coding-agent-skills 0.2.10 → 0.2.12

package/examples/evidence-packs/secret-audit.json

@@ -0,0 +1,55 @@
+{
+  "contractVersion": "1.0.0",
+  "skill": {"name": "secret-audit", "version": "0.2.3"},
+  "invocation": {
+    "id": "example-secret-audit",
+    "startedAt": "2026-07-03T11:00:00Z",
+    "endedAt": "2026-07-03T11:01:00Z"
+  },
+  "repository": {
+    "root": "/workspace/example-project",
+    "branch": "main",
+    "head": "0123456789abcdef",
+    "workingTreeState": "clean"
+  },
+  "userIntent": "Find possible tracked secret exposure before handoff.",
+  "declaredScope": ["/workspace/example-project"],
+  "projectAdapter": "example-secret-adapter",
+  "environmentSummary": {"platform": "linux", "shell": "bash"},
+  "status": "complete",
+  "confidence": {
+    "level": "high",
+    "reason": "Static files were scanned for high-confidence secret-like patterns with matched values omitted."
+  },
+  "commands": [
+    {
+      "command": "coding-agent-skills secret-audit /workspace/example-project",
+      "family": "secret-audit-renderer",
+      "workingDirectory": "/workspace/example-project",
+      "startedAt": "2026-07-03T11:00:20Z",
+      "endedAt": "2026-07-03T11:00:21Z",
+      "exitStatus": 0,
+      "resultStatus": "success",
+      "safetyClass": "allowed",
+      "approvalReference": null,
+      "purpose": "Render a redacted static secret-audit report.",
+      "outputSummary": "Reported finding paths, types, and counts without matched values."
+    }
+  ],
+  "skippedChecks": [],
+  "findings": [
+    {
+      "summary": "Potential secret exposure was reported by file path, type, and count only.",
+      "evidence": ["src/example.ts"]
+    }
+  ],
+  "risks": [],
+  "failures": [],
+  "unresolvedQuestions": [],
+  "changedState": {
+    "changed": false,
+    "summary": "No project, Git, dependency, runtime, service, or remote state changed."
+  },
+  "handoffSummary": "Secret-like findings require human review; matched values were omitted.",
+  "recommendedNextAction": "Review flagged files locally and rotate credentials only through approved project procedures."
+}

package/examples/manifests/api-contract-audit.json

@@ -0,0 +1,14 @@
+{
+  "name": "api-contract-audit",
+  "version": "0.2.3",
+  "mode": "audit-only",
+  "evidenceContract": "../../contracts/evidence-pack/evidence-pack.schema.json",
+  "commandPolicy": "../command-policies/api-contract-audit.json",
+  "adapterSchema": "../../schemas/project-adapter.schema.json",
+  "adapterCompatibility": {
+    "contractVersion": "1.0.0",
+    "compatibleAdapterVersions": ["1.0.0"]
+  },
+  "adapterInterface": "../../skills/api-contract-audit/adapter-interface.md",
+  "description": "Map static API contract surfaces without runtime calls or generation."
+}

package/examples/manifests/secret-audit.json

@@ -0,0 +1,14 @@
+{
+  "name": "secret-audit",
+  "version": "0.2.3",
+  "mode": "audit-only",
+  "evidenceContract": "../../contracts/evidence-pack/evidence-pack.schema.json",
+  "commandPolicy": "../command-policies/secret-audit.json",
+  "adapterSchema": "../../schemas/project-adapter.schema.json",
+  "adapterCompatibility": {
+    "contractVersion": "1.0.0",
+    "compatibleAdapterVersions": ["1.0.0"]
+  },
+  "adapterInterface": "../../skills/secret-audit/adapter-interface.md",
+  "description": "Find high-confidence secret exposure risks without printing values."
+}

package/examples/workflows/api-contract-audit.md

@@ -0,0 +1,8 @@
+Use `api-contract-audit` before API work or handoff:
+
+```bash
+coding-agent-skills api-contract-audit /workspace/project
+```
+
+Review contract files, endpoint declarations, client-call patterns, schema/type files,
+skipped paths, and not-verified runtime behavior before making API claims.

package/examples/workflows/secret-audit.md

@@ -0,0 +1,10 @@
+# Secret Audit Workflow
+
+Use `secret-audit` before handoff or publication:
+
+```bash
+coding-agent-skills secret-audit /workspace/project
+```
+
+Review file paths, types, counts, skipped secret-bearing paths, and not-verified stores.
+Do not ask the tool to print matched values or rotate credentials.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "coding-agent-skills",
-  "version": "0.2.10",
+  "version": "0.2.12",
   "description": "Evidence-first, read-only coding-agent skills and project adapter tooling.",
   "type": "module",
   "private": false,
@@ -11,6 +11,8 @@
     "repo-map",
     "route-trace",
     "env-audit",
+    "secret-audit",
+    "api-contract-audit",
     "project-adapters",
     "code-validation",
     "cli"

package/runs/skill-runs.md

@@ -197,3 +197,35 @@ This file records bounded maintainer-loop runs. Entries must not contain secrets
 - Validation commands: pending final release validation matrix.
 - Result: pass pending final publication evidence.
 - Commit/tag/push status: pending approved release workflow.
+
+## implementation-v0.2.11-secret-audit
+
+- Run ID: `implementation-v0.2.11-secret-audit`
+- Repository: `/home/oneclickwebsitedesignfactory/coding-agent-skills`
+- Command used: `builder-mode approval for secret-audit-skill implementation and release`
+- Files changed: `secret-audit` skill, secret-audit renderer and library, CLI wrapper,
+  adapter schemas, pack rules, release tests, synthetic secret fixtures, usage/release/
+  safety/adapter docs, changelog, roadmap, work ledger, run log, and package metadata.
+- Safety boundary: read-only, static-analysis only, no `.env` reads, no secret-file
+  reads, no matched value printing, no credential validation or rotation, no API calls,
+  no builds, no tests in target projects, no deploys, no migrations, and no
+  target-project mutation.
+- Validation commands: pending final release validation matrix.
+- Result: pass pending final publication evidence.
+- Commit/tag/push status: pending approved release workflow.
+
+## implementation-v0.2.12-api-contract-audit
+
+- Run ID: `implementation-v0.2.12-api-contract-audit`
+- Repository: `/home/oneclickwebsitedesignfactory/coding-agent-skills`
+- Command used: `builder-mode approval for api-contract-audit-skill implementation and release`
+- Files changed: `api-contract-audit` skill, API contract audit renderer and library,
+  CLI wrapper, adapter schemas, pack rules, release tests, synthetic API contract fixtures,
+  usage/release/safety/adapter docs, changelog, roadmap, work ledger, run log, and package
+  metadata.
+- Safety boundary: read-only, static-analysis only, no `.env` reads, no target runtime,
+  no URL probes, no API calls, no schema/client generation, no builds, no tests in target
+  projects, no deploys, no migrations, and no target-project mutation.
+- Validation commands: pending final release validation matrix.
+- Result: pass pending final publication evidence.
+- Commit/tag/push status: pending approved release workflow.

package/schemas/project-adapter-installation.schema.json

@@ -67,6 +67,8 @@
           "repo-map",
           "route-trace",
           "env-audit",
+          "secret-audit",
+          "api-contract-audit",
           "build-verify",
           "git-preflight",
           "runtime-truth",
@@ -101,6 +103,8 @@
               "repo-map",
               "route-trace",
               "env-audit",
+              "secret-audit",
+              "api-contract-audit",
               "build-verify",
               "git-preflight",
                 "runtime-truth",

package/schemas/project-adapter.schema.json

@@ -91,6 +91,8 @@
               "repo-map",
               "route-trace",
               "env-audit",
+              "secret-audit",
+              "api-contract-audit",
               "build-verify",
               "git-preflight",
               "runtime-truth",
@@ -169,6 +171,8 @@
                   "repo-map",
                   "route-trace",
                   "env-audit",
+                  "secret-audit",
+                  "api-contract-audit",
                   "build-verify",
                   "git-preflight",
                   "runtime-truth",