coding-agent-skills 0.2.11 → 0.2.13

package/tests/fixtures/api-contract-audit/static-project/schemas/user.schema.ts

@@ -0,0 +1,4 @@
+export interface UserDto {
+  id: string;
+  email: string;
+}

package/tests/fixtures/api-contract-audit/static-project/src/client.ts

@@ -0,0 +1,3 @@
+export async function loadUsers() {
+  return fetch("/api/users");
+}

package/tests/fixtures/migration-review/adapter-project/.coding-agent/adapters/migration-review-fixture/adapter.json

@@ -0,0 +1,56 @@
+{
+  "adapterId": "migration-review-fixture",
+  "adapterVersion": "1.0.0",
+  "project": {
+    "id": "fixture-migration-review",
+    "detection": {
+      "rootMarkers": [
+        {"kind": "file", "path": "package.json"},
+        {"kind": "file", "path": "README.md"}
+      ],
+      "maximumDepth": 1,
+      "scope": "declared-project-root",
+      "requireApprovalOutsideScope": true
+    }
+  },
+  "supportedSkills": [
+    {
+      "id": "migration-review",
+      "compatibleVersions": ["0.2.3", "0.2.x"],
+      "declaredMode": "audit-only"
+    }
+  ],
+  "extensions": {
+    "safeReadPaths": ["db"],
+    "ignoredPaths": ["ignored", "node_modules", "dist", "build"],
+    "documentationPrecedence": ["README.md"],
+    "commandAliases": [],
+    "safeStatusCommands": [],
+    "requiredEvidence": ["project root", "adapter scope", "migration files", "not-verified database areas"],
+    "expectedRuntimeManagers": [],
+    "expectedPackageManagers": ["npm"]
+  },
+  "approvalRequirements": [],
+  "inheritance": {
+    "sharedRestrictions": "required",
+    "deniedOperationCategories": [
+      "file-write",
+      "package-install",
+      "deployment",
+      "git-mutation",
+      "unrestricted-scan",
+      "secret-read",
+      "process-mutation",
+      "service-mutation",
+      "migration-apply",
+      "privileged-api"
+    ],
+    "allowRestrictionRemoval": false,
+    "allowModeOverride": false,
+    "allowFailureSuppression": false,
+    "allowCompletionOverride": false,
+    "allowSecretExposure": false,
+    "allowRequiredEvidenceRemoval": false,
+    "allowScopeExpansionWithoutApproval": false
+  }
+}

package/tests/fixtures/migration-review/adapter-project/.coding-agent/skills.json

@@ -0,0 +1,23 @@
+{
+  "declarationVersion": "1.0.0",
+  "projectId": "fixture-migration-review",
+  "adapterRoot": ".coding-agent/adapters",
+  "adapterSchemaVersion": "1.0.0",
+  "core": {
+    "id": "coding-agent-skills",
+    "expectedVersion": "0.2.3",
+    "versionPin": ">=0.2.3 <0.3.0"
+  },
+  "compatibleSkillIds": ["migration-review"],
+  "adapters": [
+    {
+      "id": "migration-review-fixture",
+      "version": "1.0.0",
+      "skillIds": ["migration-review"]
+    }
+  ],
+  "validationCommand": "node <shared-core>/scripts/validate-project-adapters.mjs <project-root>",
+  "evidenceOutput": ".coding-agent/evidence",
+  "approvalPolicyReference": ".coding-agent/approval-policy.md",
+  "noSecrets": true
+}

package/tests/fixtures/migration-review/adapter-project/README.md

@@ -0,0 +1,3 @@
+# Adapter Migration Fixture
+
+Synthetic adapter-scoped migration fixture.

package/tests/fixtures/migration-review/adapter-project/db/migrations/001_create_accounts.sql

@@ -0,0 +1,3 @@
+CREATE TABLE accounts (
+  id text PRIMARY KEY
+);

package/tests/fixtures/migration-review/adapter-project/ignored/migrations/999_ignore.sql

@@ -0,0 +1 @@
+DROP TABLE ignored_table;

package/tests/fixtures/migration-review/adapter-project/package.json

@@ -0,0 +1,3 @@
+{
+  "name": "fixture-migration-review-adapter"
+}

package/tests/fixtures/migration-review/static-project/README.md

@@ -0,0 +1,3 @@
+# Migration Review Fixture
+
+Synthetic static migration fixture.

package/tests/fixtures/migration-review/static-project/drizzle.config.ts

@@ -0,0 +1,4 @@
+export default {
+  schema: "./src/db/schema.ts",
+  out: "./drizzle",
+};

package/tests/fixtures/migration-review/static-project/package.json

@@ -0,0 +1,7 @@
+{
+  "name": "fixture-migration-review-static",
+  "scripts": {
+    "db:migrate": "prisma migrate deploy",
+    "db:generate": "prisma generate"
+  }
+}

package/tests/fixtures/migration-review/static-project/prisma/migrations/20260703010101_init/migration.sql

@@ -0,0 +1,6 @@
+CREATE TABLE "User" (
+  "id" text PRIMARY KEY,
+  "email" text NOT NULL
+);
+
+ALTER TABLE "User" DROP COLUMN "legacyName";

package/tests/fixtures/migration-review/static-project/prisma/schema.prisma

@@ -0,0 +1,4 @@
+model User {
+  id    String @id
+  email String @unique
+}

package/tests/fixtures/triggers/cases.json

@@ -55,6 +55,30 @@
       "expectedSkill": "secret-audit",
       "notSkills": ["repo-map", "build-verify"]
     },
+    {
+      "id": "api-contract-audit-openapi",
+      "prompt": "Audit the OpenAPI file, endpoint declarations, client calls, and API schema files without running the server.",
+      "expectedSkill": "api-contract-audit",
+      "notSkills": ["route-trace", "runtime-truth"]
+    },
+    {
+      "id": "api-contract-audit-drift",
+      "prompt": "Map possible API contract drift between static route handlers and client calls before handoff.",
+      "expectedSkill": "api-contract-audit",
+      "notSkills": ["build-verify", "llm-drift-control"]
+    },
+    {
+      "id": "migration-review-static",
+      "prompt": "Review database migrations and schema files without connecting to the database.",
+      "expectedSkill": "migration-review",
+      "notSkills": ["runtime-truth", "build-verify"]
+    },
+    {
+      "id": "migration-review-rollback",
+      "prompt": "Map Prisma migrations and rollback review concerns from static files before handoff.",
+      "expectedSkill": "migration-review",
+      "notSkills": ["deployment-preflight", "runtime-truth"]
+    },
     {
       "id": "build-after-implementation",
       "prompt": "The implementation is finished. Run the existing typecheck, tests, and build.",
@@ -107,7 +131,7 @@
       "id": "negative-deploy",
       "prompt": "Deploy this application to production.",
       "expectedSkill": null,
-      "notSkills": ["repo-map", "route-trace", "env-audit", "secret-audit", "build-verify", "git-preflight", "runtime-truth", "llm-drift-control"]
+      "notSkills": ["repo-map", "route-trace", "env-audit", "secret-audit", "api-contract-audit", "migration-review", "build-verify", "git-preflight", "runtime-truth", "llm-drift-control"]
     },
     {
       "id": "negative-install",

package/tests/trigger/README.md

@@ -8,6 +8,10 @@
   secret-value inspection.
 - Redacted high-confidence secret exposure detection must trigger `secret-audit`, not
   environment variable mapping or runtime truth.
+- Static API contract mapping must trigger `api-contract-audit`, not runtime truth or
+  build verification.
+- Static migration/schema review must trigger `migration-review`, not runtime truth,
+  deployment, or migration execution.
 - Local validation must trigger `build-verify` only when project-native checks are requested.
 - Git readiness must trigger `git-preflight`, not publication.
 - Process/listener/health questions must trigger `runtime-truth`, not restart behavior.

package/work-ledger.md

@@ -4,31 +4,35 @@
 
 - Repository: `coding-agent-skills`
 - Branch: `main`
-- Pilot skills: `repo-map`, `route-trace`, `env-audit`, `secret-audit`, `build-verify`, `git-preflight`, `runtime-truth`, `llm-drift-control`
+- Pilot skills: `repo-map`, `route-trace`, `env-audit`, `secret-audit`, `api-contract-audit`, `migration-review`, `build-verify`, `git-preflight`, `runtime-truth`, `llm-drift-control`
 - Adapter discovery, project adapter installation, stale-pin detection, upgrade evidence, compatibility-chain validation, evidence-bundle verification, retention policy, provenance design, archive-report rendering, archive-index fixtures, retention-expiry advisory reporting, and detached-signature verification planning are implemented.
 - Real-project adapter adoption readiness is documented as a planning-only approval gate.
 - First external project-owned adapter adoption completed for `/home/oneclickwebsitedesignfactory/tax-lien-platform` at candidate commit `c548b1a6cbb3455a70b89d0e301e22435bfccac9`.
 - The adopted adapter is `repo-map` only, docs/metadata-only, and contains no commands, runtime checks, build/test/package behavior, platform/deployment behavior, or secret-aware behavior.
 - The shared repository does not contain real adapter manifests; real project adapters remain owned by their project repositories.
-- Public npm package release `v0.2.11` exposes the dependency-free
+- Public npm package release `v0.2.13` exposes the dependency-free
   `coding-agent-skills` CLI under MIT license.
 - `route-trace` is implemented as an audit-only static route tracing skill.
 - `env-audit` is implemented as an audit-only value-free environment variable name mapping
   skill.
 - `secret-audit` is implemented as an audit-only redacted secret exposure detection skill.
+- `api-contract-audit` is implemented as an audit-only static API contract surface mapping
+  skill.
+- `migration-review` is implemented as an audit-only static migration and schema evidence
+  review skill.
 - Builder-mode approval: complete the remaining read-only skill wave for
   `coding-agent-skills` itself. Real-world project execution constraints remain unchanged.
 
 ## Last Completed Version
 
-`v0.2.11`
+`v0.2.13`
 
 ## Current Recommended Milestone
 
-The `secret-audit` public npm release is in progress under builder-mode approval. Continue
-the remaining read-only skill wave one release at a time unless a real safety, validation,
-publication, or authentication boundary appears. The next approved wave item is
-`api-contract-audit-skill`.
+The `migration-review` public npm release is in progress under builder-mode approval.
+Continue the remaining read-only skill wave one release at a time unless a real safety,
+validation, publication, or authentication boundary appears. The next approved wave item is
+`github-handoff-skill`.
 
 ## Allowed Next Actions
 
@@ -100,6 +104,26 @@ No next runner command is currently queued.
 
 No autonomous maintainer-loop run has been recorded yet.
 
+### 2026-07-03T12:00:00Z
+
+- Latest tag observed: `v0.2.12`
+- Implemented milestone: `migration-review` audit-only static migration and schema evidence review skill and CLI command.
+- Required permission: `builder-mode-skill-implementation`
+- Validation result: pass pending final publication evidence
+- Next recommended milestone: continue builder-mode wave with `github-handoff-skill`
+  after `v0.2.13` publication completes.
+
+
+### 2026-07-03T12:00:00Z
+
+- Latest tag observed: `v0.2.11`
+- Implemented milestone: `api-contract-audit` audit-only static API contract surface mapping skill and CLI command.
+- Required permission: `builder-mode-skill-implementation`
+- Validation result: pass pending final publication evidence
+- Next recommended milestone: continue builder-mode wave with `migration-review-skill`
+  after `v0.2.12` publication completes.
+
+
 ### 2026-07-03T11:00:00Z
 
 - Latest tag observed: `v0.2.10`