coding-agent-skills 0.2.14 → 0.2.15

package/scripts/render-deployment-preflight.mjs

@@ -0,0 +1,9 @@
+#!/usr/bin/env node
+import {
+  deploymentPreflightCliResult,
+} from "./lib/deployment-preflight.mjs";
+
+const result = deploymentPreflightCliResult(process.argv[2]);
+const stream = result.stream === "stderr" ? process.stderr : process.stdout;
+stream.write(`${result.lines.join("\n")}\n`);
+process.exitCode = result.exitCode;

package/scripts/test-pack.mjs

@@ -72,6 +72,11 @@ import {
   githubHandoffCliResult,
   renderGithubHandoffReport,
 } from "./lib/github-handoff.mjs";
+import {
+  buildDeploymentPreflightReport,
+  deploymentPreflightCliResult,
+  renderDeploymentPreflightReport,
+} from "./lib/deployment-preflight.mjs";
 import {
   adapterUpgradeCliResult,
   checkAdapterUpgrade,
@@ -313,6 +318,7 @@ test("local CLI maps approved commands to existing safe scripts", () => {
   assert.ok(cliText.includes("scripts/render-api-contract-audit.mjs"));
   assert.ok(cliText.includes("scripts/render-migration-review.mjs"));
   assert.ok(cliText.includes("scripts/render-github-handoff.mjs"));
+  assert.ok(cliText.includes("scripts/render-deployment-preflight.mjs"));
   assert.ok(cliText.includes("scripts/validate-adapters.mjs"));
   assert.ok(!cliText.includes(".env"));
 
@@ -363,6 +369,10 @@ test("local CLI maps approved commands to existing safe scripts", () => {
       ["github-handoff", githubHandoffFixture],
       /# GitHub Handoff Report/,
     ],
+    [
+      ["deployment-preflight", path.join(fixtureRoot, "deployment-preflight", "static-project")],
+      /# Deployment Preflight Report/,
+    ],
   ];
 
   for (const [args, expected] of commands) {
@@ -387,7 +397,7 @@ test("local CLI maps approved commands to existing safe scripts", () => {
 test("npm package metadata is public-ready and dependency-free", () => {
   const packageJson = readJson("package.json");
   assert.equal(packageJson.name, "coding-agent-skills");
-  assert.equal(packageJson.version, "0.2.14");
+  assert.equal(packageJson.version, "0.2.15");
   assert.equal(
     packageJson.description,
     "Evidence-first, read-only coding-agent skills and project adapter tooling.",
@@ -405,6 +415,7 @@ test("npm package metadata is public-ready and dependency-free", () => {
     "api-contract-audit",
     "migration-review",
     "github-handoff",
+    "deployment-preflight",
     "project-adapters",
     "code-validation",
     "cli",
@@ -796,6 +807,54 @@ test("github-handoff does not broaden a repo-map-only project adapter", () => {
   assert.match(renderGithubHandoffReport(result), /github-handoff is not enabled/);
 });
 
+test("deployment-preflight maps static deployment surfaces without deployment behavior", () => {
+  const result = buildDeploymentPreflightReport(
+    path.join(root, "tests", "fixtures", "deployment-preflight", "static-project"),
+    { coreRoot: root },
+  );
+
+  assert.equal(result.status, "complete");
+  assert.ok(result.configFiles.some((record) => record.path === "wrangler.toml"));
+  assert.ok(result.configFiles.some((record) => record.path === "Dockerfile"));
+  assert.ok(result.deploymentDocs.some((record) => record.path === "docs/deployment.md"));
+  assert.ok(result.packageScriptKeys.some((record) => record.key === "deploy"));
+  assert.ok(result.platformIndicators.some((record) => record.platform === "cloudflare"));
+  assert.ok(result.riskIndicators.some((record) => record.type === "production-reference"));
+  assert.match(renderDeploymentPreflightReport(result), /No deployment, cloud provider API call/);
+});
+
+test("deployment-preflight respects adapter-declared scope", () => {
+  const result = buildDeploymentPreflightReport(
+    path.join(root, "tests", "fixtures", "deployment-preflight", "adapter-project"),
+    { coreRoot: root },
+  );
+
+  assert.equal(result.status, "complete");
+  assert.equal(result.adapter.enabled, true);
+  assert.deepEqual(result.scopePaths, ["deploy"]);
+  assert.deepEqual(result.filesScanned, ["deploy/netlify.toml"]);
+  assert.ok(result.configFiles.some((record) => record.path === "deploy/netlify.toml"));
+  assert.ok(result.warnings.includes("deployment-preflight used adapter-declared safe read paths only"));
+  const cli = deploymentPreflightCliResult(
+    path.join(root, "tests", "fixtures", "deployment-preflight", "adapter-project"),
+    { coreRoot: root },
+  );
+  assert.equal(cli.exitCode, 0);
+  assert.match(cli.lines.join("\n"), /Deployment-preflight enabled: yes/);
+});
+
+test("deployment-preflight does not broaden a repo-map-only project adapter", () => {
+  const result = buildDeploymentPreflightReport(
+    path.join(root, "tests", "fixtures", "project-adapter-installation", "valid-exact-pin"),
+    { coreRoot: root },
+  );
+
+  assert.equal(result.status, "partial");
+  assert.equal(result.filesScanned.length, 0);
+  assert.equal(result.configFiles.length, 0);
+  assert.match(renderDeploymentPreflightReport(result), /deployment-preflight is not enabled/);
+});
+
 test("validate-pack accepts installed package trees without source-only gitignore", () => {
   const temporaryRoot = fs.mkdtempSync(path.join(os.tmpdir(), "installed-package-"));
   const installedRoot = path.join(temporaryRoot, "coding-agent-skills");

package/scripts/validate-pack.mjs

@@ -101,6 +101,7 @@ const requiredRootFiles = [
   "scripts/render-api-contract-audit.mjs",
   "scripts/render-migration-review.mjs",
   "scripts/render-github-handoff.mjs",
+  "scripts/render-deployment-preflight.mjs",
   "scripts/check-adapter-upgrade.mjs",
   "scripts/check-adapter-upgrade-chain.mjs",
   "scripts/validate-adapters.mjs",
@@ -112,6 +113,7 @@ const requiredRootFiles = [
   "scripts/lib/api-contract-audit.mjs",
   "scripts/lib/migration-review.mjs",
   "scripts/lib/github-handoff.mjs",
+  "scripts/lib/deployment-preflight.mjs",
   "scripts/lib/adapter-upgrade.mjs",
   "scripts/lib/adapter-upgrade-chain.mjs",
   "scripts/lib/adapter-discovery.mjs",
@@ -685,8 +687,8 @@ if (packageJson) {
   if (packageJson.name !== "coding-agent-skills") {
     failures.push("package.json has unexpected package name");
   }
-  if (packageJson.version !== "0.2.14") {
-    failures.push("package.json version must be 0.2.14 for public package validation");
+  if (packageJson.version !== "0.2.15") {
+    failures.push("package.json version must be 0.2.15 for public package validation");
   }
   if (packageJson.type !== "module") failures.push("package.json must preserve ESM mode");
   if (packageJson.private !== false) {
@@ -710,6 +712,7 @@ if (packageJson) {
       "api-contract-audit",
       "migration-review",
       "github-handoff",
+      "deployment-preflight",
       "project-adapters",
       "code-validation",
       "cli",

package/skills/deployment-preflight/SKILL.md

@@ -0,0 +1,89 @@
+---
+name: deployment-preflight
+description: Map statically visible deployment readiness evidence without deploying, calling provider APIs, installing packages, building, testing, reading secrets, or mutating project/runtime state. Use when Codex needs a bounded pre-deploy orientation report from config files, docs, package script keys, and static platform indicators before separately approved deployment work.
+---
+
+# Deployment Preflight
+
+Map deployment-related evidence that is already visible in the repository. Remain
+audit-only and avoid turning preflight discovery into deployment, cloud, runtime, build, or
+secret work.
+
+This skill must not change project files, Git state, dependencies, runtime state, services,
+databases, cloud provider state, remotes, deployment targets, or generated outputs.
+
+## Purpose And Use
+
+Use this skill before deployment planning, release handoff, or platform-specific work when
+the agent needs to understand visible deployment config, deployment docs, platform hints,
+and static readiness risks.
+
+Do not use it as proof of deployability, provider CLI behavior, cloud API state, domain
+validity, environment values, build outcomes, test outcomes, service runtime, deployment
+publication, database migration state, or secret content.
+
+## Inputs
+
+Require a project root or starting path. Optionally accept a project adapter, intended scan
+area, documentation precedence, deployment config hints, or known platform boundaries.
+
+Do not assume a missing deployment config means no deployment exists, package script keys are
+safe to run, provider credentials are present, remote state matches repository state, or a
+project adapter enables this skill unless validation proves it.
+
+## Procedure
+
+1. Record user intent, project root, declared scope, adapter state, and safety boundary.
+2. Validate a project adapter when present before reading adapter-declared metadata.
+3. If an adapter is present but does not enable `deployment-preflight`, stop static file
+   reading and report the adapter-limited skip.
+4. Build scan scope from adapter safe read paths when available; otherwise use a bounded
+   generic static scan.
+5. Exclude `.env`, secret-bearing files, generated output, dependency paths, build output,
+   runtime output, and oversized files before reading.
+6. Identify deployment config files and platform indicators.
+7. Identify deployment documentation and runbook references.
+8. Identify package script keys that mention deployment tooling without printing command
+   values.
+9. Identify static risk indicators without judging runtime or provider safety.
+10. Emit the shared evidence pack or deployment preflight report before claiming completion.
+
+Use [checklist.md](checklist.md). Consult [failure-modes.md](failure-modes.md),
+[adapter-interface.md](adapter-interface.md), and [examples.md](examples.md). Format findings
+with [evidence-template.md](evidence-template.md).
+
+## Evidence, Recovery, And Dependencies
+
+Emit repository identity, adapter state, scan scope, ignored paths, files scanned, deployment
+config files, deployment docs, package script keys, platform indicators, risk indicators,
+skipped items, not-verified areas, warnings, and changed-state declaration through the
+shared evidence-pack contract.
+
+Recover from missing configs, ambiguous platform hints, unreadable files, or adapter limits
+by reporting uncertainty. Never recover by deploying, running provider CLIs, calling cloud
+APIs, installing dependencies, building, testing, starting services, broadening adapter
+scope, or reading `.env`.
+
+This skill depends on the evidence-pack contract and may consume validated project adapters.
+Adapters may add safe paths, ignored paths, documentation precedence, and evidence
+requirements, but cannot weaken policy or turn this skill into deployment work.
+
+## Approval Boundary
+
+Explicit approval may permit one named non-secret static file read outside normal source
+paths. Approval does not permit `.env` or secret-file reads, provider API calls, provider CLI
+execution, package installation, builds, tests, runtime checks, service mutation,
+deployments, migrations, Git mutation, or project writes.
+
+## Completion
+
+Claim `complete` only when the declared static scan scope was inspected, visible deployment
+surfaces are reported, skipped and not-verified areas are explicit, adapter limitations are
+clear, and no project, Git, dependency, runtime, service, database, cloud provider, remote,
+deployment, or generated-output state changed.
+
+Report `partial`, `failed`, or `blocked` when adapter scope prevents scanning, requested
+evidence requires deployment/runtime/provider behavior, the project root cannot be
+established, or safety exclusions prevent the requested conclusion.
+
+These conditions are both the acceptance criteria and definition of done.

package/skills/deployment-preflight/adapter-interface.md

@@ -0,0 +1,17 @@
+# Deployment Preflight Adapter Interface
+
+Adapters may narrow the static scan by declaring:
+
+- `extensions.safeReadPaths`
+- `extensions.ignoredPaths`
+- `extensions.documentationPrecedence`
+- `extensions.requiredEvidence`
+- `extensions.expectedPackageManagers`
+
+Adapters must declare `deployment-preflight` with `declaredMode: "audit-only"` and
+compatible core versions. They cannot allow deployments, provider API calls, package
+installs, builds, tests, runtime checks, migrations, secret reads, project writes, failure
+suppression, completion overrides, or scope expansion without approval.
+
+If a project adapter is present but does not enable `deployment-preflight`, the skill reports
+`partial` and does not read target files.

package/skills/deployment-preflight/agents/openai.yaml

@@ -0,0 +1,3 @@
+display_name: Deployment Preflight
+short_description: Map static deployment readiness evidence without deploying or calling provider APIs.
+default_prompt: Review this repository's static deployment readiness evidence as an audit-only pass without modifying files, deploying, calling provider APIs, installing packages, building, testing, mutating services, or reading secrets.

package/skills/deployment-preflight/checklist.md

@@ -0,0 +1,7 @@
+# Deployment Preflight Checklist
+
+- Confirm the project root, branch state, adapter state, and declared scan scope.
+- Validate the project adapter before consuming adapter-declared paths.
+- Exclude `.env`, secret-bearing, generated, dependency, build, runtime-output, and oversized files.
+- Report deployment config files, deployment docs, package script keys, platform indicators, risk indicators, skipped items, and not-verified areas.
+- Confirm no deployment, provider API call, package install, build, test, runtime check, migration, secret read, project write, or Git mutation occurred.

package/skills/deployment-preflight/evidence-template.md

@@ -0,0 +1,19 @@
+# Deployment Preflight Evidence Template
+
+- Status:
+- Project root:
+- Branch state:
+- Adapter present/enabled:
+- Scope paths:
+- Ignored paths:
+- Files scanned:
+- Deployment config files:
+- Deployment docs:
+- Package script keys:
+- Platform indicators:
+- Risk indicators:
+- Skipped items:
+- Not verified:
+- Refused behavior:
+- Changed-state declaration:
+- Recommended next action:

package/skills/deployment-preflight/examples.md

@@ -0,0 +1,11 @@
+# Deployment Preflight Examples
+
+**Safe:** `coding-agent-skills deployment-preflight /workspace/project`
+
+**Safe:** `node scripts/render-deployment-preflight.mjs /workspace/project`
+
+**Unsafe and denied:** provider deployment commands, package deploy scripts, and production
+publish commands.
+
+Use the report to orient future deployment planning. Do not treat static evidence as proof
+that credentials, cloud resources, domains, builds, or deployed services are valid.

package/skills/deployment-preflight/failure-modes.md

@@ -0,0 +1,11 @@
+# Deployment Preflight Failure Modes
+
+- The project root cannot be established.
+- A project adapter is present but invalid or does not enable `deployment-preflight`.
+- Deployment config is absent, generated, or outside the approved scan scope.
+- Files are skipped because they are secret-bearing, oversized, symlinked, generated, or ignored.
+- A request asks for provider state, deployment execution, runtime health, credential checks, or build verification.
+
+Recover by reporting partial evidence and clear uncertainty. Do not recover by deploying,
+calling provider APIs, installing packages, building, testing, running services, widening
+scope, or reading secrets.

package/tests/fixtures/deployment-preflight/adapter-project/.coding-agent/adapters/deployment-preflight-fixture/adapter.json

@@ -0,0 +1,56 @@
+{
+  "adapterId": "deployment-preflight-fixture",
+  "adapterVersion": "1.0.0",
+  "project": {
+    "id": "fixture-deployment-preflight",
+    "detection": {
+      "rootMarkers": [
+        {"kind": "file", "path": "package.json"},
+        {"kind": "file", "path": "README.md"}
+      ],
+      "maximumDepth": 1,
+      "scope": "declared-project-root",
+      "requireApprovalOutsideScope": true
+    }
+  },
+  "supportedSkills": [
+    {
+      "id": "deployment-preflight",
+      "compatibleVersions": ["0.2.3", "0.2.x"],
+      "declaredMode": "audit-only"
+    }
+  ],
+  "extensions": {
+    "safeReadPaths": ["deploy"],
+    "ignoredPaths": ["ignored", "node_modules", "dist", "build"],
+    "documentationPrecedence": ["README.md"],
+    "commandAliases": [],
+    "safeStatusCommands": [],
+    "requiredEvidence": ["project root", "adapter scope", "deployment config", "not-verified provider areas"],
+    "expectedRuntimeManagers": [],
+    "expectedPackageManagers": ["npm"]
+  },
+  "approvalRequirements": [],
+  "inheritance": {
+    "sharedRestrictions": "required",
+    "deniedOperationCategories": [
+      "file-write",
+      "package-install",
+      "deployment",
+      "git-mutation",
+      "unrestricted-scan",
+      "secret-read",
+      "process-mutation",
+      "service-mutation",
+      "migration-apply",
+      "privileged-api"
+    ],
+    "allowRestrictionRemoval": false,
+    "allowModeOverride": false,
+    "allowFailureSuppression": false,
+    "allowCompletionOverride": false,
+    "allowSecretExposure": false,
+    "allowRequiredEvidenceRemoval": false,
+    "allowScopeExpansionWithoutApproval": false
+  }
+}

package/tests/fixtures/deployment-preflight/adapter-project/.coding-agent/skills.json

@@ -0,0 +1,23 @@
+{
+  "declarationVersion": "1.0.0",
+  "projectId": "fixture-deployment-preflight",
+  "adapterRoot": ".coding-agent/adapters",
+  "adapterSchemaVersion": "1.0.0",
+  "core": {
+    "id": "coding-agent-skills",
+    "expectedVersion": "0.2.3",
+    "versionPin": ">=0.2.3 <0.3.0"
+  },
+  "compatibleSkillIds": ["deployment-preflight"],
+  "adapters": [
+    {
+      "id": "deployment-preflight-fixture",
+      "version": "1.0.0",
+      "skillIds": ["deployment-preflight"]
+    }
+  ],
+  "validationCommand": "node <shared-core>/scripts/validate-project-adapters.mjs <project-root>",
+  "evidenceOutput": ".coding-agent/evidence",
+  "approvalPolicyReference": ".coding-agent/approval-policy.md",
+  "noSecrets": true
+}

package/tests/fixtures/deployment-preflight/adapter-project/README.md

@@ -0,0 +1,3 @@
+# Deployment Preflight Adapter Fixture
+
+Synthetic adapter-scoped deployment preflight fixture.

package/tests/fixtures/deployment-preflight/adapter-project/deploy/netlify.toml

@@ -0,0 +1,3 @@
+[build]
+publish = "dist"
+command = "npm run build"

package/tests/fixtures/deployment-preflight/adapter-project/ignored/render.yaml

@@ -0,0 +1,3 @@
+services:
+  - type: web
+    name: ignored-service

package/tests/fixtures/deployment-preflight/adapter-project/package.json

@@ -0,0 +1,5 @@
+{
+  "scripts": {
+    "deploy": "netlify deploy"
+  }
+}

package/tests/fixtures/deployment-preflight/static-project/Dockerfile

@@ -0,0 +1,2 @@
+FROM node:20-alpine
+CMD ["node", "src/index.js"]

package/tests/fixtures/deployment-preflight/static-project/README.md

@@ -0,0 +1,3 @@
+# Deployment Preflight Static Fixture
+
+Synthetic project used to verify static deployment readiness mapping.

package/tests/fixtures/deployment-preflight/static-project/docs/deployment.md

@@ -0,0 +1,4 @@
+# Deployment Notes
+
+Deployments use synthetic Cloudflare-style configuration. Production values are not stored
+in this fixture.

package/tests/fixtures/deployment-preflight/static-project/package.json

@@ -0,0 +1,6 @@
+{
+  "scripts": {
+    "deploy": "wrangler deploy",
+    "preview": "wrangler pages dev"
+  }
+}

package/tests/fixtures/deployment-preflight/static-project/src/index.js

@@ -0,0 +1 @@
+export const handler = () => "ok";

package/tests/fixtures/deployment-preflight/static-project/wrangler.toml

@@ -0,0 +1,3 @@
+name = "synthetic-worker"
+compatibility_date = "2026-07-03"
+main = "src/index.js"

package/tests/fixtures/triggers/cases.json

@@ -91,6 +91,18 @@
       "expectedSkill": "github-handoff",
       "notSkills": ["runtime-truth", "deployment-preflight"]
     },
+    {
+      "id": "deployment-preflight-static",
+      "prompt": "Run a deployment preflight and map static deployment config, docs, and package script keys without deploying.",
+      "expectedSkill": "deployment-preflight",
+      "notSkills": ["runtime-truth", "build-verify"]
+    },
+    {
+      "id": "deployment-preflight-readiness",
+      "prompt": "Map deployment readiness evidence before release, but do not call provider APIs or run builds.",
+      "expectedSkill": "deployment-preflight",
+      "notSkills": ["github-handoff", "migration-review"]
+    },
     {
       "id": "build-after-implementation",
       "prompt": "The implementation is finished. Run the existing typecheck, tests, and build.",
@@ -143,7 +155,7 @@
       "id": "negative-deploy",
       "prompt": "Deploy this application to production.",
       "expectedSkill": null,
-      "notSkills": ["repo-map", "route-trace", "env-audit", "secret-audit", "api-contract-audit", "migration-review", "github-handoff", "build-verify", "git-preflight", "runtime-truth", "llm-drift-control"]
+      "notSkills": ["repo-map", "route-trace", "env-audit", "secret-audit", "api-contract-audit", "migration-review", "github-handoff", "deployment-preflight", "build-verify", "git-preflight", "runtime-truth", "llm-drift-control"]
     },
     {
       "id": "negative-install",

package/tests/trigger/README.md

@@ -14,6 +14,8 @@
   deployment, or migration execution.
 - Local GitHub handoff evidence must trigger `github-handoff`, not publication,
   pull request creation, or Git mutation.
+- Static deployment readiness mapping must trigger `deployment-preflight`, not deployment,
+  provider API calls, or runtime mutation.
 - Local validation must trigger `build-verify` only when project-native checks are requested.
 - Git readiness must trigger `git-preflight`, not publication.
 - Process/listener/health questions must trigger `runtime-truth`, not restart behavior.

package/work-ledger.md

@@ -4,13 +4,13 @@
 
 - Repository: `coding-agent-skills`
 - Branch: `main`
-- Pilot skills: `repo-map`, `route-trace`, `env-audit`, `secret-audit`, `api-contract-audit`, `migration-review`, `github-handoff`, `build-verify`, `git-preflight`, `runtime-truth`, `llm-drift-control`
+- Pilot skills: `repo-map`, `route-trace`, `env-audit`, `secret-audit`, `api-contract-audit`, `migration-review`, `github-handoff`, `deployment-preflight`, `build-verify`, `git-preflight`, `runtime-truth`, `llm-drift-control`
 - Adapter discovery, project adapter installation, stale-pin detection, upgrade evidence, compatibility-chain validation, evidence-bundle verification, retention policy, provenance design, archive-report rendering, archive-index fixtures, retention-expiry advisory reporting, and detached-signature verification planning are implemented.
 - Real-project adapter adoption readiness is documented as a planning-only approval gate.
 - First external project-owned adapter adoption completed for `/home/oneclickwebsitedesignfactory/tax-lien-platform` at candidate commit `c548b1a6cbb3455a70b89d0e301e22435bfccac9`.
 - The adopted adapter is `repo-map` only, docs/metadata-only, and contains no commands, runtime checks, build/test/package behavior, platform/deployment behavior, or secret-aware behavior.
 - The shared repository does not contain real adapter manifests; real project adapters remain owned by their project repositories.
-- Public npm package release `v0.2.14` exposes the dependency-free
+- Public npm package release `v0.2.15` exposes the dependency-free
   `coding-agent-skills` CLI under MIT license.
 - `route-trace` is implemented as an audit-only static route tracing skill.
 - `env-audit` is implemented as an audit-only value-free environment variable name mapping
@@ -21,19 +21,21 @@
 - `migration-review` is implemented as an audit-only static migration and schema evidence
   review skill.
 - `github-handoff` is implemented as an audit-only local Git handoff evidence skill.
+- `deployment-preflight` is implemented as an audit-only static deployment readiness
+  evidence skill.
 - Builder-mode approval: complete the remaining read-only skill wave for
   `coding-agent-skills` itself. Real-world project execution constraints remain unchanged.
 
 ## Last Completed Version
 
-`v0.2.14`
+`v0.2.15`
 
 ## Current Recommended Milestone
 
-The `github-handoff` public npm release is in progress under builder-mode approval.
+The `deployment-preflight` public npm release is in progress under builder-mode approval.
 Continue the remaining read-only skill wave one release at a time unless a real safety,
 validation, publication, or authentication boundary appears. The next approved wave item is
-`deployment-preflight-skill`.
+`cloudflare-preflight-skill`.
 
 ## Allowed Next Actions
 
@@ -110,10 +112,20 @@ No autonomous maintainer-loop run has been recorded yet.
 - Latest tag observed: `v0.2.13`
 - Implemented milestone: `github-handoff` audit-only local Git handoff evidence skill and CLI command.
 - Required permission: `builder-mode-skill-implementation`
-- Validation result: pass pending final publication evidence
+- Validation result: passed; `v0.2.14` commit, tag, npm publication, registry smoke, npm exec, and GitHub Release completed
 - Next recommended milestone: continue builder-mode wave with `deployment-preflight-skill`
   after `v0.2.14` publication completes.
 
+### 2026-07-03T14:00:00Z
+
+- Latest tag observed: `v0.2.14`
+- Implemented milestone: `deployment-preflight` audit-only static deployment readiness
+  evidence skill and CLI command.
+- Required permission: `builder-mode-skill-implementation`
+- Validation result: pass pending final publication evidence
+- Next recommended milestone: continue builder-mode wave with `cloudflare-preflight-skill`
+  after `v0.2.15` publication completes.
+
 ### 2026-07-03T12:00:00Z
 
 - Latest tag observed: `v0.2.12`