paperclip-docs/PENDING.md

Pending — nightly cumulative manifest

Regenerated by /sync-docs every nightly run. Cumulative from base_release_tag.

• Base release tag: v2026.525.0
• Parent window: v2026.525.0 → parent master HEAD 911a1e8, effective cutoff 524e18b (24h quarantine)
• Commits in window: 9 effective (5 commits in quarantine, deferred to next run)
• Doc-relevant manifest entries: 3 new this run (3 prior-run entries re-derived by cumulative diff, already applied)
• Drift candidates: 0 (check-drift.mjs against master)
• Reconciliation candidates: 0 (cumulative base is the release tag; all entries are net-new or already applied)
• Genuine new dirs (rename-checked): none

Auto-merge

None. No .env.example / config / env-schema changes in the window — the env-vars watcher matched nothing.

Already applied (prior run, commit 51b9fe3)

These re-appear in the cumulative diff but are already documented; not re-edited this run.

1. Resource memberships — join/leave projects & agents (#6677)
2. Document annotations & comments (#6733)
3. Bundled plugins in plugin manager (#6734)

PR-tier — applied this run

1. Skills CLI command group (#6782)

• Watcher: cli-commands
• Parent files: cli/src/index.ts (registerSkillsCommands(program)); cli/src/commands/client/skills.ts (new).
• Change kind: added — new paperclipai skills command tree.
• Surface: skills browse|search|inspect|install|list|show|file|import|create|scan-projects|check|update|audit|reset|remove plus the skills agent list|sync|clear subgroup.
• Docs targets: docs/reference/cli/control-plane-commands.md (new "Skills Commands" workflow section); docs/reference/cli/commands.md (full skills subcommand + flag reference).
• Evidence: All command names, arguments, flags, and defaults (e.g. --path default SKILL.md, --kind bundled|optional) copied verbatim from skills.ts.

2. App-shipped skills catalog + lifecycle (#6782)

• Watcher: rest-routes, agent-skills, schemas, server-services
• Parent files: server/src/routes/company-skills.ts (new catalog + lifecycle routes); server/src/services/skills-catalog.ts (new); packages/skills-catalog/** (new package: bundled + optional SKILL.md bundles).
• Change kind: added.
• Docs targets: docs/reference/skills.md (new "App-shipped catalog" section + corrected versioning row); docs/guides/org/skills.md (friendly "install a ready-made skill" subsection).
• Evidence: Browse routes (auth-only, NOT company-scoped) GET /api/skills/catalog, /api/skills/catalog/{catalogId}, /api/skills/catalog/{catalogId}/files; lifecycle routes (company-scoped) POST .../skills/install-catalog ({ catalogSkillId, slug?, force? }), .../skills/:skillId/audit, .../install-update, .../reset. CatalogSkillKind = bundled | optional; sourceKind: catalog. Soft holds (local mods, force-overridable) vs hard-stop audit findings.

3. Private browser first-admin claim (#6755)

• Watcher: rest-routes, server-services
• Parent files: server/src/routes/access.ts (new /bootstrap/claim route); server/src/first-admin-claim.ts (new).
• Change kind: added.
• Docs targets: docs/reference/api/instance-admin.md ("Claim first instance admin" section); docs/guides/getting-started/installation.md (note under the private/Tailscale variation).
• Evidence: POST /api/bootstrap/claim — gated to deploymentMode = authenticated + deploymentExposure = private (else 404); requires signed-in browser session (else 401); promotes first signed-in user to instance_admin atomically; 409 if already claimed; success { claimed: true, userId }.

Considered, not documented

• Accepted-plan decomposition exact-once guards (#6831) — internal reliability/correctness guard with UI state; no user-facing surface to document.
• CI runner Chrome for headless workflows (#6967, 524e18b0) — CI-only; not product-facing.

⚠ Drift

None.

↻ Renames detected

None.

In quarantine (deferred to next run, <24h old at run time)

1f70fd9a workspace finalize gates + no-remote-git enforcement (PAPA-430) · 5153b01a Claude model refresh · 8014445b v2026.529.0 release changelog · aea35fe6 exe.dev config UX · 911a1e8b continuation recovery retry streaks