[aliasunder]

Cross-links the new companion project and aligns discovery metadata:

• README: new "Companion: vault-onboarding skill" section, same skeleton as the obsidian-vault companion — what it bootstraps, install command, source link. Placed directly after the existing companion section.
• generate-dockerhub-readme.ts: the new H2 added to EXCLUDED_H2; regenerated DOCKERHUB.md is byte-identical (companion sections don't ship to Docker Hub).
• package.json keywords: attachments → pkm + personal-knowledge-management (kept pdf), matching the GitHub topics update made earlier tonight.

Post-merge step (maintainer): npm run publish:lobehub — the LobeHub listing's tags are generated from package.json keywords.

🤖 Generated with Claude Code

[umm-actually]

umm-actually re-reviewed at 5732565

1 new finding(s) posted (3 tracked finding(s) across all runs).

Context notes

• Priority docs already in context: README.md

---

umm-actually · z-ai/glm-5.3-flash

[aliasunder]

Draft until vault-onboarding completes Stage 5 validation (install test + interview-path walkthroughs, planned for Fri/weekend) — the companion section shouldn't advertise the skill from this README while it's still pre-validation. Mark ready + merge once validation passes, then run npm run publish:lobehub for the keyword change.

🤖 Generated with Claude Code

[umm-actually]

Align PR description with the actual keyword change
Low severity · subtle bugs · high confidence

The PR description claims package.json keywords were changed as attachments → pkm + personal-knowledge-management (kept pdf), but the diff only adds second-brain to cli/package.json; attachments remains in the list and pkm/personal-knowledge-management were already present before this PR.

Failure scenario: A maintainer relying on the PR description to review the keyword change believes attachments was removed from the published npm package's keywords, but it is still shipped, so the LobeHub listing (generated from these keywords post-merge) still advertises attachments while the description claimed otherwise.

Suggested fix

Update the PR description to state that `second-brain` was added to align cli/package.json keywords with the root package.json and GitHub topics, and that `attachments` was retained.

[umm-actually]

Add second-brain to root package.json keywords
Low severity · subtle bugs · medium confidence

package.json:26 — beyond the diff's line ranges, in code the changes touch or depend on.

The PR adds the second-brain keyword only to cli/package.json, but the LobeHub listing's tags are generated from the root package.json keywords, which this diff leaves untouched — so the PR's own prescribed post-merge step (npm run publish:lobehub) regenerates the listing with an unchanged tag set. The root list also lags the GitHub topics and the npm package, which both carry second-brain.

Failure scenario: Maintainer merges and runs npm run publish:lobehub as the PR description instructs; lhm.plugin.json is rebuilt from the unchanged root keywords, so the LobeHub listing's tags never gain second-brain while npm search (via cli/package.json) and the GitHub topics list it — the discovery metadata this PR set out to align stays inconsistent, and the post-merge step is a silent no-op for keywords.

Suggested fix

Add "second-brain" to the root package.json keywords array after "note-taking", mirroring cli/package.json, so the post-merge publish:lobehub run actually publishes it as a LobeHub tag.

---

umm-actually · z-ai/glm-5.3-flash

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric	Results
Complexity	0
Duplication	0

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[umm-actually]

Qualify the README's claim that connecting unlocks semantic memory recall
Low severity · subtle bugs · medium confidence

The new companion section states unconditionally that connecting to vault-cortex lets the generated setup unlock hybrid search and semantic memory recall, but per AGENTS.md the vector stage of hybrid search is gated behind EMBEDDING_ENABLED and the memory layer behind its own feature flag, so a default deployment connected to vault-cortex provides keyword search only and no semantic recall.

Failure scenario: An Obsidian user reads the README companion section, installs vault-onboarding, connects the generated setup to a default vault-cortex deployment with EMBEDDING_ENABLED unset and memory tools disabled, and finds no semantic memory recall or vector search despite the README promising both unconditionally.

Suggested fix

Condition the sentence, e.g. "…unlocks remote access and hybrid search (semantic recall when embedding is enabled)", or note the two env vars that enable the vector and memory layers.

---

umm-actually · z-ai/glm-5.3-flash