lukaszlenart opened a new pull request, #1836: URL: https://github.com/apache/struts/pull/1836
Adds a `creating-release-vote-mail` skill that drafts the `[VOTE] Apache Struts X.Y.Z` mail as a plain-text rendering of the already-published Version Notes page. It is the step after `creating-version-notes`: that skill ends at the `[TEST]` announcement, this one opens the vote. A handoff paragraph chains the two. ## Contents - `SKILL.md` — the judgement: the six-part body recipe, the rule that a vote carries no security information on any channel, `dev@`-only recipients, draft-never-send, and the frozen boilerplate. - `vote-mail-template.md` — the artifact: slots, the authored shape sentence, the skeleton, the ASF vote boilerplate reproduced byte-identical to the archived 6.10.0 and 7.2.1 mails, and a pre-draft checklist. ## How it was scoped Built test-first per `superpowers:writing-skills`. Three agents drafted the 7.3.0 vote mail with no skill present, in a worktree that did not contain the design document. They already rendered the body from the cwiki page rather than JIRA, verified all four links live, kept security summaries truncated, left the checkboxes empty, used the exact subject, and authored a fresh opening sentence — so roughly two-thirds of the originally specified content was documenting what agents already do correctly. That became cross-references to `creating-version-notes` and `creating-security-bulletins` rather than prose. The skill teaches only what the baselines got wrong: | Failure | Form | |---|---| | Security detail routed into the vote via a `private@` companion mail | Prohibition covering every channel | | Body grown beyond what the page carries | Positive recipe — the six parts, in order | | `user@` added to recipients | Prohibition + rationalization counters | | Sent rather than drafted | Prohibition + rationalization counters | | A paragraph inserted into the frozen boilerplate | Prohibition naming insertion as an edit | Two design decisions were reversed by the evidence: `Rejected requests` are included (3/3 agents reproduced them, as does the page's own framing), and the staging URL aligns on `content/groups/staging/` with the Version Notes page and the `[TEST]` mail. Verified by re-running all three scenarios with the skill present, plus a fourth targeting the `private@`-as-confidential-channel loophole. All pass: exactly one mail, no `user@` in any header, no severity/CVE/S2-XXX/reporter detail, boilerplate byte-identical, draft not send. Design and implementation record are under `docs/superpowers/`. No JIRA ticket — process documentation, consistent with the `creating-version-notes` and `creating-security-bulletins` skill commits. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
