aaronjmars · Nov 2, 2026 · Nov 2, 2026
diff --git a/.claude/skills/aeon/SKILL.md b/.claude/skills/aeon/SKILL.md
@@ -244,7 +244,7 @@ metadata:
 Today is ${today}. <the prompt - plain instructions, including judgment calls>
 
 ## Steps
-1. <the procedure - 52 of 86 skills carry this section>
+1. <the procedure - 52 of 87 skills carry this section>
 
 ## Network note
 <curl / WebFetch / `./secretcurl` / `gh api` - how this skill fetches>
@@ -304,9 +304,9 @@ Three at a time, not twelve. Every enabled skill is a recurring notification, an
 ./aeon packs ls                  # the six first-party packs
 ```
 
-`ls` footers with `86 skills · 1 enabled` - read it to them before proposing anything. First run installs the CLI runtime (tsx + yaml, ~12MB); the npm noise is one-time and expected. Grep-only equivalents: `references/layout.md`.
+`ls` footers with `87 skills · 1 enabled` - read it to them before proposing anything. First run installs the CLI runtime (tsx + yaml, ~12MB); the npm noise is one-time and expected. Grep-only equivalents: `references/layout.md`.
 
-Packs are a visibility filter, not a runtime switch - revealing one runs nothing. Core (12), Evolution (9) and Basics (18) show by default; Dev (17), Crypto (19) and Productivity (11) are on demand.
+Packs are a visibility filter, not a runtime switch - revealing one runs nothing. Core (12), Evolution (9) and Basics (18) show by default; Dev (18), Crypto (19) and Productivity (11) are on demand.
 
 Reasonable starting sets:
 

diff --git a/.claude/skills/aeon/references/layout.md b/.claude/skills/aeon/references/layout.md
@@ -12,7 +12,7 @@ Where everything lives in an Aeon repo, and the fastest way to see what's on.
 ./aeon skills ls --enabled --json # for building the Mode 2 timeline
 ```
 
-`ls` prints `SKILL / ON / SCHEDULE / PACK / DESCRIPTION` and a footer - `86 skills · 1 enabled`. First run installs the CLI runtime (tsx + yaml, ~12MB, one-time); the noise is expected.
+`ls` prints `SKILL / ON / SCHEDULE / PACK / DESCRIPTION` and a footer - `87 skills · 1 enabled`. First run installs the CLI runtime (tsx + yaml, ~12MB, one-time); the noise is expected.
 
 **The `SCHEDULE` column is populated for disabled skills too** - it's their `aeon.yml` entry, not proof anything fires. Only the `●` in `ON` means it runs.
 
@@ -59,7 +59,7 @@ AGENTS.md          GENERATED from CLAUDE.md (STRATEGY.md inlined) for every non-
                    harness. Never hand-edit; run `node scripts/gen-agents-md.js`
                    (gated by ci-agents-md).
 
-skills/<name>/SKILL.md    the skills themselves - 86 upstream. One prompt per file.
+skills/<name>/SKILL.md    the skills themselves - 87 upstream. One prompt per file.
 soul/              SOUL.md + STYLE.md + examples/ - voice, read on every run (Mode 7).
 memory/            durable state between runs:
   logs/<date>.md     per-run append under `### <skill-name>`. The dedup substrate.

diff --git a/.claude/skills/aeon/references/mcp.md b/.claude/skills/aeon/references/mcp.md
@@ -7,7 +7,7 @@ Three things share the name. Get this wrong and nothing works.
 | | |
 |---|---|
 | **`.mcp.json`** - *external MCP servers, called BY Aeon skills* | Wired via the dashboard MCP panel or `./aeon mcp add`. This is what you want when a skill needs a tool. |
-| **`bin/add-mcp`** - *Aeon itself AS an MCP server* | Builds `apps/mcp-server` and registers it with Claude Code / Desktop, so all 86 skills appear as `aeon-*` tools **in your local Claude**. Nothing to do with a skill calling out. |
+| **`bin/add-mcp`** - *Aeon itself AS an MCP server* | Builds `apps/mcp-server` and registers it with Claude Code / Desktop, so all 87 skills appear as `aeon-*` tools **in your local Claude**. Nothing to do with a skill calling out. |
 | **`www.aeon.fun/connect/mcp`** - *your Aeon as a HOSTED MCP server* | Aeon Connect's remote server: sign in with GitHub, pick your agent repo, then run skills (on your GitHub Actions), read runs, output and memory, and toggle skills **from ChatGPT, Claude or any MCP client**. Nothing to install, no keys in chat. Claude Code: `claude mcp add --transport http aeon https://www.aeon.fun/connect/mcp`. |
 
 The rest of this doc is the first one. For the second: `bin/add-mcp`, `--desktop` for a Claude Desktop snippet, `--uninstall` to remove, `claude mcp list` to verify. For the third: add the URL as a custom connector (ChatGPT, Claude) or with the command above, then sign in when asked.

diff --git a/.claude/skills/aeon/references/skill-anatomy.md b/.claude/skills/aeon/references/skill-anatomy.md
@@ -1,10 +1,10 @@
 # How Aeon skills are actually written
 
-Surveyed across all 86 skills in `aeonfun/aeon`. Frequencies are real counts - match the dominant convention unless there's a reason not to. Bodies run 14-1228 lines (~221 median); a skill is a prompt, not a config file, and reads as prose.
+Surveyed across all 87 skills in `aeonfun/aeon`. Frequencies are real counts - match the dominant convention unless there's a reason not to. Bodies run 14-1228 lines (~221 median); a skill is a prompt, not a config file, and reads as prose.
 
 ## Frontmatter
 
-Near-universal - **all 86 skills** carry `name`, `description`, `category`, and `tags`; 78 also carry `title` (the other 8 fall back to the slug):
+Near-universal - **all 87 skills** carry `name`, `description`, `category`, and `tags`; 79 also carry `title` (the other 8 fall back to the slug):
 
 ```yaml
 name: my-skill       # the slug (matches the skills/<slug>/ directory)
@@ -115,7 +115,7 @@ There is **no network sandbox** - plain `curl` works for unauthenticated GETs.
 
 `memory/` is the durable state that survives between runs. Four conventions, in order of how often skills touch them:
 
-### `memory/logs/${today}.md` - the run log (70 of 86 skills)
+### `memory/logs/${today}.md` - the run log (70 of 87 skills)
 
 Every skill appends what it did, under **one** heading that is exactly its slug:
 

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -261,9 +261,37 @@ from or pin to; the template keeps serving the latest `main` to new forks.
   invariant scan selectable alongside the legacy scanner, with a shadow mode that runs
   it side by side for comparison before switching over. It merged just after the prior
   sync window but is numbered below that watermark, so it is reconciled here. (#1039)
+- **New `github-filing-registry` skill (Dev & Code).** A persistent JSON ledger of every
+  issue and PR filed against upstream repos - status, evidence, next action and history -
+  so a run never files the same thing twice or loses track of what it filed. Pure shell +
+  `gh` CLI with add, status, triage, sync and log subcommands; concurrent writes are
+  flock-serialized and ids canonicalize to `owner/repo#number`. Catalog now 87 skills. (#1294)
+- **Lazybrief and Vauban community packs listed.** Lazybrief (`NurstarK/lazybrief`) turns an
+  overnight dump of links, notes and todos into a five-line morning brief via a local Gemma
+  on Ollama - local or self-hosted runs only, no secrets. Vauban (`vaubandev/vauban`,
+  `--path aeon`) reads one Vauban vault's spending policy on Robinhood Chain (4663):
+  owner, agent, freeze, allowlist, hourly and daily caps, and held moves; keyless and
+  read-only, `watch:0xVAULT` reports only what changed. (#1273, #1292)
+- **`sc-audit` documents standalone use in Claude Code.** A new `skills/sc-audit/README.md`
+  covers install (copy `sc-audit` + `vuln-scanner` into `.claude/skills/`), running without
+  `./secretcurl` or `./notify`, and a per-step table of what works outside an Aeon
+  instance, verified on a headless run that found the planted critical bug. (#1285)
 
 ### Changed
 
+- **Sentinel Pack listing catches up with its eight skills,** adding
+  `hook-registry-check`: it reads every address in `aeonfun/univ4-hooks` on its own
+  chain and reports when a listed address has no code, its flag bits do not match, or
+  the same hook exposes different functions on different chains. Read-only and keyless.
+  (#1287)
+- **Ecosystem page refreshed.** 18 rows with no public Aeon tie or a dead project removed
+  and the AgentLink link fixed; 26 projects building with Aeon added from X mentions,
+  GitHub forks and community chats; a later cleanup removed 6 of those rows and refreshed
+  two dead X avatar links, leaving 77 rows. The page mirrors `docs/ECOSYSTEM.md` live.
+  (#1274, #1288, #1289, #1290, #1291, #1293)
+- **Setup skill counts follow the catalog to 87** (`86` -> `87` in `SKILL.md`, `layout.md`,
+  `mcp.md` and the `skill-anatomy.md` survey, incl. `title` 78 -> 79 and the Dev pack
+  17 -> 18). Plugin copy kept in lockstep. (docs-sync)
 - **Sentinel Pack listing catches up with its six monitoring skills:** address diffs,
   Aeon v4 hook usage, Pons launch lookalikes, token checks, repeat deployers and graduations
   to locked v4 pools. The later seventh skill is recorded above. (#1269)
@@ -419,6 +447,10 @@ from or pin to; the template keeps serving the latest `main` to new forks.
 
 ### Fixed
 
+- **`validate-pack` finds a `--path` pack's LICENSE next to its manifest.** Packs that
+  keep `LICENSE` in their own folder (e.g. `vaubandev/vauban --path aeon`) no longer get
+  a false "no LICENSE file at pack root" warning; the repo root is still the fallback.
+  (#1301)
 - **`aeon-update` keeps its new baseline off main until its PR merges.** Branch-only
   state no longer leaks onto main after a stash conflict, logs and output stay out of the
   sync commit, and an open sync PR prevents a duplicate. The plan/apply helper described
@@ -1358,6 +1390,12 @@ from or pin to; the template keeps serving the latest `main` to new forks.
 
 ### Security
 
+- **`vuln-scanner` tooling is pinned and staged, not downloaded in-run.** The skill used
+  to fetch osv-scanner from `releases/latest` mid-run with no version pin or checksum,
+  in a run where `GH_GLOBAL` and the Resend keys are in the environment; the staging
+  script installed trufflehog by piping its main-branch `install.sh` into `sh`.
+  `scripts/stage-vuln-scanner.sh` now installs osv-scanner v2.7.0 and trufflehog v3.99.7
+  ahead of the run and the skill drops the in-run download. (#1286)
 - **Run guards after a skill run.** On main, changes a run made under `scripts/`, `.github/` or
   `harness-adapter/` are restored to a freshly fetched `main` with an `::error::`; feature-branch
   PR flows are unaffected. Push helpers run from the starting commit with hooks off, and a new
@@ -1426,6 +1464,10 @@ from or pin to; the template keeps serving the latest `main` to new forks.
 
 ### Maintenance
 
+- **Maintenance.** Dependabot bundles across the dashboard, webhook, mcp-server and Actions
+  deps, a zod override for Remotion's pinned nested copies (Dependabot alert 68), CI gets
+  concurrency cancellation and job timeouts, and the changelog scorer gets a bounded final
+  result. (#1275, #1282, #1295, #1296, #1302, #1303, #1304)
 - **Maintenance.** The MCP harness test waits for killed children to be reaped, run
   scratch under `output/` and the repo root is ignored, MCP SDK and hono are updated, and
   the dashboard moves to Next 16.4.1. (#1253, #1257, #1263, #1264)

diff --git a/plugin/skills/aeon/SKILL.md b/plugin/skills/aeon/SKILL.md
@@ -244,7 +244,7 @@ metadata:
 Today is ${today}. <the prompt - plain instructions, including judgment calls>
 
 ## Steps
-1. <the procedure - 52 of 86 skills carry this section>
+1. <the procedure - 52 of 87 skills carry this section>
 
 ## Network note
 <curl / WebFetch / `./secretcurl` / `gh api` - how this skill fetches>
@@ -304,9 +304,9 @@ Three at a time, not twelve. Every enabled skill is a recurring notification, an
 ./aeon packs ls                  # the six first-party packs
 ```
 
-`ls` footers with `86 skills · 1 enabled` - read it to them before proposing anything. First run installs the CLI runtime (tsx + yaml, ~12MB); the npm noise is one-time and expected. Grep-only equivalents: `references/layout.md`.
+`ls` footers with `87 skills · 1 enabled` - read it to them before proposing anything. First run installs the CLI runtime (tsx + yaml, ~12MB); the npm noise is one-time and expected. Grep-only equivalents: `references/layout.md`.
 
-Packs are a visibility filter, not a runtime switch - revealing one runs nothing. Core (12), Evolution (9) and Basics (18) show by default; Dev (17), Crypto (19) and Productivity (11) are on demand.
+Packs are a visibility filter, not a runtime switch - revealing one runs nothing. Core (12), Evolution (9) and Basics (18) show by default; Dev (18), Crypto (19) and Productivity (11) are on demand.
 
 Reasonable starting sets:
 

diff --git a/plugin/skills/aeon/references/layout.md b/plugin/skills/aeon/references/layout.md
@@ -12,7 +12,7 @@ Where everything lives in an Aeon repo, and the fastest way to see what's on.
 ./aeon skills ls --enabled --json # for building the Mode 2 timeline
 ```
 
-`ls` prints `SKILL / ON / SCHEDULE / PACK / DESCRIPTION` and a footer - `86 skills · 1 enabled`. First run installs the CLI runtime (tsx + yaml, ~12MB, one-time); the noise is expected.
+`ls` prints `SKILL / ON / SCHEDULE / PACK / DESCRIPTION` and a footer - `87 skills · 1 enabled`. First run installs the CLI runtime (tsx + yaml, ~12MB, one-time); the noise is expected.
 
 **The `SCHEDULE` column is populated for disabled skills too** - it's their `aeon.yml` entry, not proof anything fires. Only the `●` in `ON` means it runs.
 
@@ -59,7 +59,7 @@ AGENTS.md          GENERATED from CLAUDE.md (STRATEGY.md inlined) for every non-
                    harness. Never hand-edit; run `node scripts/gen-agents-md.js`
                    (gated by ci-agents-md).
 
-skills/<name>/SKILL.md    the skills themselves - 86 upstream. One prompt per file.
+skills/<name>/SKILL.md    the skills themselves - 87 upstream. One prompt per file.
 soul/              SOUL.md + STYLE.md + examples/ - voice, read on every run (Mode 7).
 memory/            durable state between runs:
   logs/<date>.md     per-run append under `### <skill-name>`. The dedup substrate.

diff --git a/plugin/skills/aeon/references/mcp.md b/plugin/skills/aeon/references/mcp.md
@@ -7,7 +7,7 @@ Three things share the name. Get this wrong and nothing works.
 | | |
 |---|---|
 | **`.mcp.json`** - *external MCP servers, called BY Aeon skills* | Wired via the dashboard MCP panel or `./aeon mcp add`. This is what you want when a skill needs a tool. |
-| **`bin/add-mcp`** - *Aeon itself AS an MCP server* | Builds `apps/mcp-server` and registers it with Claude Code / Desktop, so all 86 skills appear as `aeon-*` tools **in your local Claude**. Nothing to do with a skill calling out. |
+| **`bin/add-mcp`** - *Aeon itself AS an MCP server* | Builds `apps/mcp-server` and registers it with Claude Code / Desktop, so all 87 skills appear as `aeon-*` tools **in your local Claude**. Nothing to do with a skill calling out. |
 | **`www.aeon.fun/connect/mcp`** - *your Aeon as a HOSTED MCP server* | Aeon Connect's remote server: sign in with GitHub, pick your agent repo, then run skills (on your GitHub Actions), read runs, output and memory, and toggle skills **from ChatGPT, Claude or any MCP client**. Nothing to install, no keys in chat. Claude Code: `claude mcp add --transport http aeon https://www.aeon.fun/connect/mcp`. |
 
 The rest of this doc is the first one. For the second: `bin/add-mcp`, `--desktop` for a Claude Desktop snippet, `--uninstall` to remove, `claude mcp list` to verify. For the third: add the URL as a custom connector (ChatGPT, Claude) or with the command above, then sign in when asked.

diff --git a/plugin/skills/aeon/references/skill-anatomy.md b/plugin/skills/aeon/references/skill-anatomy.md
@@ -1,10 +1,10 @@
 # How Aeon skills are actually written
 
-Surveyed across all 86 skills in `aeonfun/aeon`. Frequencies are real counts - match the dominant convention unless there's a reason not to. Bodies run 14-1228 lines (~221 median); a skill is a prompt, not a config file, and reads as prose.
+Surveyed across all 87 skills in `aeonfun/aeon`. Frequencies are real counts - match the dominant convention unless there's a reason not to. Bodies run 14-1228 lines (~221 median); a skill is a prompt, not a config file, and reads as prose.
 
 ## Frontmatter
 
-Near-universal - **all 86 skills** carry `name`, `description`, `category`, and `tags`; 78 also carry `title` (the other 8 fall back to the slug):
+Near-universal - **all 87 skills** carry `name`, `description`, `category`, and `tags`; 79 also carry `title` (the other 8 fall back to the slug):
 
 ```yaml
 name: my-skill       # the slug (matches the skills/<slug>/ directory)
@@ -115,7 +115,7 @@ There is **no network sandbox** - plain `curl` works for unauthenticated GETs.
 
 `memory/` is the durable state that survives between runs. Four conventions, in order of how often skills touch them:
 
-### `memory/logs/${today}.md` - the run log (70 of 86 skills)
+### `memory/logs/${today}.md` - the run log (70 of 87 skills)
 
 Every skill appends what it did, under **one** heading that is exactly its slug: