Relicensed to make sharing and consumption frictionless — the skill is
meant to be dropped into arbitrary client repos, and MIT removes every
question a legal department would ask about that.
Clean to do unilaterally: git shortlog shows no third-party human
contributors (Ben Brown, Claude co-authoring Ben's sessions, and two
copilot-swe-agent[bot] workflow commits made at Ben's direction).
All living license surfaces swapped in lockstep: LICENSE (MIT text,
copyright 2026 Ben Brown), Cargo.toml workspace license, README, and the
skill frontmatter in both copies (.claude + .agents mirror, regenerated
byte-identical). Historical documents in results/ are records and keep
whatever they said at the time. Prior releases/clones under GPL-3.0
remain validly GPL-licensed at those commits, as always.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The attempt-mode guide predates crates/explain and stopped at the ROI
report. It now names the post-verdict step: run just explain on every
rejection before forming the next hypothesis — below-bar, null, and
regression are three different next moves the verdict string alone does
not distinguish. Advisory framing preserved (quote the record, not the
inferences). Mirror regenerated.
Verify mode needs nothing: consumer repos have no ledger, and its
read-it-honestly table already encodes the same narrative doctrine.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
'Use whichever your host can launch' left the selection order implicit and
did not distinguish the two failure kinds. Now stated: dispatch on launcher
availability (not OS) — sh first, ps1 only when the sh launcher itself is
missing; and a STATUS=refuse from either entry point is final, never a cue
to try the other one for a different answer. The CI byte-diff exists
precisely so there is no different answer.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
On a Windows host the preflight's job is to deliver a structured refusal
(measurement is Linux/POSIX-only). But a Windows-native harness with no
POSIX shell never got that far: preflight.sh fails to LAUNCH, and an agent
staring at "sh: not found" is exactly the agent that hand-rolls a timing
loop. The refusal doctrine has to be as portable as the skill.
- scripts/preflight.ps1: faithful port of the preflight contract, runs on
Windows PowerShell 5.1 and pwsh 7+ on any OS. Host check first (so
Windows refuses before touching anything), same walk-up resolution, same
always-build rule, same key=value output, same exit codes. The source is
pure ASCII with the shared em dashes composed at runtime — Windows
PowerShell 5.1 misdecodes BOM-less UTF-8, and that exact bug class
already bit this machine once (the francis-watchdog parse failure).
- Two implementations of one contract is a drift risk, so it is gated like
every other claim in this repo: the skill-preflight CI job now runs BOTH
scripts on the same ubuntu host and byte-diffs their stdout on all three
paths (in-checkout resolve, no-checkout refusal, PELTIER_HOME from a
foreign repo). Disagreement is a red build, not a footnote.
- New skill-preflight-windows job (windows-latest): asserts the native
refusal end-to-end under Windows PowerShell 5.1 AND pwsh (STATUS=refuse,
nonzero exit, the 'unsupported host' reason), plus Git Bash sh for good
measure. Verified live on a real Windows 11 box before shipping: 5.1
parses the pure-ASCII source clean and refuses with exit 1.
- SKILL.md / references/verify.md: document the second entry point ("use
whichever your host can launch; never both, never neither"); book chapter
and CLAUDE.md updated to match. .agents mirror regenerated (identical).
The ZeroClaw variant is unaffected: rm -rf scripts/ drops the ps1 too,
and its audit still passes (7 files scanned).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The SKILL.md Agent Skills standard (agentskills.io) is now read natively by
Codex, Copilot, VS Code, Cursor, Gemini CLI, opencode, Goose, Amp, Zed,
Factory, and ZeroClaw — so the portable move is not per-harness adapter
files (forked content that drifts) but one canonical skill placed where
each harness actually looks.
- Spec-compliant frontmatter: license, compatibility (the Linux-only
measurement story, stated up front), version/author/tags top-level
(ZeroClaw's runtime reads those; the spec ignores unknown fields).
reference/ renamed to references/ per the spec's conventional layout.
- .agents/skills/peltier/ mirror: the cross-tool convergence path (Codex,
Zed, Cursor, Gemini CLI, Copilot, opencode, Goose, Amp). Byte-identical
to the .claude canonical, enforced by CI — drift between the two copies
is a red build, not a footnote.
- AGENTS.md at the repo root for the ~20 harnesses that read it (Claude
Code does not; CLAUDE.md remains its file). Deliberately thin: it points
at CLAUDE.md and the skill instead of restating rules.
- scripts/install-skill.sh: stamps a consumer repo at both discovery paths
(--layout claude|agents|both), or emits a script-less --zeroclaw-variant.
ZeroClaw's skill security policy blocks script files by default
(skills.allow_scripts off) — its audit rejected the full skill and passes
the variant, verified against the real zeroclaw binary. The variant loses
nothing: preflight.sh still exists exactly once, in the peltier checkout
the skill already requires, and SKILL.md now documents running it from
there. Re-implementing preflight inline is named as a refusal condition.
- CI (skill-preflight): frontmatter upgraded to a full Agent Skills spec
conformance check on BOTH copies (name rules, dir match, description and
body limits, metadata string-map), plus mirror equality and a functional
installer test (both layouts identical to canonical, variant carries no
scripts/, nonexistent target refused).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The description was an unquoted YAML scalar containing "trust layer:
equivalence" — a colon-space inside a plain scalar makes YAML parse it as a
nested mapping, so the frontmatter raised "mapping values are not allowed in
this context" and the skill would not load at all.
Quoted the scalar and replaced the colon with an em dash.
The real defect is that CI asserted the preflight script's behavior but never
checked that the skill it ships is loadable. Added a step that parses the
frontmatter, requires name/description to be non-empty strings, and requires
name to match the directory — so an unloadable skill fails the build instead
of failing the user.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The reusable artifact here was never the vendored targets — it is the
discipline: prove equivalence, prove significance, or claim nothing. This
packages it as a Claude Code skill usable from any repo.
Two modes. `verify` works anywhere, on any two shell commands in any
language: equivalence before timing -> A/A calibration -> interleaved A/B
with a bootstrap CI -> a verdict decided by the CI lower bound, never the
median. `attempt` drives the full in-repo loop (gates, pristine-baseline
verdict, ledger row, ROI report).
It drives the real bench-runner binary and refuses rather than degrade: on
an unsupported host, or with no trust layer reachable, preflight stops and
says so instead of falling back to a hand-rolled timing loop. A second copy
of the statistics is a second thing that can lie. A refusal ends the claim,
not the work.
An adversarial review of the skill caught six high-severity defects, all
fixed here — several of them the very errors the skill exists to prevent:
- verify mode had no risk classification at all. bench-runner emits only
accepted/rejected-bench; needs-human-review is minted by the in-repo
verdict path, which verify does not run. A concurrency change with
byte-identical output would have sailed through as "accepted". The skill
now makes the agent the classifier and says so explicitly.
- the accept template exposed `pin_prefix`, which is inert for
compare/aa/calibrate (only `verdict` reads it) — an agent would have set
it and reported pinning that never happened. Now documents wrapping both
sides in taskset instead.
- the equivalence gate compared stdout only, so two commands that write to
stderr and a dist/ tree would "GOLDEN PASS" on two empty files. Now hashes
stdout + stderr + exit code + artifact tree, and an empty diff over empty
output is a failed gate, not a passed one.
- nothing told the agent to build two coexisting immutable artifacts, so a
`cargo run` baseline could rebuild from the patched tree mid-bench — the
exact trap phase1-verdict-smoke-001 recorded.
- service mode was documented as generic HTTP. It is not: the server must
take <port> <doc> <iters>, print READY, and close the connection. A stock
Express app hangs the harness forever. Contract now stated.
- the CI refusal test could not pass: preflight also walks up from its own
location, so running it in-place found this very repo. The test now copies
the skill out of the tree first.
CI job `skill-preflight` asserts the contract that matters — resolve when a
trust layer is reachable, REFUSE when it is not, and work when consumed from
another repo via PELTIER_HOME. It deliberately does not assert a statistical
outcome: a shared runner is too noisy for that, which is precisely why the
skill calibrates before it claims.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
benbrownandClaude Fable 5