Skip to content

feat(setup): first-run welcome guides, general and for the security skills - #1653

Merged
potiuk merged 2 commits into
mainfrom
feat/security-welcome-guide
Oct 16, 2026
Merged

potiuk merged 2 commits into
mainfrom
feat/security-welcome-guide

Conversation

@potiuk

@potiuk potiuk commented Oct 16, 2026 •

Copy link
Copy Markdown
Member

Summary

  • First-time users (feedback from the Community Over Code hackathon) had no overview of how to start, of install versus adopt, or of the fact that they can just ask in plain language. Magpie now shows short welcome guides, then carries on with the task.
  • General guide, shown the first time any Magpie skill runs: install, configure for yourself or adopt for the project, update by hand or turn on automatic plugin updates, just ask (nothing happens without your OK), and "you are the creator": describe what a skill should do and it becomes an override; "upstream this change to Magpie" makes it generic and opens a PR. It lists the family guides available.
  • Security guide, shown on a later run of a security skill: the typical flow (import → triage → sync → CVE → fix → announce), one example request per step. At most one guide per run, the general one first.
  • Both come from the existing pre-flight checker as a welcome finding, so no SKILL.md pre-flight block changes. Continue shows a guide again (three times at most), Dismiss hides it until the next upgrade, Don't show again hides it until turned back on. The choice lives in the personal layer's reconciled.json.
  • New /magpie-setup:welcome-guide [<family>] skill shows any guide on demand and turns a hidden one back on (named welcome-guide because welcome is the mentoring family's skill); every guide ends by naming it. --color prints a coloured terminal version.

Type of change

  • Skill change (.claude/skills/<name>/) — eval fixtures updated below
  • Python package (tools/*/ with pyproject.toml)
  • Documentation (docs/, README.md, CONTRIBUTING.md)
  • CI / dev loop (prek, workflows, validators)

Test plan

  • tools/setup-preflight: pytest (33 new welcome tests: first run, non-security skill, each choice, three-showings limit, dismiss lifted by an upgrade, enable, record merging into reconciled.json, --color with NO_COLOR and non-tty), mypy
  • tools/dev: the skill-to-family map is generated from frontmatter; check-family-plugins reports a stale map and --fix regenerates it
  • Eval setup/preflight-floor case 9 (first Magpie run shows the general guide); new suite setup-welcome-guide/step-1-show (no argument, a known family, an unknown name); render-preflight-fixtures --check clean
  • Precedence tests: never more than one guide per run; general first; a hidden general guide does not hold back a family guide
  • check-doc-sync (80 skills), check-shared-blocks, check-duplication (shared footer in guides/_footer.md)
  • skill-evals pytest; skill-surface-hash and skill-token-count restamped for the setup skill only; typos clean
  • prek run --all-files — left to CI (prepared outside a checkout)

RFC-AI-0004 compliance

  • HITL — the guide never blocks the requested work, and nothing is written except the user's choice
  • Vendor neutrality — placeholders only in the guide
  • Conversational + correctable — the guide itself points users at overrides and upstreaming

Linked issues

Notes for reviewers (optional)

  • A dismissal is tied to the magpie-setup plugin version; on a marketplace install, whose personal-layer checker copy has no manifest, it falls back to a fingerprint of the package, which upgrade refreshes.
  • A personal layer holding only the welcome record does not count as "configured", so a never-configured project is not pushed into the reconciliation sweep.

Generative AI disclosure: prepared with Claude Code (Claude Opus 5); reviewed by the author.

🤖 Generated with Claude Code

@github-actions github-actions Bot added family:security security-* skills family:setup setup-* skills family:tools tools/* family:docs Docs, MISSION.md, READMEs family:ci .github workflows, prek, validators capability:platform Framework / agent substrate skills (install, verify, doctor, override, status, setup bootstrap) substrate:framework-dev Tool substrate: build / validate / eval the framework itself substrate:setup Tool substrate: adopter-side setup state resolved at runtime (lock parsing, floors, fingerprints) labels Oct 16, 2026
@potiuk
potiuk force-pushed the feat/security-welcome-guide branch from 3fe1967 to c74f634 Compare October 16, 2026 05:37
@potiuk potiuk changed the title feat(setup): a first-run welcome guide for the security skills feat(setup): first-run welcome guides, general and for the security skills Oct 16, 2026
…kills

The first time any Magpie skill runs, the pre-flight checker now returns
a `welcome` finding carrying a short general guide: how to install,
configure for yourself or adopt for the project, how to upgrade and turn
on automatic plugin updates, that you can just ask in plain language and
nothing happens without your OK, and that users are creators: describe
what a skill should do for you and it becomes an override, and "upstream
this change to Magpie" makes it generic and opens a PR.

The security family has its own guide: the typical flow (import, triage,
sync, CVE, fix, announce) with an example request per step. At most one
guide is shown per run, the general one first; a family guide follows on
a later run of that family's skills.

The agent shows the guide, then carries on with the task. Continue shows
it again (three times at most), Dismiss hides it until the next upgrade,
Don't show again hides it until it is turned back on. The choice lives in
the personal layer's reconciled.json. Every guide ends by naming the new
`/magpie-setup:welcome-guide [<family>]` skill, which shows any guide on
demand and turns a hidden one back on; `--color` prints a coloured
terminal version. The skill-to-family map the checker needs is generated
from frontmatter and kept in sync by check-family-plugins.

Generated-by: Claude Opus 5
@potiuk
potiuk force-pushed the feat/security-welcome-guide branch from c74f634 to affd7bd Compare October 16, 2026 06:11
Skip optional welcome guides during checker verification and preserve
setup findings when a guide cannot be read. Restrict lookup to shipped
guides and refresh agent links and generated skill metadata.

Generated-by: Codex (GPT-6)
@potiuk
potiuk force-pushed the feat/security-welcome-guide branch from affd7bd to 48ec3d9 Compare October 16, 2026 06:18
@potiuk
potiuk merged commit c67e3c6 into main Oct 16, 2026
15 checks passed
@potiuk
potiuk deleted the feat/security-welcome-guide branch October 16, 2026 06:23
Kaap10 added a commit to Kaap10/magpie that referenced this pull request Oct 16, 2026
…#1663)

Adds a concise first-run welcome guide for the utilities skill family (list-skills, write-skill, optimize-skill, report-framework-issue, and skill-reconciler), following the pattern established in apache#1653.

- Adds plugins/magpie-setup/skills/setup/setup_preflight/guides/utilities.md
- Highlights the typical utilities flow and notes zero configuration needed
- Links the guide from docs/utilities/README.md under Install & first runs
- Supports personal layer reconciled state in render-preflight-fixtures.py
- Adds case-10-utilities-first-run preflight-floor fixture and updates case-9
- Expands test_welcome.py test coverage and adds cross-platform symlink robustness
Kaap10 added a commit to Kaap10/magpie that referenced this pull request Oct 16, 2026
…#1663)

Adds a concise first-run welcome guide for the utilities skill family (list-skills, write-skill, optimize-skill, report-framework-issue, and skill-reconciler), following the pattern established in apache#1653.

- Adds plugins/magpie-setup/skills/setup/setup_preflight/guides/utilities.md
- Highlights the typical utilities flow and notes zero configuration needed
- Links the guide from docs/utilities/README.md under Install & first runs
- Supports personal layer reconciled state in render-preflight-fixtures.py
- Adds case-10-utilities-first-run preflight-floor fixture and updates case-9
- Expands test_welcome.py test coverage and adds cross-platform symlink robustness
potiuk pushed a commit to Kaap10/magpie that referenced this pull request Oct 16, 2026
…#1663)

Adds a concise first-run welcome guide for the utilities skill family (list-skills, write-skill, optimize-skill, report-framework-issue, and skill-reconciler), following the pattern established in apache#1653.

- Adds plugins/magpie-setup/skills/setup/setup_preflight/guides/utilities.md
- Highlights the typical utilities flow and notes zero configuration needed
- Links the guide from docs/utilities/README.md under Install & first runs
- Supports personal layer reconciled state in render-preflight-fixtures.py
- Adds case-10-utilities-first-run preflight-floor fixture and updates case-9
- Expands test_welcome.py test coverage and adds cross-platform symlink robustness
potiuk pushed a commit to Kaap10/magpie that referenced this pull request Oct 16, 2026
…#1663)

Adds a concise first-run welcome guide for the utilities skill family (list-skills, write-skill, optimize-skill, report-framework-issue, and skill-reconciler), following the pattern established in apache#1653.

- Adds plugins/magpie-setup/skills/setup/setup_preflight/guides/utilities.md
- Highlights the typical utilities flow and notes zero configuration needed
- Links the guide from docs/utilities/README.md under Install & first runs
- Supports personal layer reconciled state in render-preflight-fixtures.py
- Adds case-10-utilities-first-run preflight-floor fixture and updates case-9
- Expands test_welcome.py test coverage and adds cross-platform symlink robustness
potiuk added a commit that referenced this pull request Oct 16, 2026
…#1669)

* feat(setup): first-run welcome guide for the utilities family (#1663)

Adds a concise first-run welcome guide for the utilities skill family (list-skills, write-skill, optimize-skill, report-framework-issue, and skill-reconciler), following the pattern established in #1653.

- Adds plugins/magpie-setup/skills/setup/setup_preflight/guides/utilities.md
- Highlights the typical utilities flow and notes zero configuration needed
- Links the guide from docs/utilities/README.md under Install & first runs
- Supports personal layer reconciled state in render-preflight-fixtures.py
- Adds case-10-utilities-first-run preflight-floor fixture and updates case-9
- Expands test_welcome.py test coverage and adds cross-platform symlink robustness

* Describe list-skills and skill-reconciler accurately in the utilities guide

list-skills indexes installed skills only, and skill-reconciler compares
two near-duplicate skills rather than a repo against its snapshot.
Also replaces the empty `except OSError: pass` flagged by CodeQL with
`contextlib.suppress`, and re-renders the case-10 fixture.

Generated-by: Claude Opus 5

* Test the text-file mirror fallback and drop the unrelated stdout change

scan_families() now has a test for a mirror entry checked out as a plain
file holding its target path, as git writes it without symlink support,
including an entry whose target does not exist.
The stdout.reconfigure() in main() is unrelated to the utilities guide
and is removed from this change.

Generated-by: Claude Opus 5

---------

Co-authored-by: Jarek Potiuk <potiuk@apache.org>
Kaap10 added a commit to Kaap10/magpie that referenced this pull request Oct 19, 2026
apache#1658)

Adds a concise first-run welcome guide for the contributor-growth skill family (activity-sweep, calibrate, candidate-screen, committer-onboarding, contributor-to-committer, identity-map, nomination, onboarding-concierge, and sentiment), following the pattern established in apache#1653 and apache#1663.

- Adds plugins/magpie-setup/skills/setup/setup_preflight/guides/contributor-growth.md
- Highlights typical flow across 7 steps and notes private list / calibrated thresholds
- Links the guide from docs/contributor-growth/README.md under Install & first runs
- Adds case-11-contributor-growth-first-run preflight-floor fixture and updates case-9
- Expands test_welcome.py test coverage and updates total eval case counts
Kaap10 added a commit to Kaap10/magpie that referenced this pull request Oct 19, 2026
apache#1658)

Adds a concise first-run welcome guide for the contributor-growth skill family (activity-sweep, calibrate, candidate-screen, committer-onboarding, contributor-to-committer, identity-map, nomination, onboarding-concierge, and sentiment), following the pattern established in apache#1653 and apache#1663.

- Adds plugins/magpie-setup/skills/setup/setup_preflight/guides/contributor-growth.md
- Highlights typical flow across 7 steps and notes private list / calibrated thresholds
- Links the guide from docs/contributor-growth/README.md under Install & first runs
- Adds case-11-contributor-growth-first-run preflight-floor fixture and updates case-9
- Expands test_welcome.py test coverage and updates total eval case counts
@Kaap10 Kaap10 mentioned this pull request Oct 19, 2026
9 of 22 tasks
potiuk added a commit that referenced this pull request Oct 19, 2026
#1658) (#1702)

* feat(setup): first-run welcome guide for the contributor-growth family (#1658)

Adds a concise first-run welcome guide for the contributor-growth skill family (activity-sweep, calibrate, candidate-screen, committer-onboarding, contributor-to-committer, identity-map, nomination, onboarding-concierge, and sentiment), following the pattern established in #1653 and #1663.

- Adds plugins/magpie-setup/skills/setup/setup_preflight/guides/contributor-growth.md
- Highlights typical flow across 7 steps and notes private list / calibrated thresholds
- Links the guide from docs/contributor-growth/README.md under Install & first runs
- Adds case-11-contributor-growth-first-run preflight-floor fixture and updates case-9
- Expands test_welcome.py test coverage and updates total eval case counts

* docs(setup): name the contributor-growth config files; test the next run

The guide's "Configure it" section described private-list access and
thresholds without naming a file to configure. It now names the file
each skill reads (`committer-readiness.md`, `contributor-nomination-config.md`,
the onboarding and sentiment configs, and `privacy-llm.md` for the
private-list reads), and says `setup config` configures rather than
"personal install".

Every other family guide has a test that the family's skills resolve to
it and that it follows the general guide on the next run; this family
now has one too. The case-11 fixture that embeds the guide is
re-rendered.

Generated-by: Claude Opus 5

---------

Co-authored-by: Jarek Potiuk <potiuk@apache.org>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

capability:platform Framework / agent substrate skills (install, verify, doctor, override, status, setup bootstrap) family:ci .github workflows, prek, validators family:docs Docs, MISSION.md, READMEs family:security security-* skills family:setup setup-* skills family:tools tools/* substrate:framework-dev Tool substrate: build / validate / eval the framework itself substrate:setup Tool substrate: adopter-side setup state resolved at runtime (lock parsing, floors, fingerprints)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant