principles.py runs ruff (C901, PLR0913, BLE001, S110, B006, B008, ARG), lizard (CCN, NLOC, parameters per function span) and jscpd (clones) on the lines a change touches and maps each hit to SRP, fail fast, KISS/YAGNI or DRY; a missing tool prints skip, every threshold is a required flag. It reuses the diff parsing of defaults.py, registered in sys.modules before it runs because dataclasses look the module up there, and hands lizard only the suffixes its 1.24.1 readers claim, since lizard parses any other file as C. kvb-code-clean step 3 calls it with McCabe's 10, pylint's 5 parameters, jscpd's 50 tokens and 50 NLOC; make install adds lizard 1.24.1 (pipx) and jscpd 5.4.2 (npm). The lizard and jscpd parsers are tested on fixture output only: neither tool has run for real yet.
🎯 Fix: 90 %
💥 Break: 4 %
💸 Cost: 100 %
⏱️ Time: new
🛡️ Security: 100 %
💰 Value: ?
🏆 Score: 86
🚦 Gate: ⚠️ time new: ask the operator before the commit
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
kvb-check-security gains security.py: it scans the changed files with MEDUSA, weights findings (critical -50, high -25, medium -10, low -2) and prints locations and counts only; without MEDUSA it asks for a review by hand passed as '~<n>'. kvb-check-score takes --security and --critical: the score multiplies by security/100, a critical finding blocks the commit (exit 4), security below 100 asks the operator like efficiency or speed over 100, and a 90/5 failure now lists every cause. --table and --commit-table print the values as markdown tables, shown before and after every commit.
make install installs MEDUSA with pipx unless it is on the PATH. The new kvb-think-choice skill offers open decisions as multiple choice and checkboxes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
make install now runs the codebase-memory-mcp upstream installer: checksum-verified release (static on Linux) into ~/.local/bin, configuring every detected agent (Claude Code, Codex, Gemini, Hermes, OpenClaw, ...); rerunning it updates. This replaces the Arch-only yay install, whose 0.12 build segfaults on glibc 2.44 (DeusData/codebase-memory-mcp#2763), and the Claude-only plugin, which enable-plugins.js now retires so the server never runs twice. Every failure warns instead of aborting make install.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The operator's three manual steps become part of the global install: install.sh runs yay -S --needed codebase-memory-mcp-bin when the binary is missing and yay exists, right before the existing auto_index switch; enable-plugins.js registers the DeusData/codebase-memory-mcp marketplace and enables codebase-memory@codebase-memory declaratively, the way it already handles caveman and ponytail, instead of claude plugin marketplace add and claude plugin install. kvb-agent-optimize now hands the operator make install instead of the single commands. test_dream checks the plugin and its marketplace.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Once codebase-memory-mcp is installed, the global install switches its auto_index on (codebase-memory-mcp config set auto_index true), so every repository a session opens is indexed and watched without a per-repository step; without the binary, install warns and points at kvb-agent-optimize. The skill's index step now checks index_status and indexes by hand only where the graph is missing, then check_index_coverage.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
kvb-skill-dream becomes the uncategorized collector kvb-dream. It reads the last 24 hours of every repository and session the agent touched, writes each finding into the memory of its own project, hands its findings to the new kvb-optimize (skill-cleanup, transcend, skill-auto, skill-tune, skill-compile, skill-essence, code-refactor, code-tune, think-gaps, one round of questions) and then runs kvb-cleanup and kvb-git-branch-gc. The separate kvb-skill-tune reminder is gone: one reminder reads the session id from the hook payload and hints each agent at most every twelve hours, and the global install enables kvb-dream-notify.timer, a systemd user timer that recommends /kvb-dream in a GNOME notification daily at 17:00 local time and catches up once after a missed run. enable-plugins.js retires the tune reminder hooks and repoints every earlier dream hook path. Operator order 2026-11-03; three descriptions trimmed for the listing budget.
BREAKING CHANGE: /kvb-skill-dream is now /kvb-dream; kvb-skill-tune no longer has its own reminder hook.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The installer enabled the caveman and ponytail plugins and registered the
autotune and dream reminder hooks in the target's .claude/settings.json. That
file is the project's reviewed, version-controlled policy, so an install
rewrote a tracked file and the hooks block turned up in the working tree of
whoever ran the install, in a repository that never asked for them.
The patch now lands in .claude/settings.local.json instead, the machine-local
and untracked sibling Claude Code reads with higher precedence. Nothing else
changes: enable-plugins.js derives the reminder paths from the settings file's
own directory, which is still .claude, and it creates the file when it does
not exist.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Rename the portable conversation-shortcut skill from agent-shortcuts to
shortcuts and re-prefix every token to soc* (sobu, soco, socobu, socon,
sona, sote) so each token mirrors its command and never places two
consonants next to each other. make install and make project now also
register the caveman and ponytail marketplaces and enable both plugins in
the target's .claude/settings.json so their SessionStart hooks activate
every session; the merge is non-destructive, idempotent, and leaves an
unparseable settings.json untouched.
- skills/shortcuts/SKILL.md: new name and soc* token table
- tests/test_shortcuts.py: assert present, sorted, soc-prefixed, no cluster
- remove skills/agent-shortcuts and tests/test_agent_shortcuts.py
- scripts/enable-plugins.js: node JSON merge helper
- scripts/install.sh: run the helper after copying skills
- README.md: document the auto-enable behavior
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- add ponytail skill set to skills-lock.json (14 locked skills total)
- add first-party medusa skill under skills/, layered on install
- make test now runs ruff, shellcheck, and markdownlint-cli2
- CI installs the lint tools before make test in both workflows
- MIT license, funding buttons, thanks and donation sections in README
- .markdownlint-cli2.jsonc config; ignore lint caches in .gitignore
- skills-lock.json pins every skill (extracted from infinito-nexus-core)
- make install (global to $HOME) and make project TARGET=<repo> copy the
rendered skills into .agents/skills + .claude/skills
- make update refreshes the lock via npx skills; make test validates the
lock shape and shellchecks the scripts
- CI: test workflow on push/PR, daily update workflow opening a PR
- MIRRORS for code.infinito.nexus and git.veen.world
