[hanthor]

The validation gates mishandle folded descriptions at their length boundary and reject the existing Ubuntu 26.04 runner label. This fixes those checks and restores a clean full pre-commit run.

• Test all six YAML block indicators at the 256/257-character boundary and avoid grep writer failures under pipefail.
• Admit ubuntu-26.04, preserve literal Markdown backticks in the parity workflow, and normalize existing EOF failures.
• Update the CI and skill-improvement guidance and correct the package-policy reference.

Validation at db65efd: just check and pre-commit run --all-files passed. The documentation budget was resolved on main by #527; this PR does not move the ujust inventory.

Refs #578, #626. Merge this first, then retarget the dependent fixes to main.

[hivecommons-hive]

HUMAN DECISION NEEDED — @hanthor pick one approach for the package-contract 500-line budget: this PR's reference extraction (docs/skills/package-contract/references/ujust.md) vs the prose reflow proposed in #618; merging both would double-trim the page.

intent-alignment

• docs/skills/package-contract.md:457-463 — the 51-line ujust section is moved verbatim to package-contract/references/ujust.md. This satisfies #616 on its own (file is 463 lines; scripts/check-skill-frontmatter.sh and tests/test_check_skill_frontmatter.py pass at head), but it is a different strategy from #618, which the PR body itself asks a maintainer to arbitrate. Not a defect in this diff — a routing decision.

style

• docs/skills/ci-workflows.md:116-118 — three consecutive blank lines left between the new paragraph and the pre-existing "fast gate" paragraph.
• docs/skills/ci-workflows.md:405-408 — the grep -q/pipefail/SIGPIPE note is appended after the ## Verification code fence, where it reads as part of the verification commands. It documents the change at scripts/check-skill-frontmatter.sh:35-42 and belongs in "CI guard scripts and test coverage" (line 110) next to the description-budget paragraph.

No findings from: correctness, security, docs-currency.

Confidence: 3/5 (needs attention) — 1 perspective requires a human decision

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Hive filed out-of-scope review findings as backlog issues so they do not block this PR:

• Review backlog (docs-currency): Checker comment references nonexistent docs/skills/write-a-skill.md #626 — Review backlog (docs-currency): Checker comment references nonexistent docs/skills/write-a-skill.md (Review backlog (docs-currency): Checker comment references nonexistent docs/skills/write-a-skill.md #626)

Cap: 3 backlog issue(s) per PR.

[hivecommons-hive]

Read the checker, the awk/sed path and the tests at db65efd. The code changes look correct to me; one part of the PR body no longer matches the diff.

Verified

• scripts/check-skill-frontmatter.sh:48-61 joins the block description as description: > + " " + each continuation line, so the indicator sits at the start of the string after s/^description:\s*//. The old s/[[:space:]]*([|>][+-]?)[[:space:]]*$// looked for it at the end and never matched; the new s/^[|>][+-]?[[:space:]]*// is the right anchor. The replacement tests (test_block_description_at_limit_passes / _over_limit_fails) cover all six indicators at 256/257, which is exactly the boundary the removed expectedFailure test documented.
• The printf | grep -q → grep -q <<< rewrites are behaviour-preserving; $fm already has a trailing newline so ^key: anchoring is unchanged.
• .github/actionlint.yaml only admits ubuntu-26.04; other labels remain checked. The SC2016 disable is scoped to the one printf with literal backticks.

Body drift (not a code defect)
The third bullet — "Move the detailed ujust dependency inventory into a linked reference" — and the closing note about overlap with #618 describe work that is not in this diff. docs/skills/package-contract/references/ujust.md already exists on main (added by #527), package-contract.md is 487 lines on both main and this head, and #618 is closed. The only surviving trace is the comment rewrite at scripts/check-skill-frontmatter.sh:76-77 and the new paragraph in docs/skills/skill-improvement.md. Suggest trimming the body so a maintainer does not go looking for a file move that is not here.

Note: #624 is stacked on this branch and should be retargeted to main once this lands.

Confidence: 3/5 (needs attention) — 1 perspective requested changes

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hanthor]

Final combined-source verification passed at ecc3fdada8faab467a658f3cce367dc705dbe9b1: https://github.com/projectbluefin/utah/actions/runs/37578585571. No image was published.

The offline ISO installed to LUKS, unlocked, and logged into GNOME 51 Wayland with active extensions. All declared Flatpak app/runtime refs were present offline. Installed timer enablement, Common countme opt-out, RPM contract, adversarial GPG key rejection, and About/icon/greeter assets passed. Screenshots were visually inspected; GDM asset/configuration match accepted #531 exactly. The command-menu screenshot proves the panel icon renders, but does not prove menu opening.

Independently hashing the retained raw manifest matches the guest bootc digest: sha256:949e4754ff084555cbfa0966eb64b8157e0bf4fb0deb33f69fd7561d4a23b9b9. Both uncached native builds produced the same image ID and all 37 native layers. This proves the combined main-flavor candidate; NVIDIA Secure Boot, physical TPM/FIDO enrollment, published rechunking and other-flavor repeatability remain separate.

Independent last-push approval remains required for #623. Its dependent PRs must be retargeted to main after that merge; they should not be merged into feature branches.

[Danathar]

Approving at db65efd. I read the whole diff.

• Stripping a leading >/| (with +/-) block indicator before measuring fixes the miscount. The new tests cover all six indicators at 256 and 257 characters. The old regex only stripped a trailing indicator.
• Using a here-string instead of printf | grep -q removes the SIGPIPE-under-pipefail false failure.
• .github/actionlint.yaml admits only ubuntu-26.04, and the pinned actionlint is v1.7.7 (.pre-commit-config.yaml), so the comment is accurate.
• The EOF newline and shellcheck SC2016 changes are cosmetic.

At this head, tests.test_check_skill_frontmatter passes and scripts/check-skill-frontmatter.sh exits 0. One test_bootupctl_adopt_hook case fails on my machine only because my host has a real bootupctl on PATH; it fails the same way on main. Nit, not blocking: docs/skills/ci-workflows.md gains three blank lines after the new paragraph.