← Commit history
README.md+11−2
@@ -1,6 +1,6 @@ # Adom Wiki Skill Pack -**One install, 15 skills that teach the AI to use the Adom Wiki without breaking+**One install, 23 skills that teach the AI to use the Adom Wiki without breaking pages, plus a write-up of the wiki repo archetypes that have emerged from real use.** @@ -27,7 +27,7 @@ deliberately. adom-wiki pkg install adom-wiki-skillpack ``` -This drops the main `adom-wiki-skillpack` skill plus 14 sub-skills onto your+This drops the main `adom-wiki-skillpack` skill plus 22 sub-skills onto your container, and pulls in **`adom-wiki-hero-image`** (a dependency) for hero generation. @@ -144,16 +144,24 @@ The pack encodes these; they're worth stating here too: | **wiki-api** | The REST API + ``adom-wiki pkg`` CLI and the publish workflow. | | **wiki-publish-safely** | Operational pitfalls as hard rules + the verify-in-pup gate. | | **wiki-readme** | Make a great README: `README.md` vs `readme.html`, sections, embeds. |+| **wiki-readme-html** | Build a custom `readme.html`: sandbox limits, shadowing, self-containment, theming, verify loop. |+| **wiki-readme-slideshow** | A narrated, fullscreen-capable slideshow inside a readme.html: per-slide TTS audio, key navigation, auto-advance. |+| **wiki-sub-readme** | A second Markdown doc in the page repo that explains one feature-set, linked from the main README. |+| **wiki-subreadme** | A README.md inside a subfolder of the page repo, rendered by the wiki as its own doc. | | **wiki-visibility** | Public vs private source, public releases, the private readme. | | **wiki-repo-styles** | The archetype taxonomy and how to choose. | | **wiki-component** | Publish a component: chip / molecule / board; the tabbed chip CAD-hub README (symbol, footprint, 3D, pins, specs, sourcing, tape & reel). |+| **wiki-component-lod** | High / medium / low / super-low component GLB detail caches and how board viewers stream them. | | **wiki-family** | Build a Family: naming, family tag, anchor registry, breadcrumbs. | | **wiki-skillpack** | Build a Skillpack: layout, install.sh, files[], the `-skillpack` suffix. | | **wiki-hero** | Generate a hero, and never let it get unlinked. |+| **wiki-hero-studio** | Generate the page hero in Hero Studio, the human-gated hero lab the wiki requires for new app/skill heroes. | | **wiki-breadcrumbs** | Third-party "I built an add-on for X" links _(implemented, basic)_. | | **wiki-forking** | Fork + community-PR contribution _(PRs live; fork-button planned)_. | | **wiki-discovery** | How pages get found: the two layers, current state, and the TODO list _(Layer 1 live; `/discover` partial)_. | | **wiki-scoring** | Stars / high-fives / installs / trending _(stars live; rest partial)_. |+| **wiki-workspaces** | Ship a Hydrogen bench with a project: `hydrogen/workspace.json`, export with adom-cli, push, fork or clone, apply in a container. |+| **wiki-bloat** | The rule against page sprawl: find where a thing already lives before creating anything. |  ## Talk to the AI @@ -164,6 +172,7 @@ The pack encodes these; they're worth stating here too: - "Keep the source private but let people install it" → wiki-visibility - "Bundle these skills into one package" → wiki-skillpack - "Add a child plugin to adom-usb / a bridge to adom-desktop" → wiki-family+- "Ship my Hydrogen layout with the project" / "open the author's bench" → wiki-workspaces  ## Dependencies 
SKILL.md+3−2
@@ -7,7 +7,7 @@ description: >-   wiki page. The wiki is six tools in one (git host + wiki package manager (`adom-wiki pkg`) +   release database + discussion forum + pull requests + discovery), and three repo   archetypes have emerged from real use: Page, Skillpack, and Family. This pack-  routes to 16 focused sub-skills and carries the hard rules that keep pages from+  routes to 22 focused sub-skills and carries the hard rules that keep pages from   breaking. Trigger words: adompkg (deprecated old name), the wiki, adom wiki, wiki.adom.inc, publish to the   wiki, wiki repo, wiki page, what kind of wiki repo, repo archetype, skillpack,   super-skill, wiki family, parent child repo, wiki readme, hero unlinked,@@ -15,7 +15,8 @@ description: >-   page, wiki discovery, page not surfacing, wiki scoring, trending, high five,   adom-wiki pkg publish, publish a chip, component page, chip page, molecule page,   tape and reel, pin 1 orientation, cached chip thumbnails, Z-up component hero,-  reviewed laser etch, reusable chip outlines, component page widget.+  reviewed laser etch, reusable chip outlines, component page widget, shared+  workspace, hydrogen/workspace.json, ship my Hydrogen layout, open in Hydrogen. ---  # Adom Wiki Skill Pack
install.sh+1
@@ -44,6 +44,7 @@ install_skill wiki-bloat          skills/wiki-bloat/SKILL.md install_skill wiki-sub-readme skills/wiki-sub-readme/SKILL.md install_skill wiki-subreadme skills/wiki-subreadme/SKILL.md install_skill wiki-hero-studio skills/wiki-hero-studio/SKILL.md+install_skill wiki-workspaces skills/wiki-workspaces/SKILL.md  echo "OK: Installed Adom Wiki Skill Pack and all bundled skills to $DEST" done
package.json+11−3
@@ -1,7 +1,7 @@ {   "slug": "adom-wiki-skillpack",   "title": "Adom Wiki Skill Pack",-  "version": "0.8.11",+  "version": "0.8.12",   "type": "skill",   "hero": {     "path": "screenshots/hero.png"@@ -71,7 +71,14 @@     "reviewed chip artwork in assembled board",     "hero GLB versus board LOD",     "footprint or silkscreen baked into high LOD",-    "image-first component LOD previews"+    "image-first component LOD previews",+    "shared workspace",+    "project workspace",+    "hydrogen/workspace.json",+    "workspace apply",+    "workspace export",+    "ship my hydrogen layout",+    "open in hydrogen"   ],   "dependencies": {     "adom/adom-wiki-hero-image": "^0.2.2",@@ -111,7 +118,8 @@     "skills/wiki-component-lod/SKILL.md",     "skills/wiki-component-lod/references/generation.md",     "skills/wiki-component-lod/references/verification.md",-    "skills/wiki-component-lod/references/runtime.md"+    "skills/wiki-component-lod/references/runtime.md",+    "skills/wiki-workspaces/SKILL.md"   ],   "scripts": {     "install": "./install.sh",
page.json+24−6
@@ -2,7 +2,7 @@   "type": "skill",   "slug": "adom-wiki-skillpack",   "title": "Adom Wiki Skill Pack",-  "brief": "How to use the Adom Wiki without breaking pages \u2014 the wiki is six tools in one (git, package manager, releases, discussions, PRs, discovery), and three repo archetypes have emerged from real use: Page, Skillpack, and Family. Plus how to publish rich component pages (chips, molecules, boards). One install, 15 skills, plus a write-up of the design patterns for the people who build the wiki.",+  "brief": "How to use the Adom Wiki without breaking pages — the wiki is six tools in one (git, package manager, releases, discussions, PRs, discovery), and three repo archetypes have emerged from real use: Page, Skillpack, and Family. Plus how to publish rich component pages (chips, molecules, boards). One install, 15 skills, plus a write-up of the design patterns for the people who build the wiki.",   "hero": {     "type": "image",     "path": "screenshots/hero.png"@@ -104,7 +104,17 @@     "component LDO detail levels",     "coarse-first board viewer",     "3D board GPU memory freeze",-    "reviewed chip artwork in assembled board"+    "reviewed chip artwork in assembled board",+    "hero GLB versus board LOD",+    "footprint or silkscreen baked into high LOD",+    "image-first component LOD previews",+    "shared workspace",+    "project workspace",+    "hydrogen/workspace.json",+    "workspace apply",+    "workspace export",+    "ship my hydrogen layout",+    "open in hydrogen"   ],   "discovery_pitch": "Anything touching wiki.adom.inc: publishing, page archetypes, readmes, heroes, discovery, and the wiki-bloat rule (find where a thing already lives before creating any page).",   "sample_prompts": [@@ -121,8 +131,8 @@       "prompt": "Before I create this wiki page, check whether the thing already has a home."     }   ],-  "version": "0.8.11",-  "description": "The Adom Wiki Skill Pack : one main skill plus the focused sub-skills that teach the AI to publish to wiki.adom.inc without breaking pages, name the wiki repo archetypes (Page, Skillpack, Family), and publish rich component pages (chips, molecules, boards). The wiki is six tools in one: git, package manager, releases, discussions, pull requests, and discovery. One package manager install drops the whole set onto your container.",+  "version": "0.8.12",+  "description": "The Adom Wiki Skill Pack : one main skill plus the focused sub-skills that teach the AI to publish to wiki.adom.inc without breaking pages, name the wiki repo archetypes (Page, Skillpack, Family), and publish rich component pages (chips, molecules, boards). The wiki is six tools in one: git, package manager, releases, discussions, pull requests, and discovery. One package manager install drops the whole set onto your container. Includes reviewed Z-up component artwork, surface-selected MPN marking, reusable thumbnail caches and component-page widgets.",   "dependencies": {     "adom/adom-wiki-hero-image": "^0.2.2",     "adom/component-widgets": "^1.1.12"@@ -154,7 +164,15 @@     "skills/wiki-discovery/SKILL.md",     "skills/wiki-scoring/SKILL.md",     "skills/wiki-bloat/SKILL.md",-    "skills/wiki-readme-slideshow/SKILL.md"+    "skills/wiki-readme-slideshow/SKILL.md",+    "skills/wiki-sub-readme/SKILL.md",+    "skills/wiki-subreadme/SKILL.md",+    "skills/wiki-hero-studio/SKILL.md",+    "skills/wiki-component-lod/SKILL.md",+    "skills/wiki-component-lod/references/generation.md",+    "skills/wiki-component-lod/references/verification.md",+    "skills/wiki-component-lod/references/runtime.md",+    "skills/wiki-workspaces/SKILL.md"   ],   "scripts": {     "install": "./install.sh",@@ -176,4 +194,4 @@     "email": "[email protected]"   },   "org": "adom"-}+}\ No newline at end of file
skills/wiki-hero/SKILL.md+8
@@ -25,6 +25,14 @@ as unfinished.  ## Generating it +For a **hardware component**, first read+[wiki-component](../wiki-component/SKILL.md), especially its Z-up GLB and hero+workflow. Use the verified physical component render and a generic part description.+Read the current `hero-studio` hardware guidance for composition; an app screenshot+inside window chrome is not the component hero recipe. Preserve the manufacturer's+original model, validate the derived pose in the actual viewer and keep virtual MPN+markings identified as overlays. The app-specific composition below applies to apps.+ Use the **adom-wiki-hero-image** package, it's a declared **dependency of this pack**, so `adom-wiki pkg install adom-wiki-skillpack` pulls it automatically. It bundles the brand fonts + ADOM wordmark + the render pipeline, so it works
skills/wiki-readme-html/SKILL.md+40−10
@@ -66,8 +66,12 @@ file **byte-for-byte, no sanitizer**. Consequences:  - `<style>`, `style=`, and `<script>` all work. Scripts run inside the sandbox. - **No `allow-same-origin`**: the iframe runs as an opaque origin. No cookies,-  no wiki session, no `fetch` to the wiki API, no localStorage. The readme-  cannot know who is viewing it or call authenticated endpoints.+  no wiki session, no localStorage. `fetch` DOES work (`connect-src 'self' data:`,+  see the CSP section below), but credential-free: you see what an anonymous+  visitor sees. On a PRIVATE page the wiki injects a short-lived page-scoped+  capability so the readme can still read its OWN page's files (see "Private+  pages" below). The readme cannot know who is viewing it or call authenticated+  endpoints. - **No `allow-popups` / `allow-top-navigation`**: `target="_blank"` links and   `window.open` are blocked by the sandbox. Plain same-frame links navigate the   iframe itself, not the wiki page. Design navigation accordingly (prefer@@ -95,6 +99,32 @@ explicitly (match the wiki's dark look or design deliberately), and follow the Adom brand rules (tokens, brand fonts, monochrome icons, no emoji, no em-dashes). +## Private pages: the injected capability (adom/wiki#73, #81)++A readme on a PRIVATE page used to render blank or half-broken: its fetches are+credential-free, so its own page's assets hit the privacy wall, and in embeds+where the session cookie cannot ride (the wiki inside another app's webview, or+a Bearer-authenticated client) even the frame document 404'd.++Now, when the wiki serves the frame to a viewer who has already passed the+page's access check, it mints a short-lived CAPABILITY: the token rides in the+iframe `src` (so the document loads anywhere) and a small injected bootstrap+appends it to same-host `fetch()` calls and static media `src`s (so the+readme's own asset loads work unchanged).++- Existing readmes need NO changes.+- Code that builds URLs by hand: read `window.__wikiCap` and append+  `?cap=<token>` yourself.+- A parent-page integration that outlives the 15-minute TTL can re-mint at+  `GET /api/pages/<owner>/<slug>/cap`.+- The capability is page-scoped, READ-only, expiring, and unmintable from+  inside the frame. It is not a session: no API authority, no writes, no other+  page's files.+- Public pages carry no token at all (their frame is anonymously readable and+  stays cacheable).++Authoritative contract: git-wiki `docs/readme-sandbox.md`.+ ## Variants (public/private pages)  The page tracks six slots in `readme_variants_json`:@@ -160,7 +190,7 @@ should read your content height, not 600. - Iframe grows forever -> a vh-sized section is chasing the resize; pin it to fixed pixels. - Renders but unstyled/white → you assumed wiki CSS; the iframe gets nothing. - Buttons/links dead → sandbox blocks popups/top-nav; keep interactions in-frame.-- Fetch to the wiki API fails → no same-origin; the readme is display-only.+- Fetch returns anonymous-visitor data (opaque origin, no credentials ever). On a private page its own files still load via the injected capability; anything else is anonymous-only. - SVG `<img>` broken → content-type bug (issue #38); use PNG or inline the SVG markup. - Works locally, stale on the wiki → you pushed the repo but didn't `pkg publish`   (or vice versa); the readme the page renders comes from the published layer.@@ -204,7 +234,7 @@ each found the hard way:      wrong. `window` exists in a sandboxed iframe; the *origin* is null, so the property read      itself throws. Only try/catch works.    - **If the throw lands in an un-awaited async init, everything after it is silently-     abandoned** — no console error at all. A partial init looks like this:+     abandoned**, no console error at all. A partial init looks like this:      `lights: []`, `environmentTexture: false`, `activeRenderLoops: 0`, `getCamera(): null`,      while the meshes are all present. Any downstream feature that guards on the camera      (a scripted tour, a fly-to) then no-ops without complaining, which reads as a second,@@ -216,29 +246,29 @@ each found the hard way:    ``` 2. **`blob:` images are blocked** (img-src has no blob:). Anything doing    `URL.createObjectURL` for textures needs a shim that converts to `data:` URIs instead.-3. **`connect-src` — CHECK THIS, it changed.** Measured 2026-08-20, the render endpoint now+3. **`connect-src`: CHECK THIS, it changed.** Measured 2026-08-20, the render endpoint now    sends `connect-src 'self' data:`, not `'none'`. Same-origin `fetch` of your own page's    assets WORKS: a viewer bundle can pull its own `3d.glb`, `circuit.json` and split JS parts    over plain fetch. The PNG-channel packing trick below is no longer required for-   same-origin assets — keep it only for a genuinely cross-origin payload.+   same-origin assets; keep it only for a genuinely cross-origin payload.    ```    sandbox allow-scripts allow-downloads allow-popups allow-popups-to-escape-sandbox;    default-src 'none'; script-src 'unsafe-inline' https:; style-src 'unsafe-inline' https:;    img-src data: https:; media-src data: https:; font-src data: https:;    frame-src https:; connect-src 'self' data:; form-action 'none'; object-src 'none'    ```-   Verify the live header before designing around it —-   `curl -sD- -o /dev/null <render-url> | grep -i content-security-policy` — because this is+   Verify the live header before designing around it,+   `curl -sD- -o /dev/null <render-url> | grep -i content-security-policy`, because this is    the second time it has moved.  ### Size budget -A readme.html has roughly a **4-5 MB practical cap** — and so does **every individual file**+A readme.html has roughly a **4-5 MB practical cap**, and so does **every individual file** served through `/<owner>/<slug>/render/<path>`, which is the one that catches people shipping a JS bundle. Over ~4 MB it returns HTTP 413 `{"error":"File too large to render"}`, and a `<script src>` cannot surface that; it just silently fails to load. Split anything larger into <3.5 MB parts, fetch them, concatenate as **bytes** (a multi-byte character can straddle a-boundary, so never decode per part), and inject with `script.textContent` — `script-src` allows+boundary, so never decode per part), and inject with `script.textContent`: `script-src` allows `'unsafe-inline'` but not `blob:`, so `URL.createObjectURL` + `script.src` is refused. Optimize models before embedding: service-step2glb / gltf-transform (join, weld, prune, Draco) turns a raw ~16 MB board GLB into ~465 KB. Budget models first, code second.
uninstall.sh+1−1
@@ -6,7 +6,7 @@ else   DESTINATIONS=("$HOME/.claude/skills" "${CODEX_HOME:-$HOME/.codex}/skills") fi for DEST in "${DESTINATIONS[@]}"; do-  for name in adom-wiki-skillpack wiki-anatomy wiki-api wiki-publish-safely wiki-readme wiki-readme-html wiki-readme-slideshow wiki-visibility wiki-repo-styles wiki-component wiki-component-lod wiki-family wiki-skillpack wiki-hero wiki-breadcrumbs wiki-forking wiki-discovery wiki-scoring wiki-bloat wiki-sub-readme wiki-subreadme wiki-hero-studio; do+  for name in adom-wiki-skillpack wiki-anatomy wiki-api wiki-publish-safely wiki-readme wiki-readme-html wiki-readme-slideshow wiki-visibility wiki-repo-styles wiki-component wiki-component-lod wiki-family wiki-skillpack wiki-hero wiki-breadcrumbs wiki-forking wiki-discovery wiki-scoring wiki-bloat wiki-sub-readme wiki-subreadme wiki-hero-studio wiki-workspaces; do     rm -rf -- "$DEST/$name"   done done