docs: sync PRs #1042-#1061 to aeon docs

.claude/skills/aeon/SKILL.md

@@ -251,7 +251,7 @@ metadata:
 Today is ${today}. <the prompt — plain instructions, including judgment calls>
 
 ## Steps
-1. <the procedure — 43 of 80 skills lead with this>
+1. <the procedure — 43 of 81 skills lead with this>
 
 ## Network note
 <curl / WebFetch / `./secretcurl` / `gh api` — how this skill fetches>
@@ -311,9 +311,9 @@ Three at a time, not twelve. Every enabled skill is a recurring notification, an
 ./aeon packs ls                  # the six first-party packs
 ```
 
-`ls` footers with `80 skills · 1 enabled` — read it to them before proposing anything. First run installs the CLI runtime (tsx + yaml, ~12MB); the npm noise is one-time and expected. Grep-only equivalents: `references/layout.md`.
+`ls` footers with `81 skills · 1 enabled` — read it to them before proposing anything. First run installs the CLI runtime (tsx + yaml, ~12MB); the npm noise is one-time and expected. Grep-only equivalents: `references/layout.md`.
 
-Packs are a visibility filter, not a runtime switch — revealing one runs nothing. Core (12), Evolution (9) and Basics (18) show by default; Dev (12), Crypto (18) and Productivity (11) are on demand.
+Packs are a visibility filter, not a runtime switch — revealing one runs nothing. Core (12), Evolution (9) and Basics (18) show by default; Dev (12), Crypto (19) and Productivity (11) are on demand.
 
 Reasonable starting sets:
 

.claude/skills/aeon/references/layout.md

@@ -12,7 +12,7 @@ Where everything lives in an Aeon repo, and the fastest way to see what's on.
 ./aeon skills ls --enabled --json # for building the Mode 2 timeline
 ```
 
-`ls` prints `SKILL / ON / SCHEDULE / PACK / DESCRIPTION` and a footer — `80 skills · 1 enabled`. First run installs the CLI runtime (tsx + yaml, ~12MB, one-time); the noise is expected.
+`ls` prints `SKILL / ON / SCHEDULE / PACK / DESCRIPTION` and a footer — `81 skills · 1 enabled`. First run installs the CLI runtime (tsx + yaml, ~12MB, one-time); the noise is expected.
 
 **The `SCHEDULE` column is populated for disabled skills too** — it's their `aeon.yml` entry, not proof anything fires. Only the `●` in `ON` means it runs.
 

.claude/skills/aeon/references/mcp.md

@@ -7,7 +7,7 @@ Two unrelated things share the name. Get this wrong and nothing works.
 | | |
 |---|---|
 | **`.mcp.json`** — *external MCP servers, called BY Aeon skills* | Wired via the dashboard MCP panel or `./aeon mcp add`. This is what you want when a skill needs a tool. |
-| **`bin/add-mcp`** — *Aeon itself AS an MCP server* | Builds `apps/mcp-server` and registers it with Claude Code / Desktop, so all 80 skills appear as `aeon-*` tools **in your local Claude**. Nothing to do with a skill calling out. |
+| **`bin/add-mcp`** — *Aeon itself AS an MCP server* | Builds `apps/mcp-server` and registers it with Claude Code / Desktop, so all 81 skills appear as `aeon-*` tools **in your local Claude**. Nothing to do with a skill calling out. |
 
 The rest of this doc is the first one. For the second: `bin/add-mcp`, `--desktop` for a Claude Desktop snippet, `--uninstall` to remove, `claude mcp list` to verify.
 

.claude/skills/aeon/references/skill-anatomy.md

@@ -1,10 +1,10 @@
 # How Aeon skills are actually written
 
-Surveyed across all 80 skills in `aeonfun/aeon`. Frequencies are real counts — match the dominant convention unless there's a reason not to. Bodies run 133–757 lines (~306 median); a skill is a prompt, not a config file, and reads as prose.
+Surveyed across all 81 skills in `aeonfun/aeon`. Frequencies are real counts — match the dominant convention unless there's a reason not to. Bodies run 133–757 lines (~306 median); a skill is a prompt, not a config file, and reads as prose.
 
 ## Frontmatter
 
-Universal — **all 80 skills** carry these five:
+Universal — **all 81 skills** carry these five:
 
 ```yaml
 name: my-skill       # the slug (matches the skills/<slug>/ directory)
@@ -113,7 +113,7 @@ There is **no network sandbox** — plain `curl` works for unauthenticated GETs.
 
 `memory/` is the durable state that survives between runs. Four conventions, in order of how often skills touch them:
 
-### `memory/logs/${today}.md` — the run log (64 of 80 skills)
+### `memory/logs/${today}.md` — the run log (64 of 81 skills)
 
 Every skill appends what it did, under **one** heading that is exactly its slug:
 

CHANGELOG.md

@@ -11,6 +11,13 @@ from or pin to; the template keeps serving the latest `main` to new forks.
 
 ### Added
 
+- **New `miroshark-matchday` skill (Crypto & Markets).** A Friday bulk football-matchday
+  workflow on MiroShark: it builds one scenario per major league (Premier League, Serie A,
+  La Liga) from live fixtures, pays $1 USDC per sim via x402 through the Finance District
+  agent wallet (gasless EIP-3009 on Base, hard $4/run cap, retry-once-before-settlement),
+  launches all sims in parallel, collects share links and full reports, and renders one
+  1920x1080 video per sim locally (sandboxed CI ships a ready-to-run render pointer instead
+  so the paid step never repeats). Disabled by default. (#1056)
 - **New `compute-resell` skill (Crypto & Markets).** A disabled-by-default crypto
   skill that resells free or low-cost provider compute (Bankr, AWS Bedrock, Google
   Vertex) on the [Surplus Intelligence](https://surplusintelligence.ai) market. One
@@ -29,9 +36,19 @@ from or pin to; the template keeps serving the latest `main` to new forks.
   paid delivery rate, active incidents, latency, and a clear proceed/warn/block
   recommendation. It merged in a prior window but landed below the sync watermark and
   was never documented; reconciled into the catalog and icon set here. (#954)
+- **`vuln-scanner` gains an opt-in Riva research kernel.** A focused threat-model /
+  invariant scan selectable alongside the legacy scanner, with a shadow mode that runs
+  it side by side for comparison before switching over. It merged just after the prior
+  sync window but is numbered below that watermark, so it is reconciled here. (#1039)
 
 ### Changed
 
+- **`competitor-monitor` gains opt-in table-row diffing for list pages.** A watch-list
+  entry ending in `[rows]` opts that page in, so its snapshot also records every table row
+  as a normalised `cell | cell` string and the diff emits `rows_added` / `rows_removed`
+  with a capped item list. Off by default; ordinary pages never churn on table layout. Lets
+  the skill watch pages whose signal IS the rows (a vendor CVE / acknowledgements table, a
+  status-page incident table). (#1043)
 - **`deploy-uni-hook` enforces the mandatory 10 bps AeonFee on every deployed hook.**
   The audited `AeonFee` base is now ported into the skill's templates, so every hook
   the live skill deploys inherits the mandatory protocol fee to `AEON_FEE_RECIPIENT`.
@@ -40,6 +57,34 @@ from or pin to; the template keeps serving the latest `main` to new forks.
 
 ### Fixed
 
+- **Read-only skills keep `memory/` and `output/` writable in the sandbox.** The read-only
+  harness sandbox mounts the tree read-only except the state dirs, so a read-only skill can
+  still persist its `memory/` and `output/` between runs. (#1042)
+- **Read-only skills now record their `### <skill>` baseline in `memory/logs/`.** The
+  read-only capability guard logged only a content-free stub, so every read-only skill
+  (narrative-tracker, github-trending, aeon-doctor, and the rest) silently lost its
+  day-to-day baseline; it now appends the real captured run output under a `### <skill>`
+  heading for next-run dedup / diff. (#1051)
+- **A read-only skill's failure now leaves a log too.** The guard and commit steps were
+  implicitly gated on `success()`, so a failed read-only run left zero trace; a
+  `!cancelled()` guard plus a dedicated failure-log commit step fix it. (#1052)
+- **Chain runner distinguishes no-action from success.** A completed dev-loop that shipped
+  nothing now emits `CHAIN_STATUS=no-action` and is excluded from reliability bookkeeping,
+  so a no-op no longer inflates dev-loop success rates. (#1053)
+- **`vuln-scanner` bounds the trufflehog filesystem scan.** The filesystem pass is now
+  wrapped in `timeout 300` (matching the git-history pass) and scanners must not be
+  backgrounded, so a large monorepo checkout no longer burns the whole turn budget and
+  falsely reports `success`. (#1054)
+- **`github-trending` keeps its feed machine-parseable for `vuln-scanner`.** A header-only
+  notify that folded picks into a prose name list left the scanner zero parseable
+  `owner/repo` targets; the slate now requires one `[owner/repo](url)` line per pick, and
+  the scanner parses bare permalinks and falls back to search on an unparseable feed. (#1055)
+- **`aeon-update` and `changelog` close the gaps that landed downstream sync PRs CI-red.**
+  `aeon-update`'s eyebrow fail-safe now also defers a clean update/merge of an existing skill
+  whose lock entry carries findings (a line-shift above a pinned finding trips
+  `failOnCapabilityExpansion`), and the `changelog` skill runs the same formatter the CI gate
+  runs. (#1061)
+- **Dependency and CI maintenance.** (#1044, #1046, #1047, #1048, #1049, #1050, #1057, #1058)
 - **`aeon-update` derives the eyebrow version from CI.** The in-run `eyebrowlock.json`
   rescan read the version from `.github/workflows/ci-skill-integrity.yml` instead of a
   hardcoded pin, so sync PRs stop landing red on the `verify` check when CI has moved

apps/dashboard/lib/skill-icons.data.ts

@@ -43,6 +43,7 @@ export const SKILL_ICONS: Record<string, string> = {
   "last30": "<path d='M8 2v4M16 2v4'/><rect x='3' y='4' width='18' height='18' rx='2'/><path d='M3 10h18'/><path d='M8 14h.01M12 14h.01M16 14h.01M8 18h.01M12 18h.01M16 18h.01'/>",
   "memory-flush": "<rect x='4' y='6' width='16' height='12' rx='2'/><path d='M8 6V3M12 6V3M16 6V3M8 21v-3M12 21v-3M16 21v-3'/><path d='M9 11h6'/><path d='M9 14h6'/>",
   "mention-radar": "<circle cx='12' cy='12' r='4'/><path d='M16 8v5a3 3 0 0 0 6 0v-1a10 10 0 1 0-4 8'/>",
+  "miroshark-matchday": "<circle cx='12' cy='12' r='9'/><path d='M12 6.2l4.5 3.3-1.7 5.3H9.2l-1.7-5.3z'/><path d='M12 6.2V2.5M16.5 9.5l3.6-1.1M14.8 14.8l2.2 3M9.2 14.8l-2.2 3M7.5 9.5L3.9 8.4'/>",
   "monitor-polymarket": "<path d='M16 16l3-8 3 8c-.9.7-1.9 1-3 1s-2.1-.3-3-1z'/><path d='M2 16l3-8 3 8c-.9.7-1.9 1-3 1s-2.1-.3-3-1z'/><path d='M7 21h10'/><path d='M12 3v18'/><path d='M3 7h2c2 0 5-1 7-2 2 1 5 2 7 2h2'/>",
   "narrative-convergence": "<path d='M4 4l7 7'/><path d='M20 4l-7 7'/><path d='M12 11v9'/><circle cx='12' cy='11' r='1.6' fill='currentColor' stroke='none'/>",
   "narrative-tracker": "<path d='M2 6c.6.5 1.2 1 2.5 1C7 7 7 5 9.5 5c2.6 0 2.4 2 5 2 2.5 0 2.5-2 5-2 1.3 0 1.9.5 2.5 1'/><path d='M2 12c.6.5 1.2 1 2.5 1 2.5 0 2.5-2 5-2 2.6 0 2.4 2 5 2 2.5 0 2.5-2 5-2 1.3 0 1.9.5 2.5 1'/><path d='M2 18c.6.5 1.2 1 2.5 1 2.5 0 2.5-2 5-2 2.6 0 2.4 2 5 2 2.5 0 2.5-2 5-2 1.3 0 1.9.5 2.5 1'/>",

catalog/skill-icons.json

@@ -57,6 +57,7 @@
     "distribute-tokens": "<circle cx='18' cy='5' r='3'/><circle cx='6' cy='12' r='3'/><circle cx='18' cy='19' r='3'/><path d='M8.6 13.5l6.8 4'/><path d='M15.4 6.5l-6.8 4'/>",
     "finance-district-mcp": "<path d='M3 22h18'/><path d='M6 18v-7M10 18v-7M14 18v-7M18 18v-7'/><path d='M12 2 20 7H4z'/>",
     "investigation-report": "<path d='M8 11l2 2 4-4'/><circle cx='11' cy='11' r='8'/><path d='M21 21l-4.3-4.3'/>",
+    "miroshark-matchday": "<circle cx='12' cy='12' r='9'/><path d='M12 6.2l4.5 3.3-1.7 5.3H9.2l-1.7-5.3z'/><path d='M12 6.2V2.5M16.5 9.5l3.6-1.1M14.8 14.8l2.2 3M9.2 14.8l-2.2 3M7.5 9.5L3.9 8.4'/>",
     "monitor-polymarket": "<path d='M16 16l3-8 3 8c-.9.7-1.9 1-3 1s-2.1-.3-3-1z'/><path d='M2 16l3-8 3 8c-.9.7-1.9 1-3 1s-2.1-.3-3-1z'/><path d='M7 21h10'/><path d='M12 3v18'/><path d='M3 7h2c2 0 5-1 7-2 2 1 5 2 7 2h2'/>",
     "narrative-tracker": "<path d='M2 6c.6.5 1.2 1 2.5 1C7 7 7 5 9.5 5c2.6 0 2.4 2 5 2 2.5 0 2.5-2 5-2 1.3 0 1.9.5 2.5 1'/><path d='M2 12c.6.5 1.2 1 2.5 1 2.5 0 2.5-2 5-2 2.6 0 2.4 2 5 2 2.5 0 2.5-2 5-2 1.3 0 1.9.5 2.5 1'/><path d='M2 18c.6.5 1.2 1 2.5 1 2.5 0 2.5-2 5-2 2.6 0 2.4 2 5 2 2.5 0 2.5-2 5-2 1.3 0 1.9.5 2.5 1'/>",
     "onchain-monitor": "<path d='M9 17H7A5 5 0 0 1 7 7h2'/><path d='M15 7h2a5 5 0 1 1 0 10h-2'/><path d='M8 12h8'/>",