feat: Add hve-artifact-authoring skill to coding-standards collection

[dmavroeid]

Summary

Adds the hve-artifact-authoring skill to the coding-standards collection alongside python-foundational.

The skill teaches frontmatter contracts, naming conventions, collection packaging, subagent delegation, and validation pipelines for authoring HVE Core artifacts.

Benchmark Evidence (blind A/B, 8 evals, 34 expectations)

Metric	With Skill	Baseline	Delta
Mean pass rate	96%	43%	+53%

Eval	With Skill	Baseline
create-orchestrator-agent	100%	0%
create-collection-package	100%	0%
design-alignment-delegation-model	100%	0%
create-full-workflow	100%	80%
create-instruction-auto-apply	100%	50%
design-alignment-artifact-hierarchy	100%	50%
design-alignment-validation-pipeline	67%	67%
add-skill-with-scripts	100%	100%

Model: Claude Opus 4.6 (1M context)

Acceptance Criteria

• hve-artifact-authoring/SKILL.md present in coding-standards collection
• All required frontmatter fields (name:, description:, version:)
• validate:skills passes
• Skill ≤ 500 lines

Closes #1506
Part of #1504

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 82.74%. Comparing base (53ddf1a) to head (f87a10b).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1678      +/-   ##
==========================================
- Coverage   82.76%   82.74%   -0.02%     
==========================================
  Files         154      154              
  Lines       20853    20839      -14     
  Branches       13       13              
==========================================
- Hits        17259    17244      -15     
- Misses       3592     3593       +1     
  Partials        2        2              

Flag	Coverage Δ
docusaurus	94.44% <ø> (ø)
pester	86.26% <ø> (-0.02%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 2 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[dmavroeid]

CI Notes on remaining failures:

• Plugin Validation: Generated output in plugins/ and collections/*.collection.md is stale on main. Running npm run plugin:generate locally produces diffs beyond this PR's scope. Happy to include the full regeneration if preferred.
• npm Security Audit: Pre-existing qs vulnerability (GHSA-q8mj-m7cp-5q26), unrelated to this PR.

[Copilot]

Pull request overview

Adds the new hve-artifact-authoring skill to the coding-standards collection (and the aggregate hve-core-all collection), with accompanying generated plugin/collection documentation updates.

Changes:

• Introduces the new skill package at .github/skills/coding-standards/hve-artifact-authoring/ (SKILL.md + reference + templates).
• Registers the skill in collections/coding-standards.collection.yml and collections/hve-core-all.collection.yml.
• Updates auto-generated collection/plugin READMEs to list the new skill.

Reviewed changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated 13 comments.

Show a summary per file

File	Description
plugins/hve-core-all/README.md	Updates plugin skill listing to include hve-artifact-authoring
plugins/coding-standards/README.md	Updates plugin skill listing for coding-standards
collections/hve-core-all.collection.yml	Adds the new skill to the aggregate collection manifest
collections/hve-core-all.collection.md	Updates the aggregate collection’s auto-generated skill table
collections/coding-standards.collection.yml	Adds the new skill to the coding-standards collection manifest
collections/coding-standards.collection.md	Updates the coding-standards auto-generated skill table
.github/skills/coding-standards/hve-artifact-authoring/SKILL.md	Adds the new skill’s primary documentation and guidance
.github/skills/coding-standards/hve-artifact-authoring/references/frontmatter-schemas.md	Adds a frontmatter field reference doc
.github/skills/coding-standards/hve-artifact-authoring/assets/agent-template.md	Adds a starter agent template
.github/skills/coding-standards/hve-artifact-authoring/assets/collection-template.yml	Adds a starter collection manifest template
.github/skills/coding-standards/hve-artifact-authoring/assets/instruction-template.md	Adds a starter instructions template
.github/skills/coding-standards/hve-artifact-authoring/assets/prompt-template.md	Adds a starter prompt template
.github/skills/coding-standards/hve-artifact-authoring/assets/skill-template.md	Adds a starter skill template

[bindsi]

Automated review (bindsi batch). The hve-artifact-authoring skill is a valuable meta-skill for creating HVE Core artifacts. The SKILL.md comprehensively covers all artifact types (agents, prompts, instructions, skills, collections) with proper frontmatter schemas, templates, and validation guidance. Collection wiring (coding-standards, hve-core-all) and plugin generation appear consistent.

No blocking functional, security, or correctness findings. The templates in assets/ provide good starter scaffolding. LGTM.

[bindsi]

Automated batch review: no actionable findings.

[dmavroeid]

ℹ️ npm Security Audit failure is unrelated to this PR (repo-wide, transitive advisory)

The two red checks (npm Security Audit and PR Validation Success, which only aggregates it) are not caused by changes in this PR. This branch adds skill/collection/plugin files only and never touches package.json or package-lock.json.

Root cause: a newly-published advisory against the transitive dependency brace-expansion:

• GHSA-3jxr-9vmj-r5cp / CVE-2026-13149 — DoS via exponential-time brace expansion, High.
• Affected range >= 3.0.0, < 5.0.7; patched in 5.0.7. Our overrides currently pin brace-expansion to 5.0.6, which the widened advisory now flags. brace-expansion is pulled in transitively via @vscode/vsce and markdown-table-formatter (→ glob → minimatch).

Why it surfaced now / why it''s repo-wide: the advisory was published to the GitHub Advisory Database ~1 hour before this run (~2026-07-20 21:00 UTC). audit-ci queries that database live, so any audit that runs after publication fails. This PR''s audit (2026-07-20 21:23 UTC) simply happens to be the first to run afterward. Other open PRs still show green only because their audits are stale (ran hours earlier); main and all of them will fail identically on their next audit run — reproduced locally against the shared lockfile.

Fix (repo-wide, one line): bump the brace-expansion override 5.0.6 → 5.0.7 and regenerate package-lock.json. This is independent of this skill and is best handled either here as a small fix(deps) commit or via a dedicated dependency PR.

[dmavroeid]

Resolved — npm Security Audit is now passing.

Following up on my earlier note: the brace-expansion advisory has been patched upstream and this branch now includes the fix.

How it was resolved — exactly the one-line fix anticipated above: the brace-expansion override was bumped 5.0.6 → 5.0.7 (with a regenerated package-lock.json) on main via Dependabot #2481 (commit 2626c53d). I synced main into this branch (merge 9efb24b7), so the patched override is now present here. No package.json / package-lock.json edits were made in this PR itself — the fix came from upstream, as expected for a repo-wide advisory.

Verification — npm run audit:npm passes locally (0 vulnerabilities), and the npm Security Audit and PR Validation Success checks are now green on the latest commit (5fc32997).

For completeness, syncing main also pulled in a new Asset Docs Validation gate (#2470). That surfaced two follow-on items I have since addressed — adding the required docs/reference page for the skill, and trimming the skill's description to satisfy MD013 line-length — so all checks are green.