feat: bootstrap upstream skills via library-skills (DRIFT-1, #14)

[mattwwarren]

Closes #14.

Summary

• Pin library-skills==0.0.5 in dev deps; bump fastapi 0.128.0 → 0.136.1 (the first version shipping a SKILL.md) via uv lock --upgrade-package fastapi.
• Add scripts/install-upstream-skills.sh — sh + uv, idempotent — that runs uv run library-skills install --yes --copy --all (writes to gitignored .agents/skills/) and cp -a each skill into .claude/skills/_upstream/<name>/.
• Vendor today's dep-tree skills as real files: fastapi (SKILL.md + 3 references) and typer (SKILL.md, transitive via library-skills).
• Add .claude/skills/_upstream/README.md with layout, refresh, and the per-refresh audit checklist (covers known precedence overrides for ASYNC-DOC-1 ASYNC-DOC-1: Document the template's async-native stance #8 and TYPE-1 TYPE-1: Add ty to CI as a non-blocking parallel type-check job #7).
• CLAUDE.md: small Skills subsection pointing at the script and noting --check's exit-1 behavior.

Decisions locked during planning

Decision	Choice	Why
Mode	--copy (real files)	PR-reviewable, Windows-safe, no .venv coupling
Layout	.claude/skills/_upstream/<name>/	Structural collision-impossibility; simplifies DRIFT-2 (#15)
Pin location	pyproject.toml dev deps + uv run	Pin lives next to ruff/mypy/pytest; uv.lock tracks it
Orchestration	scripts/install-upstream-skills.sh	Matches existing scripts/*.sh pattern (no Make)
Allowlist	none, trust dep tree	Per #14 scope; --all

Empirical finding for #9 (commented there)

uv run library-skills --check --claude exits 1 even against purely hand-authored skills (no vendored content). Confirmed by moving _upstream/ aside and re-running — implement and follow-logs both report hand-authored, exit 1. SKILL-1 (#9)'s acceptance line "still exits 0" can't be met with library-skills==0.0.5; suggested revisions filed as a comment on #9.

Explicitly out of scope

• Slash commands /library-skills-sync / /library-skills-check → future DRIFT-3 (not filed)
• Hash-based drift detection → DRIFT-3
• Collision-guard hook → DRIFT-2 (DRIFT-2: Namespace-collision guard for hand-authored vs. upstream skills #15)
• Restructuring existing skills to SKILL.md shape → SKILL-1 (SKILL-1: Establish SKILL.md + references/ convention; port one existing skill as exemplar #9)
• def-vs-async def override doc → ASYNC-DOC-1 (ASYNC-DOC-1: Document the template's async-native stance #8)
• ty CI integration → TYPE-1 (TYPE-1: Add ty to CI as a non-blocking parallel type-check job #7)

Test plan

• uv sync --dev resolves library-skills==0.0.5 and bumps fastapi to 0.136.1
• bash scripts/install-upstream-skills.sh succeeds; final line lists fastapi typer
• find .claude/skills/_upstream -type l returns empty (no symlinks)
• git check-ignore .agents/skills/fastapi/SKILL.md succeeds (staging dir ignored)
• uv run library-skills --check --claude exits 1 (expected; documented in CLAUDE.md and _upstream/README.md)
• uv run ruff check . introduces no new findings (4 pre-existing in tests/integration/test_realtime_e2e.py, unrelated)
• uv run mypy fastapi_template introduces no new findings (4 pre-existing in tests/unit/test_realtime.py, unrelated)
• CI green (will re-verify once a worker picks this up)

https://claude.ai/code/session_01QNqcHmV4tLpzneVEFiC4QM

---

Generated by Claude Code