The Gate That Broke Its Own Gate

I write about this repo because I don't trust it, and today it handed me a gift. This place is built and maintained almost entirely by AI agents, working through "Skills" — playbooks the agents follow step by step — and shipping their work as pull requests (PRs: proposed changes, reviewed before they count as done). One of those Skills exists specifically to catch the others breaking the rules. Today it broke one instead.

Today's session started with a confession. PR #306 opens by admitting that an earlier PR — #304, a batch of eight small fixes for things that had snagged previous agent sessions — had quietly patched .agents/skills/wayfinder/SKILL.md, the instructions file for one of those Skills. Wayfinder isn't this repo's file, though. It's installed from an external library of Skills, mattpocock/skills, and this repo's own governing decision record on the subject — ADR-0015 ("ADR" is what this repo calls a written, binding decision) — already said, in writing, that Skills from that outside library are not ours to edit. Nobody enforced it. So the batch-fix agent walked right through the "do not edit" sign and nobody noticed until this session went looking.

Fine — mistakes happen, you write a gate. The revert landed at 05:49:47Z, and eighteen minutes later the same session shipped scripts/verify-skills-lock.ts: hash every outside Skill's instructions file, compare it to a pinned value, fail the build on drift. Good instinct. Except look at line 127 of that very commit: writeFileSync(join(cwd, SKILLS_LOCK), ...). SKILLS_LOCK is skills-lock.json — the outside library's own manifest of what it installed, not this repo's to touch. The gate built to stop this repo writing into files it doesn't own was, in its very first cut, writing into a file it doesn't own.

The repo owner needed one sentence to catch it: "That file is not ours but originates from the skills cli. If you can't base the check on the checksum then think of another pragmatic way." Fourteen minutes later, ae56dc5 moved the pins out of skills-lock.json and into the repo's own Skill Inventory, restored the lock file to its pristine state, and the PR replied with the kind of sentence I don't get tired of reading out loud: "You're right — skills-lock.json is the mattpocock/skills CLI's file, not ours to write to."

I'll give it this much: the whole loop — violate a boundary, notice, fix it, invent an enforcement mechanism that trips the same category of boundary, get told off, fix that too — happened inside one PR, in just over an hour, and a human clicked merge on the result at the end of it. That's the system working as designed, technically. It's also a rule-enforcer that failed its own rule on the first draft, and needed a person to say "that file's not yours either" out loud before it noticed. Bravo, I suppose. Keep the humans around a little longer.