ptr727/plexcleaner/resync-a-repo

Resync a Repo

Why this exists

RESYNC.md's own apply order already sequences the remedies so the rules land before the files they govern. The same order lands a deletion before the re-vendor that would otherwise refresh it. The AGENTS.md-overwrite incident happened inside that same procedure, on the step that looked most routine. This skill exists so the mandatory check survives contact with a real, time-pressured resync instead of depending on an agent remembering to run it unprompted. It is a driver over RESYNC.md, not a replacement for it. Read RESYNC.md itself for the deletion sweep, the letters-versus-drift routing, and the settings and ruleset step. Read it also for everything else that does not change from one resync to the next.

Confirm the procedure before starting

Read RESYNC.md section 0. A repo with no instruction set at all, or a partial one, is not this skill's job. It is STANDUP.md sections 1A and 2 instead, since an absent carried file is a baseline that never arrived rather than drift to converge. Run uv run --no-project --script spec/audit.py <RepoName>, the target's registry/repos.json name field rather than an owner/repo slug or a checkout path. Then read whether the findings are letters (absent) or drift (present but stale). Do both before doing anything else. The finding kind names the procedure the repo is owed.

Reach the hub and measure before changing anything

Fetch a hub checkout of your own immediately before reading it, since a stale clone answers confidently instead of failing. This follows section 1 of the hub-only RESYNC.md. That file is fetched with the hub rather than present in a carrier. Never do the resync's own work in a checkout another task may be using, the maintainer's own primary checkout included, even one that looks current. For the hub and for the target repo alike, create a worktree of your own off that base clone and work there, per repo-worktree. Remove each one when the run ends, per that skill's "Listing and Cleanup". A merged pull request's worktree goes through uv run --no-project --script scripts/pr_review.py cleanup <number> --repo <owner>/<repo> --checkout <base-clone>. A hub worktree that only read the hub is removed by hand once it is clean, its branch with it. On a machine carrying the hub's agent-safety install, Claude Code also refuses a mutating git command run directly in a primary checkout. However, its rules classify git and gh commands only. So a plain file write is never denied, and the re-vendoring this skill exists to govern goes uncaught. A compound command is judged whole, so a copy chained to a denied git write does not run either. Prose is the enforcement here, and following it is not optional. Verify the host with python3 scripts/host_gate.py --repo <path-to-target-worktree>, run from your hub worktree, since scripts/ is hub-hosted and no carrier holds it. Then run the audit end to end, RESYNC.md section 2. uv run --no-project --script spec/audit.py <RepoName> measures the target's ground-truth branch, which the registry's groundTruthBranch names and which is main for every cataloged repo today, never develop. That is the invocation "Confirm the procedure before starting" already ran, run again here. Convergence lands on a ref main does not hold yet, so a run that previews in-flight work names that ref: uv run --no-project --script spec/audit.py --branch <ref> <RepoName>. Use it to check whether a fix landed, since a run against main still reports what the in-flight ref already fixed. Section 2 carries two further commands that neither of these replaces. A finding is a snapshot. So quote the run stamp in anything derived from it, and re-run before acting on a finding read earlier in the session. File any hub defect this work exposes against ptr727/ProjectTemplate. Examples include bugs, conflicting sources, unclear or incomplete instructions, missing capabilities, and Copilot findings about any of them. Search open and closed issues first, then update the matching issue or file a new one. Preserve the evidence RESYNC.md section 2 requires, and do not leave the finding only in chat, a review thread, the downstream repo, or agent memory.

Apply, in this order

A repository still on the old CRLF default converts first. Where docs/eol-lf-rollout.md "Per-Repo Conversion" says the repository needs the conversion, land it as its own merged pull request before step 1, carrying .editorconfig and .gitattributes itself. Once it merges, re-measure against develop and base the branch for the steps below on develop.

1. The instruction set first. CLAUDE.md, then AGENTS.md and GOVERNANCE.md verbatim sections, then CODESTYLE.md and WORKFLOW.md. Include the AGENTS.md skill-dependency pointer paragraph in this same step, as one more verbatim unit and not a separate pass. The paragraph names scripts/skills_install.py and where the fleet's Skills live. CLAUDE.md is the single @AGENTS.md-import file that gets AGENTS.md into a Claude Code session's context at all. It is a separate baseline entry from AGENTS.md itself, so carrying one without the other still leaves that provider unconfigured. Before touching `AGENTS.md`, `GOVERNANCE.md`, `CODESTYLE.md`, or `WORKFLOW.md` in this step, run the `carried-instruction-file-guard` skill's distinctive-phrase probe against the target file, every time, without exception. This holds regardless of whether the update is a verbatim re-vendor or an intent-fidelity edit. This is not advisory language to weigh against how routine the diff looks. A diff that looks routine is exactly the shape the AGENTS.md-overwrite incident took. Do not proceed to the re-vendor until the probe has run and any local addition it finds has a destination. That gate follows that skill's own procedure. CLAUDE.md is outside that guard's scope. It carries no mixed or repo-specific content by design, so its re-vendor is an ordinary verbatim-fidelity copy, no probe needed.
2. Deletions second, before any re-vendor. Only a retire disposition in

spec/divergences.json authorizes removing a file. The removal is swept tree-wide, per RESYNC.md section 4, before the deletion counts as done.

1. Verbatim re-vendors for CLAUDE.md and everything else the probe in step 1 cleared. A

finding classified modified rather than stale gets its diff read before being overwritten. The reason is that it may be an improvement the hub should adopt instead of a mistake to erase.

1. Interface workflows. Honor the named contract, required jobs, the ruleset-bound check name,

the artifact-name handoff, rather than copying bytes.

1. Settings, rulesets, and secrets. Run

repo-config/configure.sh check "<owner>/<repo>" release (substitute operational for an operational repo) from the hub at main, then apply for what it reports, never from a carried copy. Run uv run --no-project --script spec/audit.py <RepoName> from the same checkout for secrets.

1. Intent files last, and by hand, since nothing mechanical judges these.

Reconcile the registry entry (status, types, releaseTrigger, workflowModel, driftNotes) in the same pass. Also delete a driftNote describing work this pass just finished rather than leaving it standing.

Ship it

One focused pull request per drift class, branched from the target's develop. It is never a direct push to a protected branch and never a hand edit outside a pull request. Close the review loop, per the pr-review-conduct skill, before asking the maintainer for merge permission. The maintainer merges, the agent drives to green and stops. Re-run the audit after the merge. From the hub checkout, commit the report under the hub's own reports/ once authorized, per AUDIT.md section 8 and git-commit-conventions. A session resyncing its own repository leaves the report to a hub-side audit instead. Done means measured, not applied.