coding-agent-skills 0.2.12 → 0.2.13

package/CHANGELOG.md

@@ -2,6 +2,27 @@
 
 All notable changes follow [Semantic Versioning](docs/versioning/README.md).
 
+## [0.2.13] - 2026-07-03
+
+### Added
+
+- `migration-review` audit-only skill for static database migration and schema evidence
+  review.
+- `coding-agent-skills migration-review <project-root>` CLI command.
+- Dependency-free migration review renderer for migration files, schema/config files,
+  package script keys without command values, static risk indicators, skipped paths,
+  not-verified database behavior, adapter-limited scope, and safety refusals.
+- Synthetic migration-review fixtures and release tests for generic static scans,
+  adapter-scoped scans, destructive-looking SQL indicators, package script key detection,
+  and repo-map-only adapter skips.
+
+### Changed
+
+- Adapter schemas and validators now recognize `migration-review` as an audit-only skill
+  while preserving the existing `0.2.3` adapter contract compatibility baseline.
+- Usage, release, safety, architecture, adapter, roadmap, ledger, and run-log docs now
+  describe the new static read-only migration review command.
+
 ## [0.2.12] - 2026-07-03
 
 ### Added

package/README.md

@@ -10,6 +10,7 @@ The pilot pack contains:
 - `env-audit`: audit-only environment variable name mapping without values.
 - `secret-audit`: audit-only high-confidence secret exposure detection without values.
 - `api-contract-audit`: audit-only static API contract surface mapping.
+- `migration-review`: audit-only static migration and schema evidence review.
 - `build-verify`: controlled local validation using existing project commands.
 - `git-preflight`: audit-only Git readiness inspection.
 - `runtime-truth`: audit-only runtime evidence collection.
@@ -46,6 +47,7 @@ Every skill emits the evidence-pack contract. A command being attempted is never
 - Map environment variable names with `coding-agent-skills env-audit <project-root>`.
 - Find redacted secret exposure risks with `coding-agent-skills secret-audit <project-root>`.
 - Map static API contract surfaces with `coding-agent-skills api-contract-audit <project-root>`.
+- Review static migration and schema evidence with `coding-agent-skills migration-review <project-root>`.
 - Validate project adapters against [the formal adapter schema](schemas/project-adapter.schema.json).
 - Review [external adapter discovery](docs/adapters/discovery.md).
 - Run `node scripts/validate-adapters.mjs <adapter-root>` for a disposable external root.
@@ -59,6 +61,8 @@ Every skill emits the evidence-pack contract. A command being attempted is never
   `node scripts/render-secret-audit.mjs <project-root>`.
 - Render a static API contract audit report with
   `node scripts/render-api-contract-audit.mjs <project-root>`.
+- Render a static migration review report with
+  `node scripts/render-migration-review.mjs <project-root>`.
 - Review [adapter upgrade checks](docs/adapters/upgrades.md).
 - Run `node scripts/check-adapter-upgrade.mjs <before-project-root> <after-project-root>`
   for disposable project revisions.

package/ROADMAP.md

@@ -1,6 +1,6 @@
 # Roadmap
 
-The public package now contains nine approved shared skills. Builder-mode approval is
+The public package now contains ten approved shared skills. Builder-mode approval is
 active for the remaining read-only skill wave in this repository; real-world project
 execution constraints remain unchanged.
 
@@ -36,6 +36,8 @@ execution constraints remain unchanged.
   exposure detection.
 - `v0.2.12`: audit-only `api-contract-audit` skill and CLI renderer for static API
   contract surface mapping.
+- `v0.2.13`: audit-only `migration-review` skill and CLI renderer for static migration
+  and schema evidence review.
 
 The next milestone is recorded in [work-ledger.md](work-ledger.md). The
 [maintainer loop](RUNBOOK.md) may select and evidence that milestone, but it must stop
@@ -80,8 +82,8 @@ Next safe milestone options:
 | `env-audit-skill` | General | Audit-only | Implemented in `v0.2.10` |
 | `secret-audit-skill` | General | Audit-only | Implemented in `v0.2.11` |
 | `api-contract-audit-skill` | General | Audit-only | Implemented in `v0.2.12` |
-| `migration-review-skill` | General with platform adapters | Audit-only | Builder-mode approved; next in wave |
-| `github-handoff-skill` | General | Audit-only | Builder-mode approved; later in wave |
+| `migration-review-skill` | General with platform adapters | Audit-only | Implemented in `v0.2.13` |
+| `github-handoff-skill` | General | Audit-only | Builder-mode approved; next in wave |
 | `deployment-preflight-skill` | General | Audit-only | Builder-mode approved; later in wave |
 | `cloudflare-preflight-skill` | Platform-specific | Audit-only | Builder-mode approved; later in wave |
 | `cloudflare-deploy-skill` | Platform-specific | Action-capable | Blocked on approval model |

package/bin/coding-agent-skills

@@ -47,6 +47,12 @@ const commands = {
     usage: "coding-agent-skills api-contract-audit <project-root>",
     requiredArgs: 1,
   },
+  "migration-review": {
+    script: "scripts/render-migration-review.mjs",
+    args: ([projectRoot]) => [projectRoot],
+    usage: "coding-agent-skills migration-review <project-root>",
+    requiredArgs: 1,
+  },
   "validate-adapters": {
     script: "scripts/validate-adapters.mjs",
     args: ([adapterRoot]) => [adapterRoot],
@@ -67,6 +73,7 @@ function usage(exitCode = 0) {
     "  env-audit <project-root>",
     "  secret-audit <project-root>",
     "  api-contract-audit <project-root>",
+    "  migration-review <project-root>",
     "  validate-adapters <adapter-root>",
     "",
     "local wrapper for the published coding-agent-skills package",

package/docs/adapters/README.md

@@ -104,6 +104,24 @@ reports contract files, endpoint declarations, client-call patterns, schema/type
 skipped paths, and not-verified runtime behavior. It never runs servers, calls APIs,
 generates schemas or clients, builds, tests, deploys, migrates, or mutates project files.
 
+## Adapter-Aware Migration Review Consumption
+
+The shared pack can consume a validated project-owned adapter as bounded context for
+`migration-review`:
+
+```bash
+node scripts/render-migration-review.mjs <project-root>
+```
+
+The renderer validates the project declaration when present. If an adapter is present but
+does not enable `migration-review`, it reports an adapter-limited skip instead of
+broadening scope. When enabled, it reads only adapter-declared safe paths, excludes `.env`,
+secret-bearing files, generated output, dependency paths, and oversized files, then
+reports migration files, schema/config files, package script keys, static risk indicators,
+skipped paths, and not-verified database behavior. It never connects to databases,
+executes migrations, generates ORM clients, builds, tests, deploys, or mutates project
+files.
+
 ## What Adapters May Do
 
 - Add bounded relative read paths and ignored paths.
@@ -115,6 +133,8 @@ generates schemas or clients, builds, tests, deploys, migrates, or mutates proje
   while relying on the shared scanner to exclude secret-bearing paths.
 - Add api-contract-audit safe read paths for static API docs, contract files, route
   handlers, client calls, and schema/type files.
+- Add migration-review safe read paths for static migration, schema, config, and package
+  files while relying on the shared reviewer to exclude secret-bearing paths.
 - Add command aliases that already satisfy the shared command policy.
 - Add status-only runtime commands and manager hints.
 - Require additional evidence or named approval for exceptional reads.

package/docs/adapters/project-installation.md

@@ -157,6 +157,19 @@ skip. When enabled, it reads only adapter-declared safe paths and reports static
 files, endpoint declarations, client-call patterns, schema/type files, and not-verified
 runtime behavior without running servers, calling APIs, or generating code.
 
+A project-owned adapter can also enable read-only `migration-review` context:
+
+```bash
+node scripts/render-migration-review.mjs <project-root>
+```
+
+The migration review renderer validates the project declaration when present. If the
+adapter is present but does not enable `migration-review`, it reports an adapter-limited
+skip. When enabled, it reads only adapter-declared safe paths and reports static migration
+files, schema/config files, package script keys, static risk indicators, and not-verified
+database behavior without connecting to databases, applying migrations, generating ORM
+clients, or running package scripts.
+
 ## Safety Boundary
 
 Project adapters are extension-only. They cannot remove denied operations, change an

package/docs/adapters/real-project-adoption.md

@@ -21,7 +21,7 @@ project repository is touched:
 - The project can declare exactly one installation file: `.coding-agent/skills.json` or
   `coding-agent.skills.json`.
 - The adapter need is bounded to existing pilot skills: `repo-map`, `route-trace`,
-  `env-audit`, `secret-audit`, `api-contract-audit`, `build-verify`, `git-preflight`,
+  `env-audit`, `secret-audit`, `api-contract-audit`, `migration-review`, `build-verify`, `git-preflight`,
   `runtime-truth`, or `llm-drift-control`.
 - The adapter can narrow context with relative paths, documentation precedence, safe
   aliases, status-only hints, or extra evidence requirements.

package/docs/architecture/README.md

@@ -16,6 +16,7 @@ Audit-only:
 - `env-audit`
 - `secret-audit`
 - `api-contract-audit`
+- `migration-review`
 - `git-preflight`
 - `runtime-truth`
 - `llm-drift-control`

package/docs/release/README.md

@@ -21,8 +21,9 @@
 14. Install the tarball into a temporary npm prefix and smoke-test the installed CLI.
 15. Smoke-test any new CLI command such as `coding-agent-skills route-trace`,
     `coding-agent-skills env-audit`, `coding-agent-skills secret-audit`, or
-    `coding-agent-skills api-contract-audit` against synthetic fixtures only unless a real project
-    read-only smoke is explicitly approved.
+    `coding-agent-skills api-contract-audit`, or `coding-agent-skills migration-review`
+    against synthetic fixtures only unless a real project read-only smoke is explicitly
+    approved.
 16. Review changelog, ledger, run evidence, and versioning impact.
 17. Commit with approved identity.
 18. Push `main` using credential-free remotes.

package/docs/release/npm-package.md

@@ -7,7 +7,7 @@ safety model.
 ## Current Package Shape
 
 - Package name: `coding-agent-skills`.
-- Package version: `0.2.12`.
+- Package version: `0.2.13`.
 - CLI bin: `coding-agent-skills` mapped to `bin/coding-agent-skills`.
 - Module type: `module`.
 - Dependencies: none.
@@ -31,6 +31,7 @@ coding-agent-skills route-trace /path/to/project
 coding-agent-skills env-audit /path/to/project
 coding-agent-skills secret-audit /path/to/project
 coding-agent-skills api-contract-audit /path/to/project
+coding-agent-skills migration-review /path/to/project
 coding-agent-skills validate-adapters /path/to/adapter-root
 ```
 
@@ -51,6 +52,10 @@ validating credentials.
 `api-contract-audit` is static and audit-only; it reports contract files, endpoint
 declarations, client-call patterns, schema/type files, and not-verified runtime behavior
 without running servers, calling APIs, or generating clients or schemas.
+`migration-review` is static and audit-only; it reports migration files, schema/config
+files, package script keys, static risk indicators, and not-verified database behavior
+without connecting to databases, applying migrations, generating ORM clients, or reading
+secrets.
 
 `coding-agent-skills validate-pack` is package-aware. In a source checkout, it keeps
 source-only checks such as `.gitignore` validation. In an installed package tree, where
@@ -85,7 +90,7 @@ included.
 
 The public CLI remains read-only for target projects unless a specific underlying skill
 already permits a bounded local validation action. The installed `repo-map`,
-`route-trace`, `env-audit`, `secret-audit`, `api-contract-audit`, and adapter flows do not:
+`route-trace`, `env-audit`, `secret-audit`, `api-contract-audit`, `migration-review`, and adapter flows do not:
 
 - deploy
 - run migrations

package/docs/safety/README.md

@@ -2,7 +2,7 @@
 
 ## Audit-Only Rule
 
-`repo-map`, `route-trace`, `env-audit`, `secret-audit`, `api-contract-audit`, `git-preflight`, `runtime-truth`, and `llm-drift-control` must not alter project files, Git state, dependencies, processes, services, databases, remote systems, or deployment state.
+`repo-map`, `route-trace`, `env-audit`, `secret-audit`, `api-contract-audit`, `migration-review`, `git-preflight`, `runtime-truth`, and `llm-drift-control` must not alter project files, Git state, dependencies, processes, services, databases, remote systems, or deployment state.
 
 `route-trace` is static only. It may read bounded non-secret route files and route
 configuration, but it must not execute app code, run servers, hit URLs, claim runtime
@@ -22,6 +22,11 @@ files, route handlers, client calls, and schema/type files, but it must not run
 call APIs, probe URLs, generate schemas or clients, build, test, deploy, migrate, inspect
 databases, or broaden adapter scope.
 
+`migration-review` is static only. It may read bounded non-secret migration, schema,
+config, and package files, but it must not connect to databases, apply migrations,
+generate ORM clients, run package scripts, build, test, deploy, inspect runtime state, or
+broaden adapter scope.
+
 `build-verify` may run existing project-native validation commands. Build or test tools may create their normal local artifacts, but the skill must declare observed changes and must reject installation, fix modes, snapshot updates, deployment, migration, or unknown scripts.
 
 ## Restricted Categories

package/docs/testing/README.md

@@ -59,6 +59,14 @@ declarations, client-call patterns, schema/type files, adapter-declared scope, a
 adapter-present-but-not-enabled behavior. Tests must never run servers, call endpoints,
 generate schemas or clients, build, test, deploy, migrate, or read `.env` files.
 
+## Migration Review
+
+Synthetic migration-review projects cover migration file detection, schema/config file
+detection, package script keys without command values, static risk indicators,
+adapter-declared scope, and adapter-present-but-not-enabled behavior. Tests must never
+connect to databases, apply migrations, generate ORM clients, run package scripts, build,
+test, deploy, or read `.env` files.
+
 ## Privacy And Redaction
 
 Sensitive shapes are stored as ordered synthetic parts and reconstructed only in memory. Tests verify type detection, redaction, and absence from reusable skill content without printing fixture values.

package/docs/usage/README.md

@@ -9,6 +9,7 @@ Select the least-privileged skill that matches the request:
 | Map environment variable names without values | `env-audit` |
 | Find high-confidence secret exposure risks without values | `secret-audit` |
 | Map static API contract surfaces | `api-contract-audit` |
+| Review static migration and schema evidence | `migration-review` |
 | Run existing local validation checks | `build-verify` |
 | Assess Git handoff readiness | `git-preflight` |
 | Determine what is actually running | `runtime-truth` |
@@ -24,11 +25,13 @@ Select the least-privileged skill that matches the request:
    by path, type, and count without printing matched values.
 5. Use `api-contract-audit` when OpenAPI/Swagger files, endpoint declarations, client
    calls, and schema/type files must be mapped without runtime behavior.
-6. Perform implementation outside this pilot pack.
-7. Use `build-verify` for approved project-native checks.
-8. Use `git-preflight` before handoff or publication.
-9. Use `runtime-truth` only when live local state matters.
-10. Use `llm-drift-control` when claims and evidence may disagree.
+6. Use `migration-review` when database migration, schema, config, package-script-key,
+   and static risk-indicator evidence must be mapped without database access.
+7. Perform implementation outside this pilot pack.
+8. Use `build-verify` for approved project-native checks.
+9. Use `git-preflight` before handoff or publication.
+10. Use `runtime-truth` only when live local state matters.
+11. Use `llm-drift-control` when claims and evidence may disagree.
 
 Every skill emits an evidence pack. Read `status`, skipped checks, failures, confidence, and changed state before relying on a completion claim.
 
@@ -63,6 +66,7 @@ coding-agent-skills route-trace /path/to/project
 coding-agent-skills env-audit /path/to/project
 coding-agent-skills secret-audit /path/to/project
 coding-agent-skills api-contract-audit /path/to/project
+coding-agent-skills migration-review /path/to/project
 coding-agent-skills validate-adapters /path/to/adapter-root
 ```
 
@@ -88,6 +92,10 @@ counts without printing matched values or validating credentials.
 `api-contract-audit` validates a project adapter when present, uses adapter-declared safe
 paths when enabled, and statically reports contract files, endpoint declarations,
 client-call patterns, schema/type files, skipped paths, and not-verified runtime behavior.
+`migration-review` validates a project adapter when present, uses adapter-declared safe
+paths when enabled, and statically reports migration files, schema/config files, package
+script keys, risk indicators, skipped paths, and not-verified database behavior without
+database access or migration execution.
 
 The installed CLI does not run target project builds or tests, perform runtime checks,
 deploy, migrate, mutate services or processes, or read `.env` files. Project adapters
@@ -105,6 +113,7 @@ bin/coding-agent-skills route-trace /path/to/project
 bin/coding-agent-skills env-audit /path/to/project
 bin/coding-agent-skills secret-audit /path/to/project
 bin/coding-agent-skills api-contract-audit /path/to/project
+bin/coding-agent-skills migration-review /path/to/project
 bin/coding-agent-skills validate-adapters /path/to/adapter-root
 ```
 
@@ -119,6 +128,7 @@ coding-agent-skills route-trace /path/to/project
 coding-agent-skills env-audit /path/to/project
 coding-agent-skills secret-audit /path/to/project
 coding-agent-skills api-contract-audit /path/to/project
+coding-agent-skills migration-review /path/to/project
 coding-agent-skills validate-adapters /path/to/adapter-root
 ```
 

package/examples/command-policies/migration-review.json

@@ -0,0 +1,70 @@
+{
+  "version": "0.2.3",
+  "mode": "audit-only",
+  "parserPolicy": {
+    "inspectEverySegment": true,
+    "inspectScriptBodies": true,
+    "rejectUnknownExecutables": true,
+    "rejectShellWrappers": true,
+    "rejectHeredocs": true,
+    "rejectRedirection": true,
+    "providerSpecificNpx": true,
+    "authenticatedCurlRequiresApproval": true,
+    "boundedReadsRequired": true,
+    "allowedComposition": "read-only"
+  },
+  "allowedFamilies": [
+    {
+      "name": "bounded-migration-review-inspection",
+      "executables": ["pwd", "ls", "rg", "find", "sed", "head"],
+      "argumentPolicy": {
+        "strategy": "pattern",
+        "allowedPatterns": ["bounded repository-local static migration, schema, and config inspection"],
+        "deniedPatterns": ["database access, migration execution, ORM generation, secret files, credential stores, and unbounded traversal"]
+      },
+      "constraints": [
+        "Remain inside the declared project scope.",
+        "Bound traversal depth and output.",
+        "Exclude .env, secret-bearing, generated, dependency, build, and runtime-output paths."
+      ]
+    },
+    {
+      "name": "git-identity-inspection",
+      "executables": ["git"],
+      "argumentPolicy": {
+        "strategy": "exact",
+        "allowedPatterns": ["rev-parse and status --short --branch"],
+        "deniedPatterns": ["all Git mutation and publication subcommands"]
+      },
+      "constraints": ["Allow only read-only repository identity and branch-state inspection."]
+    },
+    {
+      "name": "migration-review-renderer",
+      "executables": ["node", "coding-agent-skills"],
+      "argumentPolicy": {
+        "strategy": "exact",
+        "allowedPatterns": ["node scripts/render-migration-review.mjs <project-root>; coding-agent-skills migration-review <project-root>"],
+        "deniedPatterns": ["database access, migration execution, ORM generation, builds, tests, deployment, package installation, and secret-file reads"]
+      },
+      "constraints": [
+        "The renderer must remain static and read-only.",
+        "Do not connect to databases, apply migrations, or generate ORM clients."
+      ]
+    }
+  ],
+  "restrictedCategories": [
+    "file-write",
+    "package-install",
+    "deployment",
+    "git-mutation",
+    "unrestricted-scan",
+    "secret-read",
+    "process-mutation",
+    "service-mutation",
+    "migration-apply",
+    "privileged-api"
+  ],
+  "approvalExceptions": [
+    "A named-file approval may permit one otherwise excluded non-mutating static read when the file is not secret-bearing."
+  ]
+}

package/examples/evidence-packs/migration-review.json

@@ -0,0 +1,60 @@
+{
+  "contractVersion": "1.0.0",
+  "skill": {"name": "migration-review", "version": "0.2.3"},
+  "invocation": {
+    "id": "example-migration-review",
+    "startedAt": "2026-07-03T12:00:00Z",
+    "endedAt": "2026-07-03T12:01:00Z"
+  },
+  "repository": {
+    "root": "/workspace/example-project",
+    "branch": "main",
+    "head": "0123456789abcdef",
+    "workingTreeState": "clean"
+  },
+  "userIntent": "Map static migration and schema evidence before database handoff.",
+  "declaredScope": ["/workspace/example-project"],
+  "projectAdapter": "example-migration-review-adapter",
+  "environmentSummary": {"platform": "linux", "shell": "bash"},
+  "status": "complete",
+  "confidence": {
+    "level": "medium",
+    "reason": "Static migration and schema files were inspected, but database state was not verified."
+  },
+  "commands": [
+    {
+      "command": "coding-agent-skills migration-review /workspace/example-project",
+      "family": "migration-review-renderer",
+      "workingDirectory": "/workspace/example-project",
+      "startedAt": "2026-07-03T12:00:20Z",
+      "endedAt": "2026-07-03T12:00:21Z",
+      "exitStatus": 0,
+      "resultStatus": "success",
+      "safetyClass": "allowed",
+      "approvalReference": null,
+      "purpose": "Render a static migration review report.",
+      "outputSummary": "Reported static migration files, schema files, config files, risk indicators, skipped items, and not-verified database areas."
+    }
+  ],
+  "skippedChecks": [],
+  "findings": [
+    {
+      "summary": "Static migration evidence was mapped without database access.",
+      "evidence": ["prisma/migrations/example/migration.sql", "prisma/schema.prisma"]
+    }
+  ],
+  "risks": [
+    {
+      "summary": "Database state may differ from static migration evidence.",
+      "evidence": ["applied migration history was not queried", "runtime database connectivity was not tested"]
+    }
+  ],
+  "failures": [],
+  "unresolvedQuestions": [],
+  "changedState": {
+    "changed": false,
+    "summary": "No project, Git, dependency, runtime, database, generated-code, service, or remote state changed."
+  },
+  "handoffSummary": "Static migration evidence is mapped; applied database state remains unverified.",
+  "recommendedNextAction": "Review reported migration surfaces before editing database schema or migration files."
+}

package/examples/manifests/migration-review.json

@@ -0,0 +1,14 @@
+{
+  "name": "migration-review",
+  "version": "0.2.3",
+  "mode": "audit-only",
+  "evidenceContract": "../../contracts/evidence-pack/evidence-pack.schema.json",
+  "commandPolicy": "../command-policies/migration-review.json",
+  "adapterSchema": "../../schemas/project-adapter.schema.json",
+  "adapterCompatibility": {
+    "contractVersion": "1.0.0",
+    "compatibleAdapterVersions": ["1.0.0"]
+  },
+  "adapterInterface": "../../skills/migration-review/adapter-interface.md",
+  "description": "Map static database migration and schema evidence without database access."
+}

package/examples/workflows/migration-review.md

@@ -0,0 +1,7 @@
+# Migration Review Workflow
+
+Use `coding-agent-skills migration-review <project-root>` to map static migration, schema,
+config, package-script-key, and risk-indicator evidence before database work.
+
+The workflow remains read-only: no database connections, migration execution, ORM generation,
+package installation, builds, tests, deployments, secret-file reads, or project writes.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "coding-agent-skills",
-  "version": "0.2.12",
+  "version": "0.2.13",
   "description": "Evidence-first, read-only coding-agent skills and project adapter tooling.",
   "type": "module",
   "private": false,
@@ -13,6 +13,7 @@
     "env-audit",
     "secret-audit",
     "api-contract-audit",
+    "migration-review",
     "project-adapters",
     "code-validation",
     "cli"

package/runs/skill-runs.md

@@ -229,3 +229,19 @@ This file records bounded maintainer-loop runs. Entries must not contain secrets
 - Validation commands: pending final release validation matrix.
 - Result: pass pending final publication evidence.
 - Commit/tag/push status: pending approved release workflow.
+
+## implementation-v0.2.13-migration-review
+
+- Run ID: `implementation-v0.2.13-migration-review`
+- Repository: `/home/oneclickwebsitedesignfactory/coding-agent-skills`
+- Command used: `builder-mode approval for migration-review-skill implementation and release`
+- Files changed: `migration-review` skill, migration review renderer and library,
+  CLI wrapper, adapter schemas, pack rules, release tests, synthetic migration fixtures,
+  usage/release/safety/adapter docs, changelog, roadmap, work ledger, run log, and package
+  metadata.
+- Safety boundary: read-only, static-analysis only, no `.env` reads, no database
+  connections, no migration execution, no ORM generation, no package scripts, no builds,
+  no tests in target projects, no deploys, and no target-project mutation.
+- Validation commands: pending final release validation matrix.
+- Result: pass pending final publication evidence.
+- Commit/tag/push status: pending approved release workflow.

package/schemas/project-adapter-installation.schema.json

@@ -69,6 +69,7 @@
           "env-audit",
           "secret-audit",
           "api-contract-audit",
+          "migration-review",
           "build-verify",
           "git-preflight",
           "runtime-truth",
@@ -105,6 +106,7 @@
               "env-audit",
               "secret-audit",
               "api-contract-audit",
+              "migration-review",
               "build-verify",
               "git-preflight",
                 "runtime-truth",

package/schemas/project-adapter.schema.json

@@ -93,6 +93,7 @@
               "env-audit",
               "secret-audit",
               "api-contract-audit",
+              "migration-review",
               "build-verify",
               "git-preflight",
               "runtime-truth",
@@ -173,6 +174,7 @@
                   "env-audit",
                   "secret-audit",
                   "api-contract-audit",
+                  "migration-review",
                   "build-verify",
                   "git-preflight",
                   "runtime-truth",