[mogul]

Summary

Renames the first-mate-skill kit to personal and adds all 27 skills that Matt Pocock's Claude Code plugin promotes (mattpocock/skills, MIT), vendored at a pinned commit, with credit and maintainer docs shipped alongside.

first-mate-skill/              personal/
  spec.yaml  (3 records)  ->     spec.yaml  (84 records: 4 hand-written, 80 generated)
  files/.../paseo-first-mate     files/home/.agents/skills/
                                   paseo-first-mate/            (unchanged)
                                   ask-matt, tdd, triage, ...   (27 vendored, byte-identical but one rename)
                                   pocock-code-review/          (upstream code-review, renamed)
                                 files/home/.agents/licenses/   (Pocock MIT, HumanLayer MIT)
                                 vendor/mattpocock-skills.json  (pinned commit, sha256 per file, attribution, local changes)
                                 scripts/vendor-pocock-skills   (host-side regenerator)
                                 NOTICE  AGENTS.md  docs/vendored-skills.md

Upstream's code-review is installed as pocock-code-review: the playbook kit ships a different code-review into the same ~/.agents/skills. The script rewrites the skill's name:, its display name, and the 4 skills that call it. Everything else is byte-identical to upstream.

-name: code-review
+name: pocock-code-review
-Once done, call the Skill tool with "code-review" to review the work.
+Once done, call the Skill tool with "pocock-code-review" to review the work.

Credit. The skills are Matt Pocock's. NOTICE, the README, and docs/vendored-skills.md say so, and his MIT notice ships into the sandbox. His pr skill adapts HumanLayer's show-me (88 of 93 non-blank lines of its Summary section match); HumanLayer's MIT notice ships too, pinned by sha256. docs/vendored-skills.md also carries a script-generated table of every local difference from upstream and the steps to update.

Also: the repo link check now skips fenced code blocks (two upstream skills have example links in fences), and CI matrix / validator / test runner use the new name. ADR 0002 records the decisions.

Evidence

• Before: first-mate-skill/scripts/verify 21 checks; pytest scripts/tests 29 tests.
  After: personal/scripts/verify 27 checks (adds lock match for all 80 vendored files, generated-record mode/path, rename consistency, credit files and licence hashes); pytest scripts/tests 69 tests.
• Fidelity: reviewers diffed all 27 skill directories against the pristine upstream archive; the only differences are the six files in the generated table. vendor-pocock-skills --check reproduces the committed tree.
• Tamper tests, each fails verify: edited vendored file, stray file, bare code-review, a skill installed as code-review, name:/directory mismatch, a vendored record changed to 0777, deleted NOTICE, edited or unlisted HumanLayer licence, removed pr/CREDITS.md.
• Script hardening (tests fail against earlier versions): lock file naming paths outside the kit, upstream file names that would forge spec.yaml records, symlinked parents, malformed lock, size cap, CRLF round-trip, a changed upstream promoted list, upstream text reaching the generated doc.
• Local CI-equivalent set on the committed tree: ruff check / ruff format --check, shellcheck, validate-kits.py --patterns (6 kits valid), pytest scripts/tests, run-kit-tests.py personal, scan_unsafe_shell.py personal (0 errors), acq kit validate personal.
• Not run: a live acq run sandbox on either backend; gitleaks and pip-audit (the CI security job); the msb creation-time cost of 84 per-file copies (previously 3).

Merge Danger

Door: two-way. Revert restores the old kit.

Blast Radius: one kit's consumers.

• Anyone pinning &dir=first-mate-skill at a SHA from after this merge must change it to &dir=personal. Refs pinned at earlier SHAs keep working.
• msb copies each of the 84 records individually, so sandbox creation is slower (unmeasured). The sbx chmod step is about 20 KB; its size limit was not checked.
• 16 of the 27 skills are user-invoked only. teach fills whatever directory it runs in; handoff writes to the OS temp directory.
• Licensing is a good-faith reading of MIT, not legal advice.

Rollback

Revert this PR. No other kit depends on personal.

Security impact

No credentials, egress, startup commands, or ports. The payload is plain-text instructions that steer an agent that can run commands, so review the diff of any re-vendoring. The vendoring script runs on the host only (the only network use), refuses non-regular or non-UTF-8 archive members, unsafe file names, and oversized archives, and treats the lock file and upstream text as untrusted.

AI assistance

AI-assisted (OpenCode, claude-sonnet-5.5). Several rounds of adversarial review in a sub-agent; blockers fixed. Requires human review before merge.