Field Note5 min read

A 953-line skill entry fits the budget again

A 953-line skill entry collapses to 267 lines plus four pull-only references, and the same day seventeen Omarchy repos pin the audit-harness and review Action to the same SHA.

tl;dr On 2026-09-09 contributing-clanker split skills/contribute/SKILL.md from 953 lines to 267 lines plus four new pull-only references (operations.md, repo-intake.md, submission-policy.md, and a slimmed workflow-guide.md), and seventeen Omarchy entry repos each merged chore(deps) refreshes that bump @intentsolutions/audit-harness from 1.3.1 to 1.4.0, pin jeremylongshore/minimax-code-review to v0.5.0 SHA bcaa65182, drop a vulnerable qs override, and roll the anti-tamper seal. omarchy-mlb-booth-entry shipped its own separate feat: a persistent club and clock settings form. Two batches of hygiene on the same day, neither surprising on its own.

The day reads as two coordinated hygiene passes. The first is internal to the contributing-clanker skill entry, and the second is a single dep-refresh PR applied to seventeen Omarchy entry repos. They share the same shape: a long running surface (a single SKILL.md; a long-running audit-harness pin) gets trimmed or locked, and the receipt is a number plus a hash.

The SKILL.md that nobody could load in full

contributing-clanker PR #77 (commit 63df1ee, 2026-09-09 00:40 UTC) cut skills/contribute/SKILL.md from 953 lines to 267 lines, a 72% reduction. The content moved into four reference files, three of them new:

  • references/operations.md (69 lines, new): dashboard, live reconciliation, override audit, runtime drift, dry-run email policy.
  • references/repo-intake.md (91 lines, new): GitHub URL or owner/repo slug parsing, owned-repo scope guard, new versus known-repo briefing.
  • references/submission-policy.md (143 lines, new): required fit fields, collaboration surface, counterparty design intent, candidate updates after submission.
  • references/workflow-guide.md (153 to 112 lines): trimmed end-to-end flow.

The SKILL.md itself now reads as a thin index. Step 1 (Detect invocation mode) points at [repo intake](references/repo-intake.md) and [operations](references/operations.md). Step 3 (Require a current dossier and first-touch fit) points at [submission policy](references/submission-policy.md). The Resources section at the end lists all seven reference files in plain markdown links. A contributor who needs only the daily status flow pulls only operations.md; a contributor onboarding a new repo pulls only repo-intake.md.

The diff is 558 insertions and 893 deletions across the five files. The skill fits a tighter first-load budget, and the references stay readable as their own documents because each one was written with its own scope.

A small but telling diff: the front matter changed the allowed-tools entry from - Task to - Agent. The skill entry now declares the modern subagent tool rather than the deprecated one, which would have produced a stale warning on every invocation. The wording of the description block also tightened: from a multi-line justified narrative to a one-paragraph capability statement.

Seventeen repos pin to one SHA

The second batch is a coordinated dep refresh that landed across all seventeen Omarchy entry repos on the same day. Each repo merged a single chore(deps): refresh ecosystem dependencies (#N) PR with an identical commit body: “Updates the audit harness and review Action, removes the vulnerable qs override, hard-pins remaining Actions, fixes the maintainer intake link, and refreshes the reviewed anti-tamper seal. Local and remote gates passed.”

The substantive changes per repo are the same five:

  1. @intentsolutions/audit-harness bumped from ^1.3.1 to ^1.4.0.
  2. The review Action jeremylongshore/minimax-code-review bumped from d1314b96c1b261d5bf026d0a669823a7e5ce6b46 to bcaa65182e52183f14746663aa2049641c0dbca5 # v0.5.0. Every reference in .github/workflows/minimax-review.yml now uses the same SHA with a # v0.5.0 comment, so a reader can audit the pin by eye.
  3. A vulnerable qs override is removed from package.json (the dep update replaces the override with a fixed upstream version).
  4. The remaining Actions in gates.yml and minimax-review.yml are hard-pinned to full SHAs where they were previously referenced by tag.
  5. The maintainer-intake link in README.md is fixed from a relative ../../issues/new?template=... to an absolute https://github.com/jeremylongshore/<repo>/issues/new?template=..., which works whether the README is read on GitHub or from a clone.

The .harness-hash file rolls on every repo. Reading the capture-conveyor-entry diff shows the new hash entries for .github/workflows/minimax-review.yml and package.json (the two files whose contents changed); the other entries stay byte-for-byte identical. That is the audit surface verifying the seal: every file listed in .harness-hash was reviewed and approved as part of the new state.

The seventeen repos touched: bazaar, capture-conveyor, crew-chief, desk-transition, docket, flow-boundary, foundry, listening-post, loose-ends, mlb-booth, omatrail, pit-wall, quiet-queue, wait-state, widget-template, workspace-storyboard, x-files. (mlb-booth got the refresh plus its own separate feature commit, covered below.)

omarchy-mlb-booth-entry: persist club and clock settings

The mlb-booth entry repo shipped an additional commit on the same day that was not part of the dep-refresh wave: 6366a3a feat: persist club and clock settings (#5), by David Reed. A new SettingsForm.qml (358 lines) adds keyboard-accessible settings for all 30 clubs and 12 or 24-hour first-pitch times, persists the selected club across shell restarts and failed or stale schedule responses, and adds a deterministic live-feed loading path.

The commit also updates Model.js (55 new lines), Panel.qml (210 lines with churn), e2e/rig-after-open.sh (27 lines), and rolls the .harness-hash and .rig-proof.json fingerprints. The render-proof test was the gating surface: the new .rig-proof.json records the panel’s post-settings render, and the maintainer approval used the same seal pathway as the other entries.

This was a real user-facing change on top of the hygiene wave, not part of the wave itself.

What the two batches share

Both reads are routine on a single surface and structural on the estate. The SKILL.md refactor only touches one file’s line count in the diff stat, but it changes what gets loaded when a contributor invokes /contribute and what stays hidden behind a reference link. The seventeen-repo dep refresh only changes a SHA and a ^ in each repo, but it locks the audit-harness to one published version across the whole Omarchy entry estate, removes a vulnerable override from each clone, and reseals the harness hash for every entry.

The shape is the same. A long-running surface is reduced to a smaller loadable form, and a long-running pin is hardened against silent drift. The cost is the diff size; the receipt is the harness hash on each entry and the references index on the skill entry.