weekly sync — 2026-05-11

[norbert-pap]

Applied changes (3)

1. Anti-shortcut clause → eng-review/SKILL.md

Source: garrytan/gstack v1.27.1.0 (commit 7b4738b, 2026-05-06)

The May-2026 transcript bug: a model in plan-review mode explores the codebase, finds multiple issues, then writes them all into a single prose block and exits — without ever calling AskUserQuestion once. The user sees a report, not an interactive review. The anti-shortcut clause makes the correct path explicit:

If you have ANY non-trivial finding in any review section, the path from finding to completion goes THROUGH AskUserQuestion. Zero findings in every section is the only path that bypasses AskUserQuestion. If you find yourself wanting to summarize all findings at once before asking, stop and call AskUserQuestion now — that's the bug, recognize it.

Inserted immediately before ## CRITICAL RULE — How to ask questions in both files. Adapted from upstream by dropping ExitPlanMode references (claudebert has no plan-mode preamble); core safety language retained.

---

2. Anti-shortcut clause → prod-review/SKILL.md

Source: garrytan/gstack v1.27.1.0 (commit 7b4738b, 2026-05-06)

Same fix as above, applied to prod-review (maps to gstack's plan-ceo-review). Inserted before ## CRITICAL RULE — How to ask questions.

---

3. Browse: Headed Mode + Proxy + Anti-Bot Sites → browse/SKILL.md

Source: garrytan/gstack v1.28.0.0 (commit 443bde0, 2026-05-07)

New section documenting the --headed and --proxy flags added to the browse daemon in this release:

• --headed: visible Chromium window, auto-spawns Xvfb on Linux containers without DISPLAY
• --proxy socks5://user:pass@host:port: SOCKS5 with auth via local 127.0.0.1 bridge (Chromium can't prompt for SOCKS5 creds natively)
• --proxy http://...: HTTP/HTTPS proxy (passes through to Chromium directly)
• Credential policy: URL OR env vars BROWSE_PROXY_USER/BROWSE_PROXY_PASS, never both
• Daemon discipline: --proxy/--headed apply only to fresh daemon; mismatched config → exit 1 with browse disconnect hint
• Stealth: masks navigator.webdriver only (no fake plugins/languages — those can flag more bot-like)
• Container: Xvfb auto-spawn with PID-reuse-safe cleanup
• Failure modes: 3-retry SOCKS5 startup, no mid-stream transport retries

Inserted before ## Snapshot Flags. The --navigate flag from the same upstream commit was already present in claudebert's browse SKILL.md, confirming the binary is in sync.

---

Deferred / noted (6)

Source	What	Why deferred
garrytan/gstack v1.26.4 (19e699a)	GSTACK REVIEW REPORT delete-then-append flow fix	claudebert's eng-review and prod-review have no GSTACK REVIEW REPORT section — not applicable
garrytan/gstack v1.31.0 (5d4fe7d)	Delete AskUserQuestion "Decisions to confirm" fallback from plan-* skills	claudebert already lacks the fallback language that was deleted — not applicable
addyosmani/agent-skills (0af1a5e)	New skill: doubt-driven-development (5-step adversarial in-flight review cycle)	Interesting concept (CLAIM→EXTRACT→DOUBT→RECONCILE→STOP) but not in claudebert's pipeline gap categories; would require a new skill directory, not a cherry-pick
anthropics/skills (d211d43)	claude-api skill: Managed Agents outcomes, multiagent patterns, webhooks	API feature docs, not review pipeline
VoltAgent/awesome-agent-skills	New skills: xquik, honeydew-ai	Company-specific tool integrations, not filling pipeline gaps
Owl-Listener/designpowers (e9448b3)	terminal-starter-guide-for-designers.md	Designer terminal onboarding guide; no cognitive/a11y/motion/tokens pattern applicable to design-review

---

Sources checked: 6 (garrytan/gstack, addyosmani/agent-skills, anthropics/skills, VoltAgent/awesome-agent-skills, rohitg00/awesome-claude-code-toolkit, Owl-Listener/designpowers)
Since: 2026-05-04 (no prior .sync-state.json — used 7-day default)

https://claude.ai/code/session_01Xtvrif2KgKW6C8Qb2kcTGB

---

Generated by Claude Code