Skip to content

Remove stale web-design-guidelines vendored copy + orphaned web-interface-guidelines install #218

Closed

Description

@spizeck

Found during the spizeck/app-foundations#186 fleet audit (PR spizeck/app-foundations#187 adds STALE-VENDORED detection to install-skills.mjs).

Problem

On main:

  • .agents/skills/web-design-guidelines/ — the old external skill installed by the skills CLI (skills-lock.json entry present). It fetches mutable upstream main/ instructions at invocation — the prompt-injection surface the org replacement was created to close.
  • .devin/skills/web-interface-guidelines/ — orphaned install under the superseded org skill name (still recorded in .devin/agent-skills-state.json but no longer in the manifest). Predates the rename in app-foundations PR test(brand): assert manifest icon purpose is exactly "any" #158.
  • .devin/skills/web-design-guidelines/ — the pinned org-managed replacement is not installed, though the manifest maps it to this repo.

Remediation

cd <deepdivebrewing-web checkout>
npx skills remove web-design-guidelines          # removes .agents copy + skills-lock.json entry
node <app-foundations>/scripts/install-skills.mjs --repo . --prune   # prunes the state-recorded web-interface-guidelines orphan
node <app-foundations>/scripts/install-skills.mjs --repo .           # installs org web-design-guidelines to .devin/skills/
node <app-foundations>/scripts/install-skills.mjs --repo . --check   # expect: check: clean

(Or remove .devin/skills/web-interface-guidelines/ and its agent-skills-state.json entry by hand instead of --prune.)

Commit all of it in one PR: .devin/skills/, .devin/agent-skills-state.json, skills-lock.json, .agents/skills/ deletion.

Context: docs/agent-skills.md "Stale vendored copies" in app-foundations (post-#187).

Activity

  1. spizeck commented on Oct 13, 2026

    @spizeck
    OwnerAuthor

    Verified against current main (d3232a7): this was already remediated by #219 "Reconcile agent skills with latest app-foundations manifest", merged 2026-10-13 — no PR needed here.

    Post-#187 installer verification (install-skills.mjs --check on a clean worktree of main):

    • .agents/skills/web-design-guidelines/ — gone; skills-lock.json has no web-design-guidelines entry (all 9 other external pins intact).
    • .devin/skills/web-interface-guidelines/ — gone; agent-skills-state.json no longer records it.
    • .devin/skills/web-design-guidelines/ — installed, provenance OK (OK on all 8 org skills).
    • check: clean, exit 0 — zero STALE-VENDORED, zero duplicates, zero missing.
    • --detect suggests only the manifest-approved set.

    Recommend closing — noting for completeness that the local checkout at feat/184-qbo-tax-handling still carries uncommitted in-flight copies of these same changes; that branch's working tree can be reconciled or discarded at your discretion.

  2. spizeck commented on Oct 13, 2026

    @spizeck
    OwnerAuthor

    I recommend closing deepdivebrewing-web #218 as completed, then addressing the missing-installation issues in The Bottom Line and reading-rewards. Sea-Saba-Knowledge-Base #48 should also be checked against the now-merged #47 before any additional work is assigned.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions