feat(m69-001): bootstrap skills repo + migrate install-platform-ops

[indykish]

Summary

Bootstraps github.com/usezombie/skills as the canonical public home for usezombie-* agent skills (spec M69_001). Companion PR in usezombie/usezombie deletes the in-repo skills/ + drops it from the npm bundle.

What ships

§1 — Repo bootstrap

• README.md masthead (logo + early-access pattern from usezombie/docs)
• .claude-plugin/marketplace.json — enables claude plugin marketplace add usezombie/skills
• .github/workflows/eval.yml — bun install && bun test on PR + push to main
• assets/logo/{dark,light}.svg — branding

§2 — usezombie-install-platform-ops migration

• SKILL.md + references/ — verbatim from monorepo except 3 corrective edits for post-M69 reality:
  1. metadata.source → github.com/usezombie/skills
  2. Precondition install one-liner → npx skills add usezombie/skills
  3. Manual symlink fallback → git clone (npm-bundled skills/ path disappears with M69 §4)
• evals/ — 21 pin tests ported from node:test → bun:test:
  • skill-body.test.ts (10) — Resend-pattern frontmatter, references resolve, step coverage, RULE NLG verb guards, 350L cap
  • skill-runtime.test.ts (8) — prose-pin tests for s1.0 / s1.8 / s1.9 / s1.10
  • repo-detection.test.ts (3) — fixture sanity
• evals/fixtures/{gh-actions-fly,gh-actions-only,no-ci}/

Test runner: bun test (spec line 70 — forbids node:test, mandates Bun to match lead repo's zombiectl/ + ui/packages/ runners).

Test plan

• cd usezombie-install-platform-ops/evals && bun test → 21 pass, 0 fail, 84 expect() calls
• After merge: companion PR feat/m69-001-public-skills-repo on usezombie/usezombie can land
• Smoke install on clean env: npm install -g @usezombie/zombiectl && npx skills add usezombie/skills → /usezombie-install-platform-ops resolves in Claude Code

Sequencing

This PR (skills-repo bootstrap) lands first. Companion lead-repo PR (deletes in-repo skills/) lands second. Order matters — reversing leaves npx skills add usezombie/skills resolving to an empty repo.

🤖 Generated with Claude Code

Greptile Summary

This PR bootstraps usezombie/skills as the canonical public home for usezombie-* agent skills and migrates usezombie-install-platform-ops from the monorepo with three post-M69 corrective edits (metadata source, install one-liner → npx skills add, symlink fallback → git clone). It also ports the existing 21 eval tests from node:test to bun:test and adds the required CI workflow.

• Repo scaffold: README.md, .claude-plugin/marketplace.json, CI workflow (eval.yml with Bun runtime pinned to 1.3.14), and SVG branding assets are added.
• Skill migration: SKILL.md + three references/ docs are ported verbatim with targeted M69 corrections; all 12 install steps, precondition block, and common-mistakes table are intact.
• Eval suite: 21 pin tests split across skill-body.test.ts, skill-runtime.test.ts, and repo-detection.test.ts verify frontmatter shape, prose decision points, fixture well-formedness, and RULE guards; a nightly LLM-judge stub (llm-judge.eval.ts) is scaffolded but skipped from standard bun test discovery by its .eval.ts suffix.

Confidence Score: 5/5

Safe to merge — the changes are a clean repo bootstrap with a skill migration and an eval suite; no destructive operations or shared-state mutations are introduced.

All twelve install steps, credential handling, and HMAC self-verify logic are carried over correctly from the monorepo. The three M69 corrective edits are targeted and validated by corresponding pin tests. CI is reproducible with the Bun runtime and lockfile both resolved to 1.3.14. The only finding is a minor version drift risk in package.json that is mitigated by the committed lockfile in the normal workflow.

usezombie-install-platform-ops/evals/package.json — @types/bun is declared as latest while the runtime and lockfile are both pinned to 1.3.14.

Important Files Changed

Filename	Overview
.github/workflows/eval.yml	CI workflow for bun test matrix; Bun runtime is now pinned to "1.3.14" matching the lockfile, and fail-fast is disabled so multiple skill failures surface independently.
usezombie-install-platform-ops/SKILL.md	Migrated skill body; three post-M69 corrective edits applied (metadata.source, install one-liner, git-clone fallback). All 12 install steps, precondition block, common-mistakes table, and out-of-scope section are present.
usezombie-install-platform-ops/evals/skill-body.test.ts	10 pin tests covering frontmatter shape, reference resolution, canonical CLI verb guards, --data @- enforcement, step coverage, and 350-line cap. All patterns match current SKILL.md content.
usezombie-install-platform-ops/evals/skill-runtime.test.ts	8 prose-pin tests anchoring decision-point text for steps s1.0, s1.8, s1.9, and s1.10. Regex patterns verified against current SKILL.md including newline-spanning assertions in s1.9 idempotency check.
usezombie-install-platform-ops/evals/package.json	Declares @types/bun: latest while the workflow pins the Bun runtime to 1.3.14 and the lockfile already resolves to 1.3.14 — version drift risk on lockfile regeneration.
usezombie-install-platform-ops/references/credential-resolution.md	Rotation snippet now correctly captures OLD_SECRET via shell variable and guards against empty with an early exit before piping into jq via --arg secret "$OLD_SECRET".

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[User: npx skills add usezombie/skills] --> B[.claude-plugin/marketplace.json\nresolved by host]
    B --> C[SKILL.md loaded by host LLM]
    C --> D[Step 1: zombiectl doctor --json]
    D -->|fail| E[Stop & surface error]
    D -->|pass| F[Steps 2-6: Detect repo,\nresolve vars & credentials]
    F --> G[Step 7: zombiectl zombie install\nwrites .usezombie/platform-ops/]
    G -->|webhook_urls present| H[Steps 8-9: Parse TRIGGER.md\ngh api repos/.../hooks POST]
    G -->|webhook_urls empty| K[Skip 8-10, go to 11]
    H -->|422 hook exists| I[GET hooks, match URL, advance]
    H -->|403/401| E
    H -->|success| J[Step 10: HMAC self-verify\nopenssl + curl → expect 202]
    J -->|non-202| E
    J -->|pass| K[Step 11: Post-install summary]
    K --> L[Step 12: zombiectl steer smoke test]
    L -->|>60s| M[Print slow-response warning]
    L -->|pass| N[Done]

Loading

Prompt To Fix All With AI

Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 1
usezombie-install-platform-ops/evals/package.json:10
The `@types/bun` dependency is declared as `"latest"`, but the CI workflow pins the Bun runtime to `1.3.14` and the lockfile resolves `@types/bun@1.3.14`. If someone runs `bun update` or regenerates the lockfile, the types package will jump to whatever current `latest` is, while the runner stays on `1.3.14`. That mismatch can surface type errors for APIs that exist in the newer types but haven't landed in the pinned runtime yet. The workflow comment explicitly says "Pinned to match bun-types@1.3.14" — the `package.json` should enforce that same pin.

```suggestion
    "@types/bun": "1.3.14",
```

_{Reviews (3): Last reviewed commit: "fix(m69-001): greptile P1+P2 — paste con..." | Re-trigger Greptile}