git:20260925.41f8784 to git:20260926.7dce66c

39 added, 22 removed. Audit A to A.

---

name: push-skills

- description: Commit and push changes to a skills repo, including global AGENTS.md. Use after editing skills, or when the user says "push the skill", "push skills to github", "update the skills repo", or "publish code/AGENTS.md". Covers private commits and public mirror verification; use publish-skill for skill allowlisting.

+ description: Push skills and global AGENTS.md to the private repo and verify the public mirror. Use only when the user explicitly invokes /push-skills.

+ disable-model-invocation: true

---

# Push Skills

- Use the configured private repository and follow its established publication process. Only commit or push when the user requests it. Editing this skill is not permission to publish it. For distributed skill edits, follow `distribute-skill-to-all-agents` before pushing.

+ Canonical repo: `<skills-repo>`. Private remote: `OWNER/PRIVATE_REPO`. Pushing `main` triggers the sanitized mirror at `davidondrej/skills`; only the configured publishing process pushes there.

+ Only commit or push when the user requests it. Editing this skill is not permission to publish it. For distributed skill edits, follow `distribute-skill-to-all-agents` before pushing.

## Always include global instructions

- The user's standing scope for an authorized `/push-skills` run includes saved changes to `<global-instructions-path>`, unless they explicitly exclude that file. Check it on every run, even when the latest message names a skill. Preserve the conversation's original publishing objective through skill edits, renames, and other follow-up requests.

+ The user's standing scope for an authorized `/push-skills` run includes saved changes to `<workspace>/AGENTS.md`, unless they explicitly exclude that file. Check it on every run, even when the latest message names a skill. Preserve the conversation's original publishing objective through skill edits, renames, and other follow-up requests.

- After fetching, compare the saved global instructions with the corresponding file at `origin/main`. A dirty local checkout may simply lag behind an already published commit; do not use local Git status alone to decide whether the saved content is committed. Transfer genuinely new edits while preserving upstream changes.

+ After fetching, compare saved `global/AGENTS.md` with `origin/main:global/AGENTS.md`. Local dirt may already be published; Git status alone cannot tell. Transfer new edits while preserving upstream changes.

- Before declaring completion, verify the saved global instructions are committed privately and the substantive updates appear in the public root `AGENTS.md`. Report that file's result separately from any skill publication. A successful skill push does not complete an AGENTS.md publishing request.

+ Verify saved global instructions are committed privately and substantive updates appear in public root `AGENTS.md`. Report this separately; successful skill publication does not complete an AGENTS.md request.

## Choose the source file

- - `<global-instructions-path>` may be a symlink to the saved global instructions. Save the editor buffer and confirm the link before committing. If the link differs, inspect both files before choosing the source; do not replace the link or overwrite either file as part of publishing. The public destination is root `AGENTS.md`.

- - The private repository's own `AGENTS.md` contains private repo instructions. It is a different file and stays excluded.

+ - `<workspace>/AGENTS.md` should link to `<skills-repo>/global/AGENTS.md`. Save the editor buffer and verify the link. If it differs, inspect both files before choosing; do not replace the link or overwrite either file. Public destination: root `AGENTS.md`.

+ - `<skills-repo>/AGENTS.md` is a separate, private repo-instruction file and stays excluded.

- Updating global instructions needs no copy, skill allowlisting, or policy version bump.

- - Skill edits live under `skills/<skill-name>/`. For a newly public skill, use `publish-skill` and include its policy changes in the same commit.

+ - Skills live under `skills/<skill-name>/`. Use `publish-skill` for newly public skills; include policy changes in the same commit.

## Prepare without disturbing other work

- Run Git in the private repository, or the temporary worktree described below. Check both staged and unstaged changes:

+ Run Git in `<skills-repo>` or the temporary worktree below. Check staged and unstaged changes:

```bash

git status --short

git diff --cached --stat

- git diff HEAD -- <global-instructions-path>

+ git diff HEAD -- global/AGENTS.md

git remote -v

git fetch origin main

```

- Replace `<global-instructions-path>` with the exact intended paths for a skill update. Confirm that `origin` is the intended private repo. Review outgoing commits as well as file changes; a push includes every commit ahead of `origin/main`.

+ For skills, substitute the intended paths. Confirm `origin` is private. Review outgoing commits as well as files: every commit ahead of `origin/main` will push.

- - If the checkout is clean, fast-forward `main` with `git merge --ff-only origin/main`.

- - If only the intended edits are pending, commit them, then rebase those intended commits onto `origin/main` before pushing.

- - If there are unrelated edits, staged files, or local commits, use a clean temporary worktree based on `origin/main`: `git worktree add --detach <temporary-path> origin/main`. Leave the original checkout and index intact. Transfer only the approved changes as a patch against their original base, using three-way application where needed. Copy only approved new files separately. Preserve upstream edits; do not overwrite a newer file with an older full copy. Resolve conflicts from both versions; ask only if intent is ambiguous.

+ - Clean checkout: fast-forward `main` with `git merge --ff-only origin/main`.

+ - Only intended edits pending: commit, then rebase those commits onto `origin/main`.

+ - Unrelated edits, staged files, or local commits: use `git worktree add --detach <temporary-path> origin/main`. Preserve the original checkout and index. Transfer approved changes as a patch against their original base, using three-way application when needed; copy approved new files separately. Preserve newer upstream edits instead of overwriting with an old copy. Resolve conflicts from both versions; ask only when intent is ambiguous.

Do not stash, reset, unstage, or commit someone else's work.

## Commit and push

- Stage only the intended paths. Plain `git commit` includes every staged file, even when the preceding `git add` names only one file. Use an explicit path list:

+ Stage only intended paths. Plain `git commit` includes all staged files regardless of the preceding `git add`; use an explicit path list:

```bash

- git add -- <global-instructions-path>

- git commit --only -m "Update global agent instructions" -- <global-instructions-path>

+ git add -- global/AGENTS.md

+ git commit --only -m "Update global agent instructions" -- global/AGENTS.md

```

- Adapt the paths and message for skills. Review `git show --stat HEAD` and `git diff origin/main..HEAD` before pushing. If there is nothing new to commit, check whether the intended state is already pushed and continue with verification.

+ Adapt paths and message for skills. Review `git show --stat HEAD` and `git diff origin/main..HEAD` before pushing. If nothing needs committing, check whether the intended state is already pushed, then verify it.

```bash

git push origin HEAD:main

source_sha=$(git rev-parse HEAD)

```

- If the push is rejected because `main` advanced, fetch and rebase the isolated intended commits, review again, and retry. Never force-push. Confirm the remote contains the pushed commit; do not rely on a particular push-output label. If a temporary worktree was used, report that the original checkout was left untouched.

+ If `main` advanced, fetch, rebase the isolated intended commits, review, and retry. Never force-push. Verify the remote contains the commit instead of relying on push-output labels. Report when a temporary worktree kept the original checkout untouched.

## Verify public publication

- A private push alone does not prove publication. Find the publication workflow for the pushed commit using the repository's configured CI tools. Wait for that run, not an older successful run. If a newer run supersedes it, confirm that run's source contains the intended change. If the run fails, is cancelled without replacement, or remains stalled, inspect its status and report publication incomplete with the run link. Do not rerun indefinitely.

+ Find the publication workflow for the pushed commit; a private push alone does not prove publication:

- Read the actual published file and confirm the intended update. For global instructions, check the public root `AGENTS.md`. For skills, check `skills/<category>/<skill-name>/SKILL.md`; use the committed policy and published tree to find the category. Private-only skills need only private push verification.

+ ```bash

+ gh run list --repo "$PRIVATE_REPO" --workflow "$PUBLISH_WORKFLOW" \\

+ --commit "$source_sha" --json databaseId,headSha,status,conclusion,url

+ gh run watch <run-id> --repo "$PRIVATE_REPO" --exit-status

+ ```

- The mirror may rewrite or omit content. A green workflow and an existing file are not enough: inspect the content. For missing or unexpected output, inspect the workflow's report and documentation. Report exclusions or failures accurately; do not bypass the sanitizer or add manual approval gates. Finish with the private commit, workflow result, and public file link when published.

+ Wait for the matching run. If superseded, verify the newer source contains your change. The publishing process may add an automated sync commit, so public `Source:` can name a descendant of your commit. For failure, cancellation without replacement, or a stall, inspect status/logs and report incomplete publication with the run link. Do not rerun indefinitely.

+ Read the published file and confirm the intended update:

+ ```bash

+ gh api repos/davidondrej/skills/contents/AGENTS.md \\

+ -H 'Accept: application/vnd.github.raw'

+ ```

+ Find skill categories from the committed policy and published tree, then check `skills/<category>/<skill-name>/SKILL.md`. Private-only skills need only private push verification.

+ The mirror may rewrite or omit content; green CI and file existence do not prove correctness. For missing or unexpected content, inspect the matching publication report artifact and the mirror tooling documentation in `<skills-repo>/tools/`. Report exclusions/failures accurately. Never bypass the sanitizer or add manual approval gates. Finish with the private commit, workflow result, and published file link.