feat(skills): vendor the ponytail skill pack across all three host trees

[limcheehow]

What

Vendors the ponytail skill pack — six MIT-licensed skills from
dietrichgebert/ponytail, pinned at commit
e3ba2aa (v4.10.0) — into all three host trees, and wires them into every declaration point.

ponytail forces the laziest solution that actually works: YAGNI first, standard library before
custom code, native platform features before dependencies, one line before fifty. It is
auto-triggering on coding tasks, so once loaded it shapes how code gets written for every
coding task, not only on request.

Why

We A/B'd it on five real repos before adopting. Same tickets, same model, same repo SHAs,
per-cell clones; the arms differ only by preloading the skill (30 headless sessions, n=3 per cell,
deepseek-v4.1-flash):

Metric	ponytail vs baseline
Input tokens	−40.3%
Output tokens	−50.4%
Total tokens (incl. cache reads)	−53.7%
API calls	−38.4%
Cost	−50.4%
Source LOC written	−38.4%

Every repo used less; no repo regressed. Correctness was 100% (15/15) baseline vs
93% (14/15) ponytail. The one ponytail miss was a malformed generation — a tool-call fragment
leaked as final text with zero edits — not a quality regression. Importantly, neither arm ever
dropped a validation guard or broke an existing suite, which is the risk you'd expect a "write
less code" rule to introduce.

Honest caveats: n=3 per cell with up to 3.6× run-to-run variance, so read the means as
±10pp. One repo (city-nexus) overlaps between arms and its per-task number is not reliable; the
aggregate across all five is what holds. Five Python repos, one ticket each — this is not a
production-readiness claim.

How

Rule text is byte-for-byte upstream in all three trees. Only two things were adapted:

1. Frontmatter — license: MIT, upstream, upstream-commit added everywhere; Hermes/Codex
   host keys (version, author, platforms, metadata.hermes.*) on the ports.
2. An appended host-notes section — how each host triggers/preloads the skill.

Deliberate deviation from convention: descriptions are not given the usual
(Hermes port of ...) suffix. The description is the trigger, and rewriting it would change
when the skill fires — the one thing the A/B was measuring.

⚠️ Reviewer decision: vendoring vs the externalSkills precedent

This repo's existing pattern for third-party skills is to document them (externalSkills in
plugin.json, e.g. code-refactor) rather than vendor them. This PR knowingly vendors
instead, because that gives the team a one-command install and puts the rule text in-tree where it
can be reviewed and diffed against upstream. If you'd rather it be documentation-only, say so and
I'll rework it — the vendored copies are self-contained, so the revert is clean.

Attribution is explicit so nothing is misrepresented: skills/ponytail/LICENSE retains the upstream
MIT licence, every skill pins the upstream repo + commit, and README/CHANGELOG state plainly that
these six are third-party and do not carry the Tapway/Karpathy framing the other 24 do.

Testing

New tests/test_ponytail_pack.py — 109 checks, written RED first, and proven to
discriminate:

• removing one vendored file → 5 checks fail
• making a declared count stale → 1 check fails

It asserts that every canonical rule line survives in each host port (so the skill that ships
is the skill that was measured), upstream provenance, that declared counts agree with the
filesystem, the Hermes guard-trigger scrub, and that ponytail's description still carries its
coding-task triggers (a pack that never fires saves nothing).

• tests/test_hermes_install.py — EXPECTED and blocked grow by six, so the
  community-install guard scrub is enforced, not just documented
• tests/check_docs_consistency.py — hardcoded expectations updated
• Full suite green: 10 test files, 811 checks, 0 failures; docs consistency ALL PASS

Rollout

• counts synced everywhere: 30 canonical / 31 Hermes / 30 + $tapway umbrella Codex
• version 2.3.0 → 2.4.0 (plugin.json, marketplace.json)
• drive-by fix: marketplace.json had pre-existing stale counts (19 skills / 4 agents) that didn't
  match the filesystem — corrected to 30 skills / 5 agents

Notes

• ⚠️ Base branch: opened against master (the repo's default branch, where recent feature PRs
  docs: add direct conversational workflow to team guide #23–feat(codex): port Tapway Superpowers to OpenAI Codex (24 skills + hooks + installer) #31+ landed, and what workflow-audit.yml diffs via ${BASE_BRANCH:-master}). Note main
  no longer exists on the remote — it was renamed to master.
• Plan: docs/plans/2026-09-24-ponytail-skill-pack-adoption.md
• Checklist: docs/checklists/2026-09-24-ponytail-skill-pack-checklist.md

[github-actions]

✅ Workflow audit passed — conventional commits ✓, plan ✓, no secrets ✓.