swe-re-expert

Plugin offer consolidation review — 2026-10-13

Scope

The 58 editorial packs become 30 active packs, plus the unchanged full-library plugin on both hosts. Twenty-eight overlapping historical roles are absorbed; two surviving IDs are shortened for the existing Codex qualified-name length limit. The migration ledger binds 30 retired IDs to one active target each and a preserved membership inventory. All 293 previously offered unique canonical skill IDs remain covered; no canonical ID is removed and no new skill is imported.

The migration table and distinctions between the remaining jobs are in the user guide. Shared individual skills remain possible where jobs differ; the marketplace no longer contains both a historical pack and its overlapping AAS replacement. Every editorial pack is visible on the plugin page; candidate metadata remains a focused subset, not a second product list.

Content review

Reviewed the changed complete canonical trees: maintainer workflow, startup financial modeling, market sizing (including its existing data-source reference and SaaS example), LLM evaluation, Azure deployment, three SEO auditing skills, Google Calendar automation and the complete senior-fullstack tree. Removed unavailable support-file promises instead of fabricating resources. Calendar now uses an existing authorized integration and no longer promises missing OAuth/client scripts. Azure deployment has explicit authorization boundaries and no blanket RBAC error suppression. Financial burn uses cash outflows minus operating cash inflows; nonpositive burn has no finite runway. The SaaS ARR/MRR example is reconciled. LLM evaluation is explicit about pseudocode, dependencies, judge limitations, data/cost authorization; ordered kappa ranges replace Boolean-key overwrites, and relative regression rejects zero baselines.

Provenance and declared risk labels are preserved. Existing community skills without structured source metadata remain provenance debt; the consolidation does not claim verified external origins. Historical market-source prices and illustrative scenario percentages are not current evidence. No real cloud deployment, calendar mutation, paid judge call or external service setup was executed.

The senior-fullstack references now contain concrete boundary/checklist guidance, and all three historical helper skeletons fail explicitly instead of reporting success with no analysis. Newly selected support files are inspected as instructions and templates, not executed as operational tools.

Validation contract

Required: full unsharded root suite, web coverage and build, validation chain, references, docs-security, warning budget, source credits, changed-skill evidence, generated plugin/bundle parity, and the exact-head protected merge. Tests reject skill loss, missing migration targets, duplicate/live retired IDs, ambiguous aliases, stale public counts and reappearance of retired marketplace/payload entries. Compare canonical support bytes with every specialized generated bundle. Generated files are inspected locally but committed only by protected canonical synchronization.

Semantic review authority is the actual CI Tessl outcome or manual maintainer attestation to the exact full head SHA; structural tests and advisory scans are not semantic approval. Source merge is separate from release/publication availability.

Review bootstrap repair

The live PR exposed Tessl setup stuck before its ten-minute review timeout could begin. Bound setup separately to two minutes, skip review execution when setup fails and route to the existing exact-head manual attestation gate. Negative tests execute the actual outcome resolver with failed/cancelled setup, success and cache reuse. This changes no required check or approval authority.

Exact-head review outcomes and Azure follow-up

For source head 341155bee69b24ca00634eba8a5d0b045542e4bd, Tessl scored the maintainer skill 81 and Azure deployment 73, then stopped at the first non-passing score; the other eight trees were not automatically reviewed in that attempt. The required outcome was manual review, attested to that exact head. Address the actionable Azure feedback with explicit required hook inputs, post-deployment verification and removal of misleading custom-domain preservation claims.

The static advisory report for that head covered ten roots: seven complete reports, two partial reports and one nonzero/incomplete report, with 17 contextual findings. Maintainer findings describe the scanner/repository contract and quoted attack examples; Azure findings concern documented environment locations; the fullstack finding concerns absent optional tool-scope metadata. These are manually contextualized, not suppressed or called a clean scan. No cloud operations were executed.