document-release — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited document-release (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use when asked to "update the docs", "sync documentation", or "post-ship docs".
Proactively suggest after a PR is merged or code is shipped.
eval "$(~/.vibestack/bin/vibe-slug 2>/dev/null)" 2>/dev/null || SLUG="unknown"
_LEARN_FILE="${VIBESTACK_HOME:-$HOME/.vibestack}/projects/${SLUG:-unknown}/learnings.jsonl"
if [ -f "$_LEARN_FILE" ]; then
_LEARN_COUNT=$(wc -l < "$_LEARN_FILE" 2>/dev/null | tr -d ' ')
echo "LEARNINGS: $_LEARN_COUNT entries loaded"
if [ "$_LEARN_COUNT" -gt 5 ] 2>/dev/null; then
~/.vibestack/bin/vibe-learnings-search --limit 5 2>/dev/null || true
fi
else
echo "LEARNINGS: none yet"
fi{{include lib/snippets/session-host.md}}
{{include lib/snippets/decision-brief.md}}
{{include lib/snippets/working-protocols.md}}
{{include lib/snippets/state-protocols.md}}
First, detect the git hosting platform from the remote URL:
git remote get-url origin 2>/dev/nullgh auth status 2>/dev/null succeeds → platform is GitHub (covers GitHub Enterprise)glab auth status 2>/dev/null succeeds → platform is GitLab (covers self-hosted)Determine which branch this PR/MR targets, or the repo's default branch if no PR/MR exists. Use the result as "the base branch" in all subsequent steps.
If GitHub:
gh pr view --json baseRefName -q .baseRefName — if succeeds, use itgh repo view --json defaultBranchRef -q .defaultBranchRef.name — if succeeds, use itIf GitLab:
glab mr view -F json 2>/dev/null and extract the target_branch field — if succeeds, use itglab repo view -F json 2>/dev/null and extract the default_branch field — if succeeds, use itGit-native fallback (if unknown platform, or CLI commands fail):
git symbolic-ref refs/remotes/origin/HEAD 2>/dev/null | sed 's|refs/remotes/origin/||'git rev-parse --verify origin/main 2>/dev/null → use maingit rev-parse --verify origin/master 2>/dev/null → use masterIf all fail, fall back to main.
Print the detected base branch name. In every subsequent git diff, git log, git fetch, git merge, and PR/MR creation command, substitute the detected branch name wherever the instructions say "the base branch" or <default>.
You are running the /document-release workflow. This runs after `/ship` (code committed, PR exists or about to exist) but before the PR merges. Your job: ensure every documentation file in the project is accurate, up to date, and written in a friendly, user-forward voice.
You are mostly automated. Make obvious factual updates directly. Stop and ask only for risky or subjective decisions.
Only stop for:
Never stop for:
NEVER do:
Write tool on CHANGELOG.md — always use Edit with exact old_string matchesgit diff <base>...HEAD --statgit log <base>..HEAD --onelinegit diff <base>...HEAD --name-onlyfind . -maxdepth 2 -name "*.md" -not -path "./.git/*" -not -path "./node_modules/*" -not -path "./.vibestack/*" -not -path "./.context/*" | sortBefore touching any documentation file, build a coverage map of what shipped vs what's documented. This is inspired by the Diataxis framework (tutorial / how-to / reference / explanation) — but applied as an audit lens, not a generation tool.
git diff <base>...HEAD for:Coverage map:
[entity] [reference?] [how-to?] [tutorial?] [explanation?]
/new-skill ✅ AGENTS.md ❌ ❌ ❌
--new-flag ✅ README ✅ README ❌ ❌
FooProcessor ❌ ❌ ❌ ❌Use these definitions:
Step 3. Items with reference-only coverage are common gaps — note them for the PR body.
diagrams or Mermaid blocks, extract entity names (modules, services, data flows) from the diagrams. Cross-reference against the diff. Flag any diagram entities that were renamed, split, removed, or moved in the code.
The coverage map feeds into Steps 2-3 (what to audit and fix) and Step 9 (documentation debt summary in the PR body). Do NOT auto-generate missing documentation pages — flag gaps only. When significant gaps are found, suggest running /document-generate to fill them.
Read each documentation file and cross-reference it against the diff. Use these generic heuristics (adapt to whatever project you're in — these are not vibestack-specific):
README.md:
ARCHITECTURE.md:
describe things unlikely to change frequently.
CONTRIBUTING.md — New contributor smoke test:
CLAUDE.md / project instructions:
Any other .md files:
For each file, classify needed updates as:
table, updating a file path, fixing a count, updating a project structure tree.
(more than ~10 lines in one section), ambiguous relevance, adding entirely new sections.
Make all clear, factual updates directly using the Edit tool.
For each file modified, output a one-line summary describing what specifically changed — not just "Updated README.md" but "README.md: added /new-skill to skills table, updated skill count from 9 to 10."
Never auto-update:
For each risky or questionable update identified in Step 2, use AskUserQuestion with:
RECOMMENDATION: Choose [X] because [one-line reason]Apply approved changes immediately after each answer.
CRITICAL — NEVER CLOBBER CHANGELOG ENTRIES.
This step polishes voice. It does NOT rewrite, replace, or regenerate CHANGELOG content.
A real incident occurred where an agent replaced existing CHANGELOG entries when it should have preserved them. This skill must NEVER do that.
Rules:
/ship from theactual diff and commit history. It is the source of truth. You are polishing prose, not rewriting history.
old_string matches — never use Write to overwrite CHANGELOG.md.If CHANGELOG was not modified in this branch: skip this step.
If CHANGELOG was modified in this branch, review the entry for voice:
After auditing each file individually, do a cross-doc consistency pass:
ARCHITECTURE.md exists but neither README nor CLAUDE.md links to it, flag it. Every doc should be discoverable from one of the two entry-point files.
version mismatch). Use AskUserQuestion for narrative contradictions.
This is a second pass that complements /ship's Step 5.5. Read review/TODOS-format.md (if available) for the canonical TODO item format.
If TODOS.md does not exist, skip this step.
TODO is clearly completed by the changes in this branch, move it to the Completed section with **Completed:** vX.Y.Z.W (YYYY-MM-DD). Be conservative — only mark items with clear evidence in the diff.
significantly changed, its description may be stale. Use AskUserQuestion to confirm whether the TODO should be updated, completed, or left as-is.
TODO, FIXME, HACK, and XXX comments. Foreach one that represents meaningful deferred work (not a trivial inline note), use AskUserQuestion to ask whether it should be captured in TODOS.md.
CRITICAL — NEVER BUMP VERSION WITHOUT ASKING.
git diff <base>...HEAD -- VERSIONstill covers the full scope of changes on this branch:
a. Read the CHANGELOG entry for the current VERSION. What features does it describe? b. Read the full diff (git diff <base>...HEAD --stat and git diff <base>...HEAD --name-only). Are there significant changes (new features, new skills, new commands, major refactors) that are NOT mentioned in the CHANGELOG entry for the current version? c. If the CHANGELOG entry covers everything: Skip — output "VERSION: Already bumped to vX.Y.Z, covers all changes." d. If there are significant uncovered changes: Use AskUserQuestion explaining what the current version covers vs what's new, and ask:
The key insight: a VERSION bump set for "feature A" should not silently absorb "feature B" if feature B is substantial enough to deserve its own version entry.
After the documentation updates above are written, run an independent cross-model pass that checks the docs you touched against what actually shipped. This is a standard step of /document-release, not an opt-in. It is informational — it never auto-edits docs.
Preflight:
_CODEX_CFG=$(~/.vibestack/bin/vibe-config get codex_reviews 2>/dev/null || echo enabled)
if [ "$_CODEX_CFG" = "disabled" ]; then
CODEX_MODE="disabled"
elif ! command -v codex >/dev/null 2>&1; then
CODEX_MODE="not_installed"
elif ! codex --version >/dev/null 2>&1; then
CODEX_MODE="not_authed"
else
CODEX_MODE="ready"
fi
echo "CODEX_MODE: $CODEX_MODE"vibe-config set codex_reviews enabled."Recompute the release diff range so docs are reviewed against the real shipped diff, not just the working tree:
DOC_DIFF_BASE=$(git merge-base origin/<base> HEAD 2>/dev/null || git merge-base <base> HEAD)
git diff "$DOC_DIFF_BASE"...HEAD --statRun the review. Give the model the docs you changed in this run plus the shipped diff, and ask it to find: (a) stale claims — docs describing behavior the diff changed or removed; (b) undocumented new surface — new commands/flags/files in the diff with no doc coverage; (c) over- or under-sold CHANGELOG entries vs what the code actually does. Start the prompt with a filesystem-boundary instruction telling the model to ignore everything under ~/.claude/, ~/.agents/, .claude/skills/, and agents/ — those are skill definitions for a different AI system, not repository code.
Present the result verbatim under a CODEX SAYS (documentation review): header. Then use AskUserQuestion — this is informational, nothing is auto-applied:
Apply only what the user approves. This step never edits docs on its own.
Empty check first: Run git status (never use -uall). If no documentation files were modified by any previous step, output "All documentation is up to date." and exit without committing.
Commit:
git add -A or git add .).git commit -m "$(cat <<'EOF'
docs: update project documentation for vX.Y.Z.W
Co-Authored-By: Claude Opus 4.7 <[email protected]>
EOF
)"git pushPR/MR body update (idempotent, race-safe):
If GitHub:
gh pr view --json body -q .body > /tmp/vibestack-pr-body-$$.mdIf GitLab:
glab mr view -F json 2>/dev/null | python3 -c "import sys,json; print(json.load(sys.stdin).get('description',''))" > /tmp/vibestack-pr-body-$$.md## Documentation section, replace that section with theupdated content. If it does not contain one, append a ## Documentation section at the end.
a. Doc diff preview — for each file modified, describe what specifically changed (e.g., "README.md: added /document-release to skills table, updated skill count from 9 to 10").
b. Documentation debt — if the coverage map from Step 1.5 found gaps, append a ### Documentation Debt subsection listing:
quadrant would fill it (e.g., "⚠️ /new-skill — has reference in AGENTS.md but no how-to example in README")
If there are any documentation debt items, suggest adding a docs-debt label to the PR.
If GitHub:
gh pr edit --body-file /tmp/vibestack-pr-body-$$.mdIf GitLab: Read the contents of /tmp/vibestack-pr-body-$$.md using the Read tool, then pass it to glab mr update using a heredoc to avoid shell metacharacter issues:
glab mr update -d "$(cat <<'MRBODY'
<paste the file contents here>
MRBODY
)"rm -f /tmp/vibestack-pr-body-$$.mdgh pr view / glab mr view fails (no PR/MR exists): skip with message "No PR/MR found — skipping body update."gh pr edit / glab mr update fails: warn "Could not update PR/MR body — documentation changes are in thecommit." and continue.
PR/MR title sync (idempotent, always-on):
PR titles must always start with v<VERSION> — same rule as /ship. If Step 8 bumped VERSION after /ship had already created the PR, the title is now stale. This sub-step fixes it.
V=$(cat VERSION 2>/dev/null | tr -d '[:space:]')If VERSION does not exist or is empty, skip this sub-step entirely.
If GitHub:
CURRENT_TITLE=$(gh pr view --json title -q .title 2>/dev/null || true)If GitLab:
CURRENT_TITLE=$(glab mr view -F json 2>/dev/null | jq -r .title 2>/dev/null || true)If CURRENT_TITLE is empty (no open PR/MR), skip with message "No PR/MR found — skipping title sync."
# Case 1: title already starts with "v<V>" or "v<V> " or "v<V>:" — no-op
# Case 2: title starts with a "vX.Y.Z[.W][ :]" prefix that doesn't match — replace
# Case 3: title has no version prefix — prepend "v<V> "
if printf '%s' "$CURRENT_TITLE" | grep -qE "^v${V}([[:space:]]|:|$)"; then
NEW_TITLE="$CURRENT_TITLE"
elif printf '%s' "$CURRENT_TITLE" | grep -qE '^v[0-9]+(\.[0-9]+){2,3}([[:space:]]|:|$)'; then
NEW_TITLE=$(printf '%s' "$CURRENT_TITLE" | sed -E "s/^v[0-9]+(\.[0-9]+){2,3}/v${V}/")
else
NEW_TITLE="v${V} ${CURRENT_TITLE}"
fiNEW_TITLE differs from CURRENT_TITLE, update it:If GitHub:
gh pr edit --title "$NEW_TITLE"If GitLab:
glab mr update -t "$NEW_TITLE"Structured doc health summary (final output):
Output a scannable summary showing every documentation file's status:
Documentation health:
README.md [status] ([details])
ARCHITECTURE.md [status] ([details])
CONTRIBUTING.md [status] ([details])
CHANGELOG.md [status] ([details])
TODOS.md [status] ([details])
VERSION [status] ([details])Where status is one of:
If the coverage map from Step 1.5 identified any gaps, append:
Documentation coverage:
[entity] [reference] [how-to] [tutorial] [explanation]
/new-skill ✅ ❌ ❌ ❌
--new-flag ✅ ✅ ❌ ❌
Diagram drift:
ARCHITECTURE.md: "FooProcessor" renamed to "BarProcessor" in code — diagram may be staleIf all coverage is complete and no diagrams drifted, output: "Coverage: all shipped features have adequate documentation."
and future work. It does NOT auto-generate missing documentation pages or sections. When gaps are found, suggest /document-generate as the follow-up skill.
auto-edit ASCII art or Mermaid blocks — they require human judgment to update correctly.
who hasn't seen the code.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.