chore: publish from main

.codespellrc

@@ -56,7 +56,11 @@
 
 # ans - bash and powershell variable short for answer
 
-ignore-words-list = numer,wit,aks,edn,ser,ois,gir,rouge,categor,aline,ative,afterall,deques,dateA,dateB,TE,FillIn,alle,vai,LOD,InOut,pixelX,aNULL,Wee,Sherif,queston,Vertexes,nin,FO,CAF,Parth,ans
+# GUD - "Guideline" identifier prefix in the create-implementation-plan skill spec (alongside REQ, SEC, CON, PAT, etc.)
+
+# Vally/vally - Name of product
+
+ignore-words-list = numer,wit,aks,edn,ser,ois,gir,rouge,categor,aline,ative,afterall,deques,dateA,dateB,TE,FillIn,alle,vai,LOD,InOut,pixelX,aNULL,Wee,Sherif,queston,Vertexes,nin,FO,CAF,Parth,ans,gud,Vally,vally
 
 # Skip certain files and directories
 

.github/workflows/build-website.yml

@@ -11,6 +11,8 @@ on:
       - instructions
       - hooks
       - workflows
+      - extensions
+      - .schemas/canvas.schema.json
 
 permissions:
   contents: read

.github/workflows/external-plugin-pr-quality-gates.yml

@@ -95,6 +95,9 @@ jobs:
       - name: Install GitHub Copilot CLI
         run: npm install -g @github/copilot
 
+      - name: Install @microsoft/vally
+        run: npm install @microsoft/vally
+
       - name: Run external plugin PR quality gates
         id: quality
         env:
@@ -205,7 +208,7 @@ jobs:
                   const sourceUrl = String(entry?.source_tree_url || '');
                   const locator = String(entry?.source?.sha || entry?.source?.ref || 'repository');
                   const sourceCell = sourceUrl ? `[${locator}](${sourceUrl})` : locator;
-                  return `| ${name} | ${quality.skill_validator_status || 'not_run'} | ${quality.smoke_status || 'not_run'} | ${quality.overall_status || 'not_run'} | ${sourceCell} |`;
+                  return `| ${name} | ${quality.vally_lint_status || 'not_run'} | ${quality.smoke_status || 'not_run'} | ${quality.overall_status || 'not_run'} | ${sourceCell} |`;
                 })
               : ['| _none_ | not_run | not_run | not_run | _n/a_ |'];
 
@@ -218,7 +221,7 @@ jobs:
               '',
               '### Per-plugin quality summary',
               '',
-              '| Plugin | skill-validator | install smoke test | overall | source tree |',
+              '| Plugin | vally lint | install smoke test | overall | source tree |',
               '|---|---|---|---|---|',
               ...rows,
               '',

.github/workflows/external-plugin-quality-gates.yml

@@ -36,6 +36,9 @@ jobs:
       - name: Install GitHub Copilot CLI
         run: npm install -g @github/copilot
 
+      - name: Install @microsoft/vally
+        run: npm install @microsoft/vally
+
       - name: Run external plugin quality gates
         id: quality
         env:

.github/workflows/skill-check-comment.yml

@@ -1,12 +1,12 @@
-name: Skill Validator — PR Comment
+name: Vally Lint — PR Comment
 
-# Posts results from the "Skill Validator — PR Gate" workflow.
+# Posts results from the "Vally Lint — PR Gate" workflow.
 # Runs with write permissions but never checks out PR code,
 # so it is safe for fork PRs.
 
 on:
   workflow_run:
-    workflows: ["Skill Validator — PR Gate"]
+    workflows: ["Vally Lint — PR Gate"]
     types: [completed]
 
 permissions:
@@ -22,7 +22,7 @@ jobs:
       - name: Download results artifact
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
-          name: skill-validator-results
+          name: vally-lint-results
           run-id: ${{ github.event.workflow_run.id }}
           github-token: ${{ github.token }}
 
@@ -34,11 +34,11 @@ jobs:
             const managedLabels = {
               'skill-check-warning': {
                 color: 'FBCA04',
-                description: 'Skill validator reported warnings'
+                description: 'Vally lint reported warnings'
               },
               'skill-check-error': {
                 color: 'B60205',
-                description: 'Skill validator reported errors'
+                description: 'Vally lint reported errors'
               }
             };
 
@@ -85,9 +85,9 @@ jobs:
             const agentCount = parseInt(fs.readFileSync('agent-count.txt', 'utf8').trim(), 10);
             const totalChecked = skillCount + agentCount;
 
-            const marker = '<!-- skill-validator-results -->';
+            const marker = '<!-- vally-lint-results -->';
-            const rawOutput = fs.existsSync('sv-output.txt')
+            const rawOutput = fs.existsSync('vally-output.txt')
-              ? fs.readFileSync('sv-output.txt', 'utf8')
+              ? fs.readFileSync('vally-output.txt', 'utf8')
               : '';
             const output = rawOutput.replace(/\x1b\[[0-9;]*m/g, '').trim();
 
@@ -151,7 +151,7 @@ jobs:
             ];
 
             const findingsTable = summaryLines.length === 0
-              ? ['_No findings were emitted by the validator._']
+              ? ['_No findings were emitted by the linter._']
               : [
                   '| Level | Finding |',
                   '|---|---|',
@@ -170,7 +170,7 @@ jobs:
 
             const body = [
               marker,
-              '## 🔍 Skill Validator Results',
+              '## 🔍 Vally Lint Results',
               '',
               `**${verdict}**`,
               '',
@@ -183,16 +183,16 @@ jobs:
               ...findingsTable,
               '',
               '<details>',
-              '<summary>Full validator output</summary>',
+              '<summary>Full linter output</summary>',
               '',
               '```text',
-              output || 'No validator output captured.',
+              output || 'No linter output captured.',
               '```',
               '',
               '</details>',
               '',
               exitCode !== '0'
-                ? '> **Note:** The validator returned a non-zero exit code. Please review the findings above before merge.'
+                ? '> **Note:** Vally lint returned a non-zero exit code. Please review the findings above before merge.'
                 : '',
             ].join('\n');
 

.github/workflows/skill-check.yml

@@ -1,4 +1,4 @@
-name: Skill Validator — PR Gate
+name: Vally Lint — PR Gate
 
 on:
   pull_request:
@@ -22,37 +22,10 @@ jobs:
         with:
           fetch-depth: 0
 
-      # ── Download & cache skill-validator ──────────────────────────
+      - name: Setup Node.js
-      - name: Get cache key date
+        uses: actions/setup-node@3235b876344febd2b5f2414c5edc3a01b7f10a06 # v4.2.0
-        id: cache-date
-        run: echo "date=$(date +%Y-%m-%d)" >> "$GITHUB_OUTPUT"
-
-      - name: Restore skill-validator from cache
-        id: cache-sv
-        uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
         with:
-          path: .skill-validator
+          node-version: 20
-          key: skill-validator-linux-x64-${{ steps.cache-date.outputs.date }}
-          restore-keys: |
-            skill-validator-linux-x64-
-
-      - name: Download skill-validator
-        if: steps.cache-sv.outputs.cache-hit != 'true'
-        run: |
-          mkdir -p .skill-validator
-          curl -fsSL \
-            "https://github.com/dotnet/skills/releases/download/skill-validator-nightly/skill-validator-linux-x64.tar.gz" \
-            -o .skill-validator/skill-validator-linux-x64.tar.gz
-          tar -xzf .skill-validator/skill-validator-linux-x64.tar.gz -C .skill-validator
-          rm .skill-validator/skill-validator-linux-x64.tar.gz
-          chmod +x .skill-validator/skill-validator
-
-      - name: Save skill-validator to cache
-        if: steps.cache-sv.outputs.cache-hit != 'true'
-        uses: actions/cache/save@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
-        with:
-          path: .skill-validator
-          key: skill-validator-linux-x64-${{ steps.cache-date.outputs.date }}
 
       # ── Detect changed skills & agents ────────────────────────────
       - name: Detect changed skills and agents
@@ -111,8 +84,8 @@ jobs:
 
           echo "Found $SKILL_COUNT skill dir(s) and $AGENT_COUNT agent file(s) to check."
 
-      # ── Run skill-validator check ─────────────────────────────────
+      # ── Run vally lint check ───────────────────────────────────────
-      - name: Run skill-validator check
+      - name: Run vally lint check
         id: check
         if: steps.detect.outputs.total != '0'
         env:
@@ -134,53 +107,58 @@ jobs:
             done <<< "$AGENT_FILES_RAW"
           fi
 
-          CMD=(.skill-validator/skill-validator check --verbose)
+          EXIT_CODE=0
+          : > vally-output.txt
 
-          if [ ${#SKILL_DIRS[@]} -gt 0 ]; then
+          if [ ${#SKILL_DIRS[@]} -eq 0 ] && [ ${#AGENT_FILES[@]} -eq 0 ]; then
-            CMD+=(--skills "${SKILL_DIRS[@]}")
+            echo "No skills or agents to validate." | tee -a vally-output.txt
           fi
 
+          for skill_dir in "${SKILL_DIRS[@]}"; do
+            echo "### Linting ${skill_dir}" | tee -a vally-output.txt
+            set +e
+            OUTPUT=$(npx --yes @microsoft/vally-cli lint "$skill_dir" --verbose 2>&1)
+            CMD_EXIT=$?
+            set -e
+            echo "$OUTPUT" | tee -a vally-output.txt
+            echo "" >> vally-output.txt
+
+            if [ "$CMD_EXIT" -ne 0 ]; then
+              EXIT_CODE=1
+            fi
+          done
+
           if [ ${#AGENT_FILES[@]} -gt 0 ]; then
-            CMD+=(--agents "${AGENT_FILES[@]}")
+            {
+              echo "### Agent files detected (not linted by vally)"
+              echo "ℹ️ Vally currently lints SKILL.md content. Agent files were detected but skipped:"
+              printf '%s\n' "${AGENT_FILES[@]}"
+              echo ""
+            } | tee -a vally-output.txt
           fi
 
-          printf 'Running: '
-          printf '%q ' "${CMD[@]}"
-          echo
-
-          # Capture output; don't fail the workflow (warn-only mode)
-          set +e
-          OUTPUT=$("${CMD[@]}" 2>&1)
-          EXIT_CODE=$?
-          set -e
-
           echo "exit_code=$EXIT_CODE" >> "$GITHUB_OUTPUT"
 
-          # Save output to file (multi-line safe)
-          echo "$OUTPUT" > sv-output.txt
-
-          echo "$OUTPUT"
-
       # ── Upload results for the commenting workflow ────────────────
       - name: Save metadata
         if: always()
         run: |
-          mkdir -p sv-results
+          mkdir -p vally-results
-          echo "${{ github.event.pull_request.number }}" > sv-results/pr-number.txt
+          echo "${{ github.event.pull_request.number }}" > vally-results/pr-number.txt
-          echo "${{ steps.detect.outputs.total }}" > sv-results/total.txt
+          echo "${{ steps.detect.outputs.total }}" > vally-results/total.txt
-          echo "${{ steps.detect.outputs.skill_count }}" > sv-results/skill-count.txt
+          echo "${{ steps.detect.outputs.skill_count }}" > vally-results/skill-count.txt
-          echo "${{ steps.detect.outputs.agent_count }}" > sv-results/agent-count.txt
+          echo "${{ steps.detect.outputs.agent_count }}" > vally-results/agent-count.txt
-          echo "${{ steps.check.outputs.exit_code }}" > sv-results/exit-code.txt
+          echo "${{ steps.check.outputs.exit_code }}" > vally-results/exit-code.txt
-          if [ -f sv-output.txt ]; then
+          if [ -f vally-output.txt ]; then
-            cp sv-output.txt sv-results/sv-output.txt
+            cp vally-output.txt vally-results/vally-output.txt
           fi
 
       - name: Upload results
         if: always()
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         with:
-          name: skill-validator-results
+          name: vally-lint-results
-          path: sv-results/
+          path: vally-results/
           retention-days: 1
 
       - name: Post skip notice if no skills changed

.github/workflows/skill-quality-report.yml

@@ -19,71 +19,37 @@ jobs:
         with:
           fetch-depth: 0 # full history for git-log author fallback
 
-      # ── Download & cache skill-validator ──────────────────────────
+      - name: Setup Node.js
-      - name: Get cache key date
+        uses: actions/setup-node@3235b876344febd2b5f2414c5edc3a01b7f10a06 # v4.2.0
-        id: cache-date
-        run: echo "date=$(date +%Y-%m-%d)" >> "$GITHUB_OUTPUT"
-
-      - name: Restore skill-validator from cache
-        id: cache-sv
-        uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
         with:
-          path: .skill-validator
+          node-version: 20
-          key: skill-validator-linux-x64-${{ steps.cache-date.outputs.date }}
-          restore-keys: |
-            skill-validator-linux-x64-
-
-      - name: Download skill-validator
-        if: steps.cache-sv.outputs.cache-hit != 'true'
-        run: |
-          mkdir -p .skill-validator
-          curl -fsSL \
-            "https://github.com/dotnet/skills/releases/download/skill-validator-nightly/skill-validator-linux-x64.tar.gz" \
-            -o .skill-validator/skill-validator-linux-x64.tar.gz
-          tar -xzf .skill-validator/skill-validator-linux-x64.tar.gz -C .skill-validator
-          rm .skill-validator/skill-validator-linux-x64.tar.gz
-          chmod +x .skill-validator/skill-validator
-
-      - name: Save skill-validator to cache
-        if: steps.cache-sv.outputs.cache-hit != 'true'
-        uses: actions/cache/save@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
-        with:
-          path: .skill-validator
-          key: skill-validator-linux-x64-${{ steps.cache-date.outputs.date }}
 
       # ── Run full scan ─────────────────────────────────────────────
-      - name: Run skill-validator check on all skills
+      - name: Run vally lint on all skills
         id: check-skills
         run: |
           set +e
           set -o pipefail
-          .skill-validator/skill-validator check \
+          npx --yes @microsoft/vally-cli lint ./skills --verbose 2>&1 | tee vally-skills-output.txt
-            --skills ./skills \
-            --verbose \
-            2>&1 | tee sv-skills-output.txt
           echo "exit_code=${PIPESTATUS[0]}" >> "$GITHUB_OUTPUT"
           set +o pipefail
           set -e
 
-      - name: Run skill-validator check on all agents
+      - name: Note agent scan status
         id: check-agents
         run: |
-          set +e
-          set -o pipefail
           AGENT_FILES=$(find agents -name '*.agent.md' -type f 2>/dev/null | tr '\n' ' ')
           if [ -n "$AGENT_FILES" ]; then
-            .skill-validator/skill-validator check \
+            {
-              --agents $AGENT_FILES \
+              echo "ℹ️ Vally currently lints SKILL.md content."
-              --verbose \
+              echo "ℹ️ Agent files are detected but excluded from this scan:"
-              2>&1 | tee sv-agents-output.txt
+              echo "$AGENT_FILES"
-            echo "exit_code=${PIPESTATUS[0]}" >> "$GITHUB_OUTPUT"
+            } > vally-agents-output.txt
           else
             echo "No agent files found."
-            echo "" > sv-agents-output.txt
+            echo "" > vally-agents-output.txt
             echo "exit_code=0" >> "$GITHUB_OUTPUT"
           fi
-          set +o pipefail
-          set -e
 
       # ── Build report with author attribution ──────────────────────
       - name: Build quality report
@@ -147,18 +113,18 @@ jobs:
               }
             }
 
-            // ── Parse skill-validator output ──────────────────────
+            // ── Parse vally lint output ───────────────────────────
             // The output is a text report; we preserve it as-is and
             // augment it with author info in the summary.
-            const skillsOutput = fs.readFileSync('sv-skills-output.txt', 'utf8').trim();
+            const skillsOutput = fs.readFileSync('vally-skills-output.txt', 'utf8').trim();
-            const agentsOutput = fs.existsSync('sv-agents-output.txt')
+            const agentsOutput = fs.existsSync('vally-agents-output.txt')
-              ? fs.readFileSync('sv-agents-output.txt', 'utf8').trim()
+              ? fs.readFileSync('vally-agents-output.txt', 'utf8').trim()
               : '';
 
             const codeowners = parseCodeowners();
 
             // Count findings
-            // The skill-validator uses emoji markers: ❌ for errors, ⚠ for warnings, ℹ for advisories
+            // Vally lint uses emoji markers: ❌ for errors, ⚠ for warnings, ℹ for advisories
             const combined = skillsOutput + '\n' + agentsOutput;
             const errorCount = (combined.match(/❌/g) || []).length;
             const warningCount = (combined.match(/⚠/g) || []).length;
@@ -179,7 +145,7 @@ jobs:
             } catch {}
 
             // ── Build author-attributed summary ───────────────────
-            // Extract per-resource blocks from output.  The validator
+            // Extract per-resource blocks from output.  The linter
             // prints skill names as headers — we annotate them with
             // the resolved owner.
             function annotateWithAuthors(output, kind) {
@@ -238,10 +204,10 @@ jobs:
               `| ℹ️ Advisories | ${advisoryCount} |`, '',
               '---',
             ];
-            const footer = `\n---\n\n_Generated by the [Skill Validator nightly scan](https://github.com/${context.repo.owner}/${context.repo.repo}/actions/workflows/skill-quality-report.yml)._`;
+            const footer = `\n---\n\n_Generated by the [Vally lint nightly scan](https://github.com/${context.repo.owner}/${context.repo.repo}/actions/workflows/skill-quality-report.yml)._`;
 
-            const skillsBlock = makeDetailsBlock('Skills', 'Full skill-validator output for skills', annotatedSkills);
+            const skillsBlock = makeDetailsBlock('Skills', 'Full vally lint output for skills', annotatedSkills);
-            const agentsBlock = makeDetailsBlock('Agents', 'Full skill-validator output for agents', annotatedAgents);
+            const agentsBlock = makeDetailsBlock('Agents', 'Agent scan notes', annotatedAgents);
 
             // Try full inline body first
             const fullBody = summaryLines.join('\n') + '\n\n' + skillsBlock + '\n\n' + agentsBlock + footer;

.github/workflows/validate-canvas-extensions.yml

@@ -6,130 +6,133 @@ on:
     types: [opened, synchronize, reopened]
     paths:
       - "extensions/**"
+      - ".schemas/canvas.schema.json"
 
 permissions:
   contents: read
-  pull-requests: write
 
 jobs:
   validate:
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout code
+      - name: Checkout
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           fetch-depth: 0
 
-      - name: Validate changed canvas extensions
+      - name: Setup Node.js
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
-          script: |
+          node-version: "22"
-            const fs = require('fs');
+          cache: "npm"
-            const path = require('path');
 
-            // Collect changed extension directories from the PR diff
+      - name: Install dependencies
-            const { execSync } = require('child_process');
+        run: npm ci --ignore-scripts
-            const changedFiles = execSync(
-              `git diff --name-only origin/${{ github.base_ref }}...HEAD`
-            ).toString().trim().split('\n').filter(Boolean);
 
-            const EXTENSIONS_DIR = 'extensions';
+      - name: Validate changed canvas extensions
-            const EXTERNAL_ASSETS_DIR = 'external-assets';
+        run: |
+          set -euo pipefail
 
-            const changedExtDirs = new Set();
+          # Validate schema structure once, even for schema-only PRs.
-            for (const file of changedFiles) {
+          if ! node ./eng/validate-json-schema.mjs --schema .schemas/canvas.schema.json; then
-              const parts = file.split('/');
+            echo "❌ .schemas/canvas.schema.json failed schema compilation"
-              if (parts[0] === EXTENSIONS_DIR && parts.length >= 2) {
+            exit 1
-                const extName = parts[1];
+          fi
-                // Skip the external-assets directory — it's not a canvas extension
-                // Also skip external.json and other files at extensions root level
-                if (extName !== EXTERNAL_ASSETS_DIR && !extName.includes('.')) {
-                  changedExtDirs.add(path.join(EXTENSIONS_DIR, extName));
-                }
-              }
-            }
 
-            if (changedExtDirs.size === 0) {
+          # Collect changed extension directories.
-              console.log('No canvas extension directories changed — skipping validation.');
+          # Use null-terminated (-z) output from git diff so filenames containing newlines
-              return;
+          # or other special characters are read atomically (matches the pattern in skill-check.yml).
-            }
+          # Each extracted name is then validated against a strict allowlist regex before use,
+          # rejecting anything containing shell metacharacters ($, (, ), spaces, etc.).
+          declare -A seen_dirs=()
+          changed_extensions=()
+          errors=()
 
-            console.log(`Validating ${changedExtDirs.size} extension(s): ${[...changedExtDirs].join(', ')}`);
+          while IFS= read -r -d '' file; do
+            case "$file" in
+              extensions/*)
+                ext_name="${file#extensions/}"
+                ext_name="${ext_name%%/*}"
 
-            const errors = [];
+                if [ "$ext_name" = "external-assets" ]; then
+                  continue
+                fi
 
-            for (const extDir of changedExtDirs) {
+                # Allowlist: extension directory names must be lowercase alphanumeric + hyphens only.
-              if (!fs.existsSync(extDir)) {
+                # Fail for disallowed names so a PR cannot bypass validation by using a nonconforming folder.
-                // Directory was deleted — skip
+                if [[ ! "$ext_name" =~ ^[a-z0-9][a-z0-9-]*$ ]]; then
-                console.log(`${extDir} no longer exists (deleted?), skipping.`);
+                  errors+=("\`extensions/$ext_name\`: invalid extension directory name (must match ^[a-z0-9][a-z0-9-]*$).")
-                continue;
+                  continue
-              }
+                fi
 
-              const extName = path.basename(extDir);
+                if [ -z "${seen_dirs[$ext_name]+x}" ]; then
+                  seen_dirs["$ext_name"]=1
+                  changed_extensions+=("extensions/$ext_name")
+                fi
+                ;;
+            esac
+          done < <(git diff --name-only -z "origin/${{ github.base_ref }}...HEAD")
 
-              // Rule 1: must contain extension.mjs
+          if [ "${#changed_extensions[@]}" -eq 0 ]; then
-              const mainFile = path.join(extDir, 'extension.mjs');
+            if [ "${#errors[@]}" -ne 0 ]; then
-              if (!fs.existsSync(mainFile)) {
+              echo "❌ Canvas extension validation failed:"
-                errors.push(
+              for error in "${errors[@]}"; do
-                  `**\`${extDir}\`**: missing required \`extension.mjs\`. ` +
+                echo "- $error"
-                  `Canvas extensions must have their entry point named \`extension.mjs\`.`
+              done
-                );
+              exit 1
-              }
+            fi
+            echo "No canvas extension directories changed — skipping validation."
+            exit 0
+          fi
 
-              // Rule 2: must contain assets/preview.png
+          echo "Validating ${#changed_extensions[@]} extension(s): ${changed_extensions[*]}"
-              const previewFile = path.join(extDir, 'assets', 'preview.png');
-              if (!fs.existsSync(previewFile)) {
-                errors.push(
-                  `**\`${extDir}\`**: missing required \`assets/preview.png\`. ` +
-                  `Canvas extensions must include a screenshot at \`assets/preview.png\` ` +
-                  `so reviewers and users can preview the extension before installing it.`
-                );
-              }
-            }
 
-            if (errors.length === 0) {
+          for ext_dir in "${changed_extensions[@]}"; do
-              console.log('✅ All changed canvas extensions pass validation.');
+            if [ ! -d "$ext_dir" ]; then
-              return;
+              echo "$ext_dir no longer exists (deleted?), skipping."
-            }
+              continue
+            fi
 
-            const isFork = context.payload.pull_request.head.repo.fork;
+            if [ ! -f "$ext_dir/extension.mjs" ]; then
-            const body = [
+              errors+=("\`$ext_dir\`: missing required \`extension.mjs\`.")
-              '❌ **Canvas extension validation failed**',
+            fi
-              '',
-              'The following issue(s) were found in changed canvas extension(s):',
-              '',
-              ...errors.map(e => `- ${e}`),
-              '',
-              '---',
-              '',
-              '### Required structure for canvas extensions',
-              '',
-              'Each extension folder under `extensions/` must contain:',
-              '',
-              '| Path | Required | Description |',
-              '|------|----------|-------------|',
-              '| `extension.mjs` | ✅ | Entry point for the canvas extension |',
-              '| `assets/preview.png` | ✅ | Screenshot shown on the website and in the marketplace |',
-              '',
-              'Please add the missing file(s) and push an update to this PR.',
-            ].join('\n');
 
-            if (!isFork) {
+            if [ ! -f "$ext_dir/canvas.json" ]; then
-              try {
+              errors+=("\`$ext_dir\`: missing required \`canvas.json\`.")
-                await github.rest.pulls.createReview({
+              continue
-                  owner: context.repo.owner,
+            fi
-                  repo: context.repo.repo,
-                  pull_number: context.issue.number,
-                  event: 'REQUEST_CHANGES',
-                  body
-                });
-              } catch (error) {
-                core.warning(`Could not post PR review: ${error.message}`);
-                core.warning(body);
-              }
-            } else {
-              core.warning('PR is from a fork — skipping createReview to avoid permission errors.');
-              core.warning(body);
-            }
 
-            core.setFailed(`Canvas extension validation failed with ${errors.length} error(s).`);
+            if [ ! -f "$ext_dir/assets/preview.png" ]; then
+              errors+=("\`$ext_dir\`: missing required \`assets/preview.png\`.")
+            fi
+
+            if ! schema_output="$(node ./eng/validate-json-schema.mjs --schema .schemas/canvas.schema.json --data "$ext_dir/canvas.json" 2>&1)"; then
+              condensed_output="$(echo "$schema_output" | tr '\n' ' ' | sed 's/[[:space:]]\+/ /g')"
+              errors+=("\`$ext_dir/canvas.json\`: schema validation failed against \`.schemas/canvas.schema.json\` ($condensed_output).")
+              continue
+            fi
+
+            mapfile -t screenshot_paths < <(
+              node -e 'const fs = require("fs"); const manifest = JSON.parse(fs.readFileSync(process.argv[1], "utf8")); const paths = [manifest?.screenshots?.icon?.path, manifest?.screenshots?.gallery?.path].filter((value) => typeof value === "string" && value.trim().length > 0); for (const value of [...new Set(paths)]) { console.log(value); }' "$ext_dir/canvas.json"
+            )
+
+            for screenshot_path in "${screenshot_paths[@]}"; do
+              if [[ ! "$screenshot_path" =~ ^assets/([A-Za-z0-9_-]+/)*[A-Za-z0-9_-]+(\.[A-Za-z0-9_-]+)*\.(png|jpe?g|gif|webp|svg)$ ]]; then
+                errors+=("\`$ext_dir/canvas.json\`: screenshot path \`$screenshot_path\` is not a valid assets path.")
+                continue
+              fi
+              if [ ! -f "$ext_dir/$screenshot_path" ]; then
+                errors+=("\`$ext_dir/canvas.json\`: screenshot path \`$screenshot_path\` does not exist in the extension directory.")
+              fi
+            done
+          done
+
+          if [ "${#errors[@]}" -ne 0 ]; then
+            echo "❌ Canvas extension validation failed:"
+            for error in "${errors[@]}"; do
+              echo "- $error"
+            done
+            exit 1
+          fi
+
+          echo "✅ All changed canvas extensions passed validation."

.schemas/canvas.schema.json

@@ -0,0 +1,121 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "Canvas Extension Manifest",
+  "description": "Schema for extensions/<name>/canvas.json files",
+  "type": "object",
+  "required": [
+    "id",
+    "name",
+    "description",
+    "version",
+    "keywords",
+    "screenshots"
+  ],
+  "additionalProperties": false,
+  "properties": {
+    "id": {
+      "type": "string",
+      "description": "Unique identifier for the canvas extension",
+      "pattern": "^[a-z0-9-]+$",
+      "minLength": 1,
+      "maxLength": 100
+    },
+    "name": {
+      "type": "string",
+      "description": "Display name for the extension",
+      "minLength": 1,
+      "maxLength": 100
+    },
+    "description": {
+      "type": "string",
+      "description": "Human-friendly description of what the extension does",
+      "minLength": 1,
+      "maxLength": 500
+    },
+    "version": {
+      "type": "string",
+      "description": "Semantic version of the extension metadata",
+      "pattern": "^(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?(?:\\+[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?$"
+    },
+    "author": {
+      "type": "object",
+      "description": "Optional author metadata",
+      "required": [
+        "name"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "name": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 100
+        },
+        "url": {
+          "type": "string",
+          "format": "uri",
+          "maxLength": 2048
+        }
+      }
+    },
+    "keywords": {
+      "type": "array",
+      "description": "Keywords used for search and filtering",
+      "items": {
+        "type": "string",
+        "pattern": "^[a-z0-9-]+$",
+        "minLength": 1,
+        "maxLength": 50
+      },
+      "minItems": 1,
+      "maxItems": 20,
+      "uniqueItems": true
+    },
+    "screenshots": {
+      "type": "object",
+      "description": "Screenshot metadata for icon and gallery cards",
+      "required": [
+        "icon",
+        "gallery"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "icon": {
+          "$ref": "#/definitions/screenshot"
+        },
+        "gallery": {
+          "$ref": "#/definitions/screenshot"
+        }
+      }
+    }
+  },
+  "definitions": {
+    "screenshot": {
+      "type": "object",
+      "required": [
+        "path",
+        "type"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "path": {
+          "type": "string",
+          "description": "Path relative to the extension root",
+          "pattern": "^assets/(?:[A-Za-z0-9_-]+/)*[A-Za-z0-9_-]+(?:\\.[A-Za-z0-9_-]+)*\\.(png|jpg|jpeg|gif|webp|svg)$",
+          "minLength": 1,
+          "maxLength": 200
+        },
+        "type": {
+          "type": "string",
+          "description": "MIME type for the referenced image",
+          "enum": [
+            "image/png",
+            "image/jpeg",
+            "image/gif",
+            "image/webp",
+            "image/svg+xml"
+          ]
+        }
+      }
+    }
+  }
+}

CONTRIBUTING.md

@@ -231,7 +231,7 @@ The public-submission policy builds on those rules and also requires `license` p
 1. **Open an issue** using the external plugin issue form. Automation applies the `external-plugin` and `awaiting-review` labels.
 2. **Automated intake validation** checks that the required fields are present and correctly formatted for a GitHub-hosted plugin. Invalid submissions are labeled `requires-submitter-fixes` with a comment explaining what must be fixed before maintainer review.
 3. **Automated quality gates** run after metadata validation:
-   - `skill-validator check --plugin` against the submitted plugin path/ref/sha
+   - `vally lint` against the submitted plugin path/ref/sha
    - install smoke test via Copilot CLI against an ephemeral marketplace entry generated from the submission
 4. **Ready for maintainer review**: if metadata validation and quality gates pass, automation removes `awaiting-review` and adds `ready-for-review`.
 5. **Submitter-fix blocker**: if metadata is valid but quality gates fail, automation applies `requires-submitter-fixes` instead of advancing to human review.
@@ -246,7 +246,7 @@ The public-submission policy builds on those rules and also requires `license` p
 When a pull request updates `plugins/external.json` (for example, version updates for a previously approved listing), automation runs PR quality checks and posts the result directly on the PR:
 
 1. **Detect changed entries**: automation identifies added/updated external plugin entries in the PR.
-2. **Run quality gates**: automation runs install smoke tests and `skill-validator` checks against each changed plugin source ref/SHA/path.
+2. **Run quality gates**: automation runs install smoke tests and `vally lint` checks against each changed plugin source ref/SHA/path.
 3. **Post source links**: automation updates a bot comment with per-plugin results and direct GitHub tree links to each plugin source location.
 4. **Sync workflow-state labels on the PR**:
    - `ready-for-review` when all checks pass

eng/external-plugin-intake.mjs

@@ -423,11 +423,11 @@ export function parseMarkReadyForReviewCommand(body) {
 function normalizeQualityGateResult(rawResult) {
   const defaults = {
     overall_status: "not_run",
-    skill_validator_status: "not_run",
+    vally_lint_status: "not_run",
     smoke_status: "not_run",
     failure_class: "none",
     summary: "",
-    skill_validator_output: "",
+    vally_lint_output: "",
     smoke_output: "",
   };
 
@@ -442,7 +442,7 @@ function normalizeQualityGateResult(rawResult) {
 }
 
 function buildQualityGatesCommentSection(qualityResult) {
-  const skillState = qualityResult.skill_validator_status || "not_run";
+  const vallyState = qualityResult.vally_lint_status || "not_run";
   const smokeState = qualityResult.smoke_status || "not_run";
   const summaryText = String(qualityResult.summary || "").trim() || "_No quality gate details were provided._";
 
@@ -451,21 +451,21 @@ function buildQualityGatesCommentSection(qualityResult) {
     "",
     "| Gate | Status |",
     "|---|---|",
-    `| skill-validator | ${skillState} |`,
+    `| vally lint | ${vallyState} |`,
     `| install smoke test | ${smokeState} |`,
     "",
     summaryText,
   ];
 
-  const skillOutput = String(qualityResult.skill_validator_output || "").trim();
+  const vallyOutput = String(qualityResult.vally_lint_output || "").trim();
-  if (skillOutput) {
+  if (vallyOutput) {
     sections.push(
       "",
       "<details>",
-      "<summary>skill-validator output</summary>",
+      "<summary>vally lint output</summary>",
       "",
       "```text",
-      skillOutput,
+      vallyOutput,
       "```",
       "",
       "</details>",

eng/external-plugin-pr-quality-gates.mjs

@@ -66,27 +66,27 @@ function aggregateResultStatus(pluginResults) {
   };
 }
 
-export function runExternalPluginPrQualityGates(plugins) {
+export async function runExternalPluginPrQualityGates(plugins) {
   if (!Array.isArray(plugins)) {
     throw new Error("plugins must be an array");
   }
 
-  const checkedPlugins = plugins.map((plugin) => {
+  const checkedPlugins = await Promise.all(plugins.map(async (plugin) => {
-    const quality = runExternalPluginQualityGates(plugin);
+    const quality = await runExternalPluginQualityGates(plugin);
     return {
       name: plugin?.name ?? "unknown",
       source: plugin?.source ?? {},
       source_tree_url: buildSourceTreeUrl(plugin),
       quality,
     };
-  });
+  }));
 
   const aggregate = aggregateResultStatus(checkedPlugins);
   const summary = checkedPlugins.length === 0
     ? "No changed external plugin entries were detected in plugins/external.json."
     : checkedPlugins
       .map((entry) =>
-        `- ${entry.name}: skill-validator=${entry.quality.skill_validator_status}, install-smoke=${entry.quality.smoke_status}, overall=${entry.quality.overall_status}`
+        `- ${entry.name}: vally-lint=${entry.quality.vally_lint_status}, install-smoke=${entry.quality.smoke_status}, overall=${entry.quality.overall_status}`
       )
       .join("\n");
 
@@ -120,6 +120,6 @@ if (import.meta.url === `file://${process.argv[1]}`) {
   }
 
   const plugins = JSON.parse(args["plugins-json"]);
-  const result = runExternalPluginPrQualityGates(plugins);
+  const result = await runExternalPluginPrQualityGates(plugins);
   process.stdout.write(`${JSON.stringify(result)}\n`);
 }

eng/external-plugin-quality-gates.mjs

@@ -3,10 +3,11 @@
 import fs from "fs";
 import os from "os";
 import path from "path";
+import { Writable } from "stream";
 import { spawnSync } from "child_process";
+import { runLint, LintConsoleReporter } from "@microsoft/vally";
 
 const MAX_OUTPUT_LENGTH = 12000;
-const SKILL_VALIDATOR_ARCHIVE_URL = "https://github.com/dotnet/skills/releases/download/skill-validator-nightly/skill-validator-linux-x64.tar.gz";
 
 const INFRA_ERROR_PATTERNS = [
   /\b401\b/,
@@ -132,35 +133,10 @@ function cloneSubmissionRepository(workDir, plugin) {
   return repoDir;
 }
 
-function downloadSkillValidator(workDir) {
-  const validatorDir = path.join(workDir, "skill-validator");
-  ensureDirectory(validatorDir);
-  const archivePath = path.join(validatorDir, "skill-validator-linux-x64.tar.gz");
-
-  const download = runCommand("curl", ["-fsSL", SKILL_VALIDATOR_ARCHIVE_URL, "-o", archivePath]);
-  if (download.exitCode !== 0) {
-    throw new Error(`Failed to download skill-validator: ${download.output}`);
-  }
-
-  const untar = runCommand("tar", ["-xzf", archivePath, "-C", validatorDir]);
-  if (untar.exitCode !== 0) {
-    throw new Error(`Failed to extract skill-validator: ${untar.output}`);
-  }
-
-  const binaryPath = path.join(validatorDir, "skill-validator");
-  if (!fs.existsSync(binaryPath)) {
-    throw new Error("skill-validator binary was not found after extraction");
-  }
-
-  runCommand("chmod", ["+x", binaryPath]);
-  return binaryPath;
-}
-
 // Ordered list of candidate locations for plugin.json, from most to least specific.
-// The skill-validator --plugin mode expects plugin.json at the plugin root, but
+// Both the Copilot CLI and many external repos use nested conventions. We read the
-// both the Copilot CLI and many external repos use nested conventions. We read the
+// manifest ourselves so skill paths can be resolved from the plugin root consistently,
-// manifest ourselves so skill/agent paths can be resolved from the plugin root
+// regardless of where the manifest lives.
-// consistently, regardless of where the manifest lives.
 // NOTE: Keep in sync with EXTERNAL_PLUGIN_ROOT_MANIFEST_PATHS in external-plugin-validation.mjs
 const PLUGIN_JSON_CANDIDATES = [
   [".github", "plugin", "plugin.json"],
@@ -178,72 +154,66 @@ function findPluginJson(pluginRoot) {
   return null;
 }
 
-function buildSkillValidatorArgs(pluginRoot) {
+function buildVallyLintArgs(pluginRoot) {
   const pluginJsonPath = findPluginJson(pluginRoot);
   if (!pluginJsonPath) {
-    // No recognised plugin.json location found — let the validator fail with its
+    // No recognised plugin.json location — lint the whole plugin root and let
-    // own diagnostic (covers exotic layouts and surfaces the real error to submitters).
+    // vally surface the real error to the submitter.
-    return ["check", "--verbose", "--plugin", pluginRoot];
+    return [pluginRoot];
   }
 
   let pluginJson;
   try {
     pluginJson = JSON.parse(fs.readFileSync(pluginJsonPath, "utf8"));
   } catch {
-    // Malformed plugin.json — let the validator surface the parse error.
+    // Malformed plugin.json — fall back to linting the full root.
-    return ["check", "--verbose", "--plugin", pluginRoot];
+    return [pluginRoot];
   }
 
-  const args = ["check", "--verbose"];
+  // Collect skill directory paths from plugin.json.
-
-  // Paths in plugin.json are relative to the plugin root regardless of where
-  // plugin.json itself lives. Use [].concat() to accept both string and array values.
   const skillPaths = [].concat(pluginJson.skills ?? [])
     .map((s) => path.resolve(pluginRoot, s))
-    .filter((p) => fs.existsSync(p));
+    .filter((p) => fs.existsSync(p) && fs.statSync(p).isDirectory());
-
-  // Agent entries may be directory paths or explicit file paths; normalise to directories
-  // so AgentDiscovery.DiscoverAgentsInDirectory can discover agents within them.
-  // Deduplicate in case multiple file entries share the same parent directory.
-  const agentPaths = [...new Set(
-    [].concat(pluginJson.agents ?? [])
-      .map((a) => {
-        const resolved = path.resolve(pluginRoot, a);
-        if (fs.existsSync(resolved) && fs.statSync(resolved).isFile()) {
-          return path.dirname(resolved);
-        }
-        return resolved;
-      })
-      .filter((p) => fs.existsSync(p))
-  )];
 
   if (skillPaths.length > 0) {
-    args.push("--skills", ...skillPaths);
+    return skillPaths;
-  }
-  if (agentPaths.length > 0) {
-    args.push("--agents", ...agentPaths);
   }
 
-  if (skillPaths.length === 0 && agentPaths.length === 0) {
+  // No resolvable skill directories — lint the full plugin root so vally can
-    // plugin.json found but no resolvable skills/agents — fall back to --plugin so the
+  // surface the specific validation error to the submitter.
-    // validator can surface the specific validation error to the submitter.
+  return [pluginRoot];
-    return ["check", "--verbose", "--plugin", pluginRoot];
-  }
-
-  return args;
 }
 
-function runSkillValidatorGate(workDir, pluginRoot) {
+async function runVallyLintGate(pluginRoot) {
   try {
-    const validatorBinary = downloadSkillValidator(workDir);
+    const targets = buildVallyLintArgs(pluginRoot);
-    const args = buildSkillValidatorArgs(pluginRoot);
-    const check = runCommand(validatorBinary, args);
 
-    if (check.exitCode === 0) {
+    let combinedOutput = "";
-      return { status: "pass", output: check.output };
+    let anyFailure = false;
+
+    for (const target of targets) {
+      const chunks = [];
+      const captureStream = new Writable({
+        write(chunk, _encoding, callback) {
+          chunks.push(chunk.toString());
+          callback();
+        },
+      });
+
+      const result = await runLint({ rootPath: target });
+      const reporter = new LintConsoleReporter({ verbose: true, stream: captureStream });
+      await reporter.report(result);
+
+      combinedOutput += chunks.join("") + "\n";
+      if (!result.passed) {
+        anyFailure = true;
+      }
     }
 
-    return { status: "fail", output: check.output };
+    return {
+      status: anyFailure ? "fail" : "pass",
+      output: truncateOutput(combinedOutput),
+    };
   } catch (error) {
     return {
       status: "infra_error",
@@ -358,15 +328,15 @@ function toFailureClass(overallStatus) {
   return "none";
 }
 
-export function runExternalPluginQualityGates(plugin) {
+export async function runExternalPluginQualityGates(plugin) {
   const workDir = fs.mkdtempSync(path.join(os.tmpdir(), "external-plugin-quality-"));
   const result = {
     overall_status: "not_run",
-    skill_validator_status: "not_run",
+    vally_lint_status: "not_run",
     smoke_status: "not_run",
     failure_class: "none",
     summary: "",
-    skill_validator_output: "",
+    vally_lint_output: "",
     smoke_output: "",
   };
 
@@ -376,7 +346,7 @@ export function runExternalPluginQualityGates(plugin) {
     const pluginRoot = normalizedPluginPath ? path.join(repoDir, normalizedPluginPath) : repoDir;
 
     if (!fs.existsSync(pluginRoot) || !fs.statSync(pluginRoot).isDirectory()) {
-      result.skill_validator_status = "fail";
+      result.vally_lint_status = "fail";
       result.smoke_status = "fail";
       result.overall_status = "fail";
       result.failure_class = "submitter_fixes";
@@ -384,18 +354,18 @@ export function runExternalPluginQualityGates(plugin) {
       return result;
     }
 
-    const skillResult = runSkillValidatorGate(workDir, pluginRoot);
+    const vallyResult = await runVallyLintGate(pluginRoot);
-    result.skill_validator_status = skillResult.status;
+    result.vally_lint_status = vallyResult.status;
-    result.skill_validator_output = skillResult.output;
+    result.vally_lint_output = vallyResult.output;
 
     const smokeResult = runInstallSmokeGate(workDir, plugin);
     result.smoke_status = smokeResult.status;
     result.smoke_output = smokeResult.output;
 
-    result.overall_status = toOverallStatus(result.skill_validator_status, result.smoke_status);
+    result.overall_status = toOverallStatus(result.vally_lint_status, result.smoke_status);
     result.failure_class = toFailureClass(result.overall_status);
     result.summary = [
-      `- skill-validator: ${result.skill_validator_status}`,
+      `- vally lint: ${result.vally_lint_status}`,
       `- install smoke test: ${result.smoke_status}`,
       `- overall: ${result.overall_status}`,
     ].join("\n");
@@ -405,7 +375,7 @@ export function runExternalPluginQualityGates(plugin) {
     result.overall_status = "infra_error";
     result.failure_class = "infra";
     result.summary = truncateOutput(error.message);
-    result.skill_validator_output = truncateOutput(error.stack || error.message);
+    result.vally_lint_output = truncateOutput(error.stack || error.message);
     return result;
   } finally {
     fs.rmSync(workDir, { recursive: true, force: true });
@@ -434,6 +404,6 @@ if (import.meta.url === `file://${process.argv[1]}`) {
   }
 
   const plugin = JSON.parse(args["plugin-json"]);
-  const result = runExternalPluginQualityGates(plugin);
+  const result = await runExternalPluginQualityGates(plugin);
   process.stdout.write(`${JSON.stringify(result)}\n`);
 }

eng/validate-json-schema.mjs

@@ -0,0 +1,75 @@
+#!/usr/bin/env node
+
+import fs from "fs";
+import path from "path";
+import Ajv from "ajv";
+import addFormats from "ajv-formats";
+
+function parseArgs(argv) {
+  const args = { schema: null, data: null };
+  for (let i = 2; i < argv.length; i += 1) {
+    const arg = argv[i];
+    if (arg === "--schema") {
+      args.schema = argv[i + 1] || null;
+      i += 1;
+    } else if (arg === "--data") {
+      args.data = argv[i + 1] || null;
+      i += 1;
+    }
+  }
+  return args;
+}
+
+function readJson(filePath) {
+  const content = fs.readFileSync(filePath, "utf8");
+  return JSON.parse(content);
+}
+
+const args = parseArgs(process.argv);
+if (!args.schema) {
+  console.error("Missing required argument: --schema <path>");
+  process.exit(1);
+}
+
+const schemaPath = path.resolve(process.cwd(), args.schema);
+let schema;
+try {
+  schema = readJson(schemaPath);
+} catch (error) {
+  console.error(`Invalid schema JSON at ${args.schema}: ${error.message}`);
+  process.exit(1);
+}
+
+const ajv = new Ajv({ strict: false, allErrors: true });
+addFormats(ajv);
+
+let validate;
+try {
+  validate = ajv.compile(schema);
+} catch (error) {
+  console.error(`Invalid schema at ${args.schema}: ${error.message}`);
+  process.exit(1);
+}
+
+if (!args.data) {
+  console.log(`Schema is valid: ${args.schema}`);
+  process.exit(0);
+}
+
+const dataPath = path.resolve(process.cwd(), args.data);
+let data;
+try {
+  data = readJson(dataPath);
+} catch (error) {
+  console.error(`Invalid data JSON at ${args.data}: ${error.message}`);
+  process.exit(1);
+}
+
+const valid = validate(data);
+if (!valid) {
+  const message = ajv.errorsText(validate.errors, { separator: "; " });
+  console.error(`Schema validation failed for ${args.data}: ${message}`);
+  process.exit(1);
+}
+
+console.log(`Schema validation passed: ${args.data}`);

eng/yaml-parser.mjs

@@ -1,6 +1,6 @@
 // YAML parser for frontmatter parsing using vfile-matter
 import fs from "fs";
-import yaml from "js-yaml";
+import * as yaml from "js-yaml";
 import path from "path";
 import { VFile } from "vfile";
 import { matter } from "vfile-matter";

package-lock.json

@@ -9,11 +9,14 @@
       "version": "1.0.0",
       "license": "MIT",
       "dependencies": {
-        "js-yaml": "^4.2.0",
+        "js-yaml": "^5.2.0",
         "vfile": "^6.0.3",
         "vfile-matter": "^5.0.1"
       },
       "devDependencies": {
+        "@microsoft/vally": "^0.6.0",
+        "ajv": "^8.20.0",
+        "ajv-formats": "^3.0.1",
         "all-contributors-cli": "^6.26.1"
       }
     },
@@ -27,12 +30,234 @@
         "node": ">=6.9.0"
       }
     },
+    "node_modules/@github/copilot": {
+      "version": "1.0.67",
+      "resolved": "https://registry.npmjs.org/@github/copilot/-/copilot-1.0.67.tgz",
+      "integrity": "sha512-5YEY9LNXBT9Q8uShjCdYcornJJJhGtdIzSYla2+pjfXYpHsDVibqYubzYjfgffOUKFChyzOpH7n/868+t56iIg==",
+      "dev": true,
+      "license": "SEE LICENSE IN LICENSE.md",
+      "dependencies": {
+        "detect-libc": "^2.1.2"
+      },
+      "bin": {
+        "copilot": "npm-loader.js"
+      },
+      "optionalDependencies": {
+        "@github/copilot-darwin-arm64": "1.0.67",
+        "@github/copilot-darwin-x64": "1.0.67",
+        "@github/copilot-linux-arm64": "1.0.67",
+        "@github/copilot-linux-x64": "1.0.67",
+        "@github/copilot-linuxmusl-arm64": "1.0.67",
+        "@github/copilot-linuxmusl-x64": "1.0.67",
+        "@github/copilot-win32-arm64": "1.0.67",
+        "@github/copilot-win32-x64": "1.0.67"
+      }
+    },
+    "node_modules/@github/copilot-darwin-arm64": {
+      "version": "1.0.67",
+      "resolved": "https://registry.npmjs.org/@github/copilot-darwin-arm64/-/copilot-darwin-arm64-1.0.67.tgz",
+      "integrity": "sha512-CO3mpgFXcN6e7ZsSmjMkt1AKxMfb1+mjdn3yrf2DRnnWIURSK9kGvw+E+E1+YE37D1MBiUn/VOBmhRad5+vl0A==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "SEE LICENSE IN LICENSE.md",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "bin": {
+        "copilot-darwin-arm64": "copilot"
+      }
+    },
+    "node_modules/@github/copilot-darwin-x64": {
+      "version": "1.0.67",
+      "resolved": "https://registry.npmjs.org/@github/copilot-darwin-x64/-/copilot-darwin-x64-1.0.67.tgz",
+      "integrity": "sha512-M20Hpn3bOJRkVwAIVRK4ZlX66AqtmGfXZRxZBRFQC045QIwcfmVUP45sTSgXDb4uHWeK0cZgdTdniHwKGtMplw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "SEE LICENSE IN LICENSE.md",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "bin": {
+        "copilot-darwin-x64": "copilot"
+      }
+    },
+    "node_modules/@github/copilot-linux-arm64": {
+      "version": "1.0.67",
+      "resolved": "https://registry.npmjs.org/@github/copilot-linux-arm64/-/copilot-linux-arm64-1.0.67.tgz",
+      "integrity": "sha512-b4ePtFBow+Ior+aVLKA1hHxhR5wF+ql5CD7TSg/NHGYgc1kwD+3a9uKSENy05J5Lit/G/DZ9C6JwowvvdMWSKg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "SEE LICENSE IN LICENSE.md",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "bin": {
+        "copilot-linux-arm64": "copilot"
+      }
+    },
+    "node_modules/@github/copilot-linux-x64": {
+      "version": "1.0.67",
+      "resolved": "https://registry.npmjs.org/@github/copilot-linux-x64/-/copilot-linux-x64-1.0.67.tgz",
+      "integrity": "sha512-4ynZyfKnWAdvEPAFDDBIz1wpFttcOTJu4Y8Mlz5oXCBA0NM/rwr8K4l7Adp8UzwbfmdrMJ9y+zivqRBMDbPInA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "SEE LICENSE IN LICENSE.md",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "bin": {
+        "copilot-linux-x64": "copilot"
+      }
+    },
+    "node_modules/@github/copilot-linuxmusl-arm64": {
+      "version": "1.0.67",
+      "resolved": "https://registry.npmjs.org/@github/copilot-linuxmusl-arm64/-/copilot-linuxmusl-arm64-1.0.67.tgz",
+      "integrity": "sha512-IjezxBU8fYUr/b5hEiniXqzwoOrJ4egrQSBbG96M+roLTqd9txP0MgxZtcRtKV7phRIdIGE109wwrn4H6hSqmA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "SEE LICENSE IN LICENSE.md",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "bin": {
+        "copilot-linuxmusl-arm64": "copilot"
+      }
+    },
+    "node_modules/@github/copilot-linuxmusl-x64": {
+      "version": "1.0.67",
+      "resolved": "https://registry.npmjs.org/@github/copilot-linuxmusl-x64/-/copilot-linuxmusl-x64-1.0.67.tgz",
+      "integrity": "sha512-Zy/rbja1lnhzDoNfn051H0EybCseCvjvH7WmbcHCayjXUjzXeKF6OmAt4hvqFZH87ttT3KbKtQ8/6oDUhhM2YQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "SEE LICENSE IN LICENSE.md",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "bin": {
+        "copilot-linuxmusl-x64": "copilot"
+      }
+    },
+    "node_modules/@github/copilot-sdk": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/@github/copilot-sdk/-/copilot-sdk-1.0.4.tgz",
+      "integrity": "sha512-c6/gpatP7LAuP9stlc2uXXOrB+TJMFSs3Jrzu9FG8lJJYFGmdzbBvGz2UdL1jww84fp6D7cohEZa4UGq1+iuyA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@github/copilot": "^1.0.65",
+        "vscode-jsonrpc": "^8.2.1",
+        "zod": "^4.3.6"
+      },
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      }
+    },
+    "node_modules/@github/copilot-win32-arm64": {
+      "version": "1.0.67",
+      "resolved": "https://registry.npmjs.org/@github/copilot-win32-arm64/-/copilot-win32-arm64-1.0.67.tgz",
+      "integrity": "sha512-O3VFRS5v9NXRP8o+N1SvcFbBqECDzZP7XQBeBj2Vcrma80gdJc5GQub/w2mwmr1w5UbwgzJkRasm0Ec/jxbcoA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "SEE LICENSE IN LICENSE.md",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "bin": {
+        "copilot-win32-arm64": "copilot.exe"
+      }
+    },
+    "node_modules/@github/copilot-win32-x64": {
+      "version": "1.0.67",
+      "resolved": "https://registry.npmjs.org/@github/copilot-win32-x64/-/copilot-win32-x64-1.0.67.tgz",
+      "integrity": "sha512-td5tQ/nve5dB7RPvNglBZwa/6DJqiOBgacXXa1GpYcohqpCzoI8gONNkeaeyr6oF4iu5wXJ9krUNr6QXL4yB5Q==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "SEE LICENSE IN LICENSE.md",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "bin": {
+        "copilot-win32-x64": "copilot.exe"
+      }
+    },
+    "node_modules/@microsoft/vally": {
+      "version": "0.6.0",
+      "resolved": "https://registry.npmjs.org/@microsoft/vally/-/vally-0.6.0.tgz",
+      "integrity": "sha512-b283YRDFZXUkKNKY3+1EfMBVbHrBLIs5jfUi7lIQ8N0Y10lVsNnNGkRbtTbd7tLYZajr6AhtnpIroc4RFzo1cQ==",
+      "dev": true,
+      "dependencies": {
+        "@github/copilot-sdk": "^1.0.0",
+        "js-tiktoken": "^1.0.21",
+        "picomatch": "^4.0.4",
+        "yaml": "^2.9.0",
+        "zod": "^4.4.3"
+      }
+    },
     "node_modules/@types/unist": {
       "version": "3.0.3",
       "resolved": "https://registry.npmjs.org/@types/unist/-/unist-3.0.3.tgz",
       "integrity": "sha512-ko/gIFJRv177XgZsZcBwnqJN5x/Gien8qNOn0D5bQU/zAzVf9Zt3BlcUiLqhV9y4ARk0GbT3tnUiPNgnTXzc/Q==",
       "license": "MIT"
     },
+    "node_modules/ajv": {
+      "version": "8.20.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.20.0.tgz",
+      "integrity": "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "fast-deep-equal": "^3.1.3",
+        "fast-uri": "^3.0.1",
+        "json-schema-traverse": "^1.0.0",
+        "require-from-string": "^2.0.2"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/epoberezkin"
+      }
+    },
+    "node_modules/ajv-formats": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/ajv-formats/-/ajv-formats-3.0.1.tgz",
+      "integrity": "sha512-8iUql50EUR+uUcdRQ3HDqa6EVyo3docL8g5WJ3FNcWmu62IbkGUue/pEyLBW8VGKKucTPgqeks4fIU1DA4yowQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ajv": "^8.0.0"
+      },
+      "peerDependencies": {
+        "ajv": "^8.0.0"
+      },
+      "peerDependenciesMeta": {
+        "ajv": {
+          "optional": true
+        }
+      }
+    },
     "node_modules/all-contributors-cli": {
       "version": "6.26.1",
       "resolved": "https://registry.npmjs.org/all-contributors-cli/-/all-contributors-cli-6.26.1.tgz",
@@ -116,6 +341,27 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/base64-js": {
+      "version": "1.5.1",
+      "resolved": "https://registry.npmjs.org/base64-js/-/base64-js-1.5.1.tgz",
+      "integrity": "sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "license": "MIT"
+    },
     "node_modules/camelcase": {
       "version": "5.3.1",
       "resolved": "https://registry.npmjs.org/camelcase/-/camelcase-5.3.1.tgz",
@@ -215,6 +461,16 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/detect-libc": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
+      "integrity": "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/didyoumean": {
       "version": "1.2.2",
       "resolved": "https://registry.npmjs.org/didyoumean/-/didyoumean-1.2.2.tgz",
@@ -254,6 +510,30 @@
         "node": ">=4"
       }
     },
+    "node_modules/fast-deep-equal": {
+      "version": "3.1.3",
+      "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
+      "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/fast-uri": {
+      "version": "3.1.3",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.3.tgz",
+      "integrity": "sha512-i70LwGWUduXqzicKXWshooq+sWL1K3WUU5rKZNG/0i3a1OSoX3HqhH5WbWwTmqWfor4urUakGPiRQcleRZTwOg==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fastify"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fastify"
+        }
+      ],
+      "license": "BSD-3-Clause"
+    },
     "node_modules/figures": {
       "version": "3.2.0",
       "resolved": "https://registry.npmjs.org/figures/-/figures-3.2.0.tgz",
@@ -352,10 +632,20 @@
         "node": ">=8"
       }
     },
+    "node_modules/js-tiktoken": {
+      "version": "1.0.21",
+      "resolved": "https://registry.npmjs.org/js-tiktoken/-/js-tiktoken-1.0.21.tgz",
+      "integrity": "sha512-biOj/6M5qdgx5TKjDnFT1ymSpM5tbd3ylwDtrQvFQSu0Z7bBYko2dF+W/aUkXUPuk6IVpRxk/3Q2sHOzGlS36g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "base64-js": "^1.5.1"
+      }
+    },
     "node_modules/js-yaml": {
-      "version": "4.2.0",
+      "version": "5.2.0",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.2.0.tgz",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.2.0.tgz",
-      "integrity": "sha512-ePWsvanv0DWuDRsW8dnt+R4jQ31SCRCQ7hhNcPXZPsoBZiemuZNYGf7adZdqX2D86j6rvKp3RpCxVTSb8WQlOw==",
+      "integrity": "sha512-YeLUMlvR4Ou1B119LIaM0r65JvbOBooJDc9yEu0dClb/uSC5P4FrLU8OCCz/HXWvtPoIrR0dRzABTjo1sTN9Bw==",
       "funding": [
         {
           "type": "github",
@@ -371,7 +661,7 @@
         "argparse": "^2.0.1"
       },
       "bin": {
-        "js-yaml": "bin/js-yaml.js"
+        "js-yaml": "bin/js-yaml.mjs"
       }
     },
     "node_modules/json-fixer": {
@@ -389,6 +679,13 @@
         "node": ">=10"
       }
     },
+    "node_modules/json-schema-traverse": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-1.0.0.tgz",
+      "integrity": "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/locate-path": {
       "version": "5.0.0",
       "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-5.0.0.tgz",
@@ -535,6 +832,19 @@
         "node": ">=0.10"
       }
     },
+    "node_modules/picomatch": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
+      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
+    },
     "node_modules/pify": {
       "version": "5.0.0",
       "resolved": "https://registry.npmjs.org/pify/-/pify-5.0.0.tgz",
@@ -575,6 +885,16 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/require-from-string": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/require-from-string/-/require-from-string-2.0.2.tgz",
+      "integrity": "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
     "node_modules/require-main-filename": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/require-main-filename/-/require-main-filename-2.0.0.tgz",
@@ -783,6 +1103,16 @@
         "url": "https://opencollective.com/unified"
       }
     },
+    "node_modules/vscode-jsonrpc": {
+      "version": "8.2.1",
+      "resolved": "https://registry.npmjs.org/vscode-jsonrpc/-/vscode-jsonrpc-8.2.1.tgz",
+      "integrity": "sha512-kdjOSJ2lLIn7r1rtrMbbNCHjyMPfRnowdKjBQ+mGq6NAW5QY2bEZC/khaC5OR8svbbjvLEaIXkOq45e2X9BIbQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=14.0.0"
+      }
+    },
     "node_modules/webidl-conversions": {
       "version": "3.0.1",
       "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-3.0.1.tgz",
@@ -881,6 +1211,16 @@
       "engines": {
         "node": ">=6"
       }
+    },
+    "node_modules/zod": {
+      "version": "4.4.3",
+      "resolved": "https://registry.npmjs.org/zod/-/zod-4.4.3.tgz",
+      "integrity": "sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/colinhacks"
+      }
     }
   }
 }

package.json

@@ -38,10 +38,13 @@
   "author": "GitHub",
   "license": "MIT",
   "devDependencies": {
+    "ajv": "^8.20.0",
+    "ajv-formats": "^3.0.1",
+    "@microsoft/vally": "^0.6.0",
     "all-contributors-cli": "^6.26.1"
   },
   "dependencies": {
-    "js-yaml": "^4.2.0",
+    "js-yaml": "^5.2.0",
     "vfile": "^6.0.3",
     "vfile-matter": "^5.0.1"
   }

plugins/project-planning/skills/create-implementation-plan/SKILL.md

@@ -60,6 +60,34 @@ All implementation plans must strictly adhere to the following template. Each se
 - All identifier prefixes must follow the specified format
 - Tables must include all required columns
 - No placeholder text may remain in the final output
+- **Identifiers must be uniquely declared.** Every identifier (`REQ-NNN`, `SEC-NNN`, `CON-NNN`, `GUD-NNN`, `PAT-NNN`, `GOAL-NNN`, `TASK-NNN`, `ALT-NNN`, `DEP-NNN`, `FILE-NNN`, `TEST-NNN`, `RISK-NNN`, `ASSUMPTION-NNN`) must be **declared exactly once**. A declaration is where the identifier introduces a row: the leading cell in a TASK/GOAL table row, or the bolded prefix in a bullet line like `- **REQ-001**: ...`. The same identifier may then appear any number of times as a **reference** elsewhere in the plan (a `TASK` body citing a `REQ`, one `TASK` citing another `TASK`, the Dependencies section pointing at a `DEP` already declared upstream, etc.). References are expected and not collisions.
+
+## Identifier Uniqueness Check
+
+Run these checks before finalizing the plan. Checks (1) and (2) target declarations and must return zero rows. Check (3) is a broad informational scan: it will surface valid references too, so use it for awareness rather than as a gate.
+
+```bash
+# Set PLAN_FILE to the plan being validated.
+PLAN_FILE="/plan/<purpose>-<component>-<version>.md"
+
+# 1) Duplicate TASK / GOAL declarations in table rows.
+grep -oE '\| (TASK|GOAL)-[0-9]+ \|' "$PLAN_FILE" \
+  | sed -E 's/.*((TASK|GOAL)-[0-9]+).*/\1/' \
+  | sort | uniq -d
+
+# 2) Duplicate declaration IDs in bullet-style spec lines.
+grep -oE '^- \*\*(REQ|SEC|CON|GUD|RISK|ASSUMPTION|TASK|GOAL|FILE|TEST|PAT|ALT|DEP)-[0-9]+\*\*:' "$PLAN_FILE" \
+  | sed -E 's/^- \*\*([A-Z]+-[0-9]+)\*\*:.*/\1/' \
+  | sort | uniq -d
+
+# 3) Broad duplicate scan (diagnostic only; may include valid references).
+grep -oE '(REQ|SEC|CON|GUD|RISK|ASSUMPTION|TASK|GOAL|FILE|TEST|PAT|ALT|DEP)-[0-9]+' "$PLAN_FILE" \
+  | sort | uniq -d
+```
+
+Prerequisites: a POSIX-compatible shell (`sh` / `bash`) with `grep`, `sed`, `sort`, and `uniq`. On Windows without these tools, use equivalent platform-native commands and preserve the same declaration-vs-reference logic.
+
+If check (1) or (2) returns any row, re-number the duplicate so each identifier is declared exactly once, then re-run the checks until both are empty.
 
 ## Status
 

skills/create-implementation-plan/SKILL.md

@@ -60,6 +60,34 @@ All implementation plans must strictly adhere to the following template. Each se
 - All identifier prefixes must follow the specified format
 - Tables must include all required columns
 - No placeholder text may remain in the final output
+- **Identifiers must be uniquely declared.** Every identifier (`REQ-NNN`, `SEC-NNN`, `CON-NNN`, `GUD-NNN`, `PAT-NNN`, `GOAL-NNN`, `TASK-NNN`, `ALT-NNN`, `DEP-NNN`, `FILE-NNN`, `TEST-NNN`, `RISK-NNN`, `ASSUMPTION-NNN`) must be **declared exactly once**. A declaration is where the identifier introduces a row: the leading cell in a TASK/GOAL table row, or the bolded prefix in a bullet line like `- **REQ-001**: ...`. The same identifier may then appear any number of times as a **reference** elsewhere in the plan (a `TASK` body citing a `REQ`, one `TASK` citing another `TASK`, the Dependencies section pointing at a `DEP` already declared upstream, etc.). References are expected and not collisions.
+
+## Identifier Uniqueness Check
+
+Run these checks before finalizing the plan. Checks (1) and (2) target declarations and must return zero rows. Check (3) is a broad informational scan: it will surface valid references too, so use it for awareness rather than as a gate.
+
+```bash
+# Set PLAN_FILE to the plan being validated.
+PLAN_FILE="/plan/<purpose>-<component>-<version>.md"
+
+# 1) Duplicate TASK / GOAL declarations in table rows.
+grep -oE '\| (TASK|GOAL)-[0-9]+ \|' "$PLAN_FILE" \
+  | sed -E 's/.*((TASK|GOAL)-[0-9]+).*/\1/' \
+  | sort | uniq -d
+
+# 2) Duplicate declaration IDs in bullet-style spec lines.
+grep -oE '^- \*\*(REQ|SEC|CON|GUD|RISK|ASSUMPTION|TASK|GOAL|FILE|TEST|PAT|ALT|DEP)-[0-9]+\*\*:' "$PLAN_FILE" \
+  | sed -E 's/^- \*\*([A-Z]+-[0-9]+)\*\*:.*/\1/' \
+  | sort | uniq -d
+
+# 3) Broad duplicate scan (diagnostic only; may include valid references).
+grep -oE '(REQ|SEC|CON|GUD|RISK|ASSUMPTION|TASK|GOAL|FILE|TEST|PAT|ALT|DEP)-[0-9]+' "$PLAN_FILE" \
+  | sort | uniq -d
+```
+
+Prerequisites: a POSIX-compatible shell (`sh` / `bash`) with `grep`, `sed`, `sort`, and `uniq`. On Windows without these tools, use equivalent platform-native commands and preserve the same declaration-vs-reference logic.
+
+If check (1) or (2) returns any row, re-number the duplicate so each identifier is declared exactly once, then re-run the checks until both are empty.
 
 ## Status
 

website/package.json

@@ -19,8 +19,8 @@
   "license": "MIT",
   "dependencies": {
     "@astrojs/sitemap": "^3.7.2",
-    "@astrojs/starlight": "^0.38.4",
+    "@astrojs/starlight": "^0.41.1",
-    "astro": "^6.1.9",
+    "astro": "^7.0.3",
     "choices.js": "^11.2.2",
     "front-matter": "^4.0.2",
     "gray-matter": "^4.0.3",

website/src/pages/contributors.astro

@@ -499,9 +499,8 @@ import PageHeader from '../components/PageHeader.astro';
   <tfoot>
     <tr>
       <td align="center" size="13px" colspan="7">
-        <img src="https://raw.githubusercontent.com/all-contributors/all-contributors-cli/1b8533af435da9854653492b1327a23a4dbd0a10/assets/logo-small.svg">
+        <img src="https://raw.githubusercontent.com/all-contributors/all-contributors-cli/1b8533af435da9854653492b1327a23a4dbd0a10/assets/logo-small.svg" alt="" />
-          <a href="https://all-contributors.js.org/docs/en/bot/usage">Add your contributions</a>
+        <a href="https://all-contributors.js.org/docs/en/bot/usage">Add your contributions</a>
-        </img>
       </td>
     </tr>
   </tfoot>