coding-agent-skills 0.2.13 → 0.2.15

package/scripts/test-pack.mjs

@@ -67,6 +67,16 @@ import {
   migrationReviewCliResult,
   renderMigrationReviewReport,
 } from "./lib/migration-review.mjs";
+import {
+  buildGithubHandoffReport,
+  githubHandoffCliResult,
+  renderGithubHandoffReport,
+} from "./lib/github-handoff.mjs";
+import {
+  buildDeploymentPreflightReport,
+  deploymentPreflightCliResult,
+  renderDeploymentPreflightReport,
+} from "./lib/deployment-preflight.mjs";
 import {
   adapterUpgradeCliResult,
   checkAdapterUpgrade,
@@ -133,6 +143,27 @@ function readJson(relativePath) {
   return JSON.parse(read(relativePath));
 }
 
+function runGitFixtureCommand(cwd, args) {
+  const result = spawnSync("git", args, {
+    cwd,
+    encoding: "utf8",
+    stdio: "pipe",
+  });
+  assert.equal(result.status, 0, `git ${args.join(" ")}\n${result.stderr}`);
+  return result.stdout.trim();
+}
+
+function createGitFixture(sourceRelativePath) {
+  const temporary = fs.mkdtempSync(path.join(os.tmpdir(), "github-handoff-fixture-"));
+  fs.cpSync(path.join(root, sourceRelativePath), temporary, { recursive: true });
+  runGitFixtureCommand(temporary, ["init", "-b", "main"]);
+  runGitFixtureCommand(temporary, ["config", "user.name", "Fixture User"]);
+  runGitFixtureCommand(temporary, ["config", "user.email", "fixture@example.invalid"]);
+  runGitFixtureCommand(temporary, ["add", "."]);
+  runGitFixtureCommand(temporary, ["commit", "-m", "initial fixture commit"]);
+  return temporary;
+}
+
 function walk(directory, output = []) {
   for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
     if ([".git", "node_modules", "validation-output"].includes(entry.name)) continue;
@@ -286,10 +317,17 @@ test("local CLI maps approved commands to existing safe scripts", () => {
   assert.ok(cliText.includes("scripts/render-secret-audit.mjs"));
   assert.ok(cliText.includes("scripts/render-api-contract-audit.mjs"));
   assert.ok(cliText.includes("scripts/render-migration-review.mjs"));
+  assert.ok(cliText.includes("scripts/render-github-handoff.mjs"));
+  assert.ok(cliText.includes("scripts/render-deployment-preflight.mjs"));
   assert.ok(cliText.includes("scripts/validate-adapters.mjs"));
   assert.ok(!cliText.includes(".env"));
 
   const fixtureRoot = path.join(root, "tests", "fixtures");
+  const githubHandoffFixture = createGitFixture(
+    path.join("tests", "fixtures", "github-handoff", "static-project"),
+  );
+  fs.appendFileSync(path.join(githubHandoffFixture, "README.md"), "\nLocal handoff change.\n");
+
   const commands = [
     [["validate-pack"], /pilot pack valid/],
     [
@@ -327,6 +365,14 @@ test("local CLI maps approved commands to existing safe scripts", () => {
       ["migration-review", path.join(fixtureRoot, "migration-review", "static-project")],
       /# Migration Review Report/,
     ],
+    [
+      ["github-handoff", githubHandoffFixture],
+      /# GitHub Handoff Report/,
+    ],
+    [
+      ["deployment-preflight", path.join(fixtureRoot, "deployment-preflight", "static-project")],
+      /# Deployment Preflight Report/,
+    ],
   ];
 
   for (const [args, expected] of commands) {
@@ -351,7 +397,7 @@ test("local CLI maps approved commands to existing safe scripts", () => {
 test("npm package metadata is public-ready and dependency-free", () => {
   const packageJson = readJson("package.json");
   assert.equal(packageJson.name, "coding-agent-skills");
-  assert.equal(packageJson.version, "0.2.13");
+  assert.equal(packageJson.version, "0.2.15");
   assert.equal(
     packageJson.description,
     "Evidence-first, read-only coding-agent skills and project adapter tooling.",
@@ -368,6 +414,8 @@ test("npm package metadata is public-ready and dependency-free", () => {
     "secret-audit",
     "api-contract-audit",
     "migration-review",
+    "github-handoff",
+    "deployment-preflight",
     "project-adapters",
     "code-validation",
     "cli",
@@ -708,6 +756,105 @@ test("migration-review does not broaden a repo-map-only project adapter", () =>
   assert.match(renderMigrationReviewReport(result), /migration-review is not enabled/);
 });
 
+test("github-handoff summarizes local git state without mutating remotes", () => {
+  const fixture = createGitFixture(path.join("tests", "fixtures", "github-handoff", "static-project"));
+  runGitFixtureCommand(fixture, ["tag", "v0.0.0"]);
+  fs.appendFileSync(path.join(fixture, "README.md"), "\nChanged for handoff.\n");
+  fs.writeFileSync(path.join(fixture, "src", "new-file.js"), "export const handoff = true;\n");
+
+  const result = buildGithubHandoffReport(fixture, { coreRoot: root });
+
+  assert.equal(result.status, "complete");
+  assert.equal(result.git.branch, "main");
+  assert.ok(result.git.head);
+  assert.ok(result.git.tagsAtHead.includes("v0.0.0"));
+  assert.equal(result.changeSummary.total, 2);
+  assert.equal(result.changeSummary.modified, 1);
+  assert.equal(result.changeSummary.untracked, 1);
+  assert.ok(result.changedFiles.some((record) => record.path === "README.md"));
+  assert.ok(result.changedFiles.some((record) => record.path === "src/new-file.js"));
+  assert.match(renderGithubHandoffReport(result), /No commit, push, tag/);
+});
+
+test("github-handoff respects adapter-declared handoff metadata", () => {
+  const fixture = createGitFixture(path.join("tests", "fixtures", "github-handoff", "adapter-project"));
+  fs.appendFileSync(path.join(fixture, "src", "index.js"), "\nexport const changed = true;\n");
+
+  const result = buildGithubHandoffReport(fixture, { coreRoot: root });
+
+  assert.equal(result.status, "complete");
+  assert.equal(result.adapter.enabled, true);
+  assert.ok(result.requiredEvidence.includes("handoff summary"));
+  assert.ok(result.ignoredPaths.includes("tmp"));
+  assert.equal(result.changeSummary.modified, 1);
+  assert.ok(result.warnings.includes("github-handoff used adapter-declared handoff evidence metadata"));
+  const cli = githubHandoffCliResult(fixture, { coreRoot: root });
+  assert.equal(cli.exitCode, 0);
+  assert.match(cli.lines.join("\n"), /Github-handoff enabled: yes/);
+});
+
+test("github-handoff does not broaden a repo-map-only project adapter", () => {
+  const fixture = createGitFixture(
+    path.join("tests", "fixtures", "project-adapter-installation", "valid-exact-pin"),
+  );
+  fs.appendFileSync(path.join(fixture, "README.md"), "\nShould not be listed.\n");
+
+  const result = buildGithubHandoffReport(fixture, { coreRoot: root });
+
+  assert.equal(result.status, "partial");
+  assert.equal(result.changedFiles.length, 0);
+  assert.equal(result.changeSummary.total, 0);
+  assert.match(renderGithubHandoffReport(result), /github-handoff is not enabled/);
+});
+
+test("deployment-preflight maps static deployment surfaces without deployment behavior", () => {
+  const result = buildDeploymentPreflightReport(
+    path.join(root, "tests", "fixtures", "deployment-preflight", "static-project"),
+    { coreRoot: root },
+  );
+
+  assert.equal(result.status, "complete");
+  assert.ok(result.configFiles.some((record) => record.path === "wrangler.toml"));
+  assert.ok(result.configFiles.some((record) => record.path === "Dockerfile"));
+  assert.ok(result.deploymentDocs.some((record) => record.path === "docs/deployment.md"));
+  assert.ok(result.packageScriptKeys.some((record) => record.key === "deploy"));
+  assert.ok(result.platformIndicators.some((record) => record.platform === "cloudflare"));
+  assert.ok(result.riskIndicators.some((record) => record.type === "production-reference"));
+  assert.match(renderDeploymentPreflightReport(result), /No deployment, cloud provider API call/);
+});
+
+test("deployment-preflight respects adapter-declared scope", () => {
+  const result = buildDeploymentPreflightReport(
+    path.join(root, "tests", "fixtures", "deployment-preflight", "adapter-project"),
+    { coreRoot: root },
+  );
+
+  assert.equal(result.status, "complete");
+  assert.equal(result.adapter.enabled, true);
+  assert.deepEqual(result.scopePaths, ["deploy"]);
+  assert.deepEqual(result.filesScanned, ["deploy/netlify.toml"]);
+  assert.ok(result.configFiles.some((record) => record.path === "deploy/netlify.toml"));
+  assert.ok(result.warnings.includes("deployment-preflight used adapter-declared safe read paths only"));
+  const cli = deploymentPreflightCliResult(
+    path.join(root, "tests", "fixtures", "deployment-preflight", "adapter-project"),
+    { coreRoot: root },
+  );
+  assert.equal(cli.exitCode, 0);
+  assert.match(cli.lines.join("\n"), /Deployment-preflight enabled: yes/);
+});
+
+test("deployment-preflight does not broaden a repo-map-only project adapter", () => {
+  const result = buildDeploymentPreflightReport(
+    path.join(root, "tests", "fixtures", "project-adapter-installation", "valid-exact-pin"),
+    { coreRoot: root },
+  );
+
+  assert.equal(result.status, "partial");
+  assert.equal(result.filesScanned.length, 0);
+  assert.equal(result.configFiles.length, 0);
+  assert.match(renderDeploymentPreflightReport(result), /deployment-preflight is not enabled/);
+});
+
 test("validate-pack accepts installed package trees without source-only gitignore", () => {
   const temporaryRoot = fs.mkdtempSync(path.join(os.tmpdir(), "installed-package-"));
   const installedRoot = path.join(temporaryRoot, "coding-agent-skills");

package/scripts/validate-pack.mjs

@@ -100,6 +100,8 @@ const requiredRootFiles = [
   "scripts/render-secret-audit.mjs",
   "scripts/render-api-contract-audit.mjs",
   "scripts/render-migration-review.mjs",
+  "scripts/render-github-handoff.mjs",
+  "scripts/render-deployment-preflight.mjs",
   "scripts/check-adapter-upgrade.mjs",
   "scripts/check-adapter-upgrade-chain.mjs",
   "scripts/validate-adapters.mjs",
@@ -110,6 +112,8 @@ const requiredRootFiles = [
   "scripts/lib/secret-audit.mjs",
   "scripts/lib/api-contract-audit.mjs",
   "scripts/lib/migration-review.mjs",
+  "scripts/lib/github-handoff.mjs",
+  "scripts/lib/deployment-preflight.mjs",
   "scripts/lib/adapter-upgrade.mjs",
   "scripts/lib/adapter-upgrade-chain.mjs",
   "scripts/lib/adapter-discovery.mjs",
@@ -683,8 +687,8 @@ if (packageJson) {
   if (packageJson.name !== "coding-agent-skills") {
     failures.push("package.json has unexpected package name");
   }
-  if (packageJson.version !== "0.2.13") {
-    failures.push("package.json version must be 0.2.13 for public package validation");
+  if (packageJson.version !== "0.2.15") {
+    failures.push("package.json version must be 0.2.15 for public package validation");
   }
   if (packageJson.type !== "module") failures.push("package.json must preserve ESM mode");
   if (packageJson.private !== false) {
@@ -707,6 +711,8 @@ if (packageJson) {
       "secret-audit",
       "api-contract-audit",
       "migration-review",
+      "github-handoff",
+      "deployment-preflight",
       "project-adapters",
       "code-validation",
       "cli",

package/skills/deployment-preflight/SKILL.md

@@ -0,0 +1,89 @@
+---
+name: deployment-preflight
+description: Map statically visible deployment readiness evidence without deploying, calling provider APIs, installing packages, building, testing, reading secrets, or mutating project/runtime state. Use when Codex needs a bounded pre-deploy orientation report from config files, docs, package script keys, and static platform indicators before separately approved deployment work.
+---
+
+# Deployment Preflight
+
+Map deployment-related evidence that is already visible in the repository. Remain
+audit-only and avoid turning preflight discovery into deployment, cloud, runtime, build, or
+secret work.
+
+This skill must not change project files, Git state, dependencies, runtime state, services,
+databases, cloud provider state, remotes, deployment targets, or generated outputs.
+
+## Purpose And Use
+
+Use this skill before deployment planning, release handoff, or platform-specific work when
+the agent needs to understand visible deployment config, deployment docs, platform hints,
+and static readiness risks.
+
+Do not use it as proof of deployability, provider CLI behavior, cloud API state, domain
+validity, environment values, build outcomes, test outcomes, service runtime, deployment
+publication, database migration state, or secret content.
+
+## Inputs
+
+Require a project root or starting path. Optionally accept a project adapter, intended scan
+area, documentation precedence, deployment config hints, or known platform boundaries.
+
+Do not assume a missing deployment config means no deployment exists, package script keys are
+safe to run, provider credentials are present, remote state matches repository state, or a
+project adapter enables this skill unless validation proves it.
+
+## Procedure
+
+1. Record user intent, project root, declared scope, adapter state, and safety boundary.
+2. Validate a project adapter when present before reading adapter-declared metadata.
+3. If an adapter is present but does not enable `deployment-preflight`, stop static file
+   reading and report the adapter-limited skip.
+4. Build scan scope from adapter safe read paths when available; otherwise use a bounded
+   generic static scan.
+5. Exclude `.env`, secret-bearing files, generated output, dependency paths, build output,
+   runtime output, and oversized files before reading.
+6. Identify deployment config files and platform indicators.
+7. Identify deployment documentation and runbook references.
+8. Identify package script keys that mention deployment tooling without printing command
+   values.
+9. Identify static risk indicators without judging runtime or provider safety.
+10. Emit the shared evidence pack or deployment preflight report before claiming completion.
+
+Use [checklist.md](checklist.md). Consult [failure-modes.md](failure-modes.md),
+[adapter-interface.md](adapter-interface.md), and [examples.md](examples.md). Format findings
+with [evidence-template.md](evidence-template.md).
+
+## Evidence, Recovery, And Dependencies
+
+Emit repository identity, adapter state, scan scope, ignored paths, files scanned, deployment
+config files, deployment docs, package script keys, platform indicators, risk indicators,
+skipped items, not-verified areas, warnings, and changed-state declaration through the
+shared evidence-pack contract.
+
+Recover from missing configs, ambiguous platform hints, unreadable files, or adapter limits
+by reporting uncertainty. Never recover by deploying, running provider CLIs, calling cloud
+APIs, installing dependencies, building, testing, starting services, broadening adapter
+scope, or reading `.env`.
+
+This skill depends on the evidence-pack contract and may consume validated project adapters.
+Adapters may add safe paths, ignored paths, documentation precedence, and evidence
+requirements, but cannot weaken policy or turn this skill into deployment work.
+
+## Approval Boundary
+
+Explicit approval may permit one named non-secret static file read outside normal source
+paths. Approval does not permit `.env` or secret-file reads, provider API calls, provider CLI
+execution, package installation, builds, tests, runtime checks, service mutation,
+deployments, migrations, Git mutation, or project writes.
+
+## Completion
+
+Claim `complete` only when the declared static scan scope was inspected, visible deployment
+surfaces are reported, skipped and not-verified areas are explicit, adapter limitations are
+clear, and no project, Git, dependency, runtime, service, database, cloud provider, remote,
+deployment, or generated-output state changed.
+
+Report `partial`, `failed`, or `blocked` when adapter scope prevents scanning, requested
+evidence requires deployment/runtime/provider behavior, the project root cannot be
+established, or safety exclusions prevent the requested conclusion.
+
+These conditions are both the acceptance criteria and definition of done.

package/skills/deployment-preflight/adapter-interface.md

@@ -0,0 +1,17 @@
+# Deployment Preflight Adapter Interface
+
+Adapters may narrow the static scan by declaring:
+
+- `extensions.safeReadPaths`
+- `extensions.ignoredPaths`
+- `extensions.documentationPrecedence`
+- `extensions.requiredEvidence`
+- `extensions.expectedPackageManagers`
+
+Adapters must declare `deployment-preflight` with `declaredMode: "audit-only"` and
+compatible core versions. They cannot allow deployments, provider API calls, package
+installs, builds, tests, runtime checks, migrations, secret reads, project writes, failure
+suppression, completion overrides, or scope expansion without approval.
+
+If a project adapter is present but does not enable `deployment-preflight`, the skill reports
+`partial` and does not read target files.

package/skills/deployment-preflight/agents/openai.yaml

@@ -0,0 +1,3 @@
+display_name: Deployment Preflight
+short_description: Map static deployment readiness evidence without deploying or calling provider APIs.
+default_prompt: Review this repository's static deployment readiness evidence as an audit-only pass without modifying files, deploying, calling provider APIs, installing packages, building, testing, mutating services, or reading secrets.

package/skills/deployment-preflight/checklist.md

@@ -0,0 +1,7 @@
+# Deployment Preflight Checklist
+
+- Confirm the project root, branch state, adapter state, and declared scan scope.
+- Validate the project adapter before consuming adapter-declared paths.
+- Exclude `.env`, secret-bearing, generated, dependency, build, runtime-output, and oversized files.
+- Report deployment config files, deployment docs, package script keys, platform indicators, risk indicators, skipped items, and not-verified areas.
+- Confirm no deployment, provider API call, package install, build, test, runtime check, migration, secret read, project write, or Git mutation occurred.

package/skills/deployment-preflight/evidence-template.md

@@ -0,0 +1,19 @@
+# Deployment Preflight Evidence Template
+
+- Status:
+- Project root:
+- Branch state:
+- Adapter present/enabled:
+- Scope paths:
+- Ignored paths:
+- Files scanned:
+- Deployment config files:
+- Deployment docs:
+- Package script keys:
+- Platform indicators:
+- Risk indicators:
+- Skipped items:
+- Not verified:
+- Refused behavior:
+- Changed-state declaration:
+- Recommended next action:

package/skills/deployment-preflight/examples.md

@@ -0,0 +1,11 @@
+# Deployment Preflight Examples
+
+**Safe:** `coding-agent-skills deployment-preflight /workspace/project`
+
+**Safe:** `node scripts/render-deployment-preflight.mjs /workspace/project`
+
+**Unsafe and denied:** provider deployment commands, package deploy scripts, and production
+publish commands.
+
+Use the report to orient future deployment planning. Do not treat static evidence as proof
+that credentials, cloud resources, domains, builds, or deployed services are valid.

package/skills/deployment-preflight/failure-modes.md

@@ -0,0 +1,11 @@
+# Deployment Preflight Failure Modes
+
+- The project root cannot be established.
+- A project adapter is present but invalid or does not enable `deployment-preflight`.
+- Deployment config is absent, generated, or outside the approved scan scope.
+- Files are skipped because they are secret-bearing, oversized, symlinked, generated, or ignored.
+- A request asks for provider state, deployment execution, runtime health, credential checks, or build verification.
+
+Recover by reporting partial evidence and clear uncertainty. Do not recover by deploying,
+calling provider APIs, installing packages, building, testing, running services, widening
+scope, or reading secrets.

package/skills/github-handoff/SKILL.md

@@ -0,0 +1,95 @@
+---
+name: github-handoff
+description: Prepare read-only GitHub handoff evidence from local Git metadata. Use when Codex needs to summarize branch state, HEAD, tags at HEAD, remote names, and changed-file status before a separately approved pull request, release, or GitHub workflow handoff without creating commits, pushes, tags, pull requests, API calls, token reads, or file changes.
+---
+
+# GitHub Handoff
+
+## Purpose And Use
+
+Use this skill to produce a local, audit-only handoff report before a human or separately approved workflow performs GitHub work.
+
+The skill is for local Git evidence only. It does not create pull requests, publish releases, push branches, inspect tokens, or call GitHub APIs.
+
+## Inputs
+
+Required:
+
+- Project root.
+
+Optional:
+
+- Project adapter declaration that enables `github-handoff`.
+- Human-provided handoff intent.
+
+Do not assume:
+
+- GitHub authentication is available.
+- Local commits are pushed.
+- CI status, review status, or PR state is known.
+- Remote URLs are safe to print.
+
+## Procedure
+
+1. Confirm the project root exists.
+2. Validate the project adapter when one is present.
+3. If an adapter exists but does not enable `github-handoff`, report `partial` and do not list changed files.
+4. Inspect local Git metadata only: root, branch state, current branch, HEAD, tags at HEAD, remote names, and status entries.
+5. Redact secret-bearing changed paths such as `.env`, key files, credential paths, or token paths.
+6. Summarize changed-file counts by status.
+7. Record skipped and not-verified GitHub state honestly.
+8. State refused behavior clearly.
+
+## Evidence, Recovery, And Dependencies
+
+Expected evidence:
+
+- Git root.
+- Branch state.
+- Current branch.
+- HEAD or short HEAD.
+- Tags at HEAD.
+- Remote names only, not remote URLs.
+- Changed-file summary.
+- Redacted path count when applicable.
+
+Recovery:
+
+- If the directory is not a Git repository, return `failed` with no mutation.
+- If Git status is unavailable, return a warning and preserve partial evidence.
+- If adapter validation fails, fail closed.
+
+Dependencies:
+
+- Local Git command-line tool.
+- Node.js 20+ for the packaged renderer.
+
+## Approval Boundary
+
+This skill is audit-only.
+
+Allowed:
+
+- Read local Git metadata.
+- List changed-file paths unless they are secret-bearing.
+- Validate project adapter metadata.
+- Render a handoff report.
+
+Forbidden:
+
+- Commit.
+- Push.
+- Tag.
+- Checkout, reset, rebase, merge, stash, restore, or clean.
+- Create pull requests.
+- Create releases.
+- Call GitHub APIs.
+- Read tokens, `.env`, `.env.*`, `.npmrc`, keys, or credential files.
+- Print remote URLs.
+- Change project files.
+
+## Completion
+
+Complete only after a report states what was verified, what was skipped, and what was not verified.
+
+The completion boundary must say that no commit, push, tag, branch change, pull request creation, GitHub API mutation, token read, secret-file read, or project write occurred.

package/skills/github-handoff/adapter-interface.md

@@ -0,0 +1,18 @@
+# GitHub Handoff Adapter Interface
+
+Adapters may enable `github-handoff` as an audit-only skill.
+
+Adapters may narrow:
+
+- Required evidence labels.
+- Ignored path labels.
+- Documentation precedence used as human context.
+
+Adapters must not:
+
+- Permit commits, pushes, tags, pull request creation, release creation, or GitHub API mutation.
+- Permit token reads.
+- Permit secret-file reads.
+- Suppress warnings or failures.
+- Redefine completion.
+- Escalate the skill out of audit-only mode.

package/skills/github-handoff/agents/openai.yaml

@@ -0,0 +1,3 @@
+display_name: GitHub Handoff
+short_description: Prepare local Git handoff evidence without GitHub mutation.
+default_prompt: Prepare a GitHub handoff report as an audit-only pass without modifying files, committing, pushing, tagging, creating pull requests, reading tokens, or calling GitHub APIs.

package/skills/github-handoff/checklist.md

@@ -0,0 +1,10 @@
+# GitHub Handoff Checklist
+
+- Confirm the project root.
+- Validate adapter metadata if present.
+- Inspect local Git state only.
+- Summarize changed files without reading file contents.
+- Redact secret-bearing paths.
+- Do not print remote URLs.
+- Report not-verified GitHub state.
+- Confirm no mutation occurred.

package/skills/github-handoff/evidence-template.md

@@ -0,0 +1,16 @@
+# GitHub Handoff Evidence Template
+
+- Skill: `github-handoff`
+- Status: `complete`, `partial`, or `failed`
+- Project root:
+- Git root:
+- Branch state:
+- HEAD:
+- Tags at HEAD:
+- Remote names:
+- Changed-file summary:
+- Redacted path count:
+- Skipped:
+- Not verified:
+- Refused behavior:
+- Changed state: no project, Git, GitHub, dependency, runtime, service, or remote state changed.

package/skills/github-handoff/examples.md

@@ -0,0 +1,19 @@
+# GitHub Handoff Examples
+
+## Safe Examples
+
+```bash
+coding-agent-skills github-handoff /path/to/project
+```
+
+```bash
+node scripts/render-github-handoff.mjs /path/to/project
+```
+
+## Unsafe Examples
+
+- Create a pull request.
+- Push the current branch.
+- Tag the release.
+- Read GitHub tokens.
+- Print configured remote URLs.

package/skills/github-handoff/failure-modes.md

@@ -0,0 +1,8 @@
+# GitHub Handoff Failure Modes
+
+- Project root is not a Git repository.
+- Adapter exists but does not enable `github-handoff`.
+- Adapter validation fails.
+- Git status is unavailable.
+- Secret-bearing changed paths are present and must be redacted.
+- Remote PR, CI, and review state cannot be verified without separately approved GitHub access.

package/tests/fixtures/deployment-preflight/adapter-project/.coding-agent/adapters/deployment-preflight-fixture/adapter.json

@@ -0,0 +1,56 @@
+{
+  "adapterId": "deployment-preflight-fixture",
+  "adapterVersion": "1.0.0",
+  "project": {
+    "id": "fixture-deployment-preflight",
+    "detection": {
+      "rootMarkers": [
+        {"kind": "file", "path": "package.json"},
+        {"kind": "file", "path": "README.md"}
+      ],
+      "maximumDepth": 1,
+      "scope": "declared-project-root",
+      "requireApprovalOutsideScope": true
+    }
+  },
+  "supportedSkills": [
+    {
+      "id": "deployment-preflight",
+      "compatibleVersions": ["0.2.3", "0.2.x"],
+      "declaredMode": "audit-only"
+    }
+  ],
+  "extensions": {
+    "safeReadPaths": ["deploy"],
+    "ignoredPaths": ["ignored", "node_modules", "dist", "build"],
+    "documentationPrecedence": ["README.md"],
+    "commandAliases": [],
+    "safeStatusCommands": [],
+    "requiredEvidence": ["project root", "adapter scope", "deployment config", "not-verified provider areas"],
+    "expectedRuntimeManagers": [],
+    "expectedPackageManagers": ["npm"]
+  },
+  "approvalRequirements": [],
+  "inheritance": {
+    "sharedRestrictions": "required",
+    "deniedOperationCategories": [
+      "file-write",
+      "package-install",
+      "deployment",
+      "git-mutation",
+      "unrestricted-scan",
+      "secret-read",
+      "process-mutation",
+      "service-mutation",
+      "migration-apply",
+      "privileged-api"
+    ],
+    "allowRestrictionRemoval": false,
+    "allowModeOverride": false,
+    "allowFailureSuppression": false,
+    "allowCompletionOverride": false,
+    "allowSecretExposure": false,
+    "allowRequiredEvidenceRemoval": false,
+    "allowScopeExpansionWithoutApproval": false
+  }
+}

package/tests/fixtures/deployment-preflight/adapter-project/.coding-agent/skills.json

@@ -0,0 +1,23 @@
+{
+  "declarationVersion": "1.0.0",
+  "projectId": "fixture-deployment-preflight",
+  "adapterRoot": ".coding-agent/adapters",
+  "adapterSchemaVersion": "1.0.0",
+  "core": {
+    "id": "coding-agent-skills",
+    "expectedVersion": "0.2.3",
+    "versionPin": ">=0.2.3 <0.3.0"
+  },
+  "compatibleSkillIds": ["deployment-preflight"],
+  "adapters": [
+    {
+      "id": "deployment-preflight-fixture",
+      "version": "1.0.0",
+      "skillIds": ["deployment-preflight"]
+    }
+  ],
+  "validationCommand": "node <shared-core>/scripts/validate-project-adapters.mjs <project-root>",
+  "evidenceOutput": ".coding-agent/evidence",
+  "approvalPolicyReference": ".coding-agent/approval-policy.md",
+  "noSecrets": true
+}

package/tests/fixtures/deployment-preflight/adapter-project/README.md

@@ -0,0 +1,3 @@
+# Deployment Preflight Adapter Fixture
+
+Synthetic adapter-scoped deployment preflight fixture.