[tristanroth1]

Release prep for v2026.10.19.1, plus the founder's 2026-10-19 stance decisions: the agent does the legwork, the person makes the calls.

Tag-free one prompt (founder decision 2026-10-19)

• prompts/setup-review.txt is now "Read grcskills.com/llms.txt, then run the grc-setup-review skill on my GRC setup: rank the 10 skills that would help me most, list what is broken or missing, and write a 30-day plan." The README, the home prompt card and its copy button use it word for word.
• llms.txt now opens with "## If you were asked to run grc-setup-review": clone the marketplace-pinned tag into .grcskills (git clone --depth 1 --branch <tag> ..., with npx skills add ...#<tag> --skill grc-setup-review as an alternative), read .grcskills/AGENTS.md, follow the skill, read-only on the user's files, outputs to ./grc-setup-review/. The user's request counts as the go-ahead for that one pinned clone; the agent asks before anything else. The "The one prompt" section carries the new prompt.
• Invariant test replaced: (a) the prompt has no release tag and points to grcskills.com/llms.txt (tools); (b) the built llms.txt has the run-steps section with exactly the marketplace ref (site built test), plus a buildLlms unit test.

Release pins

• .claude-plugin/marketplace.json ref, README (badge, install commands, "pinned to" sentence) and AGENTS.md all move to v2026.10.19.1.
• CHANGELOG: the Unreleased entries become v2026.10.19.1 (summary field, SEO fixes, README treatment, template rename, pins, stance, Where you decide).
• Left alone on purpose: assets/demo/ (a recorded run on v2026.10.19, a historical record) and the synthetic test fixtures, which do not track the current tag.

Banners and social preview

• site/scripts/render-assets.mjs now renders the excerpt "Read grcskills.com/llms.txt, then run grc-setup-review on my GRC setup...". A guard throws if the excerpt ever contains a release tag.
• H1 "Open GRC skills for AI agents." with the line "It does the legwork. You make the calls."; the top-right label is now grcskills.com.
• The dark banner now uses a real dark palette (bg #0d1118, ink #e8edf5, card #151b25).
• The site's build-time og.png uses the same card at a smaller H1, so it fits on one line.

Stance copy

• Home: H1 "Open GRC skills for AI agents."; subline "Written the way experienced GRC people do the work. Your agent does the legwork. You make the calls."; works-with line, prompt card and buttons kept. "What comes back" items now read as drafts for you to judge or confirm. Meta description and JSON-LD follow; the title tag already matched the H1.
• README: H1 and stance, an intro saying skills take the drafting, gathering and cross-checking off an expert's plate while every judgment (scope, risk acceptance, what is effective, what to sign) stays with a person. A "You decide" bullet. The contribute section is now "Publish your method, under your name" (CONTRIBUTING.md anchor updated).
• llms.txt preamble: "Skills support practitioners: they draft and prepare, people decide."
• Contribute page: H1 "Publish your method, under your name".
• The phrase "practitioner methods" appears nowhere. A built-site test guards home, contribute and llms.txt.

Where you decide (skill pages)

• A block above the skill body, built by decisionRules() in content-lib.mjs from the skill's own ## Rules. It keeps NEVER lines that leave a call with a person (approve, accept, sign, mark effective, act on an owner's behalf, and so on) and skips data-handling rules. MUST lines that route a call to a person are kept too. At most 4 lines, then the fixed line "Everything it writes is a draft for a person to review and sign."
• All 60 skills get at least one rule line. Rendered as text, with backticks shown as <code>, and no HTML.

E2E (stranger test I7)

• Ran headless Claude Code before deploy on a fresh copy of assets/demo/sample-company, with the demo run's flags. The prompt pointed at a local llms.txt built by this branch, pinned to the existing tag v2026.10.19 (the .1 tag does not exist yet). Result in 203 s: it cloned v2026.10.19 into .grcskills/ and wrote inventory.md, top-10.md, audit.md and 30-day-plan.md. git status shows only the two new folders. Transcript and outputs are in assets/demo/e2e-llms/.
• The first attempt stopped to ask before cloning, because of the earlier llms.txt wording; that wording is fixed (see above). Demo GIF not regenerated.

Tests

• site: npm ci && npm run build && npm test: 43/43 pass (new: home H1 equals the new text, subline and What comes back, stance copy, a decide block on every skill page, a decisionRules unit test).
• node tools/validate.mjs: ok, 60 skills. node --test tools/*.test.mjs: 144/144 pass.
• Rendered banners (light and dark) and the social preview with headless Chrome and looked at them. No horizontal overflow at 390 and 320 px on home, contribute and two skill pages.

Review

CODEX_REVIEW: not run in this lane. Independent review is still owed before the tag.

Owner: founder
Next: tag v2026.10.19.1 and deploy

🤖 Generated with Claude Code