[finding] The scaffolder's "Created files" list names 12 files and omits AGENTS.md, both ~968 KB skill trees and the lockfiles — then tells you to review the skills it did not name

[os-elon]

Found during the new-developer first-run journey audit, #10264. Observed against published create-objectstack@17.1.0.

The run prints a "Created files" list of 12 files. It also writes, unlisted:

• AGENTS.md
• .github/copilot-instructions.md
• skills-lock.json
• pnpm-lock.yaml
• two skill trees of ~968 KB each — .agents/skills/ and agent/skills/, 11 skills apiece, same content, different YAML frontmatter serialization

That is roughly 1.9 MB of agent-facing instruction material, in two copies, none of it named in the summary of what was just written to the user's disk.

The pairing is what makes it a finding rather than a nit: the same run prints

"Review skills before use; they run with full agent permissions."

Being told to review files that were not listed — and not told where they are — is advice a newcomer cannot act on. For a security-flavoured warning, that is the wrong failure direction.

Two questions for whoever takes this

1. Is the duplication intentional? .agents/skills/ and agent/skills/ may be deliberate multi-agent fan-out for different tool conventions. If so, the two copies carrying different frontmatter serialization is still odd and worth a look. Neither directory appeared to be gitignored.
2. The PM's quick grep of packages/create-objectstack/src/*.ts did not locate the code that writes the skill trees, so the writer may live in a subdirectory or a sync script. This finding rests on observed output of the published package, not on a located source line — whoever takes it should start by finding the writer.

Suggested landing (hint for triage, not a routing decision)

packages/create-objectstack/src/index.ts for the summary list; the skill-copy path for the duplication question. The duplication may deserve splitting into its own card.

Filed by the PM loop from the audit in #10264. Not yet graded or routed.

[os-elon]

Claim: domain:cli lane execution seat
Session: session_019bmVFqoQPq63zhKrxdYG1r
Branch: claude/issue-10323-created-files-summary
Worktree: objectstack-issue-10323
Domain: domain:cli
File surface: whatever emits the scaffolder's "Created files" summary, and — for part ② — the skill-tree writer, once located. ⛔ Re-derive both at head; triage's own note says the finding rests on published-package output, not a source line, so ⛔ do not assume the emitter is where the output looks like it comes from.
Container & model: M, mode:subagent, model: opus
Clause-②: no — this changes what the scaffolder prints and possibly what it writes into a new project. No running server accepts, serves or refuses anything differently.
Serial constraints cleared: PR #10507 (blank template README) merged at 3a3f209e7 and PR #10522 (rendered pnpm-workspace.yaml) is enqueued green — both in this package, neither in this card's surface. Same package is exempt per this seat's standing ruling; same file is hard serial — ⚠️ if your diff needs the template README or the workspace-yaml renderer, STOP and report the collision.

⛔ Triage already scoped this card — quoting it as binding rather than re-deriving it

From the first-touch comment (5358652202), verbatim:

① make the "Created files" summary name everything the run writes (or summarize by tree with sizes) — the security-flavoured "review skills before use" advice must point at reviewable paths

② locate the skill-tree writer first (the finding rests on published-package output, not a source line) and answer whether .agents/skills/ vs agent/skills/ duplication is deliberate multi-agent fan-out — if removing a copy or changing the layout, stop and report the fork rather than deciding in-PR.

⚠️ Part ② is a stop-and-report, not a fix. Answer the question; ⛔ do not remove a copy or change the layout in this PR even if the duplication looks obviously wrong. Two skill trees at ~968 KB each is exactly the shape that looks like waste and turns out to be a deliberate fan-out for a second agent runtime — and deleting one would break that silently, in a scaffolded project, where nobody would connect the failure back to here.

Why part ① is the load-bearing half

The summary names 12 files and omits AGENTS.md, both skill trees and the lockfiles — and then tells the user to review the skills it did not name. That is worse than an incomplete list: it is security-flavoured advice pointing at paths the reader was never shown. A user who follows it reviews the 12 files they were told about and never opens the ~968 KB of agent instructions that actually shipped.

So the bar for ① is not "make the list longer" — it is that every path the run writes is reachable from what it prints. A tree summary with sizes satisfies that; an enumeration of 40 files also satisfies it; a list that grows to 15 and still omits the skill trees does not.

Measure first

⛔ Do not patch the list from reading the emitter. Scaffold a real project with the real CLI, capture what is printed, and diff it against what is actually on disk afterwards. The gap you can prove that way is the specification for ①. Exit codes captured before any pipe.

Fences

• ⛔ Never weaken a gate: no threshold moved, no baseline raised, no test skipped, quarantined or retry-wrapped.
• ⛔ Never edit content/docs/releases/**.
• If the fix needs a test, pin the property (everything written is named), not the current file count — a hard-coded 12→40 assertion rots the moment the template changes, and this card exists because a hard-coded list drifted.

premise_still_valid: false is a legitimate delivery if the summary already names everything at head.

⚠️ Race arbitration: re-read this card's comments in full before your first edit. An earlier Claim: from a different session ID wins on timestamp regardless of the assignee field.

---

Generated by Claude Code