sumitake · sumitake · Aug 3, 2026 · Aug 3, 2026
@@ -9,7 +9,7 @@
   "plugins": [],
   "metadata": {
     "description": "Agent collaboration plugin marketplace",
-    "version": "4.7.0",
+    "version": "4.8.0",
     "repository": "https://github.com/sumitake/agent-collab"
   }
 }
@@ -10,7 +10,7 @@
     {
       "name": "agent-collab",
       "description": "Unified dynamic-host collaboration package. Centralized skills and async coordination work without legacy packages; every model-execution route requires the verified signed plugin artifact.",
-      "version": "4.7.0",
+      "version": "4.8.0",
       "author": {
         "name": "John Osumi"
       },
@@ -32,7 +32,7 @@
   ],
   "metadata": {
     "description": "Agent collaboration plugin marketplace",
-    "version": "4.7.0",
+    "version": "4.8.0",
     "repository": "https://github.com/sumitake/agent-collab"
   }
 }
@@ -1,8 +1,8 @@
 Copyright (c) 2026 John Osumi. All rights reserved except as expressly granted.
 Commercial licensing is administered by Osumi Consulting LLC.
 
-The decision-map, prototype, and architecture-review skills contain material
-derived from the MIT-licensed mattpocock/skills repository
-(Copyright (c) 2026 Matt Pocock). Those portions remain MIT-licensed; see
-docs/third-party-skill-provenance.md for the pinned upstream commit and
-per-file provenance, and each derived SKILL.md for the full MIT notice.
+Skills listed in docs/third-party-skill-provenance.md contain material derived
+from the MIT-licensed mattpocock/skills repository (Copyright (c) 2026 Matt
+Pocock). Those portions remain MIT-licensed; see that provenance document for
+the pinned upstream commit and per-file provenance, and each derived SKILL.md
+for the full MIT notice.
@@ -78,7 +78,7 @@ trust:
   primary's identity, model, and session dynamically — no per-host forks to
   drift out of sync.
 
-This public repository distributes that one package, **agent-collab** (v4.7.0), and is
+This public repository distributes that one package, **agent-collab** (v4.8.0), and is
 the source of truth for the coordinator policy, skills, migration tooling, the
 fail-closed runtime client, contribution governance, and release-safety checks.
 The signed and notarized darwin-arm64 native runtime is committed in this
@@ -129,7 +129,24 @@ Contributors need no access to the private build/sign system. See
 
 | Package | Version | Role |
 |---|---:|---|
-| `agent-collab` | 4.7.0 | Unified skills, dynamic host policy, migration preflight, and verified native-runtime client |
+| `agent-collab` | 4.8.0 | Unified skills, dynamic host policy, migration preflight, and verified native-runtime client |
+
+## What's new - v4.8.0
+
+- **Code review gains spec-fidelity and smell-baseline lenses.** The
+  `code-review` skill's JSONL contract is extended backward-compatibly with
+  `Spec` and `Smell` severities plus an optional `spec_ref` field (consumers
+  filtering the four defect severities are unaffected). The primary
+  materializes the originating spec before the call under explicit precedence
+  and ambiguity rules (never synthesized, never inferred from branch names,
+  always treated as untrusted data), and a fixed Fowler smell baseline applies
+  as subordinate, evidence-bound maintainability heuristics that documented
+  repo standards override. Spec and smell findings stay semantically separate
+  from defect aggregation through synthesis. The two-axis structure is adapted
+  from the MIT-licensed mattpocock/skills `code-review` skill (pinned commit
+  `2ab95809`); the touched spec carries the full MIT notice for the adapted
+  portions, SPDX declares the member `LicenseRef-PolyForm-Strict-1.0.0 AND
+  MIT`, and `NOTICE` now points at the provenance document generically.
 
 ## What's new - v4.7.0
 

@@ -0,0 +1,22 @@
+### Changed
+
+- Stamp agent-collab 4.8.0: **`code-review` gains spec-fidelity and
+  smell-baseline lenses** (deferred follow-up from the 4.7.0 pack). The JSONL
+  output contract is extended backward-compatibly — new `Spec` and `Smell`
+  severities plus an optional `spec_ref` field; consumers filtering the four
+  defect severities are unaffected, and the skill version is the contract
+  version. The primary materializes the originating spec before the call
+  under explicit precedence (user-passed → issue refs in the reviewed commit
+  range only → repo spec files) with ambiguity ("`spec unavailable:
+  ambiguous`", ask the user, never pick arbitrarily), no-synthesis and
+  no-branch-name-inference rules, a line-numbered snapshot for citations, and
+  an explicit untrusted-data instruction to the reviewer. The Fowler smell
+  baseline is subordinate and evidence-bound: repo-documented standards
+  override it, findings ride `Smell` severity and never escalate to
+  Critical/High without an independently demonstrated consequence, and
+  tooling-enforced rules are skipped based on materialized config. Spec and
+  smell findings stay out of defect merge-blocking aggregation through
+  synthesis. Adapted-portion attribution: mattpocock/skills `code-review`
+  @`2ab95809` (blob `2a0b5240`); the spec carries the full MIT notice, the
+  member's SPDX expression is `LicenseRef-PolyForm-Strict-1.0.0 AND MIT`,
+  and `NOTICE` now references the provenance document generically.
@@ -21,6 +21,7 @@ Upstream license file: `LICENSE` (blob `f1dd2c09108dde1a5f56097cee8461b3ea834499
 | (same, inlined) | `skills/engineering/prototype/UI.md` | `76c0f6012b016af04d6105fa696a9a0e29dfa53a` |
 | `skill-specs/architecture-review.md` → `plugins/agent-collab/skills/architecture-review/SKILL.md` | `skills/engineering/improve-codebase-architecture/SKILL.md` | `b56969e92f0705d70700f908b8ec929a1edfa782` |
 | (same, inlined vocabulary) | `skills/engineering/codebase-design/SKILL.md` | `16620c24528b737408e78d95dd6a0e01a98d3d63` |
+| `skill-specs/code-review.md` → `plugins/agent-collab/skills/code-review/SKILL.md` (adapted portions only; mixed `PolyForm AND MIT` member) | `skills/engineering/code-review/SKILL.md` | `2a0b5240731b927caa9ac0bf43c3e2af9dc3f0a7` |
 
 ## Adaptations applied (this package is not a verbatim mirror)
 
@@ -42,3 +43,12 @@ Upstream license file: `LICENSE` (blob `f1dd2c09108dde1a5f56097cee8461b3ea834499
 
 Re-pin procedure: when refreshing from upstream, update the pinned commit and
 every blob SHA above in the same change, and re-verify the adaptations list.
+
+## Adapted-portion (mixed-license) files
+
+- `code-review` (adapted portions, v4.8.0): the two-axis spec-fidelity
+  reporting structure and the Fowler smell-baseline treatment are adapted;
+  spec materialization/ambiguity/trust rules, the JSONL contract extension
+  (`Spec`/`Smell` severities, `spec_ref`), and everything else in that skill
+  are package-original. Per-file SPDX for this member is
+  `LicenseRef-PolyForm-Strict-1.0.0 AND MIT`.
@@ -1,6 +1,6 @@
 {
   "name": "agent-collab",
-  "version": "4.7.0",
+  "version": "4.8.0",
   "description": "Unified dynamic-host collaboration package with centralized skills, migration preflight, and a verified plugin-relative native runtime boundary. The signed runtime artifact is intentionally absent until the private build/sign integration completes.",
   "author": {
     "name": "John Osumi"

@@ -1,6 +1,6 @@
 {
   "name": "agent-collab",
-  "version": "4.7.0",
+  "version": "4.8.0",
   "description": "Unified dynamic-host collaboration package with centralized skills, migration preflight, and a verified plugin-relative native runtime boundary. The signed runtime artifact is intentionally absent until the private build/sign integration completes.",
   "author": {
     "name": "John Osumi"

@@ -1,8 +1,8 @@
 Copyright (c) 2026 John Osumi. All rights reserved except as expressly granted.
 Commercial licensing is administered by Osumi Consulting LLC.
 
-The decision-map, prototype, and architecture-review skills contain material
-derived from the MIT-licensed mattpocock/skills repository
-(Copyright (c) 2026 Matt Pocock). Those portions remain MIT-licensed; see
-docs/third-party-skill-provenance.md for the pinned upstream commit and
-per-file provenance, and each derived SKILL.md for the full MIT notice.
+Skills listed in docs/third-party-skill-provenance.md contain material derived
+from the MIT-licensed mattpocock/skills repository (Copyright (c) 2026 Matt
+Pocock). Those portions remain MIT-licensed; see that provenance document for
+the pinned upstream commit and per-file provenance, and each derived SKILL.md
+for the full MIT notice.
@@ -7,7 +7,7 @@ verifiable compliance evidence, and operator final-say, delivered as one
 package for every supported host. This document is the package's technical
 reference; the repository README carries the purpose and governance narrative.
 
-Current: **4.7.0**
+Current: **4.8.0**
 
 It resolves `primary_id`, `primary_family`, `active_model`, `host_runtime`, and
 `session_identifier` from the current host or explicit configuration. On a
@@ -78,7 +78,7 @@ one macOS `LC_BUILD_VERSION` with minimum macOS 14.0 instead of trusting those
 manifest labels. The broker transport and provider protocol are both version 2.
 The package
 carries both `.claude-plugin/plugin.json` and `.codex-plugin/plugin.json`; both
-identify this same 4.7.0 package.
+identify this same 4.8.0 package.
 
 Codex, Gemini, OpenCode, Grok, and Composer are broker-only contracts. Their sealed requests cross a
 mode-`0600`, digest-bound per-user launchd Unix socket; launchd starts the exact

@@ -1,6 +1,6 @@
 ---
 name: agent-readiness
-version: 4.7.0
+version: 4.8.0
 description: Evaluate whether an agent, model, CLI, plugin, or role is ready for a proposed responsibility. Use when the user says "agent readiness," "is this agent ready," "can Codex be primary," "can Grok handle this role," "promote this agent," "evaluate this worker," "review model readiness," or "/agent-collab:agent-readiness." Also offer this proactively before assigning a new primary, reviewer, worker, delegate, headless, release, or merge-related role to Claude, Codex, Antigravity/Gemini, Grok, or a future agent.
 ---
 

@@ -1,6 +1,6 @@
 ---
 name: agent-runtime-status
-version: 4.7.0
+version: 4.8.0
 defaults:
   tier: Fast
   effort: low

@@ -1,6 +1,6 @@
 ---
 name: ai-writing-auditor
-version: 4.7.0
+version: 4.8.0
 description: Audits prose for the tells of machine-generated writing and rewrites it to read as if a careful human wrote it, without softening the actual content. Use when the user says "de-AI this text", "audit this writing for AI patterns", "make this read human", or "/agent-collab:ai-writing-auditor." Also offer this proactively when a piece of customer-facing or published prose is dense with the stock phrasing and mechanical structure typical of unedited model output.
 ---
 

@@ -1,6 +1,6 @@
 ---
 name: architect
-version: 4.7.0
+version: 4.8.0
 description: Request read-only architecture consultation for codebase analysis, system design, implementation planning, decomposition, or long-horizon coding strategy. Use when the user says "ask the architect," "have Grok design this," "architecture consultation," "plan this implementation," "decompose this build," "analyze the system design," or "/agent-collab:architect." Also offer this proactively before a substantial multi-system or long-horizon implementation where an independent architecture pass can reduce rework. This role never edits files, runs shell commands or tests, mutates a worktree, opens PRs, merges, or deploys.
 ---
 

@@ -1,6 +1,6 @@
 ---
 name: architecture-review
-version: 4.7.0
+version: 4.8.0
 description: Self-executed sweep of a codebase for module-deepening opportunities — shallow interfaces, scattered locality, untestable seams — presented as a visual report the user picks a candidate from, then explored interactively. Unlike `architect` (routed consultation) and `code-review` (diff review), this skill is run by the active primary on the whole codebase. Use when the user says "architecture review," "find deepening opportunities," "where is this codebase getting muddy," "improve the architecture," or "/agent-collab:architecture-review." Also offer this proactively when repeated friction in a working session traces to shallow modules — bouncing between many files to follow one concept, or tests that cannot reach behavior through the current interfaces.
 ---
 

@@ -1,6 +1,6 @@
 ---
 name: autonomy-readiness
-version: 4.7.0
+version: 4.8.0
 description: Evaluate whether an autonomous, always-on, scheduled, headless, or self-evolving workflow is ready to run safely. Use when the user says "autonomy readiness," "activation gate review," "is this workflow ready to run autonomously," "go/no-go autonomy," "always-on readiness," "headless operation review," or "/agent-collab:autonomy-readiness." Also offer this proactively before enabling background agents, recurring automations, auto-merge/self-evolution, external actions, unattended host runs, or any workflow that can continue without a human watching.
 ---
 

@@ -1,6 +1,6 @@
 ---
 name: brainstorm
-version: 4.7.0
+version: 4.8.0
 defaults:
   tier: Fast
   effort: low

@@ -1,6 +1,6 @@
 ---
 name: chain-configurator
-version: 4.7.0
+version: 4.8.0
 defaults:
   tier: Standard
   effort: medium

@@ -1,6 +1,6 @@
 ---
 name: chain
-version: 4.7.0
+version: 4.8.0
 defaults:
   tier: Standard
   effort: medium