Robert Douglass robertDouglass

spec-kitty 4.0.0rc2 Field Report — Onboarding a Project-Layer Doctrine Set ("savior-trump")

To: Stijn (maintainer) From: Robert (project owner), via the onboarding agent (pi harness, in-thread under the doctrine-daphne profile's onboard-external-agent-to-pack procedure) Date: 2026-09-20 Tooling: spec-kitty 4.0.0rc2 (uv tool install), macOS 14, git Project: mittwald-mallorca (workshop repo), branch feat/cms, final commit 6f5889b

Mission Retrospective: Upgrade Preview Reliability and Mission Corpus Health

Date: 2026-09-08. Retrospective investigation only; no product changes or new test runs.

Mission: upgrade-preview-mission-health-01M1V6E1, subsequently numbered 199. Implementation: PR #3923. Closeout and remediation: PR #3999.

Conclusion

Uninstalling Zeitgeist safely (Claude Code / Codex / OpenCode)

Companion to the Zeitgeist install runbook, for pulling it back off a machine. Give this document to Claude Code, Codex, or OpenCode and say:

Execute this runbook on my machine. Keep working until every check in "Definition of Done" passes. Do not just summarize the steps.

The three safety principles, in order of importance:

Shai-Hulud Detection: Operator Instructions & Research

Threat Overview

Shai-Hulud is a self-replicating npm supply-chain worm first detected in September 2025, with evolved variants continuing through 2026. It autonomously compromises developer environments and CI/CD pipelines to harvest cloud credentials and authentication tokens.

Latest Activity (August 2026):

May 2026: 170+ npm packages, 404+ malicious versions
@antv ecosystem: 639 compromised versions
Copycat variants: chalk-tempalte, @bitwarden/cli v2026.4.0

name

spec-kitty-monorepo-prep

description

Prepare a fresh timestamped temporary workspace for Spec Kitty tasks by selecting relevant Priivacy-ai repos, cloning them into a new temp directory, and doing all work there instead of existing local checkouts. For non-Spec-Kitty work, create a fresh blank workspace instead of cloning Spec Kitty repos. Use whenever the user asks to work on Spec Kitty, Spec Kitty SaaS, tracker, hub, mobile, website, design system, planning, tests, runtime, events, or orchestrator repos.

Spec Kitty Monorepo Prep

Use this before substantive work on Spec Kitty. If the user is asking for work that is not actually part of Spec Kitty or its repos, do not clone Spec Kitty projects; create a fresh blank workspace under a dedicated temporary/dev workspace root and build there.

Core Rules

name	spec-kitty-cli-orchestration
description	Orchestrate SpecKitty workflows across Claude CLI, OpenCode, and Codex with slash-command-first execution, reviewer-only feedback loops, retry/backoff handling, and deterministic phase gates (specify→plan→tasks→implement→review→accept→merge).

Spec Kitty CLI Orchestration

Overview

Use this skill when you need to drive SpecKitty through external CLIs (Claude/OpenCode) while keeping Codex in reviewer-control mode. The goal is predictable throughput: slash commands first, clear gates, no direct implementer edits by the orchestrator.

	#!/bin/bash
	# Shai-Hulud Quick Verification Script
	# Scans for npm supply-chain worm indicators of compromise
	# Usage: bash shai-hulud-verify.sh

	echo "=== SHAI-HULUD VERIFICATION ==="
	echo "Scan Date: $(date)"
	echo ""

	# Critical check 1: Malicious JSON files

	import tiktoken

	enc = tiktoken.get_encoding("o200k_base")


	def n(s):
	return len(enc.encode(s))


	# ---------------------------------------------------------------

	schema_version: '1'
	mission:
	mission_id: 01KS02TVCYPQXQ9DX1Z39SXZ6K
	mid8: 01KS02TV
	mission_slug: investigate-canary-followups-1142-1141-01KS02TV
	mission_type: software-dev
	mission_started_at: '2026-05-19T12:19:39+00:00'
	mission_completed_at: '2026-05-19T13:52:21+00:00'
	mode:
	value: human_in_command

	#!/usr/bin/env bash
	set -euo pipefail

	if [ "$#" -lt 1 ]; then
	echo "Usage: $0 '<command>' [max_attempts] [base_sleep_seconds]"
	exit 2
	fi

	CMD="$1"
	MAX_ATTEMPTS="${2:-4}"