coding-agent-skills 0.2.14 → 0.2.15

package/CHANGELOG.md

@@ -2,6 +2,28 @@
 
 All notable changes follow [Semantic Versioning](docs/versioning/README.md).
 
+## [0.2.15] - 2026-07-03
+
+### Added
+
+- `deployment-preflight` audit-only skill for static deployment readiness evidence
+  mapping before separately approved deployment work.
+- `coding-agent-skills deployment-preflight <project-root>` CLI command.
+- Dependency-free deployment preflight renderer for deployment config files, deployment
+  docs, package script keys without command values, platform indicators, static risk
+  indicators, adapter-limited scope, skipped paths, not-verified provider/runtime areas,
+  and safety refusals.
+- Synthetic deployment-preflight fixtures and release tests for generic static scans,
+  adapter-scoped scans, package script key detection, platform indicators, and
+  repo-map-only adapter skips.
+
+### Changed
+
+- Adapter schemas and validators now recognize `deployment-preflight` as an audit-only
+  skill while preserving the existing `0.2.3` adapter contract compatibility baseline.
+- Usage, release, safety, architecture, adapter, roadmap, ledger, and run-log docs now
+  describe the new static read-only deployment preflight command.
+
 ## [0.2.14] - 2026-07-03
 
 ### Added

package/README.md

@@ -12,12 +12,13 @@ The pilot pack contains:
 - `api-contract-audit`: audit-only static API contract surface mapping.
 - `migration-review`: audit-only static migration and schema evidence review.
 - `github-handoff`: audit-only local Git handoff evidence before separately approved GitHub work.
+- `deployment-preflight`: audit-only static deployment readiness evidence mapping.
 - `build-verify`: controlled local validation using existing project commands.
 - `git-preflight`: audit-only Git readiness inspection.
 - `runtime-truth`: audit-only runtime evidence collection.
 - `llm-drift-control`: audit-only claim reconciliation.
 
-It does not contain deployment, package installation, Git publication, runtime mutation, migration, privileged API, platform-specific, or project-specific skills.
+It does not contain deployment execution, package installation, Git publication, runtime mutation, migration application, privileged API, platform-specific deployment automation, or project-specific skills.
 
 Project-specific adapters will live in their owning repositories and may narrow, but never weaken, shared safety rules.
 
@@ -50,6 +51,7 @@ Every skill emits the evidence-pack contract. A command being attempted is never
 - Map static API contract surfaces with `coding-agent-skills api-contract-audit <project-root>`.
 - Review static migration and schema evidence with `coding-agent-skills migration-review <project-root>`.
 - Prepare local Git handoff evidence with `coding-agent-skills github-handoff <project-root>`.
+- Map static deployment readiness evidence with `coding-agent-skills deployment-preflight <project-root>`.
 - Validate project adapters against [the formal adapter schema](schemas/project-adapter.schema.json).
 - Review [external adapter discovery](docs/adapters/discovery.md).
 - Run `node scripts/validate-adapters.mjs <adapter-root>` for a disposable external root.
@@ -67,6 +69,8 @@ Every skill emits the evidence-pack contract. A command being attempted is never
   `node scripts/render-migration-review.mjs <project-root>`.
 - Render a local GitHub handoff report with
   `node scripts/render-github-handoff.mjs <project-root>`.
+- Render a static deployment preflight report with
+  `node scripts/render-deployment-preflight.mjs <project-root>`.
 - Review [adapter upgrade checks](docs/adapters/upgrades.md).
 - Run `node scripts/check-adapter-upgrade.mjs <before-project-root> <after-project-root>`
   for disposable project revisions.

package/ROADMAP.md

@@ -1,6 +1,6 @@
 # Roadmap
 
-The public package now contains eleven approved shared skills. Builder-mode approval is
+The public package now contains twelve approved shared skills. Builder-mode approval is
 active for the remaining read-only skill wave in this repository; real-world project
 execution constraints remain unchanged.
 
@@ -40,6 +40,8 @@ execution constraints remain unchanged.
   and schema evidence review.
 - `v0.2.14`: audit-only `github-handoff` skill and CLI renderer for local Git handoff
   evidence before separately approved GitHub work.
+- `v0.2.15`: audit-only `deployment-preflight` skill and CLI renderer for static
+  deployment readiness evidence before separately approved deployment work.
 
 The next milestone is recorded in [work-ledger.md](work-ledger.md). The
 [maintainer loop](RUNBOOK.md) may select and evidence that milestone, but it must stop
@@ -86,7 +88,7 @@ Next safe milestone options:
 | `api-contract-audit-skill` | General | Audit-only | Implemented in `v0.2.12` |
 | `migration-review-skill` | General with platform adapters | Audit-only | Implemented in `v0.2.13` |
 | `github-handoff-skill` | General | Audit-only | Implemented in `v0.2.14` |
-| `deployment-preflight-skill` | General | Audit-only | Builder-mode approved; next in wave |
+| `deployment-preflight-skill` | General | Audit-only | Implemented in `v0.2.15` |
 | `cloudflare-preflight-skill` | Platform-specific | Audit-only | Builder-mode approved; later in wave |
 | `cloudflare-deploy-skill` | Platform-specific | Action-capable | Blocked on approval model |
 | `supabase-rls-audit-skill` | Platform-specific | Audit-only | Builder-mode approved; later in wave |

package/bin/coding-agent-skills

@@ -59,6 +59,12 @@ const commands = {
     usage: "coding-agent-skills github-handoff <project-root>",
     requiredArgs: 1,
   },
+  "deployment-preflight": {
+    script: "scripts/render-deployment-preflight.mjs",
+    args: ([projectRoot]) => [projectRoot],
+    usage: "coding-agent-skills deployment-preflight <project-root>",
+    requiredArgs: 1,
+  },
   "validate-adapters": {
     script: "scripts/validate-adapters.mjs",
     args: ([adapterRoot]) => [adapterRoot],
@@ -81,6 +87,7 @@ function usage(exitCode = 0) {
     "  api-contract-audit <project-root>",
     "  migration-review <project-root>",
     "  github-handoff <project-root>",
+    "  deployment-preflight <project-root>",
     "  validate-adapters <adapter-root>",
     "",
     "local wrapper for the published coding-agent-skills package",

package/docs/adapters/README.md

@@ -138,6 +138,24 @@ tags at HEAD, remote names, and changed-file summaries. It never prints remote U
 reads tokens, creates pull requests, commits, pushes, tags, calls GitHub APIs, or mutates
 project files.
 
+## Adapter-Aware Deployment Preflight Consumption
+
+The shared pack can consume a validated project-owned adapter as bounded context for
+`deployment-preflight`:
+
+```bash
+node scripts/render-deployment-preflight.mjs <project-root>
+```
+
+The renderer validates the project declaration when present. If an adapter is present but
+does not enable `deployment-preflight`, it reports an adapter-limited skip instead of
+broadening scope. When enabled, it reads only adapter-declared safe paths, excludes `.env`,
+secret-bearing files, generated output, dependency paths, build output, runtime output,
+and oversized files, then reports deployment config files, deployment docs, package
+script keys, platform indicators, risk indicators, skipped paths, and not-verified
+provider/runtime behavior. It never deploys, calls provider APIs, installs packages,
+builds, tests, runs services, migrates, or mutates project files.
+
 ## What Adapters May Do
 
 - Add bounded relative read paths and ignored paths.
@@ -153,6 +171,9 @@ project files.
   files while relying on the shared reviewer to exclude secret-bearing paths.
 - Add github-handoff required evidence labels and ignored path labels while relying on the
   shared renderer to avoid remote URLs, tokens, and GitHub mutation.
+- Add deployment-preflight safe read paths for static deployment config, docs, and package
+  metadata while relying on the shared preflight renderer to exclude secret-bearing paths
+  and avoid deployment behavior.
 - Add command aliases that already satisfy the shared command policy.
 - Add status-only runtime commands and manager hints.
 - Require additional evidence or named approval for exceptional reads.

package/docs/adapters/project-installation.md

@@ -182,6 +182,20 @@ When enabled, it reports local Git metadata and changed-file summaries without p
 remote URLs, reading tokens, creating pull requests, committing, pushing, tagging, calling
 GitHub APIs, or changing project files.
 
+A project-owned adapter can also enable read-only `deployment-preflight` context:
+
+```bash
+node scripts/render-deployment-preflight.mjs <project-root>
+```
+
+The deployment preflight renderer validates the project declaration when present. If the
+adapter is present but does not enable `deployment-preflight`, it reports an
+adapter-limited skip. When enabled, it reads only adapter-declared safe paths and reports
+static deployment config files, deployment docs, package script keys, platform indicators,
+risk indicators, and not-verified provider/runtime behavior without deploying, calling
+provider APIs, installing packages, building, testing, running services, or reading
+secrets.
+
 ## Safety Boundary
 
 Project adapters are extension-only. They cannot remove denied operations, change an

package/docs/adapters/real-project-adoption.md

@@ -22,8 +22,8 @@ project repository is touched:
   `coding-agent.skills.json`.
 - The adapter need is bounded to existing pilot skills: `repo-map`, `route-trace`,
   `env-audit`, `secret-audit`, `api-contract-audit`, `migration-review`,
-  `github-handoff`, `build-verify`, `git-preflight`, `runtime-truth`, or
-  `llm-drift-control`.
+  `github-handoff`, `deployment-preflight`, `build-verify`, `git-preflight`,
+  `runtime-truth`, or `llm-drift-control`.
 - The adapter can narrow context with relative paths, documentation precedence, safe
   aliases, status-only hints, or extra evidence requirements.
 - The adapter does not require deployment, migration, package installation, Git

package/docs/architecture/README.md

@@ -18,6 +18,7 @@ Audit-only:
 - `api-contract-audit`
 - `migration-review`
 - `github-handoff`
+- `deployment-preflight`
 - `git-preflight`
 - `runtime-truth`
 - `llm-drift-control`
@@ -26,6 +27,6 @@ Controlled local validation:
 
 - `build-verify`
 
-The evidence pack is a shared output contract, not an executable skill. Deployment
-preflight, provider operations, and additional project adapters remain separate future
+The evidence pack is a shared output contract, not an executable skill. Provider
+operations, deployment execution, and additional project adapters remain separate future
 work.

package/docs/release/README.md

@@ -22,7 +22,7 @@
 15. Smoke-test any new CLI command such as `coding-agent-skills route-trace`,
     `coding-agent-skills env-audit`, `coding-agent-skills secret-audit`,
     `coding-agent-skills api-contract-audit`, `coding-agent-skills migration-review`,
-    or `coding-agent-skills github-handoff`
+    `coding-agent-skills github-handoff`, or `coding-agent-skills deployment-preflight`
     against synthetic fixtures only unless a real project read-only smoke is explicitly
     approved.
 16. Review changelog, ledger, run evidence, and versioning impact.

package/docs/release/npm-package.md

@@ -7,7 +7,7 @@ safety model.
 ## Current Package Shape
 
 - Package name: `coding-agent-skills`.
-- Package version: `0.2.14`.
+- Package version: `0.2.15`.
 - CLI bin: `coding-agent-skills` mapped to `bin/coding-agent-skills`.
 - Module type: `module`.
 - Dependencies: none.
@@ -33,6 +33,7 @@ coding-agent-skills secret-audit /path/to/project
 coding-agent-skills api-contract-audit /path/to/project
 coding-agent-skills migration-review /path/to/project
 coding-agent-skills github-handoff /path/to/project
+coding-agent-skills deployment-preflight /path/to/project
 coding-agent-skills validate-adapters /path/to/adapter-root
 ```
 
@@ -60,6 +61,10 @@ secrets.
 `github-handoff` is local Git metadata only; it reports branch state, HEAD, tags at HEAD,
 remote names, and changed-file summaries without printing remote URLs, reading tokens,
 creating pull requests, committing, pushing, tagging, or calling GitHub APIs.
+`deployment-preflight` is static and audit-only; it reports deployment config files,
+deployment docs, package script keys, platform indicators, risk indicators, and
+not-verified provider/runtime behavior without deploying, calling provider APIs,
+installing packages, building, testing, or reading secrets.
 
 `coding-agent-skills validate-pack` is package-aware. In a source checkout, it keeps
 source-only checks such as `.gitignore` validation. In an installed package tree, where
@@ -95,7 +100,7 @@ included.
 The public CLI remains read-only for target projects unless a specific underlying skill
 already permits a bounded local validation action. The installed `repo-map`,
 `route-trace`, `env-audit`, `secret-audit`, `api-contract-audit`, `migration-review`,
-`github-handoff`, and adapter flows do not:
+`github-handoff`, `deployment-preflight`, and adapter flows do not:
 
 - deploy
 - run migrations

package/docs/safety/README.md

@@ -2,7 +2,7 @@
 
 ## Audit-Only Rule
 
-`repo-map`, `route-trace`, `env-audit`, `secret-audit`, `api-contract-audit`, `migration-review`, `github-handoff`, `git-preflight`, `runtime-truth`, and `llm-drift-control` must not alter project files, Git state, dependencies, processes, services, databases, remote systems, or deployment state.
+`repo-map`, `route-trace`, `env-audit`, `secret-audit`, `api-contract-audit`, `migration-review`, `github-handoff`, `deployment-preflight`, `git-preflight`, `runtime-truth`, and `llm-drift-control` must not alter project files, Git state, dependencies, processes, services, databases, remote systems, or deployment state.
 
 `route-trace` is static only. It may read bounded non-secret route files and route
 configuration, but it must not execute app code, run servers, hit URLs, claim runtime
@@ -32,6 +32,11 @@ HEAD, remote names, and changed-file status, but it must not print remote URLs,
 tokens, create pull requests, commit, push, tag, call GitHub APIs, mutate Git state, or
 broaden adapter scope.
 
+`deployment-preflight` is static only. It may read bounded non-secret deployment config,
+docs, and package metadata, but it must not deploy, run provider CLIs, call cloud APIs,
+install packages, build, test, run services, migrate databases, read secret files, or
+broaden adapter scope.
+
 `build-verify` may run existing project-native validation commands. Build or test tools may create their normal local artifacts, but the skill must declare observed changes and must reject installation, fix modes, snapshot updates, deployment, migration, or unknown scripts.
 
 ## Restricted Categories

package/docs/testing/README.md

@@ -75,6 +75,14 @@ summary, adapter-declared evidence metadata, and adapter-present-but-not-enabled
 Tests must never commit to the shared repository, push, tag shared history, create pull
 requests, call GitHub APIs, print remote URLs, read tokens, or read `.env` files.
 
+## Deployment Preflight
+
+Synthetic deployment-preflight projects cover deployment config detection, deployment docs,
+package script keys without command values, static platform indicators, risk indicators,
+adapter-declared scope, and adapter-present-but-not-enabled behavior. Tests must never
+deploy, call provider APIs, install packages, build, test, run services, migrate, or read
+`.env` files.
+
 ## Privacy And Redaction
 
 Sensitive shapes are stored as ordered synthetic parts and reconstructed only in memory. Tests verify type detection, redaction, and absence from reusable skill content without printing fixture values.

package/docs/usage/README.md

@@ -11,6 +11,7 @@ Select the least-privileged skill that matches the request:
 | Map static API contract surfaces | `api-contract-audit` |
 | Review static migration and schema evidence | `migration-review` |
 | Prepare local GitHub handoff evidence | `github-handoff` |
+| Map static deployment readiness evidence | `deployment-preflight` |
 | Run existing local validation checks | `build-verify` |
 | Assess Git handoff readiness | `git-preflight` |
 | Determine what is actually running | `runtime-truth` |
@@ -30,11 +31,13 @@ Select the least-privileged skill that matches the request:
    and static risk-indicator evidence must be mapped without database access.
 7. Use `github-handoff` when local Git metadata and changed-file summaries are needed
    before separately approved GitHub work.
-8. Perform implementation outside this pilot pack.
-9. Use `build-verify` for approved project-native checks.
-10. Use `git-preflight` before handoff or publication.
-11. Use `runtime-truth` only when live local state matters.
-12. Use `llm-drift-control` when claims and evidence may disagree.
+8. Use `deployment-preflight` when visible deployment config, docs, package script keys,
+   and platform hints must be mapped without deployment behavior.
+9. Perform implementation outside this pilot pack.
+10. Use `build-verify` for approved project-native checks.
+11. Use `git-preflight` before handoff or publication.
+12. Use `runtime-truth` only when live local state matters.
+13. Use `llm-drift-control` when claims and evidence may disagree.
 
 Every skill emits an evidence pack. Read `status`, skipped checks, failures, confidence, and changed state before relying on a completion claim.
 
@@ -71,6 +74,7 @@ coding-agent-skills secret-audit /path/to/project
 coding-agent-skills api-contract-audit /path/to/project
 coding-agent-skills migration-review /path/to/project
 coding-agent-skills github-handoff /path/to/project
+coding-agent-skills deployment-preflight /path/to/project
 coding-agent-skills validate-adapters /path/to/adapter-root
 ```
 
@@ -104,6 +108,10 @@ database access or migration execution.
 state, HEAD, tags at HEAD, remote names, and changed-file summaries without printing
 remote URLs, committing, pushing, tagging, creating pull requests, calling GitHub APIs,
 or reading tokens.
+`deployment-preflight` validates a project adapter when present, uses adapter-declared
+safe paths when enabled, and statically reports deployment config files, deployment docs,
+package script keys, platform indicators, risk indicators, skipped paths, and
+not-verified provider/runtime behavior without deploying or calling provider APIs.
 
 The installed CLI does not run target project builds or tests, perform runtime checks,
 deploy, migrate, mutate services or processes, or read `.env` files. Project adapters
@@ -123,6 +131,7 @@ bin/coding-agent-skills secret-audit /path/to/project
 bin/coding-agent-skills api-contract-audit /path/to/project
 bin/coding-agent-skills migration-review /path/to/project
 bin/coding-agent-skills github-handoff /path/to/project
+bin/coding-agent-skills deployment-preflight /path/to/project
 bin/coding-agent-skills validate-adapters /path/to/adapter-root
 ```
 
@@ -139,6 +148,7 @@ coding-agent-skills secret-audit /path/to/project
 coding-agent-skills api-contract-audit /path/to/project
 coding-agent-skills migration-review /path/to/project
 coding-agent-skills github-handoff /path/to/project
+coding-agent-skills deployment-preflight /path/to/project
 coding-agent-skills validate-adapters /path/to/adapter-root
 ```
 

package/examples/command-policies/deployment-preflight.json

@@ -0,0 +1,70 @@
+{
+  "version": "0.2.3",
+  "mode": "audit-only",
+  "parserPolicy": {
+    "inspectEverySegment": true,
+    "inspectScriptBodies": true,
+    "rejectUnknownExecutables": true,
+    "rejectShellWrappers": true,
+    "rejectHeredocs": true,
+    "rejectRedirection": true,
+    "providerSpecificNpx": true,
+    "authenticatedCurlRequiresApproval": true,
+    "boundedReadsRequired": true,
+    "allowedComposition": "read-only"
+  },
+  "allowedFamilies": [
+    {
+      "name": "bounded-deployment-preflight-inspection",
+      "executables": ["pwd", "ls", "rg", "find", "sed", "head"],
+      "argumentPolicy": {
+        "strategy": "pattern",
+        "allowedPatterns": ["bounded repository-local static deployment config, docs, and package metadata inspection"],
+        "deniedPatterns": ["deployments, provider APIs, package installs, builds, tests, runtime checks, secret files, and unbounded traversal"]
+      },
+      "constraints": [
+        "Remain inside the declared project scope.",
+        "Bound traversal depth and output.",
+        "Exclude .env, secret-bearing, generated, dependency, build, and runtime-output paths."
+      ]
+    },
+    {
+      "name": "git-identity-inspection",
+      "executables": ["git"],
+      "argumentPolicy": {
+        "strategy": "exact",
+        "allowedPatterns": ["rev-parse and status --short --branch"],
+        "deniedPatterns": ["all Git mutation and publication subcommands"]
+      },
+      "constraints": ["Allow only read-only repository identity and branch-state inspection."]
+    },
+    {
+      "name": "deployment-preflight-renderer",
+      "executables": ["node", "coding-agent-skills"],
+      "argumentPolicy": {
+        "strategy": "exact",
+        "allowedPatterns": ["node scripts/render-deployment-preflight.mjs <project-root>; coding-agent-skills deployment-preflight <project-root>"],
+        "deniedPatterns": ["deployments, provider APIs, package installs, builds, tests, runtime checks, migrations, service mutation, and secret-file reads"]
+      },
+      "constraints": [
+        "The renderer must remain static and read-only.",
+        "Do not run provider CLIs, deploy, build, test, or inspect secrets."
+      ]
+    }
+  ],
+  "restrictedCategories": [
+    "file-write",
+    "package-install",
+    "deployment",
+    "git-mutation",
+    "unrestricted-scan",
+    "secret-read",
+    "process-mutation",
+    "service-mutation",
+    "migration-apply",
+    "privileged-api"
+  ],
+  "approvalExceptions": [
+    "A named-file approval may permit one otherwise excluded non-mutating static read when the file is not secret-bearing."
+  ]
+}

package/examples/evidence-packs/deployment-preflight.json

@@ -0,0 +1,60 @@
+{
+  "contractVersion": "1.0.0",
+  "skill": {"name": "deployment-preflight", "version": "0.2.3"},
+  "invocation": {
+    "id": "example-deployment-preflight",
+    "startedAt": "2026-07-03T12:00:00Z",
+    "endedAt": "2026-07-03T12:01:00Z"
+  },
+  "repository": {
+    "root": "/workspace/example-project",
+    "branch": "main",
+    "head": "0123456789abcdef",
+    "workingTreeState": "clean"
+  },
+  "userIntent": "Map static deployment readiness evidence before deployment planning.",
+  "declaredScope": ["/workspace/example-project"],
+  "projectAdapter": "example-deployment-preflight-adapter",
+  "environmentSummary": {"platform": "linux", "shell": "bash"},
+  "status": "complete",
+  "confidence": {
+    "level": "medium",
+    "reason": "Static deployment evidence was inspected, but provider credentials and deployed state were not verified."
+  },
+  "commands": [
+    {
+      "command": "coding-agent-skills deployment-preflight /workspace/example-project",
+      "family": "deployment-preflight-renderer",
+      "workingDirectory": "/workspace/example-project",
+      "startedAt": "2026-07-03T12:00:20Z",
+      "endedAt": "2026-07-03T12:00:21Z",
+      "exitStatus": 0,
+      "resultStatus": "success",
+      "safetyClass": "allowed",
+      "approvalReference": null,
+      "purpose": "Render a static deployment preflight report.",
+      "outputSummary": "Reported static deployment config files, docs, platform indicators, risk indicators, skipped items, and not-verified provider areas."
+    }
+  ],
+  "skippedChecks": [],
+  "findings": [
+    {
+      "summary": "Static deployment evidence was mapped without deployment behavior.",
+      "evidence": ["wrangler.toml", "docs/deployment.md"]
+    }
+  ],
+  "risks": [
+    {
+      "summary": "Provider and deployed service state may differ from static repository evidence.",
+      "evidence": ["provider APIs were not called", "runtime health checks were not performed"]
+    }
+  ],
+  "failures": [],
+  "unresolvedQuestions": [],
+  "changedState": {
+    "changed": false,
+    "summary": "No project, Git, dependency, runtime, service, database, cloud provider, remote, deployment, or generated-output state changed."
+  },
+  "handoffSummary": "Static deployment evidence is mapped; deployment execution and provider state remain unverified.",
+  "recommendedNextAction": "Review reported deployment surfaces before separately approving any platform-specific deployment work."
+}

package/examples/manifests/deployment-preflight.json

@@ -0,0 +1,14 @@
+{
+  "name": "deployment-preflight",
+  "version": "0.2.3",
+  "mode": "audit-only",
+  "evidenceContract": "../../contracts/evidence-pack/evidence-pack.schema.json",
+  "commandPolicy": "../command-policies/deployment-preflight.json",
+  "adapterSchema": "../../schemas/project-adapter.schema.json",
+  "adapterCompatibility": {
+    "contractVersion": "1.0.0",
+    "compatibleAdapterVersions": ["1.0.0"]
+  },
+  "adapterInterface": "../../skills/deployment-preflight/adapter-interface.md",
+  "description": "Map static deployment readiness evidence without deployment behavior."
+}

package/examples/workflows/deployment-preflight.md

@@ -0,0 +1,8 @@
+# Deployment Preflight Workflow
+
+```bash
+coding-agent-skills deployment-preflight /workspace/project
+```
+
+Use the output as static deployment orientation only. It does not deploy, call provider APIs,
+install packages, run builds, run tests, start services, run migrations, or read secrets.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "coding-agent-skills",
-  "version": "0.2.14",
+  "version": "0.2.15",
   "description": "Evidence-first, read-only coding-agent skills and project adapter tooling.",
   "type": "module",
   "private": false,
@@ -15,6 +15,7 @@
     "api-contract-audit",
     "migration-review",
     "github-handoff",
+    "deployment-preflight",
     "project-adapters",
     "code-validation",
     "cli"

package/runs/skill-runs.md

@@ -258,6 +258,25 @@ This file records bounded maintainer-loop runs. Entries must not contain secrets
 - Safety boundary: read-only local Git metadata only, no `.env` reads, no token reads, no
   remote URL printing, no commits, no pushes, no tags, no pull request creation, no GitHub
   API calls, and no target-project mutation.
+- Validation commands: full source validation, package dry-run, tarball smoke, registry
+  install smoke, npm exec, and GitHub Release verification.
+- Result: passed; `v0.2.14` was committed, pushed, tagged, published to npm, smoke-tested
+  from the registry, and released on GitHub.
+- Commit/tag/push status: complete.
+
+## implementation-v0.2.15-deployment-preflight
+
+- Run ID: `implementation-v0.2.15-deployment-preflight`
+- Repository: `/home/oneclickwebsitedesignfactory/coding-agent-skills`
+- Command used: `builder-mode approval for deployment-preflight-skill implementation and release`
+- Files changed: `deployment-preflight` skill, deployment preflight renderer and library,
+  CLI wrapper, adapter schemas, pack rules, release tests, synthetic deployment fixtures,
+  usage/release/safety/adapter docs, changelog, roadmap, work ledger, run log, and package
+  metadata.
+- Safety boundary: read-only static deployment evidence only, no `.env` reads, no provider
+  API calls, no provider CLI execution, no package installs, no builds, no tests, no
+  runtime checks, no service mutation, no deployments, no migrations, and no target-project
+  mutation.
 - Validation commands: pending final release validation matrix.
 - Result: pass pending final publication evidence.
 - Commit/tag/push status: pending approved release workflow.

package/schemas/project-adapter-installation.schema.json

@@ -71,6 +71,7 @@
           "api-contract-audit",
           "migration-review",
           "github-handoff",
+          "deployment-preflight",
           "build-verify",
           "git-preflight",
           "runtime-truth",
@@ -109,6 +110,7 @@
               "api-contract-audit",
               "migration-review",
               "github-handoff",
+              "deployment-preflight",
               "build-verify",
               "git-preflight",
                 "runtime-truth",

package/schemas/project-adapter.schema.json

@@ -95,6 +95,7 @@
               "api-contract-audit",
               "migration-review",
               "github-handoff",
+              "deployment-preflight",
               "build-verify",
               "git-preflight",
               "runtime-truth",
@@ -177,6 +178,7 @@
                   "api-contract-audit",
                   "migration-review",
                   "github-handoff",
+                  "deployment-preflight",
                   "build-verify",
                   "git-preflight",
                   "runtime-truth",