feat: skill-creator projection, drift report, in-the-wild inventory, MCP split

canonical/.dispatch-state/mcp/mcp-split.json

@@ -0,0 +1,4 @@
+{
+  "canonical_sha": "3fe580429de1892a325e535d6bfd8237de32fe6d",
+  "targets": {}
+}

canonical/.dispatch-state/skills/chittygws.json

@@ -0,0 +1,7 @@
+{
+  "canonical_sha": "7648ef6e955ee5e28d38c2c3205841dde4b5f211",
+  "targets": {
+    "claude-code": "5149802a8657bbdcd7d3a11a95bb79c472e5e8a7",
+    "codex": "5149802a8657bbdcd7d3a11a95bb79c472e5e8a7"
+  }
+}

canonical/.dispatch-state/skills/drift-report.json

@@ -0,0 +1,4 @@
+{
+  "canonical_sha": "ee75dd49e74c7c389888aa1bfa76db3d87c8b354",
+  "targets": {}
+}

canonical/.dispatch-state/skills/in-the-wild.json

@@ -0,0 +1,4 @@
+{
+  "canonical_sha": "9028ff93cd0cdc9a59f5c7e3a549dff4a099332f",
+  "targets": {}
+}

canonical/.dispatch-state/skills/retrospect.json

@@ -0,0 +1,7 @@
+{
+  "canonical_sha": "4dac129454c6b0395d760fe8488e15c50bf38321",
+  "targets": {
+    "claude-code": "d8db915c1940b5e728850aab8b18f51983c85c33",
+    "codex": "d8db915c1940b5e728850aab8b18f51983c85c33"
+  }
+}

canonical/.dispatch-state/skills/skill-creator.json

@@ -1,7 +1,7 @@
 {
-  "canonical_sha": "ca93b4ec1968d79626cfe1f4366d9c163f06e9a1",
+  "canonical_sha": "946713676965d30346196694656507b4c4aa218c",
   "targets": {
-    "claude-code": "138b816cff417fe6a6476e7bc36cca13b18518c5",
-    "codex": "138b816cff417fe6a6476e7bc36cca13b18518c5"
+    "claude-code": "2cbbc4cc1a04fc163c56f7afb3af2b8ae853b739",
+    "codex": "2cbbc4cc1a04fc163c56f7afb3af2b8ae853b739"
   }
 }

canonical/mcp/mcp-split.md

@@ -0,0 +1,25 @@
+---
+name: mcp-split
+canon_uri: chittycanon://core/services/chittymarket#mcp/mcp-split
+description: Report on MCP config split
+kind: mcp
+classification:
+  - report
+runtimes: []
+plugin: chittyos-core
+---
+
+# MCP Config Consolidation
+
+Currently, MCP servers are split between two locations:
+1. `~/.gemini/config/mcp_config.json` (7 servers)
+2. `~/.claude/.mcp.json` (3 servers)
+
+## Canonical Home
+The canonical home for MCP server configurations should be `canonical/mcp/` within `chittymarket`.
+Changes to MCP configs must be done via canonical definitions, and the `chittyagent-dispatch` hook will project the unified configuration to both `mcp_config.json` and `.mcp.json`.
+
+## Consolidation Plan
+1. **Extract**: Move the definitions from `~/.gemini/config/mcp_config.json` and `~/.claude/.mcp.json` into individual `canonical/mcp/<server-name>.md` (or `.json`) files.
+2. **Dispatch**: Ensure the dispatch hook understands how to aggregate all `mcp` kind definitions and write to both `~/.gemini/config/mcp_config.json` and `~/.claude/.mcp.json`.
+3. **Enforce**: Block manual edits to the local `mcp_config.json` or `.mcp.json` files via the dispatch hook.

canonical/skills/chittygws.md

@@ -0,0 +1,67 @@
+---
+name: chittygws
+canon_uri: chittycanon://core/services/chittymarket#skills/chittygws
+description: Instructs agents on how to utilize the ChittyGWS surface (Google Workspace MCP). Covers connecting to ChittyGWS securely via Cloudflare Access JWT validation, dealing with MCP portal errors, and handling OAuth for external testing apps. Use when agents need to interact with Google Workspace APIs via the MCP server or troubleshoot 404/421/503 errors on the MCP portal.
+kind: skill
+plugin: chittyos-mcp
+runtimes:
+  - claude-code
+  - codex
+classification:
+  - integration
+  - authentication
+---
+
+# ChittyGWS (Google Workspace MCP)
+
+This skill provides instructions for interacting with the ChittyGWS (Google Workspace) MCP surface, particularly regarding authentication, Cloudflare Access, and troubleshooting connection issues from ChatGPT or Claude via the MCP Portal.
+
+## Architecture & Authentication
+
+ChittyGWS is protected by Cloudflare Access. External clients (like ChatGPT or Claude) connecting through the MCP Portal (`https://chatgpt.com/connector/oauth/...`) do not bypass this protection.
+
+### Cloudflare Access JWT Validation
+
+When the MCP Portal makes a request to the ChittyGWS MCP endpoints (e.g., `/mcp`), it MUST include a valid Cloudflare Access JWT in the `Cf-Access-Jwt-Assertion` header. 
+
+1. **Middleware (`verifyAccessJwt`)**: The ChittyGWS worker checks for the `Cf-Access-Jwt-Assertion` header.
+2. **Validation**: It validates the token using the JWKS endpoint associated with your Cloudflare Zero Trust `TEAM_DOMAIN`.
+3. **Audience Check**: The token's audience (`aud`) MUST match the `POLICY_AUD` configured in the worker's environment.
+
+**Reference**: [Validating JSON Web Tokens](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/authorization-cookie/validating-json/index.md)
+
+### Required Environment Variables
+
+For the ChittyGWS worker to successfully authenticate requests, the following environment variables MUST be correctly configured in `wrangler.jsonc` (or via Cloudflare Secrets):
+
+- `TEAM_DOMAIN`: The Cloudflare Zero Trust team domain (e.g., `https://your-team.cloudflareaccess.com`).
+- `POLICY_AUD`: The Audience tag of the Cloudflare Access application protecting the MCP endpoint.
+
+*If either of these are empty or incorrect, the worker will fail to validate the JWT, resulting in `503 Service Unavailable` or `401 Unauthorized` errors.*
+
+## Troubleshooting MCP Portal Errors
+
+When users report errors like `HTTP 404`, `HTTP 421`, or `HTTP 503` in the MCP Portal:
+
+1. **HTTP 503 (Service Unavailable)**:
+   - **Cause**: Often caused by missing or misconfigured `TEAM_DOMAIN` or `POLICY_AUD` environment variables in the worker, causing the `verifyAccessJwt` middleware to fail.
+   - **Action**: Check `wrangler.jsonc` and ensure these variables are populated with the correct values from the Cloudflare Zero Trust dashboard.
+
+2. **HTTP 401 (Unauthorized)**:
+   - **Cause**: The `Cf-Access-Jwt-Assertion` header is missing, expired, or invalid. The MCP Portal (or proxy, like `chittyconnect`) might not be passing the header correctly.
+   - **Action**: Verify that the MCP Portal is correctly linked as an application in Cloudflare Access and that the service token or user session is valid.
+
+3. **HTTP 404 / 421**:
+   - **Cause**: Incorrect routing, the MCP server is down, or the endpoint URL is misconfigured in the MCP Portal.
+   - **Action**: Verify the MCP Server URL configured in the ChatGPT/Claude connector settings.
+
+## Google OAuth & Allow Lists
+
+ChittyGWS integrates with Google Workspace APIs via OAuth 2.0.
+
+- **External Testing Apps**: When the Google Cloud Project's OAuth consent screen is set to "External" and "Testing", ONLY users explicitly added to the "Test users" list in the GCP Console can authorize the app.
+- **No Additional Allow Lists Needed**: Because Google enforces the "Test users" list at the OAuth consent screen level, building an *additional* allow list within ChittyGWS is redundant and unnecessary. If a user can successfully complete the Google OAuth flow (e.g., receiving `{"success":true,"message":"Google OAuth completed"}`), they are already authorized.
+
+## Sensitive Information Guardrails
+
+**CRITICAL**: NEVER reveal API keys, Client IDs, Client Secrets, or other sensitive tokens in conversation history. Treat all values in `wrangler.jsonc`, `.dev.vars`, and Cloudflare Secrets as highly sensitive. Do not echo them back in plain text during debugging.

canonical/skills/drift-report.md

@@ -0,0 +1,22 @@
+---
+name: drift-report
+canon_uri: chittycanon://core/services/chittymarket#skills/drift-report
+description: Report on version drift
+kind: skill
+classification:
+  - report
+runtimes: []
+plugin: chittyos-core
+---
+
+# Version Drift Report
+
+Based on the capability inventory, here are the top 5 cases of version drift across runtimes:
+
+| Skill Name | Canonical Lines | Wildest Version Lines | Location of Wildest | Recommended Action |
+| --- | --- | --- | --- | --- |
+| `neon-postgres` | 0 (not in canonical yet) | 376 | `~/.agents/skills/neon-postgres/SKILL.md` | Promote to canonical, run dispatch hook to sync to 376 lines across runtimes (Codex currently has 186). |
+| `claimable-postgres` | 0 (not in canonical yet) | 249 | `~/.gemini/config/skills/claimable-postgres/SKILL.md` | Promote to canonical, run dispatch hook to sync across runtimes (Codex has 224). |
+| `skill-creator` | 41 (stub) | 480 | `~/.gemini/skills/skill-creator/SKILL.md` | Update canonical to the full projection (completed in this PR), which overrides the 30-line stubs. |
+| `chitty-registry` | 132 | 132 | `~/.gemini/config/skills/chitty-registry/SKILL.md` | The `chittyos-devops` plugin version only has 94 lines. Reconcile latest 132-line version to canonical and dispatch. |
+| `chitty-deploy` | 0 (Wait, is it in canonical?) | 81 | `~/.gemini/config/plugins/chittyos-devops/skills/chitty-deploy/SKILL.md` | Promote 81-line version to canonical, run dispatch to overwrite the 77-line versions. |

canonical/skills/in-the-wild.md

@@ -0,0 +1,87 @@
+---
+name: in-the-wild
+canon_uri: chittycanon://core/services/chittymarket#skills/in-the-wild
+description: Report on skills in the wild
+kind: skill
+classification:
+  - report
+runtimes: []
+plugin: chittyos-core
+---
+
+# Skills In The Wild (Not in Canonical)
+
+The following skills were found in `~/.gemini/skills/` or `~/.agents/skills/` but have no corresponding entry in `chittymarket/canonical/skills/`:
+
+- `agent-md-refactor`
+- `agent-tools`
+- `agents-sdk`
+- `ai-image-generation`
+- `ai-product-photography`
+- `ai-social-media-content`
+- `audit-website`
+- `brainstorming`
+- `building-native-ui`
+- `cloudflare`
+- `cloudflare-email-service`
+- `cloudflare-one`
+- `cloudflare-one-migrations`
+- `command-creator`
+- `competitor-teardown`
+- `component-refactoring`
+- `customer-persona`
+- `daily-meeting-update`
+- `durable-objects`
+- `enhance-prompt`
+- `find-skills`
+- `frontend-code-review`
+- `frontend-testing`
+- `gitops-workflow`
+- `google-agents-cli-adk-code`
+- `google-agents-cli-deploy`
+- `google-agents-cli-eval`
+- `google-agents-cli-observability`
+- `google-agents-cli-publish`
+- `google-agents-cli-scaffold`
+- `google-agents-cli-workflow`
+- `javascript-sdk`
+- `mcp-builder`
+- `neon`
+- `neon-ai-gateway`
+- `neon-functions`
+- `neon-object-storage`
+- `neon-postgres`
+- `neon-postgres-branches`
+- `neon-postgres-egress-optimizer`
+- `nuxt`
+- `nuxt-ui`
+- `playwright-skill`
+- `plugin-forge`
+- `product-marketing-context`
+- `programmatic-seo`
+- `react-state-management`
+- `remotion-best-practices`
+- `requesting-code-review`
+- `sandbox-sdk`
+- `seo-audit`
+- `stripe-best-practices`
+- `stripe-directory`
+- `stripe-projects`
+- `superdesign`
+- `tailwind-design-system`
+- `turnstile-spin`
+- `ui-ux-pro-max`
+- `upgrade-stripe`
+- `upgrading-expo`
+- `using-superpowers`
+- `vercel-composition-patterns`
+- `vercel-react-best-practices`
+- `vercel-react-native-skills`
+- `vue-best-practices`
+- `vueuse-functions`
+- `web-artifacts-builder`
+- `web-component-design`
+- `web-perf`
+- `workers-best-practices`
+- `wrangler`
+- `writing-plans`

canonical/skills/retrospect.md

@@ -0,0 +1,121 @@
+---
+name: retrospect
+canon_uri: chittycanon://core/services/chittymarket#skills/retrospect
+description: Evidence-grounded retrospection — reflect on a session or task, validate the reflection against ground truth (transcript, logs, artifacts), then distill to generalizable principles that travel beyond the specific context. Triggers on "retrospect", "reflect on this session", "what did we learn", "validate my reflection", "after-action review", "what would you do differently", "distill learnings", or at natural session close when significant work was completed.
+kind: skill
+plugin: chittyos-core
+runtimes:
+  - claude-code
+  - codex
+classification:
+  - learning
+  - governance
+  - process
+---
+
+# Retrospect
+
+A three-phase evidence-grounded retrospection process. Designed to prevent the compounding of unvalidated self-assessments across sessions — the same failure mode as inheriting wrong completion claims from prior sessions, applied to reflection itself.
+
+## When to invoke
+
+- At session close after significant multi-step work
+- After a debugging or migration effort with multiple failed attempts
+- When the user asks "what did we learn", "reflect on this", or "what would you do differently"
+- After any session where architecture decisions were made or corrected
+
+---
+
+## Phase 1 — Reflect
+
+Produce a narrative account of the session. Cover:
+
+1. **What was attempted** — the starting intent
+2. **What failed and why** — be specific about root causes, not just symptoms
+3. **What succeeded** — the actual unlock moments, not just the final state
+4. **What was corrected by the user** — explicit corrections are high-signal; name them
+5. **What surprised you** — discoveries that weren't anticipated
+
+Do not sanitize. Include the embarrassing parts. Unvalidated reflection is journaling; this is diagnosis.
+
+---
+
+## Phase 2 — Validate
+
+Check the narrative against ground truth before distilling.
+
+```bash
+# Count actual user turns
+grep -c '"type":"USER_INPUT"' $TRANSCRIPT_PATH
+
+# Find premature completion claims
+python3 -c "
+import json
+with open('$TRANSCRIPT_PATH') as f:
+    for line in f:
+        d = json.loads(line)
+        if d.get('type') == 'PLANNER_RESPONSE':
+            c = str(d.get('content',''))
+            if any(w in c.lower() for w in ['complete', 'done', 'migrated', 'finished']):
+                print(d.get('step_index'), c[:100])
+"
+
+# Find first mentions of key entities/concepts
+# Find where errors first appeared vs when they were resolved
+# Check: did the reflection overstate or understate durations/counts?
+```
+
+Correction rules:
+- If you said "N turns" — check the actual count
+- If you said something was "the key moment" — verify it appears before the resolution, not after
+- If you described yourself as discovering something — check whether the user pointed you there first
+- If you described a pattern as "once" — check how many times it actually recurred
+
+**The reflection is a hypothesis. Validate it.**
+
+---
+
+## Phase 3 — Distill
+
+Strip away everything context-specific. For each lesson from Phase 1:
+
+Ask: *If I removed all the nouns (service names, error codes, tool names) — does this principle still hold?*
+
+If yes → it's a generalizable learning. If no → it's a tactic, not a principle.
+
+Format each learning as:
+```
+**[Principle name]**
+One sentence of the generalizable claim.
+One sentence of what it looks like when violated.
+```
+
+Target: 4–8 principles. More than 8 usually means you haven't distilled enough.
+
+---
+
+## Anti-patterns (do not do these)
+
+- **Sanitized narrative** — only describing what worked, not what failed
+- **Tactic-level learnings** — "next time I'll check for MCP_OBJECT" is not a principle
+- **Unvalidated claims** — saying "I did X" without checking whether you did
+- **Length as thoroughness** — a long reflection with no distillation is just logging
+
+---
+
+## Output format
+
+```markdown
+## Session Retrospect — [date]
+
+### Reflection
+[narrative]
+
+### Validation
+[what the transcript confirmed or corrected]
+
+### Principles
+**[Name]** — [claim]. Violated when [symptom].
+```
+
+Save to: `$ARTIFACTS_DIR/retrospect-[YYYY-MM-DD].md`