fix(skills): clear high-confidence asf-coupling advisory backlog

skills/release-announce-draft/SKILL.md

@@ -29,7 +29,7 @@ license: Apache-2.0
      <version>                 → release version string (e.g. 2.11.0)
      <product-name>            → project display name (e.g. Apache Airflow)
      <promote-timestamp>       → UTC timestamp of the Step 10 svn promote commit
-     <dist-release-url>        → URL to the promoted dist/release/<project>/<version>/ directory
+     <dist-release-url>        → URL to the promoted release directory (dist/release/<project>/<version>/ when release_dist_backend = svnpubsub)
      <download-page-url>       → URL to the project's canonical Download Page
      <changelog-url>           → URL to the changelog for this release
      <keys-url>                → URL to the project KEYS file
@@ -68,7 +68,7 @@ This skill composes with:
 - `release-promote` (proposed) — upstream step; the `promoted` label on
   the planning issue confirms that Step 10 completed.
 - `release-archive-sweep` (proposed) — downstream step; runs after the
-  announcement is sent to clean up old RC artefacts from `dist/dev/`.
+  announcement is sent to clean up old RC staging artefacts.
 - `release-audit-report` (proposed) — downstream step; records the
   complete release lifecycle.
 
@@ -94,7 +94,7 @@ send. The RM can override with `--skip-promote-wait <reason>`.
 
 **Golden rule 4 — ASF address reminder.** The `[ANNOUNCE]` body header
 carries a reminder that the email must be sent from the RM's
-`@apache.org` address; the `announce@apache.org` list rejects
+`@apache.org` address; the `<announce-list>` rejects
 non-`@apache.org` senders. This reminder is always present, never
 omitted.
 
@@ -154,7 +154,7 @@ non-blocking.
   completed. The skill can also accept an explicit `--planning-issue <url>`
   override.
 - **Promote timestamp available** — the planning issue body contains the
-  UTC timestamp of the Step 10 `svn mv` (or backend-equivalent promote
+  UTC timestamp of the Step 10 promote commit (`svn mv` for `release_dist_backend = svnpubsub`, or backend-equivalent promote
   commit), or the RM provides it via `--promote-timestamp <ISO-8601>`.
 - **`<project-config>/release-management-config.md` readable** —
   `announce_list`, `announce_cc_lists`, `announce_subject_template`,
@@ -233,7 +233,7 @@ Read the following from the planning issue body and
 | `product_name` | `release-management-config.md` | derived from `project_dist_name` (capitalised display name) |
 | `version` | trigger argument | `<version>` |
 | `promote_timestamp` | planning issue body or `--promote-timestamp` | UTC ISO-8601 timestamp of Step 10 promote commit |
-| `dist_release_url` | planning issue body | URL under `dist/release/<project>/<version>/` |
+| `dist_release_url` | planning issue body | URL under `dist/release/<project>/<version>/` (for `release_dist_backend = svnpubsub`) |
 | `download_page_url` | planning issue body, config, or `--download-page` | canonical Download Page URL |
 | `changelog_url` | planning issue body | URL to changelog for this release |
 | `keys_url` | `release-management-config.md` | `keys_file_url` |
@@ -271,7 +271,7 @@ Cc: <announce_cc_lists joined by ", ">
 Subject: [ANNOUNCE] <Product Name> <version> released
 
 NOTE: This email must be sent from your @apache.org address. The
-announce@apache.org list rejects non-@apache.org senders.
+<announce-list> rejects non-@apache.org senders (for ASF TLPs).
 
 The Apache <Project Name> community is pleased to announce the release
 of <Product Name> <version>.
@@ -417,7 +417,7 @@ The AI-driven part ends with a hand-back artefact containing:
 - **Site-bump PR** — URL if opened, or "skipped — `site_repo` not
   configured", with a reminder that merge follows `[ANNOUNCE]`, not precedes it.
 - **Next steps** — `release-archive-sweep` to clean up RC artefacts from
-  `dist/dev/`; `release-audit-report` to record the lifecycle.
+  the staging area; `release-audit-report` to record the lifecycle.
 
 ---
 
@@ -470,10 +470,10 @@ The AI-driven part ends with a hand-back artefact containing:
 - `release-promote` (proposed) — upstream step; `promoted` label is the
   completion signal.
 - `release-archive-sweep` (proposed) — downstream step; cleans up RC
-  artefacts from `dist/dev/`.
+  artefacts from the staging area.
 - `release-audit-report` (proposed) — downstream step; records the
   complete lifecycle.
 - [ASF release policy § announcements](https://www.apache.org/legal/release-policy.html#release-announcements) —
-  the `announce@apache.org` requirement for ASF TLP releases.
+  the `<announce-list>` requirement for ASF TLP releases (see `release_announce_backend`).
 - [ASF release distribution](https://infra.apache.org/release-distribution.html) —
   the `closer.lua` CDN/mirror selector requirement for download links.

skills/release-archive-sweep/SKILL.md

@@ -2,7 +2,7 @@
 name: magpie-release-archive-sweep
 mode: Triage
 description: |
-  Scan `dist/release/<project>/` (or the configured distribution location),
+  Scan the release distribution area (`dist/release/<project>/` when `release_dist_backend = svnpubsub`, or the configured distribution location),
   identify releases past the project's retention rule, and propose the
   backend-shaped command set to move them to the archive area. Read-only on
   the distribution surface; the RM executes every archival command as
@@ -26,9 +26,9 @@ license: Apache-2.0
      <upstream>            → adopter's public source repo (e.g. apache/airflow)
      <project>             → project distribution name (e.g. airflow)
      <version>             → release version string (e.g. 2.11.0)
-     <dist-release-url>    → URL root for dist/release/<project>/ listing
+     <dist-release-url>    → URL root for release distribution listing (dist/release/<project>/ when release_dist_backend = svnpubsub)
      <archive-url>         → URL root for the archive area (e.g. https://archive.apache.org/dist/<project>/)
-     <svn-release-base>    → SVN URL for dist/release/<project>/ (svnpubsub backend)
+     <svn-release-base>    → SVN URL for dist/release/<project>/ (release_dist_backend = svnpubsub)
      <svn-archive-base>    → SVN URL for the archive destination
      Substitute these with concrete values from the adopting
      project's <project-config>/release-management-config.md before
@@ -42,7 +42,7 @@ set for the RM to archive them. It is Step 12 of the
 [release-management lifecycle](../../docs/release-management/process.md).
 
 The skill is **read-only on the distribution surface**. It never runs
-`svn mv`, `gh release delete`, `aws s3 mv`, or any equivalent archival
+`svn mv` (for `release_dist_backend = svnpubsub`), `gh release delete`, `aws s3 mv`, or any equivalent archival
 command. Every command it emits is paste-ready for the RM to execute under
 their own credentials.
 
@@ -66,7 +66,7 @@ This skill composes with:
 
 **Golden rule 1 — every state-changing action is a proposal.**
 The archive command set is paste-ready output for the RM. The skill never
-runs `svn mv`, `gh release`, or `aws s3 mv` on its own. The human executes
+runs `svn mv` (for `release_dist_backend = svnpubsub`), `gh release`, or `aws s3 mv` on its own. The human executes
 every archival operation.
 
 **Golden rule 2 — never archive the latest release of any supported line.**
@@ -119,7 +119,7 @@ non-blocking.
 - **`<project-config>/release-trains.md` readable** — the set of supported
   release lines and their current latest versions. Used to identify orphans.
 - **Distribution listing accessible** — the skill must be able to read the
-  list of releases currently on `dist/release/<project>/` (or the backend
+  list of releases currently on `dist/release/<project>/` (for `release_dist_backend = svnpubsub`, or the backend
   equivalent). For `svnpubsub`, this is an `svn list` call against the
   distribution URL.
 
@@ -187,7 +187,7 @@ Return ONLY valid JSON with this structure:
 3. **Apply the retention rule.** The `archive_retention_rule` field in
    `<project-config>/release-management-config.md` controls what stays.
    The ASF default rule is: **only the latest version of each supported
-   release train** remains on `dist/release/`; all earlier versions of
+   release train** remains on `dist/release/` (for `release_dist_backend = svnpubsub`); all earlier versions of
    each train are past-retention. Project configs may add more specific
    rules (e.g. keep the latest two of a given train) but may never drop
    the latest-of-each-train floor.
@@ -236,13 +236,13 @@ from the distribution surface to the archive area.
 For each past-retention version `<ver>`:
 
 ```text
-svn mv \
-  https://dist.apache.org/repos/dist/release/<project>/<ver> \
+svn mv \  # release_dist_backend=svnpubsub
+  https://dist.apache.org/repos/dist/release/<project>/<ver> \  # release_dist_backend=svnpubsub
   https://archive.apache.org/dist/<project>/<ver> \
   -m "Archive <project> <ver> per retention policy"
 ```
 
-One `svn mv` per past-retention version, in ascending version order (oldest
+One `svn mv` (for `release_dist_backend = svnpubsub`) per past-retention version, in ascending version order (oldest
 first). Include the commit message inline.
 
 **`github-releases`.**
@@ -304,7 +304,7 @@ The AI-driven part ends with a hand-back artefact containing:
 
 ## Hard rules
 
-- **Never run `svn mv`, `gh release delete`, `aws s3 mv`, or equivalent.**
+- **Never run `svn mv` (for `release_dist_backend = svnpubsub`), `gh release delete`, `aws s3 mv`, or equivalent.**
   Every archival command is paste-ready output; the RM executes it.
 - **Never archive the latest release of any supported train.** If the
   retention rule implies this, block with `retention-rule-error` and require

skills/release-keys-sync/SKILL.md

@@ -73,7 +73,7 @@ keyserver. It never requests, stores, or reads a passphrase, a
 secret-key export, or any private-key half.
 
 **Golden rule 2 — every state-changing action is a proposal.** The
-KEYS diff and `svn commit` command are paste-ready recipes for the RM.
+KEYS diff and `svn commit` (or backend-equivalent; see `release_dist_backend`) command are paste-ready recipes for the RM.
 The skill never commits or writes to any repository.
 
 **Golden rule 3 — no-op gracefully when already present.** When the
@@ -263,13 +263,13 @@ Using the public key block from Step 1, compose:
 
    ```text
    # 1. Check out only the KEYS-file directory
-   svn checkout <svn-keys-dir-url> /tmp/<project-dist-name>-keys \
+   svn checkout <svn-keys-dir-url> /tmp/<project-dist-name>-keys \  # release_dist_backend=svnpubsub
      --depth immediates
 
    # 2. Append the key block below to /tmp/<project-dist-name>-keys/KEYS
 
    # 3. Commit
-   svn commit /tmp/<project-dist-name>-keys/KEYS \
+   svn commit /tmp/<project-dist-name>-keys/KEYS \  # release_dist_backend=svnpubsub
      -m "Add <rm-uid> to KEYS (fingerprint: <fingerprint>)"
    ```
 
@@ -327,7 +327,7 @@ The AI-driven part ends with a hand-back artefact containing:
 
 - **Never hold the private key.** No passphrase, secret-key export, or
   hardware-token request of any kind.
-- **Never commit.** Every `svn commit` (or equivalent) is a paste-ready
+- **Never commit.** Every `svn commit` (or `release_dist_backend`-equivalent) is a paste-ready
   recipe; the RM runs it as themselves.
 - **Never emit commands for a key below the ASF strength floor.** Stop
   at Step 1 when the key fails strength validation.

skills/release-prepare/SKILL.md

@@ -71,7 +71,7 @@ This skill composes with:
 - `release-keys-sync` (proposed) — downstream of Step 1; syncs the
   RM's GPG key into `KEYS` before the RC is cut.
 - `release-rc-cut` (proposed) — downstream of Step 2; cuts the RC
-  tag, signs artefacts, stages to `dist/dev/`.
+  tag, signs artefacts, stages to the RC staging area (`dist/dev/` when `release_dist_backend = svnpubsub`).
 - `release-verify-rc` (proposed) — downstream of Step 2; verifies the
   staged RC before the `[VOTE]` thread opens.
 - `release-announce-draft` — downstream of Step 14 only in