chore(skills): remove git-commit and gh-cli, which only restate AGENTS.md policy #623

Summary

.github/skills/git-commit/SKILL.md and .github/skills/gh-cli/SKILL.md carry no organization-specific procedure beyond rules that AGENTS.md already states as mandatory policy. Proposal: remove both skills and their manifest entries (skill-git-commit, skill-gh-cli in .github/instruction-surfaces.json), keeping the policy lines where they already live. The alternative, if a maintainer wants them for Copilot, is to keep them declared as Copilot-only and have downstream deliverers honor the manifest's consumers field.

What the two skills contain

git-commit (3.4 KB) is a generic Conventional Commits workflow: detect type and scope from the diff, stage logically, write the message. Its only z-shell-specific content is the safety block near the end (never skip hooks, never force-push to main, a commit does not authorize a push or PR, no bot or AI Co-authored-by), and every one of those lines restates AGENTS.md ("Commit trailers", "Conventional Commits", the authorization rules). The Conventional Commits format itself is owned by decisions/0003-conventional-commits.md.

gh-cli (3.1 KB) is a safety boundary (read-only by default, explicit authority for every write, do not treat an auth failure during an outage as an invalid token, no bypass flags) followed by "run gh --help and read current GitHub docs". The safety boundary duplicates the external-write and optional-tools sections of AGENTS.md; the rest is derivable at run time by any agent with gh installed.

Usage evidence, stated with its limits

The manifest declares both skills advisory, not required, with consumers: ["copilot"]. There is no usage record for Copilot either way, so this issue makes no claim about Copilot.

A downstream consumer that delivers every organization skill into Claude Code and Codex (without filtering by consumers; that is a downstream defect, tracked separately) recorded zero invocations of either skill across 36 Claude Code sessions and 248 Codex sessions, while the same sessions made 229 commits and 1,403 gh calls and followed the policy rules directly from AGENTS.md. That is consistent with the skills being redundant with policy, not with them being wrong; it is also exactly what the consumers declaration predicts, so it is supporting context rather than the argument.

Impact review (runbooks/instruction-update.md)

1. Kind: removal of two advisory, runtime-scoped skills. No policy text changes; the rules the skills restate remain in AGENTS.md.
2. Runtimes and contexts: declared consumer is Copilot only, in this repository. Downstream deliverers that copy the whole .github/skills tree stop receiving the two directories at their next sync.
3. Canonical owner: AGENTS.md for the commit-trailer, authorization, and outage rules; ADR-0003 for the commit format. Both already own the content; the skills were secondary copies.
4. Duplication or contradiction: removal reduces duplication. Nothing else references either skill: rg over runbooks/, decisions/, PATTERNS.md, .github/README.md, and .github/copilot-instructions.md finds no mention (the git-commit hit in actions/commit/action.yml is an icon name).
5. Manifest routes: remove the two kind: skill entries; the public manifest has no routes, so no route changes. scripts/validate-agent-policy.py scans the skill inventory, so the entries and directories must be removed in the same change.
6. Mandatory rule without optional hook or skill: unchanged; the rules were never owned by the skills. The mandatory code-review skill health rule is unaffected.
7. Generated output and size: none in this repository. The agent-instructions.yml workflow validates on any .github/skills/** change and will exercise the manifest and inventory consistency.

Proposed change

• Delete .github/skills/git-commit/ and .github/skills/gh-cli/.
• Remove skill-git-commit and skill-gh-cli from .github/instruction-surfaces.json.
• Run python3 scripts/validate-agent-policy.py and the workflow's test suite.

If the Copilot-only alternative is preferred, no change is needed here beyond a note in the manifest's description that consumers is authoritative for delivery.