From 44d8be4cab86148ef84aad7471ca29ca341201d6 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Mon, 20 Jul 2026 23:42:43 +0000
Subject: [PATCH 1/3] chore: claim #2260
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

> 🤖 Generated by the Daily AI Engineer (Cursor cloud instance)

Co-authored-by: Nikolai Emil Damm <devantler@users.noreply.github.com>

From 559b05ad3ceee89b437d3264de7ec128d6b79aa6 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Mon, 20 Jul 2026 23:43:05 +0000
Subject: [PATCH 2/3] docs(agent): align monorepo product-card labels with live
 taxonomy

Replace nonexistent ci with github_actions, drop agentic-workflows,
add roadmap, and pin the allowlist in the product-value contract test.

Fixes #2260

Co-authored-by: Nikolai Emil Damm <devantler@users.noreply.github.com>
---
 .claude/scripts/product-value-contract.test.sh | 14 ++++++++++++++
 .claude/skills/products/monorepo/SKILL.md      |  6 +++++-
 2 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/.claude/scripts/product-value-contract.test.sh b/.claude/scripts/product-value-contract.test.sh
index 153a05ee..a43f261a 100755
--- a/.claude/scripts/product-value-contract.test.sh
+++ b/.claude/scripts/product-value-contract.test.sh
@@ -99,4 +99,18 @@ grep -Fq '      - changes' "${workflow}" ||
 grep -Fq '${{ needs.changes.result }}' "${workflow}" ||
   fail "required aggregate does not evaluate path-detection failures"
 
+# Monorepo product-card label allowlist (#2260) — must match live taxonomy names.
+labels_line="$(grep -E '^\- \*\*Labels\*\*' "${site_card}" || true)"
+[[ -n "${labels_line}" ]] || fail "site card missing Labels allowlist line"
+grep -Fq '`github_actions`' <<<"${labels_line}" ||
+  fail "site card Labels allowlist missing live github_actions (#2260)"
+grep -Fq '`roadmap`' <<<"${labels_line}" ||
+  fail "site card Labels allowlist missing live roadmap (#2260)"
+if grep -Eq '`ci`' <<<"${labels_line}"; then
+  fail "site card Labels allowlist still lists nonexistent ci (#2260)"
+fi
+if grep -Fq '`agentic-workflows`' <<<"${labels_line}"; then
+  fail "site card Labels allowlist still lists nonexistent agentic-workflows (#2260)"
+fi
+
 echo "product value contract: all assertions passed"
diff --git a/.claude/skills/products/monorepo/SKILL.md b/.claude/skills/products/monorepo/SKILL.md
index a1e1b82a..e12f911c 100644
--- a/.claude/skills/products/monorepo/SKILL.md
+++ b/.claude/skills/products/monorepo/SKILL.md
@@ -22,7 +22,11 @@ material refreshes. Validate with the `docs` build before any PR.
 - **Branch** `claude/<area>-<desc>-<issue>` (the issue number makes a pre-PR claim matchable — see the contract's *Claim protocol*; issue-less hotfixes and trivial obvious fixes keep plain `claude/<area>-<desc>`). Submodule pointers often show as modified — **expected, not yours**; detect real dirtiness with `git status --porcelain --ignore-submodules=all`; never stage pointer bumps; never `git submodule update --remote`.
 - **Validate:** before any `docs/` PR, `[ -d docs/node_modules ] || (cd docs && npm ci)` then `cd docs && npm run build` (use `npm --prefix docs …`). Workflows → `actionlint`. Never edit auto-generated files / `*.lock.yml`.
 - **Agent/review files:** `AGENTS.md` is the **single canonical** instruction file — what humans, agents, and **Copilot code review** all read ([since 2026-06-18](https://github.blog/changelog/2026-06-18-copilot-code-review-agents-md-support-and-ui-improvements/)); there is no separate `.github/copilot-instructions.md` (retired portfolio-wide). Keep `AGENTS.md`, the `.claude/` skills/cards, and any path-scoped `.github/instructions/` files from drifting apart (see `product-engineering` §7).
-- **Labels** (apply only from this set): `automation`, `documentation`, `ci`, `dependencies`, `submodules`, `bug`, `enhancement`, `question`, `duplicate`, `wontfix`, `needs triage`, `needs investigation`, `performance`, `refactor`, `security`, `repo-assist`, `agentic-workflows`, `good first issue`, `help wanted`, `spam`, `blocked`, `next`.
+- **Labels** (apply only from this set): `automation`, `documentation`, `github_actions`, `dependencies`, `submodules`, `bug`, `enhancement`, `question`, `duplicate`, `wontfix`, `needs triage`, `needs investigation`, `performance`, `refactor`, `security`, `repo-assist`, `roadmap`, `good first issue`, `help wanted`, `spam`, `blocked`, `next`.
+  Live taxonomy is the verification source (`gh label list -R devantler-tech/monorepo`); the allowlist
+  above must stay a subset of it — never invent label names. Contract self-test:
+  `.claude/scripts/product-value-contract.test.sh` pins `github_actions` present and rejects the
+  retired `ci` / `agentic-workflows` entries.
 
 ## Task menu (1–3 highest-value; Content Review gated to Mondays; Blog Stewardship low priority)
 - **A. CI Doctor:** `gh run list --repo devantler-tech/monorepo --status failure --limit 20 ...` (active workflows **CI** + **Publish - Pages**; ignore removed gh-aw workflows & Dependabot's submodule-update job). Dedupe vs native memory's CI-investigation cache (`caches.md`). `gh run view <id> --log-failed` (untrusted); root-cause (bad MDX/frontmatter, broken imports, `npm ci` lockfile desync, Node/Sharp, dead submodule ref, broken YAML). Failure on an open PR → one root-cause comment (+ draft fix if confident); else record it in native memory (`caches.md`). Prune cache >7d.

From 5951b97310d93d319f33113959fa4e6ba6278273 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Mon, 27 Jul 2026 00:37:02 +0000
Subject: [PATCH 3/3] fix(agent): validate every monorepo label against live
 taxonomy

Codex P2 on #2488: parse every backticked Labels allowlist token and
assert it is in the pinned live taxonomy so misspellings fail closed.

Co-authored-by: ned <ned@devantler.tech>
---
 .../scripts/product-value-contract.test.sh    | 20 ++++++++++++++++++-
 .claude/skills/products/monorepo/SKILL.md     |  4 ++--
 2 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/.claude/scripts/product-value-contract.test.sh b/.claude/scripts/product-value-contract.test.sh
index 7e73c844..5a760200 100755
--- a/.claude/scripts/product-value-contract.test.sh
+++ b/.claude/scripts/product-value-contract.test.sh
@@ -129,7 +129,18 @@ grep -Fq '      - changes' "${workflow}" ||
 grep -Fq '${{ needs.changes.result }}' "${workflow}" ||
   fail "required aggregate does not evaluate path-detection failures"
 
-# Monorepo product-card label allowlist (#2260) — must match live taxonomy names.
+# Monorepo product-card label allowlist (#2260) — every backticked name must be a
+# live taxonomy label. Pin the expected set hermetically (no network); refresh
+# from `gh label list -R devantler-tech/monorepo` when the live taxonomy changes.
+# shellcheck disable=SC2034 # referenced by name in the associative-array check below
+declare -A LIVE_MONOREPO_LABELS=(
+  [automation]=1 [blocked]=1 ["breaking change"]=1 [bug]=1 [dependencies]=1
+  [documentation]=1 [duplicate]=1 [enhancement]=1 [github_actions]=1
+  ["good first issue"]=1 ["help wanted"]=1 [javascript]=1
+  ["needs investigation"]=1 ["needs triage"]=1 [next]=1 ["off topic"]=1
+  [performance]=1 [question]=1 [refactor]=1 [released]=1 [repo-assist]=1
+  [roadmap]=1 [security]=1 [spam]=1 [submodules]=1 [wontfix]=1
+)
 labels_line="$(grep -E '^\- \*\*Labels\*\*' "${site_card}" || true)"
 [[ -n "${labels_line}" ]] || fail "site card missing Labels allowlist line"
 grep -Fq '`github_actions`' <<<"${labels_line}" ||
@@ -142,6 +153,13 @@ fi
 if grep -Fq '`agentic-workflows`' <<<"${labels_line}"; then
   fail "site card Labels allowlist still lists nonexistent agentic-workflows (#2260)"
 fi
+# Parse every `label` token — misspellings like `github-action` must fail (#2488 P2).
+while IFS= read -r label; do
+  [[ -n "${label}" ]] || continue
+  if [[ -z "${LIVE_MONOREPO_LABELS[${label}]+x}" ]]; then
+    fail "site card Labels allowlist lists nonexistent '${label}' (#2260/#2488)"
+  fi
+done < <(grep -oE '`[^`]+`' <<<"${labels_line}" | tr -d '`')
 
 # Egress mention neutralisation (#2312) — bots parse raw text; backticks do not inert a mention.
 grep -Fq 'No Markdown construct hides a mention from a bot' "${contract}" ||
diff --git a/.claude/skills/products/monorepo/SKILL.md b/.claude/skills/products/monorepo/SKILL.md
index e12f911c..c1ca927d 100644
--- a/.claude/skills/products/monorepo/SKILL.md
+++ b/.claude/skills/products/monorepo/SKILL.md
@@ -25,8 +25,8 @@ material refreshes. Validate with the `docs` build before any PR.
 - **Labels** (apply only from this set): `automation`, `documentation`, `github_actions`, `dependencies`, `submodules`, `bug`, `enhancement`, `question`, `duplicate`, `wontfix`, `needs triage`, `needs investigation`, `performance`, `refactor`, `security`, `repo-assist`, `roadmap`, `good first issue`, `help wanted`, `spam`, `blocked`, `next`.
   Live taxonomy is the verification source (`gh label list -R devantler-tech/monorepo`); the allowlist
   above must stay a subset of it — never invent label names. Contract self-test:
-  `.claude/scripts/product-value-contract.test.sh` pins `github_actions` present and rejects the
-  retired `ci` / `agentic-workflows` entries.
+  `.claude/scripts/product-value-contract.test.sh` parses every backticked allowlist label against a
+  pinned live-taxonomy set (and still rejects the retired `ci` / `agentic-workflows` entries).
 
 ## Task menu (1–3 highest-value; Content Review gated to Mondays; Blog Stewardship low priority)
 - **A. CI Doctor:** `gh run list --repo devantler-tech/monorepo --status failure --limit 20 ...` (active workflows **CI** + **Publish - Pages**; ignore removed gh-aw workflows & Dependabot's submodule-update job). Dedupe vs native memory's CI-investigation cache (`caches.md`). `gh run view <id> --log-failed` (untrusted); root-cause (bad MDX/frontmatter, broken imports, `npm ci` lockfile desync, Node/Sharp, dead submodule ref, broken YAML). Failure on an open PR → one root-cause comment (+ draft fix if confident); else record it in native memory (`caches.md`). Prune cache >7d.