Imported from spencerbeggs/okfit (plugins/claude-code/skills/okf-finalize/SKILL.md). Install upstream with npx skills add spencerbeggs/okfit --skill okf-finalize. Copyright stays with the author.

okf-finalize

The sweep, in order

Run all six steps sequentially in one context. There is no context: fork here (M-12) -- design-docs' finalize workflow isolates its bundle-editing, context-editing, and readme-editing phases across three separate agents (FIELDSTUDY:448-457), and this plugin consciously trades that isolation for the simplicity of one agent running one skill straight through.

1. List the concepts the branch's diff touches: git diff against the base branch, restricted to bundle paths.
2. Reconcile each touched concept against okf-authoring's nineteen rules.
3. Run validate_bundle — or okfit validate --format json when the MCP tools are unavailable — and fix what it reports. When the report is worth quoting, cite its engine_version and okf_version; a different okfit_version between the tool and the CLI is each front end's own version, not a different engine.
4. Run okfit sync (or okfit sync --dry-run first to inspect) to regenerate generated.at, generated.body_sha256, index.md, and log.md. A concept whose recorded digest still matches its body is reported unchanged and keeps its existing at, so a squash-merged branch needs no restamp pass. All three are derived (okf-spec's reserved-files section plus the profiles-generated-at-is-author-date Decision) -- never hand-edit any of them. Report what sync wrote, left unchanged, or skipped (and why) to whoever reads the sweep's output.
5. Check CLAUDE.md pointer coverage with okf-context's checklist, in both directions.
6. Tell the user what changed. Separately, list any concept step 3's okfit validate reported as require-verified-unmet as "awaiting human verification" and stop there — this skill never runs okfit verify.

Ends by reporting, never committing

This skill never commits, never pushes, and never creates a changeset -- that stays a human's call (Spencer's standing rule), restated here because this is the one skill in the group whose allowed-tools includes a Bash(...) grant at all, and therefore the one place the commit boundary could be crossed by accident. The grants above are scoped to git diff:* and the two okfit subcommands this sweep actually runs -- validate and context -- across every invocation form okfit is run through in this repo (direct, pnpm exec, npx, and node_modules/.bin/okfit). There is no bare Bash(okfit:*) grant: okfit verify writes a human's attestation (step 6 above defers to a human for that), and a permission pattern that cannot match it is a second line of defence alongside the prose, not just a subcommand list git commit happens to be excluded from -- running this skill to completion means describing what changed and stopping there.