sumitake · sumitake · Aug 3, 2026 · Aug 3, 2026 · Aug 3, 2026 · Aug 3, 2026
@@ -9,7 +9,7 @@
   "plugins": [],
   "metadata": {
     "description": "Agent collaboration plugin marketplace",
-    "version": "4.6.0",
+    "version": "4.7.0",
     "repository": "https://github.com/sumitake/agent-collab"
   }
 }
@@ -10,7 +10,7 @@
     {
       "name": "agent-collab",
       "description": "Unified dynamic-host collaboration package. Centralized skills and async coordination work without legacy packages; every model-execution route requires the verified signed plugin artifact.",
-      "version": "4.6.0",
+      "version": "4.7.0",
       "author": {
         "name": "John Osumi"
       },
@@ -32,7 +32,7 @@
   ],
   "metadata": {
     "description": "Agent collaboration plugin marketplace",
-    "version": "4.6.0",
+    "version": "4.7.0",
     "repository": "https://github.com/sumitake/agent-collab"
   }
 }
@@ -1,2 +1,8 @@
 Copyright (c) 2026 John Osumi. All rights reserved except as expressly granted.
 Commercial licensing is administered by Osumi Consulting LLC.
+
+The decision-map, prototype, and architecture-review skills contain material
+derived from the MIT-licensed mattpocock/skills repository
+(Copyright (c) 2026 Matt Pocock). Those portions remain MIT-licensed; see
+docs/third-party-skill-provenance.md for the pinned upstream commit and
+per-file provenance, and each derived SKILL.md for the full MIT notice.
@@ -78,7 +78,7 @@ trust:
   primary's identity, model, and session dynamically — no per-host forks to
   drift out of sync.
 
-This public repository distributes that one package, **agent-collab** (v4.6.0), and is
+This public repository distributes that one package, **agent-collab** (v4.7.0), and is
 the source of truth for the coordinator policy, skills, migration tooling, the
 fail-closed runtime client, contribution governance, and release-safety checks.
 The signed and notarized darwin-arm64 native runtime is committed in this
@@ -129,7 +129,24 @@ Contributors need no access to the private build/sign system. See
 
 | Package | Version | Role |
 |---|---:|---|
-| `agent-collab` | 4.6.0 | Unified skills, dynamic host policy, migration preflight, and verified native-runtime client |
+| `agent-collab` | 4.7.0 | Unified skills, dynamic host policy, migration preflight, and verified native-runtime client |
+
+## What's new - v4.7.0
+
+- **Engineering-process skill pack (MIT-derived).** Three self-executed skills
+  join the package: `decision-map` (multi-session planning as a shared map of
+  decision tickets on the issue tracker, with an explicit user-approval gate
+  before any tracker write), `prototype` (throwaway logic/UI prototypes that
+  answer one design question, isolated from the caller's branch), and
+  `architecture-review` (a codebase sweep for module-deepening opportunities
+  with a self-contained visual report, composing with the routed `architect`
+  consultation). They are derived from the MIT-licensed
+  [mattpocock/skills](https://github.com/mattpocock/skills) repository at
+  pinned commit `2ab95809` and adapted for this package; the derived portions
+  remain MIT-licensed, each generated `SKILL.md` carries the full MIT notice,
+  release SPDX evidence declares those members `MIT`, and
+  `docs/third-party-skill-provenance.md` records per-file provenance. No
+  coordinator, provider, or routing surface is touched.
 
 ## What's new - v4.6.0
 
@@ -801,3 +818,11 @@ material, and their incorporated components under their own terms. The exact,
 digest-pinned inventory is shipped as `THIRD-PARTY-NOTICES.txt` and
 `third-party-licenses/` inside the plugin package. Those files are excluded from
 policy-only archives because no native runtime is present.
+
+The `decision-map`, `prototype`, and `architecture-review` skills contain
+material derived from the MIT-licensed
+[mattpocock/skills](https://github.com/mattpocock/skills) repository
+(Copyright (c) 2026 Matt Pocock). Those portions are and remain MIT-licensed
+in every archive; each derived `SKILL.md` carries the full MIT permission
+notice, and [docs/third-party-skill-provenance.md](docs/third-party-skill-provenance.md)
+records the pinned upstream commit and per-file provenance.
@@ -0,0 +1,23 @@
+### Added
+
+- Stamp agent-collab 4.7.0: **engineering-process skill pack (MIT-derived)**.
+  Three self-executed skills join the package — `decision-map` (multi-session
+  planning as a shared map of decision tickets on the issue tracker, with an
+  explicit user-approval gate before any tracker write and a claim discipline
+  for concurrent sessions), `prototype` (throwaway logic/UI prototypes that
+  answer one design question, built on an isolated worktree/branch with a
+  production-safe gate on UI variant mechanisms), and `architecture-review`
+  (a self-executed sweep for module-deepening opportunities presented as a
+  fully self-contained visual report, composing with — not replacing — the
+  routed `architect` consultation). Derived from the MIT-licensed
+  [mattpocock/skills](https://github.com/mattpocock/skills) repository at
+  pinned commit `2ab958093e83e0ec752e6c1c5932da465bf23e0c` and adapted for
+  this package (tracker resolution with feature detection and a local-markdown
+  fallback, host-neutral sub-skill references, inlined companion references,
+  no CDN assets, mutation gates). The derived portions remain MIT-licensed:
+  each generated `SKILL.md` carries the full MIT permission notice, release
+  SPDX evidence declares those three members `MIT`
+  (`scripts/build_release_evidence.py`), and
+  `docs/third-party-skill-provenance.md` records the per-file upstream blob
+  SHAs and adaptations. `NOTICE` and both README license boundaries name the
+  exception. No coordinator, provider, routing, or runtime surface is touched.
@@ -0,0 +1,44 @@
+# Third-party skill provenance — mattpocock/skills (MIT)
+
+Three skills in this package are derived from Matt Pocock's
+[mattpocock/skills](https://github.com/mattpocock/skills) repository,
+MIT-licensed (Copyright (c) 2026 Matt Pocock). The derived portions remain
+MIT-licensed; the PolyForm Strict License 1.0.0 governs only the rest of this
+package. Each derived generated skill carries the full MIT permission notice
+in its own `SKILL.md` (§ Attribution and license), so the notice travels with
+every archive — policy-only and activation — that ships the skills tree.
+
+Pinned upstream commit: `2ab958093e83e0ec752e6c1c5932da465bf23e0c`
+Upstream license file: `LICENSE` (blob `f1dd2c09108dde1a5f56097cee8461b3ea834499`)
+
+## File map (local ← upstream @ 2ab9580)
+
+| Local (spec → generated) | Upstream path | Upstream blob SHA |
+|---|---|---|
+| `skill-specs/decision-map.md` → `plugins/agent-collab/skills/decision-map/SKILL.md` | `skills/engineering/wayfinder/SKILL.md` | `42e3644cc57e41a1b87482754f25b4d9462d4bbc` |
+| `skill-specs/prototype.md` → `plugins/agent-collab/skills/prototype/SKILL.md` | `skills/engineering/prototype/SKILL.md` | `e75d5331ceffd9b2c5a9554c3db124d848afa054` |
+| (same, inlined) | `skills/engineering/prototype/LOGIC.md` | `fe9a2c29f77b9b7182ad7fa4bd251f27e506b7d9` |
+| (same, inlined) | `skills/engineering/prototype/UI.md` | `76c0f6012b016af04d6105fa696a9a0e29dfa53a` |
+| `skill-specs/architecture-review.md` → `plugins/agent-collab/skills/architecture-review/SKILL.md` | `skills/engineering/improve-codebase-architecture/SKILL.md` | `b56969e92f0705d70700f908b8ec929a1edfa782` |
+| (same, inlined vocabulary) | `skills/engineering/codebase-design/SKILL.md` | `16620c24528b737408e78d95dd6a0e01a98d3d63` |
+
+## Adaptations applied (this package is not a verbatim mirror)
+
+- `decision-map` (from `wayfinder`): renamed; tracker resolved at run time
+  (GitHub `gh` with feature detection → local markdown → project-documented
+  workflow) instead of a setup-skill config file; an explicit user-approval
+  write gate added before any tracker mutation; upstream sub-skill references
+  (`/grilling`, `/domain-modeling`, `/research`, `/setup-matt-pocock-skills`)
+  replaced with host-neutral equivalents.
+- `prototype`: upstream `LOGIC.md`/`UI.md` companion files inlined (this
+  package's generated skill directories are `SKILL.md`-only); isolated
+  worktree/branch requirement and a production-safe gate on the whole UI
+  variant mechanism added; no auto-commit to the caller's branch.
+- `architecture-review` (from `improve-codebase-architecture` +
+  `codebase-design`): renamed; deep-module vocabulary inlined; report changed
+  from CDN Tailwind/Mermaid to fully self-contained inline CSS/SVG; grilling
+  replaced with host-neutral interviewing; composition with this package's
+  routed `architect` consultation documented.
+
+Re-pin procedure: when refreshing from upstream, update the pinned commit and
+every blob SHA above in the same change, and re-verify the adaptations list.
@@ -1,6 +1,6 @@
 {
   "name": "agent-collab",
-  "version": "4.6.0",
+  "version": "4.7.0",
   "description": "Unified dynamic-host collaboration package with centralized skills, migration preflight, and a verified plugin-relative native runtime boundary. The signed runtime artifact is intentionally absent until the private build/sign integration completes.",
   "author": {
     "name": "John Osumi"

@@ -1,6 +1,6 @@
 {
   "name": "agent-collab",
-  "version": "4.6.0",
+  "version": "4.7.0",
   "description": "Unified dynamic-host collaboration package with centralized skills, migration preflight, and a verified plugin-relative native runtime boundary. The signed runtime artifact is intentionally absent until the private build/sign integration completes.",
   "author": {
     "name": "John Osumi"

@@ -1,2 +1,8 @@
 Copyright (c) 2026 John Osumi. All rights reserved except as expressly granted.
 Commercial licensing is administered by Osumi Consulting LLC.
+
+The decision-map, prototype, and architecture-review skills contain material
+derived from the MIT-licensed mattpocock/skills repository
+(Copyright (c) 2026 Matt Pocock). Those portions remain MIT-licensed; see
+docs/third-party-skill-provenance.md for the pinned upstream commit and
+per-file provenance, and each derived SKILL.md for the full MIT notice.
@@ -7,7 +7,7 @@ verifiable compliance evidence, and operator final-say, delivered as one
 package for every supported host. This document is the package's technical
 reference; the repository README carries the purpose and governance narrative.
 
-Current: **4.6.0**
+Current: **4.7.0**
 
 It resolves `primary_id`, `primary_family`, `active_model`, `host_runtime`, and
 `session_identifier` from the current host or explicit configuration. On a
@@ -54,6 +54,15 @@ Nuitka 4.1.3 runtime material, and incorporated dependencies. Those exact files
 are digest-pinned by the archive builder and remain outside policy-only
 archives, which contain none of the corresponding runtime components.
 
+Exception to the PolyForm boundary: the `decision-map`, `prototype`, and
+`architecture-review` skills contain material derived from the MIT-licensed
+[mattpocock/skills](https://github.com/mattpocock/skills) repository
+(Copyright (c) 2026 Matt Pocock). Those portions are and remain MIT-licensed;
+each derived `SKILL.md` carries the full MIT permission notice, release SPDX
+evidence declares those members `MIT`, and
+[docs/third-party-skill-provenance.md](../../docs/third-party-skill-provenance.md)
+records the pinned upstream commit, per-file blob SHAs, and adaptations.
+
 ## Runtime and safe mode
 
 The package may contain a privately built signed native standalone bundle only
@@ -69,7 +78,7 @@ one macOS `LC_BUILD_VERSION` with minimum macOS 14.0 instead of trusting those
 manifest labels. The broker transport and provider protocol are both version 2.
 The package
 carries both `.claude-plugin/plugin.json` and `.codex-plugin/plugin.json`; both
-identify this same 4.6.0 package.
+identify this same 4.7.0 package.
 
 Codex, Gemini, OpenCode, Grok, and Composer are broker-only contracts. Their sealed requests cross a
 mode-`0600`, digest-bound per-user launchd Unix socket; launchd starts the exact
@@ -306,13 +315,24 @@ time; a listed skill does not imply that its native route is currently active.
 | Domain expertise - infrastructure and reliability (pack, v4.4.0) | `kubernetes-specialist`, `terraform-engineer`, `sre-engineer`, `incident-responder` |
 | Domain expertise - data and AI (pack, v4.4.0) | `mlops-engineer`, `llm-architect`, `postgres-engineer`, `data-engineer` |
 | Domain expertise - LLM evaluation and writing quality (pack, v4.4.0) | `eval-engineer`, `prompt-regression-tester`, `hallucination-investigator`, `ai-writing-auditor` |
+| Engineering process (pack, v4.7.0; MIT-derived) | `decision-map`, `prototype`, `architecture-review` |
 
 The sixteen domain-expertise skills were authored for this repository. Their
 scope selection was informed by two MIT-licensed VoltAgent reference corpora,
 reviewed as untrusted input at pinned commits and fully re-authored (zero
 copied passages, verified by shingle comparison): awesome-claude-code-subagents
 (commit 947b44ca) and awesome-codex-subagents (commit 5605c9c1).
 
+The three engineering-process skills are self-executed by the active primary
+(no coordinator route) and are derived from the MIT-licensed
+[mattpocock/skills](https://github.com/mattpocock/skills) repository at pinned
+commit `2ab95809`, adapted for this package. Those portions remain
+MIT-licensed; each derived `SKILL.md` carries the full MIT permission notice,
+and the file-level provenance map is
+[docs/third-party-skill-provenance.md](../../docs/third-party-skill-provenance.md).
+`architecture-review` is the self-executed sweep; `architect` remains the
+routed read-only consultation the sweep can hand its top candidates to.
+
 `visual-review` and `ui-to-code` currently provide primary-only guidance because
 the managed protocol does not accept image attachments. They never reinterpret
 binary images as long-context text. Mutation-capable skills still require an

@@ -1,6 +1,6 @@
 ---
 name: agent-readiness
-version: 4.6.0
+version: 4.7.0
 description: Evaluate whether an agent, model, CLI, plugin, or role is ready for a proposed responsibility. Use when the user says "agent readiness," "is this agent ready," "can Codex be primary," "can Grok handle this role," "promote this agent," "evaluate this worker," "review model readiness," or "/agent-collab:agent-readiness." Also offer this proactively before assigning a new primary, reviewer, worker, delegate, headless, release, or merge-related role to Claude, Codex, Antigravity/Gemini, Grok, or a future agent.
 ---
 

@@ -1,6 +1,6 @@
 ---
 name: agent-runtime-status
-version: 4.6.0
+version: 4.7.0
 defaults:
   tier: Fast
   effort: low

@@ -1,6 +1,6 @@
 ---
 name: ai-writing-auditor
-version: 4.6.0
+version: 4.7.0
 description: Audits prose for the tells of machine-generated writing and rewrites it to read as if a careful human wrote it, without softening the actual content. Use when the user says "de-AI this text", "audit this writing for AI patterns", "make this read human", or "/agent-collab:ai-writing-auditor." Also offer this proactively when a piece of customer-facing or published prose is dense with the stock phrasing and mechanical structure typical of unedited model output.
 ---
 

@@ -1,6 +1,6 @@
 ---
 name: architect
-version: 4.6.0
+version: 4.7.0
 description: Request read-only architecture consultation for codebase analysis, system design, implementation planning, decomposition, or long-horizon coding strategy. Use when the user says "ask the architect," "have Grok design this," "architecture consultation," "plan this implementation," "decompose this build," "analyze the system design," or "/agent-collab:architect." Also offer this proactively before a substantial multi-system or long-horizon implementation where an independent architecture pass can reduce rework. This role never edits files, runs shell commands or tests, mutates a worktree, opens PRs, merges, or deploys.
 ---