docs: sync PRs #1062-#1073 to aeon docs

.claude/skills/aeon/SKILL.md

@@ -251,7 +251,7 @@ metadata:
 Today is ${today}. <the prompt — plain instructions, including judgment calls>
 
 ## Steps
-1. <the procedure - 44 of 81 skills lead with this>
+1. <the procedure - 44 of 82 skills lead with this>
 
 ## Network note
 <curl / WebFetch / `./secretcurl` / `gh api` — how this skill fetches>
@@ -311,9 +311,9 @@ Three at a time, not twelve. Every enabled skill is a recurring notification, an
 ./aeon packs ls                  # the six first-party packs
 ```
 
-`ls` footers with `81 skills · 1 enabled` — read it to them before proposing anything. First run installs the CLI runtime (tsx + yaml, ~12MB); the npm noise is one-time and expected. Grep-only equivalents: `references/layout.md`.
+`ls` footers with `82 skills · 1 enabled` — read it to them before proposing anything. First run installs the CLI runtime (tsx + yaml, ~12MB); the npm noise is one-time and expected. Grep-only equivalents: `references/layout.md`.
 
-Packs are a visibility filter, not a runtime switch — revealing one runs nothing. Core (12), Evolution (9) and Basics (18) show by default; Dev (12), Crypto (19) and Productivity (11) are on demand.
+Packs are a visibility filter, not a runtime switch — revealing one runs nothing. Core (12), Evolution (9) and Basics (18) show by default; Dev (13), Crypto (19) and Productivity (11) are on demand.
 
 Reasonable starting sets:
 

.claude/skills/aeon/references/layout.md

@@ -12,7 +12,7 @@ Where everything lives in an Aeon repo, and the fastest way to see what's on.
 ./aeon skills ls --enabled --json # for building the Mode 2 timeline
 ```
 
-`ls` prints `SKILL / ON / SCHEDULE / PACK / DESCRIPTION` and a footer — `81 skills · 1 enabled`. First run installs the CLI runtime (tsx + yaml, ~12MB, one-time); the noise is expected.
+`ls` prints `SKILL / ON / SCHEDULE / PACK / DESCRIPTION` and a footer — `82 skills · 1 enabled`. First run installs the CLI runtime (tsx + yaml, ~12MB, one-time); the noise is expected.
 
 **The `SCHEDULE` column is populated for disabled skills too** — it's their `aeon.yml` entry, not proof anything fires. Only the `●` in `ON` means it runs.
 

.claude/skills/aeon/references/mcp.md

@@ -7,7 +7,7 @@ Two unrelated things share the name. Get this wrong and nothing works.
 | | |
 |---|---|
 | **`.mcp.json`** — *external MCP servers, called BY Aeon skills* | Wired via the dashboard MCP panel or `./aeon mcp add`. This is what you want when a skill needs a tool. |
-| **`bin/add-mcp`** — *Aeon itself AS an MCP server* | Builds `apps/mcp-server` and registers it with Claude Code / Desktop, so all 81 skills appear as `aeon-*` tools **in your local Claude**. Nothing to do with a skill calling out. |
+| **`bin/add-mcp`** — *Aeon itself AS an MCP server* | Builds `apps/mcp-server` and registers it with Claude Code / Desktop, so all 82 skills appear as `aeon-*` tools **in your local Claude**. Nothing to do with a skill calling out. |
 
 The rest of this doc is the first one. For the second: `bin/add-mcp`, `--desktop` for a Claude Desktop snippet, `--uninstall` to remove, `claude mcp list` to verify.
 

.claude/skills/aeon/references/skill-anatomy.md

@@ -1,10 +1,10 @@
 # How Aeon skills are actually written
 
-Surveyed across all 81 skills in `aeonfun/aeon`. Frequencies are real counts — match the dominant convention unless there's a reason not to. Bodies run 133–757 lines (~306 median); a skill is a prompt, not a config file, and reads as prose.
+Surveyed across all 82 skills in `aeonfun/aeon`. Frequencies are real counts — match the dominant convention unless there's a reason not to. Bodies run 133–757 lines (~306 median); a skill is a prompt, not a config file, and reads as prose.
 
 ## Frontmatter
 
-Universal — **all 81 skills** carry these five:
+Universal — **all 82 skills** carry these five:
 
 ```yaml
 name: my-skill       # the slug (matches the skills/<slug>/ directory)
@@ -113,7 +113,7 @@ There is **no network sandbox** — plain `curl` works for unauthenticated GETs.
 
 `memory/` is the durable state that survives between runs. Four conventions, in order of how often skills touch them:
 
-### `memory/logs/${today}.md` — the run log (64 of 81 skills)
+### `memory/logs/${today}.md` — the run log (65 of 82 skills)
 
 Every skill appends what it did, under **one** heading that is exactly its slug:
 

CHANGELOG.md

@@ -11,6 +11,23 @@ from or pin to; the template keeps serving the latest `main` to new forks.
 
 ### Added
 
+- **New `sc-audit` skill (Dev & Code).** A deep smart-contract audit skill: point it at a
+  Solidity GitHub repo, a live on-chain address (`<chain>:0x...`, with verified-source fetch
+  plus proxy/owner/funds-at-risk context), or a bundled fixture. It models the protocol
+  invariants and trust boundaries first, runs Slither best-effort, then a bounded agentic pass
+  that hunts a path breaking each invariant, triages, adversarially verifies, proves survivors
+  with a fuzzer (Echidna/Medusa), and routes each finding through `vuln-scanner`'s shared
+  responsible-disclosure machinery. The contract arm split out of `vuln-scanner`; on-chain
+  findings are operator-gated. Catalog 81 to 82. (#1072)
+- **`dev-loop` gains one verified repair pass.** The Aeon Engineer self-test chain can now fix
+  an actionable review finding, re-verify checks, and re-review before recording, instead of
+  stopping at a human handoff. The repair dispatch is authorized only by a fresh review receipt
+  bound to the PR's exact head SHA and fails closed on any mismatch; it runs at most once and
+  never loops. (#1070)
+- **`miroshark-matchday` vertical 9:16 render path.** The local video step now also renders each
+  sim to a `<out>-9x16.mp4` short-form cut (Shorts/TikTok/Reels) after the 16:9 batch, a reflow
+  rather than a center-crop; a failed vertical render is reported and never blocks the 16:9
+  delivery or re-runs anything paid. (#1062)
 - **New `miroshark-matchday` skill (Crypto & Markets).** A Friday bulk football-matchday
   workflow on MiroShark: it builds one scenario per major league (Premier League, Serie A,
   La Liga) from live fixtures, pays $1 USDC per sim via x402 through the Finance District
@@ -43,6 +60,18 @@ from or pin to; the template keeps serving the latest `main` to new forks.
 
 ### Changed
 
+- **`vuln-scanner` disclosure routing hardened.** A new SECURITY.md-first intake step resolves
+  the repo's designated channel (vendor PSIRT / bug-bounty portal, then security email, then an
+  explicit GitHub PVR, including the org-level `{owner}/.github` fallback) before the finding-type
+  matrix, so a code flaw is no longer filed on a GitHub PVR queue a vendor never reads. A PVR
+  preflight now reads the HTTP status code, so a 404 (private / missing / renamed) no longer
+  misreads as enabled. (#1073)
+- **Aeon PR watermark scoped to self-test runs.** The "Built by Aeon" / "Built autonomously by
+  Aeon" PR footer is now gated on `$AEON_DISPATCH_ID`, set only when the dev-loop chain
+  dispatches a run, so real external contributions ship without AI-attribution branding. (#1069)
+- **Maintenance.** Always-on CI Gate job added for branch protection (#1065); three
+  `curl`-piped-to-shell mentions in `vuln-scanner`'s prose rephrased to clear the eyebrow RCE
+  gate with no behavior change (#1068).
 - **`competitor-monitor` gains opt-in table-row diffing for list pages.** A watch-list
   entry ending in `[rows]` opts that page in, so its snapshot also records every table row
   as a normalised `cell | cell` string and the diff emits `rows_added` / `rows_removed`
@@ -57,6 +86,19 @@ from or pin to; the template keeps serving the latest `main` to new forks.
 
 ### Fixed
 
+- **Reflected XSS in the dashboard MCP OAuth callback (GHSA-gh95-xx4q-qch8).** `GET
+  /api/mcp-auth/callback` interpolated attacker-controlled `error` / `error_description` query
+  params into its response HTML unescaped; `page()` now HTML-escapes title and detail for every
+  caller. Same-origin script could otherwise reach the dashboard's loopback-gated `/api/*`
+  surface (write secrets, run or install skills). (#1066)
+- **Riva shadow-mode isolation gap on the MCP dispatch path.** The shadow/compare selector that
+  forces read-only mode and strips disclosure credentials lived only in the workflow's
+  `resolve-riva-capabilities.sh`, so dispatching a shadow run through `apps/mcp-server` got full
+  write tools and every live credential. The check moves into `scripts/skill_mode.sh` as one
+  enforcement point both paths consult. (#1067)
+- **Broken partner avatars on aeon.fun/ecosystem.** Refreshed the HivemindOS X avatar (old pinned
+  URL 404'd) and removed the dead Spoon row (handle gone), so neither renders a broken logo.
+  (#1071)
 - **Read-only skills keep `memory/` and `output/` writable in the sandbox.** The read-only
   harness sandbox mounts the tree read-only except the state dirs, so a read-only skill can
   still persist its `memory/` and `output/` between runs. (#1042)

docs/skill-packs.md

@@ -74,8 +74,8 @@ Pack key = category. Six packs, no empties; three are shown by default.
 | **Core** (`core`) | Fleet coordination, self-configuration, liveness, memory + reporting. Shown by default; not removable. | 12 |
 | **Evolution** (`evolution`) | The self-improvement loop — authors, evolves, installs, and heals its own skills. Shown by default. | 9 |
 | **Basics** (`basics`) | Simple, immediately-runnable skills — one approachable entry per area. Shown by default. | 18 |
-| **Dev & Code** (`dev`) | PR/issue triage, review, merges, changelogs, repo monitoring, security scanning, app deploys, cloud-cost analysis. | 12 |
-| **Crypto & Markets** (`crypto`) | Token/DeFi/prediction-market monitoring, narrative tracking, on-chain forensics + automation, compute reselling, Uniswap v4 hook deploys. | 17 |
+| **Dev & Code** (`dev`) | PR/issue triage, review, merges, changelogs, repo monitoring, security scanning, app deploys, cloud-cost analysis. | 13 |
+| **Crypto & Markets** (`crypto`) | Token/DeFi/prediction-market monitoring, narrative tracking, on-chain forensics + automation, compute reselling, Uniswap v4 hook deploys. | 19 |
 | **Productivity** (`productivity`) | Personal + social ops: routines, ideas, retrospectives, mentions, replies, ads, email, competitor watch, media + video generation. | 11 |
 
 ### Core + Evolution + Basics — what a fresh fork shows

plugin/skills/aeon/SKILL.md

@@ -251,7 +251,7 @@ metadata:
 Today is ${today}. <the prompt — plain instructions, including judgment calls>
 
 ## Steps
-1. <the procedure - 44 of 81 skills lead with this>
+1. <the procedure - 44 of 82 skills lead with this>
 
 ## Network note
 <curl / WebFetch / `./secretcurl` / `gh api` — how this skill fetches>
@@ -311,9 +311,9 @@ Three at a time, not twelve. Every enabled skill is a recurring notification, an
 ./aeon packs ls                  # the six first-party packs
 ```
 
-`ls` footers with `81 skills · 1 enabled` — read it to them before proposing anything. First run installs the CLI runtime (tsx + yaml, ~12MB); the npm noise is one-time and expected. Grep-only equivalents: `references/layout.md`.
+`ls` footers with `82 skills · 1 enabled` — read it to them before proposing anything. First run installs the CLI runtime (tsx + yaml, ~12MB); the npm noise is one-time and expected. Grep-only equivalents: `references/layout.md`.
 
-Packs are a visibility filter, not a runtime switch — revealing one runs nothing. Core (12), Evolution (9) and Basics (18) show by default; Dev (12), Crypto (19) and Productivity (11) are on demand.
+Packs are a visibility filter, not a runtime switch — revealing one runs nothing. Core (12), Evolution (9) and Basics (18) show by default; Dev (13), Crypto (19) and Productivity (11) are on demand.
 
 Reasonable starting sets:
 

plugin/skills/aeon/references/layout.md

@@ -12,7 +12,7 @@ Where everything lives in an Aeon repo, and the fastest way to see what's on.
 ./aeon skills ls --enabled --json # for building the Mode 2 timeline
 ```
 
-`ls` prints `SKILL / ON / SCHEDULE / PACK / DESCRIPTION` and a footer — `81 skills · 1 enabled`. First run installs the CLI runtime (tsx + yaml, ~12MB, one-time); the noise is expected.
+`ls` prints `SKILL / ON / SCHEDULE / PACK / DESCRIPTION` and a footer — `82 skills · 1 enabled`. First run installs the CLI runtime (tsx + yaml, ~12MB, one-time); the noise is expected.
 
 **The `SCHEDULE` column is populated for disabled skills too** — it's their `aeon.yml` entry, not proof anything fires. Only the `●` in `ON` means it runs.
 

plugin/skills/aeon/references/mcp.md

@@ -7,7 +7,7 @@ Two unrelated things share the name. Get this wrong and nothing works.
 | | |
 |---|---|
 | **`.mcp.json`** — *external MCP servers, called BY Aeon skills* | Wired via the dashboard MCP panel or `./aeon mcp add`. This is what you want when a skill needs a tool. |
-| **`bin/add-mcp`** — *Aeon itself AS an MCP server* | Builds `apps/mcp-server` and registers it with Claude Code / Desktop, so all 81 skills appear as `aeon-*` tools **in your local Claude**. Nothing to do with a skill calling out. |
+| **`bin/add-mcp`** — *Aeon itself AS an MCP server* | Builds `apps/mcp-server` and registers it with Claude Code / Desktop, so all 82 skills appear as `aeon-*` tools **in your local Claude**. Nothing to do with a skill calling out. |
 
 The rest of this doc is the first one. For the second: `bin/add-mcp`, `--desktop` for a Claude Desktop snippet, `--uninstall` to remove, `claude mcp list` to verify.
 

plugin/skills/aeon/references/skill-anatomy.md

@@ -1,10 +1,10 @@
 # How Aeon skills are actually written
 
-Surveyed across all 81 skills in `aeonfun/aeon`. Frequencies are real counts — match the dominant convention unless there's a reason not to. Bodies run 133–757 lines (~306 median); a skill is a prompt, not a config file, and reads as prose.
+Surveyed across all 82 skills in `aeonfun/aeon`. Frequencies are real counts — match the dominant convention unless there's a reason not to. Bodies run 133–757 lines (~306 median); a skill is a prompt, not a config file, and reads as prose.
 
 ## Frontmatter
 
-Universal — **all 81 skills** carry these five:
+Universal — **all 82 skills** carry these five:
 
 ```yaml
 name: my-skill       # the slug (matches the skills/<slug>/ directory)
@@ -113,7 +113,7 @@ There is **no network sandbox** — plain `curl` works for unauthenticated GETs.
 
 `memory/` is the durable state that survives between runs. Four conventions, in order of how often skills touch them:
 
-### `memory/logs/${today}.md` — the run log (64 of 81 skills)
+### `memory/logs/${today}.md` — the run log (65 of 82 skills)
 
 Every skill appends what it did, under **one** heading that is exactly its slug: