feat(setup): add repo-health family first-run welcome guide

docs/repo-health/README.md

@@ -65,6 +65,12 @@ New to Magpie? The [quick start](../quick-start.md) walks the whole path in
 one place — install, the first `/magpie-setup:setup` run, and a recording of it
 happening — plus the other agents and the secure-isolation setup to run next.
 
+The first repo-health skill you run opens with a one-minute
+[welcome guide](../../plugins/magpie-setup/skills/setup/setup_preflight/guides/repo-health.md):
+the typical flow, what needs configuring, what to ask it, and how to make it yours.
+Dismiss it, or hide it for good, from its last line;
+*"show the repo-health welcome again"* or `/magpie-setup:welcome-guide repo-health` brings it back.
+
 ### Before the first run
 
 <!-- BEGIN generated: skill-config (tools/dev/check-skill-config.py --fix) -->

plugins/magpie-setup/skills/setup/setup_preflight/guides/repo-health.md

@@ -0,0 +1,52 @@
+<!-- SPDX-License-Identifier: Apache-2.0
+     https://www.apache.org/licenses/LICENSE-2.0 -->
+
+# 🐦 Magpie here — your repository-health sidekick
+
+A one-minute tour, then straight back to what you asked for.
+
+## 🔄 The typical flow
+
+1. 🏃 **Audit CI runners** for outdated labels — *"audit our CI runners"*
+2. 🔒 **Check workflows** for security risks — *"audit workflow security"*
+3. 📦 **Audit dependencies** for vulnerabilities and licenses — *"audit dependencies"* / *"check dependency licenses"*
+4. 📜 **Check compliance** across LICENSE and NOTICE — *"check license compliance"*
+5. 🧪 **Triage flaky tests** to separate flakes from regressions — *"find flaky tests"*
+6. 🛠️ **Draft a fix** for an audit finding — *"draft a fix for this finding"*
+
+The six audit skills report findings without modifying project files.
+`audit-finding-fix` edits and commits a fix locally, asking before each write; `--draft-pr` opens a draft PR only after a further explicit OK.
+
+## ⚙️ Configure it
+
+Some skills need project-specific settings:
+
+- ⚙️ **Audit policy** — `repo-health-config.md` for dependency, workflow-security, license-compliance and flaky-test audits
+- 🛠️ **Fix workflow** — `fix-workflow.md` and `runtime-invocation.md` for `audit-finding-fix`
+- 📋 **Other audits** — CI runner and dependency-license audits have no required config
+
+Configure personally with `/magpie-setup:setup config`.
+Project adoption with `/magpie-setup:setup adopt` is a maintainer decision.
+
+## 💬 Just ask
+
+Talk to Magpie in plain language:
+
+- *"find obsolete CI runner labels"*
+- *"check GitHub Actions permissions and triggers"*
+- *"audit dependency vulnerabilities and licenses"*
+- *"check LICENSE and NOTICE compliance"*
+- *"investigate flaky tests in CI"*
+- *"draft a tested fix for this audit finding"*
+
+## 🎨 Make it yours
+
+Describe the checks or reporting style you prefer:
+
+- *"use our project's flaky-test thresholds"*
+- *"focus workflow security findings on high-risk triggers"*
+
+Each becomes an override for the repo-health skill it changes.
+Useful elsewhere? Ask *"upstream this change to Magpie"* to prepare a contribution for review.
+
+<!-- welcome footer: generated from guides/_footer.md -->

tools/setup-preflight/tests/test_welcome.py

@@ -34,7 +34,7 @@
 
 REPO_ROOT = Path(__file__).resolve().parents[3]
 SECURITY_SKILL = "issue-sync"
-OTHER_SKILL = "ci-runner-audit"
+OTHER_SKILL = "rc-cut"
 
 
 def stamp(root: Path) -> dict:
@@ -165,6 +165,25 @@ def test_the_contributor_growth_family_guide_comes_on_the_next_run(project: Path
     assert due(project, "activity-sweep") == [("general", "again")]
 
 
+def test_the_repo_health_family_guide_comes_on_the_next_run(project: Path, version) -> None:
+    for skill in (
+        "audit-finding-fix",
+        "ci-runner-audit",
+        "dependency-audit",
+        "dependency-license-audit",
+        "flaky-test-triage",
+        "license-compliance-audit",
+        "workflow-security-audit",
+    ):
+        assert welcome.family_of(skill) == "repo-health"
+
+    assert due(project, "ci-runner-audit") == [("general", "first-run")]
+    welcome.record(project, "general", "seen")
+    assert due(project, "ci-runner-audit") == [("repo-health", "first-run")]
+    welcome.record(project, "repo-health", "seen")
+    assert due(project, "ci-runner-audit") == [("general", "again")]
+
+
 def test_at_most_one_guide_per_run(project: Path, version) -> None:
     for _ in range(8):
         found = welcome_findings(project, SECURITY_SKILL)
@@ -188,7 +207,7 @@ def test_a_hidden_general_guide_does_not_hold_back_the_family_one(project: Path,
 
 
 def test_a_skill_of_a_family_without_a_guide_gets_only_the_general_one(project: Path, version) -> None:
-    assert welcome.family_of(OTHER_SKILL) == "repo-health"
+    assert welcome.family_of(OTHER_SKILL) == "release-management"
     assert due(project, OTHER_SKILL) == [("general", "first-run")]
     welcome.record(project, "general", "never")
     assert due(project, OTHER_SKILL) == []
@@ -471,6 +490,7 @@ def test_the_rules_section_and_all_guides_ship() -> None:
         "issue",
         "pr-management",
         "contributor-growth",
+        "repo-health",
     } <= set(welcome.guides())
     assert welcome.family_guides() == [g for g in welcome.guides() if g != "general"]
 
@@ -486,6 +506,7 @@ def test_the_rules_section_and_all_guides_ship() -> None:
         "issue",
         "pr-management",
         "contributor-growth",
+        "repo-health",
     ],
 )
 def test_each_guide_is_short_and_ends_with_the_way_back(name: str) -> None:
@@ -514,7 +535,18 @@ def test_the_footer_is_shared_and_filled_in_per_guide() -> None:
     issue = welcome.guide("issue") or ""
     pr_management = welcome.guide("pr-management") or ""
     contributor_growth = welcome.guide("contributor-growth") or ""
-    for text in (security, general, utilities, mentoring, pairing, issue, pr_management, contributor_growth):
+    repo_health = welcome.guide("repo-health") or ""
+    for text in (
+        security,
+        general,
+        utilities,
+        mentoring,
+        pairing,
+        issue,
+        pr_management,
+        contributor_growth,
+        repo_health,
+    ):
         assert "{{" not in text
         assert "welcome footer: generated" not in text
     assert "`/magpie-setup:welcome-guide security`" in security
@@ -533,6 +565,8 @@ def test_the_footer_is_shared_and_filled_in_per_guide() -> None:
     assert "--family pr-management --color=always" in pr_management
     assert "`/magpie-setup:welcome-guide contributor-growth`" in contributor_growth
     assert "--family contributor-growth --color=always" in contributor_growth
+    assert "`/magpie-setup:welcome-guide repo-health`" in repo_health
+    assert "--family repo-health --color=always" in repo_health
 
 
 def test_list_prints_every_guide(capsys) -> None:

tools/skill-evals/README.md

@@ -11,7 +11,7 @@ Behavioral eval harness for Apache Magpie skills. Each eval suite tests a skill
 
 Suites are currently implemented for:
 
-- **setup** — 138 cases across 30 steps (step-verify-drift, step-overrides-surface, step-override-bypass, step-m3-baseline-pick, step-m4-install-gates, step-m5-no-repo-offer, step-m5-companion-offer, step-upgrade-companion-offer, step-adopt-settings-merge, verify-default-set, uninstall-default-set, lock-marketplace-parse, adopt-write-floor, setup-prefill-from-floor, preflight-floor, upgrade-adoption-split, verify-floor, adopt-review-process, adopt-security-list, step-reconcile, step-verify, step-config-stamp, step-config-adversarial, step-config-mail, step-adopt-stamp, step-upgrade-stamp, step-delegate-propose, config-vcs-backend, config-local-custom-parser)
+- **setup** — 139 cases across 30 steps (step-verify-drift, step-overrides-surface, step-override-bypass, step-m3-baseline-pick, step-m4-install-gates, step-m5-no-repo-offer, step-m5-companion-offer, step-upgrade-companion-offer, step-adopt-settings-merge, verify-default-set, uninstall-default-set, lock-marketplace-parse, adopt-write-floor, setup-prefill-from-floor, preflight-floor, upgrade-adoption-split, verify-floor, adopt-review-process, adopt-security-list, step-reconcile, step-verify, step-config-stamp, step-config-adversarial, step-config-mail, step-adopt-stamp, step-upgrade-stamp, step-delegate-propose, config-vcs-backend, config-local-custom-parser)
 - **setup-isolated-setup-install** — 19 cases across 5 steps (runtime-routing, step-snapshot-drift, step-scope-confirm, step-hardware-key, step-roborev-exclusion)
 - **setup-privacy-llm** — 6 cases across 2 steps (step-1-resolve, step-4-gate)
 - **setup-shared-config-sync** — 12 cases across 2 steps (step-3-decide-action, step-5-draft-commit)

tools/skill-evals/evals/setup/README.md

@@ -5,7 +5,7 @@
 
 Behavioral evals for the `setup` skill.
 
-## Suites (138 cases total)
+## Suites (139 cases total)
 
 | Suite | Step | Cases | What it covers |
 |---|---|---|---|
@@ -25,7 +25,7 @@ Behavioral evals for the `setup` skill.
 | adopt-review-process | adopt.md § Step 4c | 5 | a fresh adopt finding two deviations in the confirmed documents where one is accepted and one rejected, and a release policy left alone because that family is not in the floor; a re-adoption reviewing only the one family the floor diff added; a re-adoption that adds no family, where edited process documents are still not re-read; a sentence that would weaken a merge confirmation gate, dropped and named while a label deviation beside it is written; and a repo whose only candidate document the maintainer un-ticks, skipping the step |
 | adopt-security-list | adopt.md § Step 4b | 4 | an ASF project whose dedicated security list is in its docs and on the ASF page (recommend `security@`); an ASF project with no dedicated list (no recommendation, `private@` only as a flagged fallback); a non-ASF project, which is not asked; and conflicting evidence between `SECURITY.md` and the ASF page (no recommendation, flagged fallback) |
 | setup-prefill-from-floor | install.md § Step M0b | 4 | adopted (propose the floor), unadopted (framework defaults), a foreign marketplace called out, and a snapshot lock falling through |
-| preflight-floor | preflight-block.md § Pre-flight | 18 | at floor (silent), below floor (update), plugin missing (install), foreign marketplace (ask first, run nothing), no `claude` CLI (print), unadopted (propose setup), `apache/magpie` in an alarming context (update anyway, unasked), unreadable `claude plugin list --json` (silent, treated as unknown not absent), first Magpie run (show the general welcome guide, record it, carry on), first utilities run (show the utilities welcome guide, record it, carry on), first mentoring run (show the mentoring welcome guide, record it, carry on), first pairing run (show the pairing welcome guide, record it, carry on), first issue run (show the issue welcome guide, record it, carry on), first pr-management run (show the pr-management welcome guide, record it, carry on), first contributor-growth run (show the contributor-growth welcome guide, record it, carry on), below floor on Codex (marketplace upgrade), below floor on Gemini (update the extension once), at floor on Gemini (silent) |
+| preflight-floor | preflight-block.md § Pre-flight | 19 | at floor (silent), below floor (update), plugin missing (install), foreign marketplace (ask first, run nothing), no `claude` CLI (print), unadopted (propose setup), `apache/magpie` in an alarming context (update anyway, unasked), unreadable `claude plugin list --json` (silent, treated as unknown not absent), first Magpie run (show the general welcome guide, record it, carry on), first utilities run (show the utilities welcome guide, record it, carry on), first mentoring run (show the mentoring welcome guide, record it, carry on), first pairing run (show the pairing welcome guide, record it, carry on), first issue run (show the issue welcome guide, record it, carry on), first pr-management run (show the pr-management welcome guide, record it, carry on), first contributor-growth run (show the contributor-growth welcome guide, record it, carry on), below floor on Codex (marketplace upgrade), below floor on Gemini (update the extension once), at floor on Gemini (silent), first repo-health run (show the repo-health welcome guide, record it, carry on) |
 | upgrade-adoption-split | upgrade.md § Step 0b | 4 | not adopted (nothing staged), adopted (floor raised and staged), already ahead (floor unchanged), snapshot method (falls through) |
 | verify-floor | verify.md § Adoption floor | 4 | no lock (not a fault), ahead of floor with extra plugins (not a fault), a shortfall (a fault), a floor plugin the marketplace no longer ships (a fault, not installed around) |
 | step-reconcile | reconcile.md § The sweep | 3 | a clean sweep on a pinned-snapshot install (anchor present, config resolved — stamp written, nothing proposed), a renamed step heading stranding an override's anchor (one re-anchor proposal named), a marketplace install whose plugin cache is sandbox-denied (anchor resolution left `unchecked`, config resolution still completes) |

tools/skill-evals/evals/setup/preflight-floor/fixtures/case-19-repo-health-first-run/case-meta.json

@@ -0,0 +1 @@
+{"tags":["local-smoke"]}

tools/skill-evals/evals/setup/preflight-floor/fixtures/case-19-repo-health-first-run/expected.json

@@ -0,0 +1 @@
+{"action": "welcome", "commands": [], "blocks": false}

tools/skill-evals/evals/setup/preflight-floor/fixtures/case-19-repo-health-first-run/report.md

@@ -0,0 +1,37 @@
+<!-- SPDX-License-Identifier: Apache-2.0
+     https://www.apache.org/licenses/LICENSE-2.0 -->
+
+There is no `.apache-magpie.lock`, no `.apache-magpie-overrides/` and no
+`.apache-magpie-local/` at the repo root. The running agent is Claude Code
+with magpie-setup 0.4.0 and magpie-repo-health 0.4.0 installed.
+
+The user has already seen the initial general welcome guide on an earlier run.
+The invoked skill's own frontmatter reads `name: ci-runner-audit` and
+`surface_hash: sha256:c6da72e64ac4808d`; it belongs to the repo-health family.
+This is the first time a repo-health skill has run here.
+The user asked it to "audit our CI runners".
+
+The pre-flight command printed:
+
+```json
+{
+  "findings": [
+    {
+      "code": "welcome",
+      "facts": {
+        "family": "repo-health",
+        "guide": "# \ud83d\udc26 Magpie here \u2014 your repository-health sidekick\n\nA one-minute tour, then straight back to what you asked for.\n\n## \ud83d\udd04 The typical flow\n\n1. \ud83c\udfc3 **Audit CI runners** for outdated labels \u2014 *\"audit our CI runners\"*\n2. \ud83d\udd12 **Check workflows** for security risks \u2014 *\"audit workflow security\"*\n3. \ud83d\udce6 **Audit dependencies** for vulnerabilities and licenses \u2014 *\"audit dependencies\"* / *\"check dependency licenses\"*\n4. \ud83d\udcdc **Check compliance** across LICENSE and NOTICE \u2014 *\"check license compliance\"*\n5. \ud83e\uddea **Triage flaky tests** to separate flakes from regressions \u2014 *\"find flaky tests\"*\n6. \ud83d\udee0\ufe0f **Draft a fix** for an audit finding \u2014 *\"draft a fix for this finding\"*\n\nThe six audit skills report findings without modifying project files.\n`audit-finding-fix` edits and commits a fix locally, asking before each write; `--draft-pr` opens a draft PR only after a further explicit OK.\n\n## \u2699\ufe0f Configure it\n\nSome skills need project-specific settings:\n\n- \u2699\ufe0f **Audit policy** \u2014 `repo-health-config.md` for dependency, workflow-security, license-compliance and flaky-test audits\n- \ud83d\udee0\ufe0f **Fix workflow** \u2014 `fix-workflow.md` and `runtime-invocation.md` for `audit-finding-fix`\n- \ud83d\udccb **Other audits** \u2014 CI runner and dependency-license audits have no required config\n\nConfigure personally with `/magpie-setup:setup config`.\nProject adoption with `/magpie-setup:setup adopt` is a maintainer decision.\n\n## \ud83d\udcac Just ask\n\nTalk to Magpie in plain language:\n\n- *\"find obsolete CI runner labels\"*\n- *\"check GitHub Actions permissions and triggers\"*\n- *\"audit dependency vulnerabilities and licenses\"*\n- *\"check LICENSE and NOTICE compliance\"*\n- *\"investigate flaky tests in CI\"*\n- *\"draft a tested fix for this audit finding\"*\n\n## \ud83c\udfa8 Make it yours\n\nDescribe the checks or reporting style you prefer:\n\n- *\"use our project's flaky-test thresholds\"*\n- *\"focus workflow security findings on high-risk triggers\"*\n\nEach becomes an override for the repo-health skill it changes.\nUseful elsewhere? Ask *\"upstream this change to Magpie\"* to prepare a contribution for review.\n\n## \ud83d\udc4b About this guide\n\n- **Continue** \u2014 show it again next time (three times at most)\n- **Dismiss** \u2014 hide it until the next Magpie upgrade\n- **Don't show again** \u2014 hide it for good; say *\"show the repo-health welcome again\"* to bring it back\n\nShow this again any time: `/magpie-setup:welcome-guide repo-health`\n(`/magpie-setup-welcome-guide repo-health` on a pinned snapshot).\n\n\ud83c\udf08 Prefer it in colour? Run this yourself \u2014 the `!` prefix runs it as a shell command:\n\n```text\n! PYTHONPATH=\".apache-magpie-local:$(git rev-parse --git-common-dir)/../.apache-magpie-local:$(git rev-parse --git-common-dir)/apache-magpie\" python3 -m setup_preflight.welcome show --family repo-health --color=always\n```\n",
+        "max_shown": 3,
+        "reason": "first-run",
+        "shown": 0
+      },
+      "scope": "family",
+      "section": "welcome"
+    }
+  ],
+  "rules": {
+    "welcome": "## welcome \u2014 a first-run welcome guide is due\n\nA welcome guide is due on this run: `facts.family` names it\n(`general`, for the first Magpie skill this user runs here, or the skill's own family),\nand `facts.reason` says why (`first-run`, `again`, or `upgraded` after a dismissal).\n`facts.guide` is the guide. The checker shows at most one guide per run and has already picked it.\n\n1. **Show `facts.guide` to the user verbatim**, as Markdown, before the work they asked for.\n   Do not summarise, reword, trim, or add to it, and substitute nothing in it:\n   its placeholders (`<security-list>`, `<tracker>`, `<family>`, \u2026) are meant to be read as written.\n2. **Offer the three choices in one line**:\n   **Continue** (show again next time) \u00b7 **Dismiss** (hide until the next Magpie upgrade) \u00b7 **Don't show again**.\n3. **Record `seen` at once**, which is what no answer means, then carry on with the user's request in the same turn.\n   Never block the requested work on the guide, and never wait for an answer before starting it.\n4. **When the user picks Dismiss or Don't show again** \u2014 now or later in the session \u2014 record that choice;\n   it replaces `seen`. Continue needs nothing further.\n\n```bash\nPYTHONPATH=\".apache-magpie-local:$(git rev-parse --git-common-dir)/../.apache-magpie-local:$(git rev-parse --git-common-dir)/apache-magpie\" \\\n  python3 -m setup_preflight.welcome record --family <facts.family> --choice <seen|dismiss|never>\n```\n\n`seen` brings the guide back on a later run, `facts.max_shown` recorded showings in all (`facts.shown` so far);\n`dismiss` hides it until the framework version changes; `never` hides it until re-enabled.\nEvery write merges into the personal layer's `reconciled.json` under `welcome.<facts.family>`, keeping every other key;\nnever write it by hand.\nIf the command exits non-zero, say nothing more about it and carry on.\n\nAny guide can be shown again on request with `/magpie-setup:welcome-guide [<family>]`,\nwhich also turns a hidden one back on."
+  },
+  "verdict": "action"
+}
+```

tools/skill-evals/evals/setup/preflight-floor/fixtures/case-19-repo-health-first-run/state.json

@@ -0,0 +1,24 @@
+{
+  "lock": null,
+  "plugins": [
+    [
+      "magpie-setup",
+      "0.4.0"
+    ],
+    [
+      "magpie-repo-health",
+      "0.4.0"
+    ]
+  ],
+  "reconciled": {
+    "welcome": {
+      "general": {
+        "choice": "seen",
+        "shown": 1
+      }
+    }
+  },
+  "skill": "ci-runner-audit",
+  "welcome": true,
+  "hash": "sha256:c6da72e64ac4808d"
+}