/setup/install-recipes.md` § Subsequent runs and drift detection](../../../docs/setup/install-recipes.md#subsequent-runs-and-drift-detection) +for the full flow. + +Drift severity: + +- **method or URL differ** → ✗ full re-install needed. +- **ref differs** (project bumped tag, or `git-branch` + local is behind upstream tip) → ⚠ sync needed. +- **`svn-zip` SHA-512 mismatches the committed + anchor** → ✗ security-flagged; investigate before + upgrading. + +--- ## Inputs Before running the skill, you need: diff --git a/.claude/skills/security-issue-import-from-md/SKILL.md b/.claude/skills/security-issue-import-from-md/SKILL.md index e2b305e56..f2c2847fb 100644 --- a/.claude/skills/security-issue-import-from-md/SKILL.md +++ b/.claude/skills/security-issue-import-from-md/SKILL.md @@ -106,6 +106,29 @@ to `apache/airflow-steward`. --- +## Snapshot drift + +Also at the top of every run, this skill compares the +gitignored `.apache-steward.local.lock` (per-machine +fetch) against the committed `.apache-steward.lock` +(the project pin). On mismatch the skill surfaces the +gap and proposes +[`/setup-steward upgrade`](../setup-steward/upgrade.md). +The proposal is non-blocking — the user may defer if +they want to run with the local snapshot for now. See +[`docs/setup/install-recipes.md` § Subsequent runs and drift detection](../../../docs/setup/install-recipes.md#subsequent-runs-and-drift-detection) +for the full flow. + +Drift severity: + +- **method or URL differ** → ✗ full re-install needed. +- **ref differs** (project bumped tag, or `git-branch` + local is behind upstream tip) → ⚠ sync needed. +- **`svn-zip` SHA-512 mismatches the committed + anchor** → ✗ security-flagged; investigate before + upgrading. + +--- ## Prerequisites Before running, the skill needs: diff --git a/.claude/skills/security-issue-import-from-pr/SKILL.md b/.claude/skills/security-issue-import-from-pr/SKILL.md index b67e494db..db0071b67 100644 --- a/.claude/skills/security-issue-import-from-pr/SKILL.md +++ b/.claude/skills/security-issue-import-from-pr/SKILL.md @@ -102,6 +102,29 @@ to `apache/airflow-steward`. --- +## Snapshot drift + +Also at the top of every run, this skill compares the +gitignored `.apache-steward.local.lock` (per-machine +fetch) against the committed `.apache-steward.lock` +(the project pin). On mismatch the skill surfaces the +gap and proposes +[`/setup-steward upgrade`](../setup-steward/upgrade.md). +The proposal is non-blocking — the user may defer if +they want to run with the local snapshot for now. See +[`docs/setup/install-recipes.md` § Subsequent runs and drift detection](../../../docs/setup/install-recipes.md#subsequent-runs-and-drift-detection) +for the full flow. + +Drift severity: + +- **method or URL differ** → ✗ full re-install needed. +- **ref differs** (project bumped tag, or `git-branch` + local is behind upstream tip) → ⚠ sync needed. +- **`svn-zip` SHA-512 mismatches the committed + anchor** → ✗ security-flagged; investigate before + upgrading. + +--- ## Prerequisites Before running, the skill needs: diff --git a/.claude/skills/security-issue-import/SKILL.md b/.claude/skills/security-issue-import/SKILL.md index 549d564e7..696d57e71 100644 --- a/.claude/skills/security-issue-import/SKILL.md +++ b/.claude/skills/security-issue-import/SKILL.md @@ -115,6 +115,29 @@ to `apache/airflow-steward`. --- +## Snapshot drift + +Also at the top of every run, this skill compares the +gitignored `.apache-steward.local.lock` (per-machine +fetch) against the committed `.apache-steward.lock` +(the project pin). On mismatch the skill surfaces the +gap and proposes +[`/setup-steward upgrade`](../setup-steward/upgrade.md). +The proposal is non-blocking — the user may defer if +they want to run with the local snapshot for now. See +[`docs/setup/install-recipes.md` § Subsequent runs and drift detection](../../../docs/setup/install-recipes.md#subsequent-runs-and-drift-detection) +for the full flow. + +Drift severity: + +- **method or URL differ** → ✗ full re-install needed. +- **ref differs** (project bumped tag, or `git-branch` + local is behind upstream tip) → ⚠ sync needed. +- **`svn-zip` SHA-512 mismatches the committed + anchor** → ✗ security-flagged; investigate before + upgrading. + +--- ## Prerequisites Before running, the skill needs: diff --git a/.claude/skills/security-issue-invalidate/SKILL.md b/.claude/skills/security-issue-invalidate/SKILL.md index 15c131dc6..9e5f8978d 100644 --- a/.claude/skills/security-issue-invalidate/SKILL.md +++ b/.claude/skills/security-issue-invalidate/SKILL.md @@ -95,6 +95,29 @@ to `apache/airflow-steward`. --- +## Snapshot drift + +Also at the top of every run, this skill compares the +gitignored `.apache-steward.local.lock` (per-machine +fetch) against the committed `.apache-steward.lock` +(the project pin). On mismatch the skill surfaces the +gap and proposes +[`/setup-steward upgrade`](../setup-steward/upgrade.md). +The proposal is non-blocking — the user may defer if +they want to run with the local snapshot for now. See +[`docs/setup/install-recipes.md` § Subsequent runs and drift detection](../../../docs/setup/install-recipes.md#subsequent-runs-and-drift-detection) +for the full flow. + +Drift severity: + +- **method or URL differ** → ✗ full re-install needed. +- **ref differs** (project bumped tag, or `git-branch` + local is behind upstream tip) → ⚠ sync needed. +- **`svn-zip` SHA-512 mismatches the committed + anchor** → ✗ security-flagged; investigate before + upgrading. + +--- ## Prerequisites Before running, the skill needs: diff --git a/.claude/skills/security-issue-sync/SKILL.md b/.claude/skills/security-issue-sync/SKILL.md index eddfc3fd9..2bd573f5c 100644 --- a/.claude/skills/security-issue-sync/SKILL.md +++ b/.claude/skills/security-issue-sync/SKILL.md @@ -102,6 +102,29 @@ to `apache/airflow-steward`. --- +## Snapshot drift + +Also at the top of every run, this skill compares the +gitignored `.apache-steward.local.lock` (per-machine +fetch) against the committed `.apache-steward.lock` +(the project pin). On mismatch the skill surfaces the +gap and proposes +[`/setup-steward upgrade`](../setup-steward/upgrade.md). +The proposal is non-blocking — the user may defer if +they want to run with the local snapshot for now. See +[`docs/setup/install-recipes.md` § Subsequent runs and drift detection](../../../docs/setup/install-recipes.md#subsequent-runs-and-drift-detection) +for the full flow. + +Drift severity: + +- **method or URL differ** → ✗ full re-install needed. +- **ref differs** (project bumped tag, or `git-branch` + local is behind upstream tip) → ⚠ sync needed. +- **`svn-zip` SHA-512 mismatches the committed + anchor** → ✗ security-flagged; investigate before + upgrading. + +--- ## Inputs Before running the skill, you need a **selector** that resolves to one diff --git a/.claude/skills/setup-isolated-setup-install/SKILL.md b/.claude/skills/setup-isolated-setup-install/SKILL.md index 781e01a12..d33f85130 100644 --- a/.claude/skills/setup-isolated-setup-install/SKILL.md +++ b/.claude/skills/setup-isolated-setup-install/SKILL.md @@ -61,6 +61,29 @@ to `apache/airflow-steward`. --- +## Snapshot drift + +Also at the top of every run, this skill compares the +gitignored `.apache-steward.local.lock` (per-machine +fetch) against the committed `.apache-steward.lock` +(the project pin). On mismatch the skill surfaces the +gap and proposes +[`/setup-steward upgrade`](../setup-steward/upgrade.md). +The proposal is non-blocking — the user may defer if +they want to run with the local snapshot for now. See +[`docs/setup/install-recipes.md` § Subsequent runs and drift detection](../../../docs/setup/install-recipes.md#subsequent-runs-and-drift-detection) +for the full flow. + +Drift severity: + +- **method or URL differ** → ✗ full re-install needed. +- **ref differs** (project bumped tag, or `git-branch` + local is behind upstream tip) → ⚠ sync needed. +- **`svn-zip` SHA-512 mismatches the committed + anchor** → ✗ security-flagged; investigate before + upgrading. + +--- ## Golden rules - **Do not auto-run privilege-elevating commands.** Anything that diff --git a/.claude/skills/setup-isolated-setup-update/SKILL.md b/.claude/skills/setup-isolated-setup-update/SKILL.md index e9c15cd88..49ec8db59 100644 --- a/.claude/skills/setup-isolated-setup-update/SKILL.md +++ b/.claude/skills/setup-isolated-setup-update/SKILL.md @@ -51,6 +51,29 @@ to `apache/airflow-steward`. --- +## Snapshot drift + +Also at the top of every run, this skill compares the +gitignored `.apache-steward.local.lock` (per-machine +fetch) against the committed `.apache-steward.lock` +(the project pin). On mismatch the skill surfaces the +gap and proposes +[`/setup-steward upgrade`](../setup-steward/upgrade.md). +The proposal is non-blocking — the user may defer if +they want to run with the local snapshot for now. See +[`docs/setup/install-recipes.md` § Subsequent runs and drift detection](../../../docs/setup/install-recipes.md#subsequent-runs-and-drift-detection) +for the full flow. + +Drift severity: + +- **method or URL differ** → ✗ full re-install needed. +- **ref differs** (project bumped tag, or `git-branch` + local is behind upstream tip) → ⚠ sync needed. +- **`svn-zip` SHA-512 mismatches the committed + anchor** → ✗ security-flagged; investigate before + upgrading. + +--- ## Golden rules - **Read-only.** This skill does not bump the manifest, does not diff --git a/.claude/skills/setup-isolated-setup-verify/SKILL.md b/.claude/skills/setup-isolated-setup-verify/SKILL.md index 3cf3d66fc..ae2ba1c92 100644 --- a/.claude/skills/setup-isolated-setup-verify/SKILL.md +++ b/.claude/skills/setup-isolated-setup-verify/SKILL.md @@ -51,6 +51,29 @@ to `apache/airflow-steward`. --- +## Snapshot drift + +Also at the top of every run, this skill compares the +gitignored `.apache-steward.local.lock` (per-machine +fetch) against the committed `.apache-steward.lock` +(the project pin). On mismatch the skill surfaces the +gap and proposes +[`/setup-steward upgrade`](../setup-steward/upgrade.md). +The proposal is non-blocking — the user may defer if +they want to run with the local snapshot for now. See +[`docs/setup/install-recipes.md` § Subsequent runs and drift detection](../../../docs/setup/install-recipes.md#subsequent-runs-and-drift-detection) +for the full flow. + +Drift severity: + +- **method or URL differ** → ✗ full re-install needed. +- **ref differs** (project bumped tag, or `git-branch` + local is behind upstream tip) → ⚠ sync needed. +- **`svn-zip` SHA-512 mismatches the committed + anchor** → ✗ security-flagged; investigate before + upgrading. + +--- ## Golden rules - **Read-only.** This skill does not edit any file, copy any diff --git a/.claude/skills/setup-shared-config-sync/SKILL.md b/.claude/skills/setup-shared-config-sync/SKILL.md index b99cda21d..7b957057b 100644 --- a/.claude/skills/setup-shared-config-sync/SKILL.md +++ b/.claude/skills/setup-shared-config-sync/SKILL.md @@ -55,6 +55,29 @@ to `apache/airflow-steward`. --- +## Snapshot drift + +Also at the top of every run, this skill compares the +gitignored `.apache-steward.local.lock` (per-machine +fetch) against the committed `.apache-steward.lock` +(the project pin). On mismatch the skill surfaces the +gap and proposes +[`/setup-steward upgrade`](../setup-steward/upgrade.md). +The proposal is non-blocking — the user may defer if +they want to run with the local snapshot for now. See +[`docs/setup/install-recipes.md` § Subsequent runs and drift detection](../../../docs/setup/install-recipes.md#subsequent-runs-and-drift-detection) +for the full flow. + +Drift severity: + +- **method or URL differ** → ✗ full re-install needed. +- **ref differs** (project bumped tag, or `git-branch` + local is behind upstream tip) → ⚠ sync needed. +- **`svn-zip` SHA-512 mismatches the committed + anchor** → ✗ security-flagged; investigate before + upgrading. + +--- ## Hardcoded path The sync repo lives at `~/.claude-config/`. This is the convention