95 tracked `.security-scan-passed` files are deleted, and `.gitignore` gains the
entry that makes them local artifacts like their three siblings.
How they came to be deleted: a sweep on 2026-09-05 01:48 ran
`find . -name ".skill-regression-reviewed" -o -name ".security-scan-passed"
| xargs -r rm -f`, intending only the first name; `-o` made the second a peer of
it. The first is a gitignored local receipt, the second was tracked. 91 of the 95
parent directories still carry that exact minute as their mtime, which is how the
timestamp was pinned. A restore was attempted 93 seconds later and stopped at the
guard, and the files have sat deleted since. The owner has now retried and the
decision was to let them go; this records it.
Why retiring is coherent rather than a loss: the marker is a four-line local
receipt (scan time, tool, content hash) that `security_scan.py` regenerates on
demand, and `packaging_policy.py` already excludes it from every package. Its
three siblings in that same EXCLUDE_FILES set -- `.DS_Store`,
`.skill-regression-reviewed`, `.skill-regression-baseline.json` -- were all
already gitignored; this one was the outlier. Its `Scanned at` timestamp also
means a regenerated copy never byte-matches a committed one, so tracking it
produced churn and no signal.
The cost is one command: packaging a skill whose marker is gone now needs
`security_scan.py` run first, which regenerates it locally.
No skill content changes, so no plugin version is bumped and no CHANGELOG entry is
added: that file's entries are skill releases, and nothing ships differently. The
three documentation statements about this marker (marketplace-health-check's
SKILL.md and its methodology reference) describe what a scan result means, not
where the file is stored, and remain true. CLAUDE.md never mentioned it.
Pre-checked against main's version gate, which now consumes the shipping policy:
the candidate passes with no bumps.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Add exact active/inactive clone inventory and candidate-hash binding, expose
nominal versus physical release in ranking, and make deletion output and batch
failure behavior truthful.
Add daymade-macos and daymade-codex, move benchmark-due-diligence into daymade-financial, and move excel-automation into daymade-docs. Rename the iOS source directory to developing-ios-apps and synchronize install docs, tests, and marketplace references.
Co-authored-by: OpenAI Codex <noreply@openai.com>
daymade