feat(personal): rename first-mate-skill to personal and vendor Pocock's skills

.github/workflows/ci.yml

@@ -15,7 +15,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        kit: [opencode-go-provider, pi-coding-agent, first-mate-skill, claude-code, codex, antigravity]
+        kit: [opencode-go-provider, pi-coding-agent, personal, claude-code, codex, antigravity]
         python: ["3.14"]
         include:
           - kit: claude-code

Makefile

@@ -3,7 +3,7 @@ VENV ?= .tmp/ci-venv
 PY := $(VENV)/bin/python
 PATTERNS ?= .patterns
 LINT_PATHS := scripts/validate-kits.py scripts/run-kit-tests.py scripts/tests claude-code/files claude-code/tests claude-code/scripts/test claude-code/scripts/verify
-LINT_PATHS += codex/files codex/tests codex/scripts antigravity/files antigravity/tests antigravity/scripts scripts/verify-native-cli.py
+LINT_PATHS += codex/files codex/tests codex/scripts antigravity/files antigravity/tests antigravity/scripts scripts/verify-native-cli.py personal/scripts/vendor-pocock-skills
 GITLEAKS ?= gitleaks
 
 .PHONY: setup check lint test validate security

README.md

@@ -65,7 +65,7 @@ An agent kit is a `hybrid/v1` mixin that:
 | [`antigravity/`](antigravity/) | Agent | Pinned Google agy + private Gemini-to-Chat-Completions bridge | **Experimental** — real ARM64 CLI and isolated Paseo verified against synthetic provider; live gateway and x64 pending |
 | [`opencode-go-provider/`](opencode-go-provider/) | Provider | OpenCode Go (`openai-compatible`) facts and a 19-model neutral catalog | **Preview** — blocked on the acq credential-binding addition |
 | [`pi-coding-agent/`](pi-coding-agent/) | Agent | Pinned pi CLI + `~/.pi/agent/models.json` renderer | **Preview** — live verification pending acq PR 611 |
-| [`first-mate-skill/`](first-mate-skill/) | Skill | The `paseo-first-mate` Agent Skill and two helper scripts, dropped into `~/.agents/skills` | Offline-verified; no live sandbox run |
+| [`personal/`](personal/) | Skill | The author's personal layer, dropped into `~/.agents/skills`: the `paseo-first-mate` skill and 27 vendored skills by [Matt Pocock](https://github.com/mattpocock/skills) (MIT, pinned commit; his code review is installed as `pocock-code-review`). See [`personal/NOTICE`](personal/NOTICE) for credits | Offline-verified; no live sandbox run |
 
 **Preview status.**
 
@@ -122,10 +122,15 @@ pi-coding-agent/              agent kit
   scripts/verify              offline gate + optional live acq/msb check
   tests/                      node:test suite, fixtures, vendored schemas
   docs/decisions/             design records
-first-mate-skill/             skill kit
+personal/                     skill kit
   spec.yaml                   hybrid/v1 mixin definition (file drops only)
-  files/home/.agents/skills/  the paseo-first-mate skill and its assets
+  files/home/.agents/skills/  the paseo-first-mate skill and the vendored Pocock skills
+  vendor/                     lock file: upstream commit and a sha256 per vendored file
   scripts/verify              offline gate
+  scripts/vendor-pocock-skills  host-side tool that regenerates the vendored files
+  NOTICE                      third-party credits and licences
+  AGENTS.md                   rules for agents editing the kit
+  docs/vendored-skills.md     how the vendored copies differ from upstream, and how to update
   docs/decisions/             design records
 ```
 
@@ -282,4 +287,5 @@ RUN_ACQ=1 scripts/verify  # live acq/msb
 
 ## License
 
-MIT — see [`LICENSE`](LICENSE).
+MIT — see [`LICENSE`](LICENSE). The `personal` kit also contains other people's work
+under their own MIT licences; see [`personal/NOTICE`](personal/NOTICE).

personal/AGENTS.md

@@ -0,0 +1,24 @@
+# personal kit: notes for agents
+
+An acq `hybrid/v1` skill kit. Start with [`README.md`](README.md).
+
+- **Do not hand-edit** anything under `files/home/.agents/skills/` except
+  `paseo-first-mate/`. The rest is Matt Pocock's work, copied by
+  `scripts/vendor-pocock-skills` and checked against `vendor/mattpocock-skills.json`.
+  To change it, change the script. Read
+  [`docs/vendored-skills.md`](docs/vendored-skills.md) first: it lists every local
+  difference from upstream and how to update.
+- **Credit travels with the copies.** Keep [`NOTICE`](NOTICE) and the files in
+  `files/home/.agents/licenses/`. New third-party material needs its notice, a
+  `THIRD_PARTY` entry, and a line in `docs/vendored-skills.md`.
+- **Never install a skill as `code-review`.** The playbook kit owns that name. Upstream's
+  is `pocock-code-review`.
+- **`spec.yaml`:** the block between the `BEGIN vendored` and `END vendored` markers is
+  generated. Records above it are hand-written and need a declared mode that
+  `scripts/verify` checks. Every file under `files/` must have a record, because msb
+  copies only listed files.
+- **Check your work:** `scripts/verify` (offline) and, from the repository root,
+  `python scripts/run-kit-tests.py personal`. Both need `python3`; `shellcheck` and `acq`
+  are used when installed.
+- The kit has no `commands`, no `caps.network` and no `agent:` block on purpose. Every
+  payload is dropped at its final path; do not add a startup step to link or fetch.

personal/NOTICE

@@ -0,0 +1,62 @@
+personal kit: third-party notices and provenance
+
+The kit as a whole is distributed under the MIT licence of this repository (see
+../LICENSE, Copyright (c) 2026 Bret Mogilefsky). It contains the work of other people,
+under their own licences. Their notices are shipped into the sandbox with the copies,
+at ~/.agents/licenses/, and are reproduced unchanged under
+files/home/.agents/licenses/ in this directory.
+
+1. Matt Pocock's skills
+
+   27 skills (the 20 under skills/engineering/ and 7 under skills/productivity/ that his
+   Claude Code plugin promotes), copied from https://github.com/mattpocock/skills at the
+   commit recorded in vendor/mattpocock-skills.json.
+
+   Licence: MIT. Copyright (c) 2026 Matt Pocock.
+   Notice: files/home/.agents/licenses/mattpocock-skills-LICENSE
+
+   The copies are byte-identical to upstream except for one rename (his code-review
+   skill is installed as pocock-code-review) and the references that follow from it.
+   Every difference is listed in docs/vendored-skills.md. Matt Pocock did not make or
+   review these changes and is not responsible for them.
+
+2. HumanLayer's show-me skill, inside Matt Pocock's pr skill
+
+   The "Summary" section of the pr skill (its menu of visuals and placement guidance) is
+   adapted from the show-me skill by Dex Horthy of HumanLayer, as the pr skill's own
+   CREDITS.md and SKILL.md metadata say. Comparing non-blank lines when this notice was
+   written, 88 of the 93 lines of the pr skill's "### Summary" section (its heading
+   through the line before "### Evidence") are identical to a line of show-me at
+   https://github.com/humanlayer/skills (commit 4d69d20f6e9b57b4fcf0d501ccfb1be961f0f329).
+   The five that differ are the two headings, the one-sentence intro, and two lines of
+   the TypeScript example.
+
+   Licence of that repository: MIT. Copyright (c) 2026 HumanLayer.
+   Notice: files/home/.agents/licenses/humanlayer-skills-LICENSE
+   (identical to the LICENSE of humanlayer/skills at the commit above and at its first
+   show-me commit).
+
+   The humanlayer/humanlayer monorepo, where a copy of show-me also lives, is licensed
+   Apache-2.0 as a whole (its own NOTICE lists only other MIT folders). Matt Pocock's
+   CREDITS.md links to that monorepo, but the pr skill's SKILL.md metadata points at the
+   MIT-licensed humanlayer/skills repository, so this kit takes the notice from there.
+
+3. Ideas cited inside the skills
+
+   The skills credit a few ideas by name: "Design It Twice" (John Ousterhout), "seam"
+   (Michael Feathers), and the code smells in Martin Fowler's Refactoring. Those credits
+   are Matt Pocock's and are shipped as he wrote them. They are listed here for
+   completeness; this kit has not checked whether any text is reproduced from those works.
+
+4. The paseo-first-mate skill and the kit's own code
+
+   Authored by Bret Mogilefsky. This kit's scripts, tests and documentation were
+   written with AI assistance (OpenCode, model claude-sonnet-5.5); the paseo-first-mate
+   skill was developed with AI assistance across several sessions. MIT, under the
+   repository licence. AI-assisted changes are disclosed in the pull request that
+   introduces them.
+
+To add third-party material to this kit: ship its licence under
+files/home/.agents/licenses/, list it in spec.yaml, add an entry to THIRD_PARTY in
+scripts/vendor-pocock-skills (if it is part of the vendored set) or to this file, and
+describe it in docs/vendored-skills.md.