$npx -y skills add Raishin/vanguard-frontier-agentic --skill definition-of-doneThe ordered finish-line runner for any change in this repo — generators, then the asset-integrity refresh last on its own, then the full gate suite, then commit and push; use before declaring any change finished or whenever the stop hook reports uncommitted or untracked changes.
| 1 | # Definition of Done |
| 2 | |
| 3 | ## Doctrine |
| 4 | |
| 5 | The order is load-bearing. The integrity manifest must hash the settled tree, so |
| 6 | `asset-integrity:write` always runs last, on its own, from the repo root — never folded into a |
| 7 | parallel generator batch, never run from a subdirectory. |
| 8 | |
| 9 | ## Trigger |
| 10 | |
| 11 | - Before declaring any change in this repo finished. |
| 12 | - Whenever the stop hook reports uncommitted or untracked changes. |
| 13 | |
| 14 | ## Input |
| 15 | |
| 16 | The list of paths you touched in this change. |
| 17 | |
| 18 | ## Decision matrix |
| 19 | |
| 20 | Pick the steps that apply based on what changed — most changes trigger more than one row. |
| 21 | |
| 22 | - **catalog / agents / skills / roles / providers changed** → `npm run manifest:write:all`, |
| 23 | then re-run asset-integrity LAST on its own (the parallel-generator ordering caveat in |
| 24 | `CLAUDE.md`). |
| 25 | - **`skills/**` changed** → `npm run manifest:write`. |
| 26 | - **`catalog/model-policy.json` or `model-registry.json` changed** → `npm run |
| 27 | model-policy:check` (and `model-policy:apply` if the projection changed). |
| 28 | - **`tools/vfa-tui/**` changed** → `cd tools/vfa-tui && cargo fmt --check && cargo clippy |
| 29 | --all-targets -- -D warnings && cargo test`. Return to the repo root afterwards — a |
| 30 | persisted `cd` has broken integrity runs before. |
| 31 | - **any root file / `agents/` / `plugins/` / `package.json` changed** → asset-integrity |
| 32 | refresh required. |
| 33 | |
| 34 | ## The invariant sequence |
| 35 | |
| 36 | Always, in this order: |
| 37 | |
| 38 | 1. Applicable generators from the decision matrix above. |
| 39 | 2. `python3 tests/validate-asset-integrity.py --write` from the REPO ROOT, last, on its own. |
| 40 | 3. `npm run validate` — zero failures. |
| 41 | 4. `npm run lint:spell` and `npx --yes markdownlint-cli2 "**/*.md" "#node_modules"` — zero |
| 42 | failures. |
| 43 | 5. `git status` clean after committing with a scoped conventional-commit message. |
| 44 | 6. `git push -u origin <branch>` (retry with backoff on network errors only). |
| 45 | |
| 46 | ## Footguns |
| 47 | |
| 48 | - `grep -cE 'FAIL|ERROR'` exits 1 on a count of 0 — do not chain it with `&&` before the |
| 49 | commit, or a clean gate run looks like a failure and blocks you. |
| 50 | - Run integrity from the repo root — a leftover `cd` into `tools/vfa-tui` makes the write |
| 51 | silently target a nonexistent path. |
| 52 | - Warnings from model-policy are exit-0 by design — read them, don't treat them as failures. |
| 53 | - Never edit `catalog/asset-integrity.json` by hand. |
| 54 | |
| 55 | ## Output |
| 56 | |
| 57 | The checklist above with pass evidence per step, then the commit hash and push confirmation. |
| 58 | |
| 59 | ## Delegation note |
| 60 | |
| 61 | Gate runs may be delegated to a Haiku subagent per `agentic-delegation`'s "Gate run" workflow |
| 62 | template, but the orchestrator reads the results and owns the commit — a delegate's self-report |
| 63 | that gates passed is not verification. |