Skip to content
Back to skills

Specs

ASecurity

Date: 2026-09-02. Status: approved by the owner on 2026-09-02, as written. Driver: backlog batch 5 — HR-013 (owner request of 2026-09-01), HR-014 (batch 4 deferral). Branch `batch-5` from `6d58633`. Process: implementer on sonnet, task review on opus, branch review on fable; one tier up after two endpoint drops; strictly sequential. Workspace `.superpowers/sdd/2026-09-02-batch-5/` with the ledger `progress.md`.

  • 2 stars
  • 0 votes
  • 0 copies
  • 0 views
  • Added October 2, 2026
ai-agentsgo

Works with

  • cli

Security analysis

A100/100

Pro scans all 21 files and shows the line behind each finding

Scanned October 2, 2026

npx -y skills add jblossey/houserules --skill specs --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Specs?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Specs
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/jblossey-specs/badge)](https://www.skillsdirectory.com/skills/jblossey-specs)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
# Batch 5: the knowledge-migration skill, and the settings read

Date: 2026-09-02. Status: approved by the owner on 2026-09-02, as written.
Driver: backlog batch 5 — HR-013 (owner request of 2026-09-01), HR-014
(batch 4 deferral). Branch `batch-5` from `6d58633`.
Process: implementer on sonnet, task review on opus, branch review on fable;
one tier up after two endpoint drops; strictly sequential. Workspace
`.superpowers/sdd/2026-09-02-batch-5/` with the ledger `progress.md`.

## 1. Goal

Ship the skill that walks a pre-existing codebase from scattered knowledge
(CLAUDE.md prose, docs, ad-hoc rules files, comments) into `knowledge/*.json`
entries in the houserules style, and finish the bin's last inconsistent
project-data read.

## 2. Out of scope

- HR-015 to HR-018 (batch 6 candidates), HR-003 follow-ups, publishing,
  adoption.
- No new dependency; the skill is markdown in the payload.

## 3. Facts

- Kit-owned skills live in `template/.claude/skills/<name>/SKILL.md`, ship
  through `KIT_OWNED` in `bin/houserules.mjs`, and are dogfooded at the root
  (`tests/dogfood.test.mjs` iterates `KIT_OWNED`, so parity is automatic
  once the list grows; the `files` manifest and init assertions move,
  RED first).
- The knowledge style the skill teaches is already written down:
  `knowledge/schema.json` (kinds, areas, summary ≤ 160, source, verify,
  check) and the `knowledge-base.*` rules (summary-is-the-rule,
  state-only-the-source, ids-are-permanent).
- `mergeSettings` in `bin/houserules.mjs` still hand-parses
  `.claude/settings.json` with its own wording (`not readable JSON`); the
  stamp path reads through `readJson` since batch 4. The existing test
  asserts exit 2 and `toContain('settings.json')` only.

## 4. Tasks, in order, one Conventional Commit each

### T1 `feat(template): a skill that migrates existing knowledge into the kit` (HR-013)

- Create `template/.claude/skills/migrating-knowledge/SKILL.md` (kit-owned):
  frontmatter `name: migrating-knowledge`, a `description` that triggers on
  "migrate knowledge", "existing CLAUDE.md", "adopt houserules in an
  existing project". Sections:
  1. **When**: after `init` in a codebase that already has knowledge.
  2. **Inventory**: where knowledge hides — CLAUDE.md prose, `docs/`,
     wikis and READMEs, code comments that state constraints, PR and
     review templates, lint and CI configs that encode rules.
  3. **Classify**: one line per kind — rule, invariant, gotcha, procedure,
     decision, history — with the schema's semantics.
  4. **Write entries**: summary is the rule (≤ 160, no time-sensitive
     phrasing); body why/how/exceptions; `source` with date and by;
     `verify` paths that exist; a `check` where the rule is deterministic
     (grep-absent, commits, co-change, report-field). State only what the
     source states; never invent an instruction.
  5. **Areas**: extend the enum in `knowledge/schema.json` and the globs in
     `knowledge/areas.json` together.
  6. **Migrate topic by topic**: one topic file per pass; park what is not
     worth an entry (`backlog/parked.json` with a reason); delete the
     migrated originals — knowledge lives once; CLAUDE.md keeps only
     identity and the two seeded sections.
  7. **Gates**: `tools/kb.sh render`, `tools/kb.sh check`,
     `tools/backlog.sh check`; the next branch audit carries the new rules.
  8. **A worked example**: one CLAUDE.md paragraph transformed into one
     complete entry, before/after.
- `bin/houserules.mjs`: `KIT_OWNED` gains the skill path (RED first: the
  `files` manifest and init assertions move; dogfood parity is automatic).
- README: the "Apply to an existing project" section points to the skill
  (one sentence).
- Live run: scratch `init` ships the skill; then a mini-migration in the
  scratch repository follows the skill's own steps — take a two-rule
  CLAUDE.md paragraph, produce one entry, extend an area, park one
  leftover, delete the original, both gates green; each command its own
  report entry with the scratch path and exit.
- TDD note: markdown plus an ownership-list change; the list change is
  RED-first; the prose has no natural RED (say so; the live-run
  mini-migration is the evidence).

### T2 `fix(cli): read settings.json through readJson` (HR-014)

- `mergeSettings` reads with `readJson`: invalid JSON in
  `.claude/settings.json` becomes `UsageError('<path>: invalid JSON (...)')`
  (one line, exit 2); an unreadable file (a permissions or directory
  defect) propagates as a plain Error — the recorded semantics decision,
  consistent with the stamp and with `readJson`'s contract.
- Tests, RED first: the existing settings test's message expectation moves
  from `not readable JSON` to the `readJson` wording (it already asserts
  exit 2 and the file name); a companion pins the plain-Error defect path
  (the batch 4 `EISDIR` idiom).
- Live run: scratch `init`; corrupt `.claude/settings.json`; `init` again →
  one line naming the file, exit 2; restore; ok.

## 5. Reviews and finish

Per batch: task review (opus) with `AUDIT_JSON`; every finding fixed or a
reasoned backlog item; branch review (fable) with `--workspace`; the
retrospective applied; ticks; one to five clean commits; commitlint and the
audit over the range; CLI ff-only merge. T1 changes no implementer or
task-reviewer template and no scenario, so `process.evals-rerun` demands no
record change (the audit enforces it either way).

## 6. Code-health scan (files this batch touches)

- `bin/houserules.mjs`: `mergeSettings` is the last hand parse of project
  data (T2 removes it); the ownership lists absorb one more path (T1).
- `template/.claude/skills/`: three skills today, each one file; the new
  one follows the same one-file shape. No smell in the touched tests.

Files in this skill

  • 2026-08-31-batch-0-bootstrap.md6.2 KB
  • 2026-09-01-batch-2-pnpm-workspace-and-cli-robustness.md10.3 KB
  • 2026-09-01-batch-3-gates-and-agent-layer.md10.3 KB
  • 2026-09-01-batch-4-evals-port-and-polish.md9.2 KB
  • 2026-09-02-batch-5-migration-skill.md5.7 KB
  • 2026-09-02-batch-6-audit-and-hooks.md7.1 KB
  • 2026-09-02-batch-7-report-contract-and-templates.md8.5 KB
  • 2026-09-02-batch-8-audit-reach-and-stamp-strictness.md7.7 KB
  • 2026-09-02-batch-9-predicate-pin-and-protocol.md5.8 KB
  • 2026-09-03-batch-10-hygiene-and-status.md5.8 KB
  • 2026-09-03-batch-11-alpha.md6.4 KB
  • 2026-09-03-batch-12-release-hotfix.md2.6 KB
  • 2026-09-03-batch-13-oss.md4.4 KB
  • 2026-09-04-batch-14-hygiene.md4.7 KB
  • 2026-09-04-batch-15-tier2-spec.md14.9 KB
  • 2026-09-05-batch-18-phase3.md9.4 KB
  • 2026-09-06-batch-19-phase4.md5.6 KB
  • 2026-09-07-batch-20-phase5.md6.8 KB
  • 2026-09-08-batch-21-gates.md6.1 KB
  • 2026-09-11-batch-22-stewardship.md10.2 KB

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.