* feat(validation): enforce 60K-char cap on skill reference files Implements issue #277: - validate-references.rb: new oversized_reference_errors check — every references/*.md must be <= 60,000 characters; error reports path, size, and the split-and-reindex remediation; wired into validate-skills.rb - test-validate-skills.rb: 5 fixture tests (under-limit passes, over-limit fails with path+size, exactly-at-limit passes, remediation message, non-.md ignored); the suite now runs in validate.yml after the format check (it was previously untested in CI) - Docs: agent-skills/SKILL.md, agent-skills/references/best-practices.md, and the AGENTS.md Format Compliance table document the cap and the split-and-reindex procedure - Compliance: split remote-systems-administration/references/ansible.md and programming-principles/references/refactoring-guru.full.md into an index + focused parts (content moved verbatim); SKILL.md routing, README, and source-index references updated; pre-existing stale refactoring-guru-smells.md reference repointed to the index - Fix pre-existing quality-gate violations in the programming-principles and remote-systems-administration descriptions (imperative verb + negative boundary) so this PR's CI quality step passes; regenerated llms.txt and marketplace artifacts Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com> * test(evals): add eval manifests to modified skills for ratchet The eval-coverage ratchet requires schema-valid eval manifests for any skill modified once coverage is past 50%. This PR modifies programming-principles and remote-systems-administration (splitting their oversized references), so add evals/evals.json to both: - programming-principles: 6 output-quality cases (task-to-book mapping, principled code review, refactor-vs-rewrite, no-op detection, rule distillation, principle conflicts) - remote-systems-administration: 6 output-quality cases (discovery before change, smallest control plane, rollback planning, platform identification, verification evidence, escalation on missing authority) Coverage: 87/145 (60.0%) schema-valid; ratchet clean. Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com> --------- Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
12 KiB
Source Index
This skill is a routing and safety guide, not a frozen command reference. Re-check current primary documentation before asserting version-specific behavior, package availability, service defaults, or upgrade paths.
| Area | Primary source | What it grounds | Checked |
|---|---|---|---|
| OpenSSH client/configuration | OpenBSD ssh(1), ssh_config(5) | Host-key behavior, ProxyJump, connection multiplexing |
2026-07-13 |
| Ansible playbooks | Check and diff mode, execution strategies | Simulation limits, diff sensitivity, serial rollout | 2026-07-13 |
| Ansible modules | package, template, copy, file, lineinfile, command, systemd_service, reboot | Generic-module limits, package-name variance, safe config replacement, narrow unmanaged-file editing, command idempotence, systemd scope, and reconnect behavior | 2026-07-13 |
| Ansible administration | Ansible CLI, inventory CLI, Vault, delegation, and references/ansible.md (index to references/ansible-administration-and-safety.md and references/ansible-runbooks-and-advanced-operations.md) |
Installation, effective configuration, inventory inspection, content patterns, vault lifecycle, delegated rollout, platform boundaries, troubleshooting, and lifecycle routing | 2026-07-13 |
| Ansible quality gates | ansible-lint configuration, Molecule workflow, and Molecule CI | Lint policy/exceptions, CI behavior, scenario lifecycle, idempotence, and outcome verification | 2026-07-13 |
| Paramiko | Paramiko documentation and SSHClient API | Client, host-key, channel, and SFTP responsibilities | 2026-07-13 |
| systemd | systemctl manual | Unit lifecycle and state inspection | 2026-07-13 |
| Linux firewall | nftables wiki | nftables architecture and CLI concepts | 2026-07-13 |
| Debian/Ubuntu packages and lifecycle | Ubuntu software management, automatic updates, Debian release upgrades, Ubuntu release upgrades | APT metadata/transaction distinction, dpkg conffiles, unattended updates, and package versus release lifecycle | 2026-07-13 |
| Debian/Ubuntu networking | Netplan YAML, NetworkManager administration, systemd-networkd, cloud-init boot stages | Renderer and generator ownership before network mutation | 2026-07-13 |
| RHEL/Fedora packages and lifecycle | DNF documentation, Red Hat package management (RHEL 9 reference), Upgrading from RHEL 8 to RHEL 9 (RHEL 9 reference), Fedora offline upgrade | DNF transaction/history/repository inspection and vendor-specific major upgrade workflows | 2026-07-13 |
| RHEL/Fedora services and policy | RHEL NetworkManager (RHEL 9 reference), firewalld documentation, RHEL SELinux (RHEL 9 reference) | Connection ownership, firewall control plane, and SELinux diagnosis boundaries | 2026-07-13 |
| SUSE/openSUSE lifecycle | SUSE lifecycle, SLES transactional updates, SLE Micro transactional updates, openSUSE lifetime | Product support, transactional snapshots, reboot activation, and rollback boundaries | 2026-07-13 |
| Arch packages and recovery | System maintenance, Pacman, systemd, nftables | Full-system upgrades, configuration files, signatures, service discovery, and firewall ownership | 2026-07-13 |
| Alpine packages and persistence | Alpine Package Keeper, Diskless Mode, Alpine local backup, OpenRC | apk configuration conflicts, persistence modes, LBU/apkovl, and service-manager boundaries | 2026-07-13 |
| FreeBSD configuration and lifecycle | FreeBSD Handbook: configuration, updating and upgrading, ports and packages | rc ownership, base-system lifecycle, and package/ports separation | 2026-07-13 |
| FreeBSD recovery and networking | FreeBSD Handbook: ZFS, bectl(8), FreeBSD Handbook: firewalls | ZFS/boot-environment limits and PF/IPFW/IPFILTER ownership | 2026-07-13 |
| NetBSD services and lifecycle | NetBSD rc.d guide, NetBSD upgrading guide, pkgsrc guide, pkg_add(1) | rc ownership, base lifecycle, and pkgsrc binary/source boundaries | 2026-07-13 |
| NetBSD networking and firewall | NetBSD networking guide | Network persistence and NPF, PF, or IPF control-plane discovery | 2026-07-13 |
| OpenBSD services | rcctl(8) | daemon configuration, enablement, and actions | 2026-07-13 |
| OpenBSD packages | pkg_add(1) | package install/update, signatures, package/base distinction | 2026-07-13 |
| OpenBSD base patches | syspatch(8) | official-release binary patch lifecycle and rollback behavior | 2026-07-13 |
| OpenBSD PF | pfctl(8), pf.conf(5) | rule validation/loading and PF control scope | 2026-07-13 |
| Apple launchd | Creating Launch Daemons and Agents | daemon/agent distinction, labels, and launchd ownership model | 2026-07-13 |
| Apple networking | target-host networksetup(8) manual (version-specific) |
network-service configuration controls | 2026-07-13 |
| Apple software updates | Update macOS on Mac and target-host softwareupdate(8) manual |
Apple-provided update planning and target-version-specific update behavior | 2026-07-13 |
| Apple firewall | Block connections to your Mac with a firewall | application/service firewall behavior | 2026-07-13 |
| Apple deployment | Apple Platform Deployment, Firewall payload | Apple-supported management, profile ownership, and Application Firewall controls | 2026-07-13 |
| Homebrew | Homebrew manpage | package-manager behavior and environment controls | 2026-07-13 |
Research observations
- Ansible documents
--checkas a simulation with module support gaps and notes that--diffcan expose sensitive information; the skill therefore treats both as previews, not proof. references/ansible.mdis the index for the deep operational Ansible reference, split intoreferences/ansible-administration-and-safety.md(sections 1-13) andreferences/ansible-runbooks-and-advanced-operations.md(sections 14-21). It was grounded in current Ansible Community, ansible-lint, and Molecule documentation; re-check it against the project runtime before asserting version-specific behavior.- Paramiko documents that clients are responsible for authentication and checking server host keys; the skill therefore forbids automatic acceptance of unknown keys.
- OpenBSD documents
rcctlactions andpkg_add's signed-package behavior; the skill keeps OpenBSD service and package guidance separate from Linux and FreeBSD. - The FreeBSD Handbook distinguishes prebuilt packages from ports; the skill does not present them as a single update mechanism.
- The platform overlays require control-plane ownership discovery before service, package, network, firewall, storage, or lifecycle mutation; manager success is recorded as component evidence, not boundary health.
- Each network or firewall overlay links to the shared connectivity gate so a platform-specific command never substitutes for retained access, independent recovery, rollback, and verification.
Refresh rules
Refresh this index before adding exact release support windows, package versions, security advisories, default firewall behavior, command flags that vary by release, or OS upgrade procedures. If a primary site is unavailable to a crawler, use the maintained canonical URL and state the retrieval limitation rather than replacing it with a plausible paraphrase.
Before RHEL lifecycle work, select documentation for the observed target major release and refresh every RHEL 9 reference in this index as needed. RHEL 9 links are examples and reference guides, not generic current-RHEL documentation.