Session Handoff [default]: HomeAutomation-Config Audit Report Promoted and Released as 2.0.667 #1788

Promoted the HomeAutomation-Config release-model audit report to main via #1784, with three corrections to it that Copilot raised on the promotion (#1785, #1786, #1787), and released 2.0.667. The report itself (#1781) came from a parallel HomeAutomation-Config session, which also filed #1783.

Next steps, in priority order

Re-read each issue and pull request rather than trusting these summaries.

1. Verify bootstrap.ps1 on native Windows, then close Bootstrap registers its temporary tree as the live Claude Code skills source, then deletes it #1756. Unchanged from Session Handoff [default]: ESPHome-Config Build Profile and Kept Skills Tree Released as 2.0.663 #1782. Done looks like bootstrap.ps1 -Skills on a Windows host leaving %LOCALAPPDATA%\host-setup\skills-tree, with skills_install.py --report naming it under live.checkout, and a second run replacing it. Needs a Windows host.
2. Work the Bootstrap registers its temporary tree as the live Claude Code skills source, then deletes it #1756 follow-ups. Start with Bootstrap kept-tree rollback can leave no tree, and a hand-run report mislabels its commit #1770, whose comments are the spec. Then The menu's skills task registers a clone it then removes #1771, then Re-point a Claude Code registration an older bootstrap left dangling #1769. Re-point a Claude Code registration an older bootstrap left dangling #1769 needs claude plugin marketplace remove's real behavior confirmed before any design.
3. Spec: python.profile.detect does not describe a virtual uv workspace root #1778: the spec's python.profile.detect doesn't describe a virtual uv workspace root. Done looks like the assert treating a workspace root whose members carry [project] as the build shape.
4. Declare the Default Workflow Token Permission in the Repository Settings Payload #1783: declare the default workflow token permission in repo-config/settings.json, so configure.sh check sees it. Filed this round by the HomeAutomation-Config session, and the audit report's escalation now points at it.
5. Carried from Session Handoff [default]: ESPHome-Config Build Profile and Kept Skills Tree Released as 2.0.663 #1782, unchanged: A regex pins a phrase inside a # comment, so rewrapping that comment fails the test with a false explanation #1732, then the skills_install.py follow-ups skills_install --report follow-ups: stamp-less live report, bootstrap remedy text, --intended guard test #1759, skills_install source_ref hides ignored files and trusts an enclosing git repo #1758, skills_install --report's live channel does not check that the plugin is installed and enabled #1757, then the stacked-PR decision A stacked pull request's diff reopens after the parent squash-merges, and nothing documents it #1742, Financial-Modeling's hub workflow pins (Session Handoff [default]: One Issue Closed Whose Premise Was Wrong, and a Release #1735), Converge Financial-Modeling with the hub baseline (32 findings) #1579, The widened configuration shape misses the unspaced key=value an environment file writes #1717, issue-ref reads no URL outside instruction text, so an own-repository tracker URL in code is banned and unreported #1719. Lower: Two skills describe the live skills channel only as a git checkout #1772, A kept skills tree edited by hand still stamps clean #1775, Nothing tests the bootstrap loaders' kept-tree swap sequence #1767, Two concurrent bootstrap runs can remove each other's tree #1764, install-skills.ps1 fails under a directory whose path contains a wildcard character #1765.

External blockers

• A native Windows host is needed for step 1, skills_install.py runs a bare claude argv, which may miss a Windows .cmd shim #1754, and install-skills.ps1 fails under a directory whose path contains a wildcard character #1765.
• CodeRabbit never auto-reviews this repository, and needs an explicit @coderabbitai review. This round it was also rate-limited for about an hour after three requests close together. It reviewed only Promote the HomeAutomation-Config Release-Model Audit Report to Main #1784's first head, and none of the three fix PRs.
• Private-repo Dependabot still needs the maintainer's Check for Updates click, carried from Session Handoff [default]: #1739's Two-Channel Skills Report Released as 2.0.661, and #1756 Is Decided #1761.

Internal dependencies

• Re-point a Claude Code registration an older bootstrap left dangling #1769 before skills_install --report follow-ups: stamp-less live report, bootstrap remedy text, --intended guard test #1759's remedy text. The "--host or --skills lands it" wording is only true once a stale registration can be repaired.
• Bootstrap kept-tree rollback can leave no tree, and a hand-run report mislabels its commit #1770's marker-order fix before Nothing tests the bootstrap loaders' kept-tree swap sequence #1767's test. The test should pin the corrected order.
• skills_install source_ref hides ignored files and trusts an enclosing git repo #1758's stampVersion decision comes before any other change to the stamp's shape.

State

Re-derive each of these at resume.

• Hub: main is at Promote the HomeAutomation-Config Release-Model Audit Report to Main #1784's merge commit, released as 2.0.667. develop has nothing that isn't on main.
• Worktrees: this round's three fix worktrees and their branches were removed, locally and on the remote. The base clone is clean on develop. Four detached *-resync worktrees predate this round and belong to other work.
• This machine's Skills were refreshed from the promoted main, and --report read current.
• HomeAutomation-Config: its own session ran the resync and audit, and it keeps its own handoff chain there. Its residual deltas are tracked in that repository.
• Backlog, read with an explicit page size: 313 open hub issues, excluding the handoff label.

The parked decision queue

Empty. No open issue carries the decision label. This session put these questions to the maintainer and recorded each answer:

1. Which PR to drive, given that Re-Audit HomeAutomation-Config on the Release Model #1781 looked like another session's work: take it over. That session merged it into develop moments later.
2. Whether to open the promotion PR while the other session was live: yes. I told that session, which confirmed it would make no more hub writes.
3. Promote the HomeAutomation-Config Release-Model Audit Report to Main #1784 ready, with CodeRabbit covering only its first head: merge and release.

What the last round did

• Opened Promote the HomeAutomation-Config Release-Model Audit Report to Main #1784 (develop -> main). It carried Re-Audit HomeAutomation-Config on the Release Model #1781 plus three fix PRs, each merged to develop after a clean Copilot round and a recorded local review pass:
  • Point the HomeAutomation-Config Audit's Escalation at Its Issue #1785 points the report's escalation at Declare the Default Workflow Token Permission in the Repository Settings Payload #1783.
  • Qualify the Hub Promotion Reference in the HomeAutomation-Config Audit #1786 qualifies "promoted in Promote the HomeAutomation-Config Release Reclassification to Main #1768" as a hub reference.
  • Say What the HomeAutomation-Config Intent Advisories Measure #1787 corrects the report's account of the intent advisories.
• Merged Promote the HomeAutomation-Config Release-Model Audit Report to Main #1784 and released 2.0.667. Refreshed this machine's Skills.

What not to repeat

• Fetch before git worktree add ... origin/develop. One fix worktree was branched from a stale origin/develop, one merge behind, and needed a rebase before its first push.
• Don't treat an audit report as settled because its first review was clean. Copilot raised a new previously-missed prose finding on each of three consecutive heads of Promote the HomeAutomation-Config Release-Model Audit Report to Main #1784, all on text the promotion didn't change. Budget a round per such finding when promoting a report.

New learnings

• The intent-staleness advisory measures a file against its intentRef document, not the hub's copy of the file (intent_canonical_rel in spec/audit.py). A config file byte-identical to the hub's own copy is still flagged, and the identity skip can never fire for it. That is hub An intent finding verified satisfied cannot be cleared, so a correct resync can never produce a clean run #727's mechanism, now stated in reports/homeautomation-config/audit.md.