Building backlog-toolkit to Stop Accidental Backlog Uploads — Combining UI Suppression with declarativeNetRequest and Attributing Block Causes

I built backlog-toolkit, an unofficial Chrome / Edge extension that prevents accidental file uploads on configured Backlog spaces by combining content-script UI suppression with Manifest V3 declarativeNetRequest rules. It is designed for the window before access controls or DLP settings catch up, when the main concern is 'someone clicks the attachment button on the wrong document.' Rules block POST only on observed issue, comment, Wiki, and shared-file upload routes, while the content script hides file inputs, intercepts drag-and-drop, and blocks image paste. This write-up walks through the design decisions I settled during PR review: using onRuleMatchedDebug to attribute blocks only to the extension's own rules, scoping each space through a gitignored configuration file, and framing the extension as accident prevention rather than a server-side authorization boundary.

Adding ht-github-issue-rollout to hermes-talaria — Separating API Visibility from Administrative Coverage and Not Substituting Markdown Links for Native Sub-Issues

I added ht-github-issue-rollout to hermes-talaria, a skill that scans every repository in a GitHub organization or every organization and repository in an enterprise, assesses a shared request such as vulnerability remediation, and creates an approved native epic/sub-issue hierarchy. Emergency CVE responses increasingly need a coordinated bulk ask across the whole organization, and hand-wiring epics and sub-issues on a tight deadline stops being a reasonable operator task. GitHub's native sub-issue API requires parent and child repositories to share an owner, so substituting Markdown links turns it from a native hierarchy into something the platform does not aggregate. This post records the design decisions I settled during PR review: how the skill keeps the same-owner constraint, separates API visibility from administrative coverage, keeps applicable / not_applicable / unknown as distinct states, and recovers from partial failure through hidden markers.

Adding ht-gitignore-setup to hermes-talaria — Separating Scope Resolution, Template Pinning, and Pre-Write Verification

I added ht-gitignore-setup to hermes-talaria: a skill that creates or improves a .gitignore from upstream templates and repository evidence, targeting either a local directory or a GitHub repository / tree URL. Day-to-day .gitignore work with github/gitignore tends to drift into stacking Global/ OS and editor templates into a shared project file, silently pulling tracked files into the ignore set, or guessing where a tree URL's branch name ends. The skill's SKILL.md pins down scope resolution, upstream SHA pinning, pre-write validation outside the real worktree, and the right way to run git check-ignore. This write-up walks through the design decisions I settled during PR review.