coding-agent-skills 0.2.14 → 0.2.16

package/scripts/render-deployment-preflight.mjs

@@ -0,0 +1,9 @@
+#!/usr/bin/env node
+import {
+  deploymentPreflightCliResult,
+} from "./lib/deployment-preflight.mjs";
+
+const result = deploymentPreflightCliResult(process.argv[2]);
+const stream = result.stream === "stderr" ? process.stderr : process.stdout;
+stream.write(`${result.lines.join("\n")}\n`);
+process.exitCode = result.exitCode;

package/scripts/test-pack.mjs

@@ -72,6 +72,11 @@ import {
   githubHandoffCliResult,
   renderGithubHandoffReport,
 } from "./lib/github-handoff.mjs";
+import {
+  buildDeploymentPreflightReport,
+  deploymentPreflightCliResult,
+  renderDeploymentPreflightReport,
+} from "./lib/deployment-preflight.mjs";
 import {
   adapterUpgradeCliResult,
   checkAdapterUpgrade,
@@ -216,6 +221,39 @@ function snapshotAbsoluteDirectory(directory) {
   return digest.digest("hex");
 }
 
+function assertOpenClawJsonContract(value, command, packageVersion = "0.2.16") {
+  assert.equal(value.tool, "coding-agent-skills");
+  assert.equal(value.command, command);
+  assert.equal(value.packageVersion, packageVersion);
+  assert.equal(value.success, true);
+  assert.match(value.status, /^(complete|partial|blocked|failed|empty)$/);
+  assert.equal(value.changedState, false);
+  assert.equal(value.safety?.readOnly, true);
+  assert.equal(value.safety?.secretsRead, false);
+  assert.equal(value.safety?.targetCommandsRun, false);
+  assert.equal(value.safety?.mutationsPerformed, false);
+  assert.equal(value.exitCode, 0);
+  assert.equal(value.exitCodeMeaning, "handled");
+  assert.ok(value.recommendedNextAction);
+  assert.equal(typeof value.recommendedNextAction.label, "string");
+  assert.equal(typeof value.recommendedNextAction.reason, "string");
+  assert.equal(typeof value.recommendedNextAction.requiresApproval, "boolean");
+  for (const key of [
+    "summary",
+    "findings",
+    "warnings",
+    "risks",
+    "skipped",
+    "notVerified",
+    "refusedBehavior",
+  ]) {
+    assert.ok(Array.isArray(value[key]), `${command}.${key} must be an array`);
+  }
+  const encoded = JSON.stringify(value);
+  assert.doesNotMatch(encoded, /github_pat_|ghp_|Authorization:\s*Bearer|BEGIN .*PRIVATE KEY/i);
+  assert.doesNotMatch(encoded, /\/home\/oneclickwebsitedesignfactory\//);
+}
+
 const manifestSchema = readJson("schemas/skill-manifest.schema.json");
 const policySchema = readJson("schemas/command-policy.schema.json");
 const adapterSchema = readJson("schemas/project-adapter.schema.json");
@@ -313,6 +351,7 @@ test("local CLI maps approved commands to existing safe scripts", () => {
   assert.ok(cliText.includes("scripts/render-api-contract-audit.mjs"));
   assert.ok(cliText.includes("scripts/render-migration-review.mjs"));
   assert.ok(cliText.includes("scripts/render-github-handoff.mjs"));
+  assert.ok(cliText.includes("scripts/render-deployment-preflight.mjs"));
   assert.ok(cliText.includes("scripts/validate-adapters.mjs"));
   assert.ok(!cliText.includes(".env"));
 
@@ -363,6 +402,10 @@ test("local CLI maps approved commands to existing safe scripts", () => {
       ["github-handoff", githubHandoffFixture],
       /# GitHub Handoff Report/,
     ],
+    [
+      ["deployment-preflight", path.join(fixtureRoot, "deployment-preflight", "static-project")],
+      /# Deployment Preflight Report/,
+    ],
   ];
 
   for (const [args, expected] of commands) {
@@ -384,10 +427,68 @@ test("local CLI maps approved commands to existing safe scripts", () => {
   assert.match(unknown.stderr, /unknown command: deploy/);
 });
 
+test("local CLI emits OpenClaw-compatible JSON for public commands", () => {
+  const cliPath = path.join(root, "bin", "coding-agent-skills");
+  const fixtureRoot = path.join(root, "tests", "fixtures");
+  const githubHandoffFixture = createGitFixture(
+    path.join("tests", "fixtures", "github-handoff", "static-project"),
+  );
+  fs.appendFileSync(path.join(githubHandoffFixture, "README.md"), "\nLocal handoff change.\n");
+
+  const commands = [
+    ["validate-pack"],
+    ["validate-adapters", path.join(fixtureRoot, "external-adapters", "valid-basic")],
+    [
+      "validate-project",
+      path.join(fixtureRoot, "project-adapter-installation", "valid-exact-pin"),
+    ],
+    ["repo-map", path.join(fixtureRoot, "project-adapter-installation", "valid-exact-pin")],
+    ["route-trace", path.join(fixtureRoot, "route-trace", "static-project")],
+    ["env-audit", path.join(fixtureRoot, "env-audit", "static-project")],
+    ["secret-audit", path.join(fixtureRoot, "secret-audit", "static-project")],
+    ["api-contract-audit", path.join(fixtureRoot, "api-contract-audit", "static-project")],
+    ["migration-review", path.join(fixtureRoot, "migration-review", "static-project")],
+    ["github-handoff", githubHandoffFixture],
+    ["deployment-preflight", path.join(fixtureRoot, "deployment-preflight", "static-project")],
+  ];
+
+  for (const args of commands) {
+    const result = spawnSync(cliPath, [...args, "--json"], {
+      cwd: root,
+      encoding: "utf8",
+      stdio: "pipe",
+    });
+    assert.equal(result.status, 0, `${args.join(" ")}\n${result.stderr}`);
+    assert.equal(result.stderr, "");
+    const parsed = JSON.parse(result.stdout);
+    assertOpenClawJsonContract(parsed, args[0]);
+  }
+
+  const partial = spawnSync(
+    cliPath,
+    [
+      "deployment-preflight",
+      path.join(fixtureRoot, "project-adapter-installation", "valid-exact-pin"),
+      "--json",
+    ],
+    {
+      cwd: root,
+      encoding: "utf8",
+      stdio: "pipe",
+    },
+  );
+  assert.equal(partial.status, 0);
+  const parsedPartial = JSON.parse(partial.stdout);
+  assertOpenClawJsonContract(parsedPartial, "deployment-preflight");
+  assert.equal(parsedPartial.status, "partial");
+  assert.ok(parsedPartial.skipped.length > 0);
+  assert.ok(parsedPartial.refusedBehavior.includes("no deployments"));
+});
+
 test("npm package metadata is public-ready and dependency-free", () => {
   const packageJson = readJson("package.json");
   assert.equal(packageJson.name, "coding-agent-skills");
-  assert.equal(packageJson.version, "0.2.14");
+  assert.equal(packageJson.version, "0.2.16");
   assert.equal(
     packageJson.description,
     "Evidence-first, read-only coding-agent skills and project adapter tooling.",
@@ -405,6 +506,7 @@ test("npm package metadata is public-ready and dependency-free", () => {
     "api-contract-audit",
     "migration-review",
     "github-handoff",
+    "deployment-preflight",
     "project-adapters",
     "code-validation",
     "cli",
@@ -796,6 +898,54 @@ test("github-handoff does not broaden a repo-map-only project adapter", () => {
   assert.match(renderGithubHandoffReport(result), /github-handoff is not enabled/);
 });
 
+test("deployment-preflight maps static deployment surfaces without deployment behavior", () => {
+  const result = buildDeploymentPreflightReport(
+    path.join(root, "tests", "fixtures", "deployment-preflight", "static-project"),
+    { coreRoot: root },
+  );
+
+  assert.equal(result.status, "complete");
+  assert.ok(result.configFiles.some((record) => record.path === "wrangler.toml"));
+  assert.ok(result.configFiles.some((record) => record.path === "Dockerfile"));
+  assert.ok(result.deploymentDocs.some((record) => record.path === "docs/deployment.md"));
+  assert.ok(result.packageScriptKeys.some((record) => record.key === "deploy"));
+  assert.ok(result.platformIndicators.some((record) => record.platform === "cloudflare"));
+  assert.ok(result.riskIndicators.some((record) => record.type === "production-reference"));
+  assert.match(renderDeploymentPreflightReport(result), /No deployment, cloud provider API call/);
+});
+
+test("deployment-preflight respects adapter-declared scope", () => {
+  const result = buildDeploymentPreflightReport(
+    path.join(root, "tests", "fixtures", "deployment-preflight", "adapter-project"),
+    { coreRoot: root },
+  );
+
+  assert.equal(result.status, "complete");
+  assert.equal(result.adapter.enabled, true);
+  assert.deepEqual(result.scopePaths, ["deploy"]);
+  assert.deepEqual(result.filesScanned, ["deploy/netlify.toml"]);
+  assert.ok(result.configFiles.some((record) => record.path === "deploy/netlify.toml"));
+  assert.ok(result.warnings.includes("deployment-preflight used adapter-declared safe read paths only"));
+  const cli = deploymentPreflightCliResult(
+    path.join(root, "tests", "fixtures", "deployment-preflight", "adapter-project"),
+    { coreRoot: root },
+  );
+  assert.equal(cli.exitCode, 0);
+  assert.match(cli.lines.join("\n"), /Deployment-preflight enabled: yes/);
+});
+
+test("deployment-preflight does not broaden a repo-map-only project adapter", () => {
+  const result = buildDeploymentPreflightReport(
+    path.join(root, "tests", "fixtures", "project-adapter-installation", "valid-exact-pin"),
+    { coreRoot: root },
+  );
+
+  assert.equal(result.status, "partial");
+  assert.equal(result.filesScanned.length, 0);
+  assert.equal(result.configFiles.length, 0);
+  assert.match(renderDeploymentPreflightReport(result), /deployment-preflight is not enabled/);
+});
+
 test("validate-pack accepts installed package trees without source-only gitignore", () => {
   const temporaryRoot = fs.mkdtempSync(path.join(os.tmpdir(), "installed-package-"));
   const installedRoot = path.join(temporaryRoot, "coding-agent-skills");

package/scripts/validate-pack.mjs

@@ -101,6 +101,7 @@ const requiredRootFiles = [
   "scripts/render-api-contract-audit.mjs",
   "scripts/render-migration-review.mjs",
   "scripts/render-github-handoff.mjs",
+  "scripts/render-deployment-preflight.mjs",
   "scripts/check-adapter-upgrade.mjs",
   "scripts/check-adapter-upgrade-chain.mjs",
   "scripts/validate-adapters.mjs",
@@ -112,6 +113,7 @@ const requiredRootFiles = [
   "scripts/lib/api-contract-audit.mjs",
   "scripts/lib/migration-review.mjs",
   "scripts/lib/github-handoff.mjs",
+  "scripts/lib/deployment-preflight.mjs",
   "scripts/lib/adapter-upgrade.mjs",
   "scripts/lib/adapter-upgrade-chain.mjs",
   "scripts/lib/adapter-discovery.mjs",
@@ -685,8 +687,8 @@ if (packageJson) {
   if (packageJson.name !== "coding-agent-skills") {
     failures.push("package.json has unexpected package name");
   }
-  if (packageJson.version !== "0.2.14") {
-    failures.push("package.json version must be 0.2.14 for public package validation");
+  if (packageJson.version !== "0.2.16") {
+    failures.push("package.json version must be 0.2.16 for public package validation");
   }
   if (packageJson.type !== "module") failures.push("package.json must preserve ESM mode");
   if (packageJson.private !== false) {
@@ -710,6 +712,7 @@ if (packageJson) {
       "api-contract-audit",
       "migration-review",
       "github-handoff",
+      "deployment-preflight",
       "project-adapters",
       "code-validation",
       "cli",

package/skills/deployment-preflight/SKILL.md

@@ -0,0 +1,89 @@
+---
+name: deployment-preflight
+description: Map statically visible deployment readiness evidence without deploying, calling provider APIs, installing packages, building, testing, reading secrets, or mutating project/runtime state. Use when Codex needs a bounded pre-deploy orientation report from config files, docs, package script keys, and static platform indicators before separately approved deployment work.
+---
+
+# Deployment Preflight
+
+Map deployment-related evidence that is already visible in the repository. Remain
+audit-only and avoid turning preflight discovery into deployment, cloud, runtime, build, or
+secret work.
+
+This skill must not change project files, Git state, dependencies, runtime state, services,
+databases, cloud provider state, remotes, deployment targets, or generated outputs.
+
+## Purpose And Use
+
+Use this skill before deployment planning, release handoff, or platform-specific work when
+the agent needs to understand visible deployment config, deployment docs, platform hints,
+and static readiness risks.
+
+Do not use it as proof of deployability, provider CLI behavior, cloud API state, domain
+validity, environment values, build outcomes, test outcomes, service runtime, deployment
+publication, database migration state, or secret content.
+
+## Inputs
+
+Require a project root or starting path. Optionally accept a project adapter, intended scan
+area, documentation precedence, deployment config hints, or known platform boundaries.
+
+Do not assume a missing deployment config means no deployment exists, package script keys are
+safe to run, provider credentials are present, remote state matches repository state, or a
+project adapter enables this skill unless validation proves it.
+
+## Procedure
+
+1. Record user intent, project root, declared scope, adapter state, and safety boundary.
+2. Validate a project adapter when present before reading adapter-declared metadata.
+3. If an adapter is present but does not enable `deployment-preflight`, stop static file
+   reading and report the adapter-limited skip.
+4. Build scan scope from adapter safe read paths when available; otherwise use a bounded
+   generic static scan.
+5. Exclude `.env`, secret-bearing files, generated output, dependency paths, build output,
+   runtime output, and oversized files before reading.
+6. Identify deployment config files and platform indicators.
+7. Identify deployment documentation and runbook references.
+8. Identify package script keys that mention deployment tooling without printing command
+   values.
+9. Identify static risk indicators without judging runtime or provider safety.
+10. Emit the shared evidence pack or deployment preflight report before claiming completion.
+
+Use [checklist.md](checklist.md). Consult [failure-modes.md](failure-modes.md),
+[adapter-interface.md](adapter-interface.md), and [examples.md](examples.md). Format findings
+with [evidence-template.md](evidence-template.md).
+
+## Evidence, Recovery, And Dependencies
+
+Emit repository identity, adapter state, scan scope, ignored paths, files scanned, deployment
+config files, deployment docs, package script keys, platform indicators, risk indicators,
+skipped items, not-verified areas, warnings, and changed-state declaration through the
+shared evidence-pack contract.
+
+Recover from missing configs, ambiguous platform hints, unreadable files, or adapter limits
+by reporting uncertainty. Never recover by deploying, running provider CLIs, calling cloud
+APIs, installing dependencies, building, testing, starting services, broadening adapter
+scope, or reading `.env`.
+
+This skill depends on the evidence-pack contract and may consume validated project adapters.
+Adapters may add safe paths, ignored paths, documentation precedence, and evidence
+requirements, but cannot weaken policy or turn this skill into deployment work.
+
+## Approval Boundary
+
+Explicit approval may permit one named non-secret static file read outside normal source
+paths. Approval does not permit `.env` or secret-file reads, provider API calls, provider CLI
+execution, package installation, builds, tests, runtime checks, service mutation,
+deployments, migrations, Git mutation, or project writes.
+
+## Completion
+
+Claim `complete` only when the declared static scan scope was inspected, visible deployment
+surfaces are reported, skipped and not-verified areas are explicit, adapter limitations are
+clear, and no project, Git, dependency, runtime, service, database, cloud provider, remote,
+deployment, or generated-output state changed.
+
+Report `partial`, `failed`, or `blocked` when adapter scope prevents scanning, requested
+evidence requires deployment/runtime/provider behavior, the project root cannot be
+established, or safety exclusions prevent the requested conclusion.
+
+These conditions are both the acceptance criteria and definition of done.

package/skills/deployment-preflight/adapter-interface.md

@@ -0,0 +1,17 @@
+# Deployment Preflight Adapter Interface
+
+Adapters may narrow the static scan by declaring:
+
+- `extensions.safeReadPaths`
+- `extensions.ignoredPaths`
+- `extensions.documentationPrecedence`
+- `extensions.requiredEvidence`
+- `extensions.expectedPackageManagers`
+
+Adapters must declare `deployment-preflight` with `declaredMode: "audit-only"` and
+compatible core versions. They cannot allow deployments, provider API calls, package
+installs, builds, tests, runtime checks, migrations, secret reads, project writes, failure
+suppression, completion overrides, or scope expansion without approval.
+
+If a project adapter is present but does not enable `deployment-preflight`, the skill reports
+`partial` and does not read target files.

package/skills/deployment-preflight/agents/openai.yaml

@@ -0,0 +1,3 @@
+display_name: Deployment Preflight
+short_description: Map static deployment readiness evidence without deploying or calling provider APIs.
+default_prompt: Review this repository's static deployment readiness evidence as an audit-only pass without modifying files, deploying, calling provider APIs, installing packages, building, testing, mutating services, or reading secrets.

package/skills/deployment-preflight/checklist.md

@@ -0,0 +1,7 @@
+# Deployment Preflight Checklist
+
+- Confirm the project root, branch state, adapter state, and declared scan scope.
+- Validate the project adapter before consuming adapter-declared paths.
+- Exclude `.env`, secret-bearing, generated, dependency, build, runtime-output, and oversized files.
+- Report deployment config files, deployment docs, package script keys, platform indicators, risk indicators, skipped items, and not-verified areas.
+- Confirm no deployment, provider API call, package install, build, test, runtime check, migration, secret read, project write, or Git mutation occurred.

package/skills/deployment-preflight/evidence-template.md

@@ -0,0 +1,19 @@
+# Deployment Preflight Evidence Template
+
+- Status:
+- Project root:
+- Branch state:
+- Adapter present/enabled:
+- Scope paths:
+- Ignored paths:
+- Files scanned:
+- Deployment config files:
+- Deployment docs:
+- Package script keys:
+- Platform indicators:
+- Risk indicators:
+- Skipped items:
+- Not verified:
+- Refused behavior:
+- Changed-state declaration:
+- Recommended next action:

package/skills/deployment-preflight/examples.md

@@ -0,0 +1,11 @@
+# Deployment Preflight Examples
+
+**Safe:** `coding-agent-skills deployment-preflight /workspace/project`
+
+**Safe:** `node scripts/render-deployment-preflight.mjs /workspace/project`
+
+**Unsafe and denied:** provider deployment commands, package deploy scripts, and production
+publish commands.
+
+Use the report to orient future deployment planning. Do not treat static evidence as proof
+that credentials, cloud resources, domains, builds, or deployed services are valid.

package/skills/deployment-preflight/failure-modes.md

@@ -0,0 +1,11 @@
+# Deployment Preflight Failure Modes
+
+- The project root cannot be established.
+- A project adapter is present but invalid or does not enable `deployment-preflight`.
+- Deployment config is absent, generated, or outside the approved scan scope.
+- Files are skipped because they are secret-bearing, oversized, symlinked, generated, or ignored.
+- A request asks for provider state, deployment execution, runtime health, credential checks, or build verification.
+
+Recover by reporting partial evidence and clear uncertainty. Do not recover by deploying,
+calling provider APIs, installing packages, building, testing, running services, widening
+scope, or reading secrets.

package/tests/fixtures/deployment-preflight/adapter-project/.coding-agent/adapters/deployment-preflight-fixture/adapter.json

@@ -0,0 +1,56 @@
+{
+  "adapterId": "deployment-preflight-fixture",
+  "adapterVersion": "1.0.0",
+  "project": {
+    "id": "fixture-deployment-preflight",
+    "detection": {
+      "rootMarkers": [
+        {"kind": "file", "path": "package.json"},
+        {"kind": "file", "path": "README.md"}
+      ],
+      "maximumDepth": 1,
+      "scope": "declared-project-root",
+      "requireApprovalOutsideScope": true
+    }
+  },
+  "supportedSkills": [
+    {
+      "id": "deployment-preflight",
+      "compatibleVersions": ["0.2.3", "0.2.x"],
+      "declaredMode": "audit-only"
+    }
+  ],
+  "extensions": {
+    "safeReadPaths": ["deploy"],
+    "ignoredPaths": ["ignored", "node_modules", "dist", "build"],
+    "documentationPrecedence": ["README.md"],
+    "commandAliases": [],
+    "safeStatusCommands": [],
+    "requiredEvidence": ["project root", "adapter scope", "deployment config", "not-verified provider areas"],
+    "expectedRuntimeManagers": [],
+    "expectedPackageManagers": ["npm"]
+  },
+  "approvalRequirements": [],
+  "inheritance": {
+    "sharedRestrictions": "required",
+    "deniedOperationCategories": [
+      "file-write",
+      "package-install",
+      "deployment",
+      "git-mutation",
+      "unrestricted-scan",
+      "secret-read",
+      "process-mutation",
+      "service-mutation",
+      "migration-apply",
+      "privileged-api"
+    ],
+    "allowRestrictionRemoval": false,
+    "allowModeOverride": false,
+    "allowFailureSuppression": false,
+    "allowCompletionOverride": false,
+    "allowSecretExposure": false,
+    "allowRequiredEvidenceRemoval": false,
+    "allowScopeExpansionWithoutApproval": false
+  }
+}

package/tests/fixtures/deployment-preflight/adapter-project/.coding-agent/skills.json

@@ -0,0 +1,23 @@
+{
+  "declarationVersion": "1.0.0",
+  "projectId": "fixture-deployment-preflight",
+  "adapterRoot": ".coding-agent/adapters",
+  "adapterSchemaVersion": "1.0.0",
+  "core": {
+    "id": "coding-agent-skills",
+    "expectedVersion": "0.2.3",
+    "versionPin": ">=0.2.3 <0.3.0"
+  },
+  "compatibleSkillIds": ["deployment-preflight"],
+  "adapters": [
+    {
+      "id": "deployment-preflight-fixture",
+      "version": "1.0.0",
+      "skillIds": ["deployment-preflight"]
+    }
+  ],
+  "validationCommand": "node <shared-core>/scripts/validate-project-adapters.mjs <project-root>",
+  "evidenceOutput": ".coding-agent/evidence",
+  "approvalPolicyReference": ".coding-agent/approval-policy.md",
+  "noSecrets": true
+}

package/tests/fixtures/deployment-preflight/adapter-project/README.md

@@ -0,0 +1,3 @@
+# Deployment Preflight Adapter Fixture
+
+Synthetic adapter-scoped deployment preflight fixture.

package/tests/fixtures/deployment-preflight/adapter-project/deploy/netlify.toml

@@ -0,0 +1,3 @@
+[build]
+publish = "dist"
+command = "npm run build"

package/tests/fixtures/deployment-preflight/adapter-project/ignored/render.yaml

@@ -0,0 +1,3 @@
+services:
+  - type: web
+    name: ignored-service

package/tests/fixtures/deployment-preflight/adapter-project/package.json

@@ -0,0 +1,5 @@
+{
+  "scripts": {
+    "deploy": "netlify deploy"
+  }
+}

package/tests/fixtures/deployment-preflight/static-project/Dockerfile

@@ -0,0 +1,2 @@
+FROM node:20-alpine
+CMD ["node", "src/index.js"]

package/tests/fixtures/deployment-preflight/static-project/README.md

@@ -0,0 +1,3 @@
+# Deployment Preflight Static Fixture
+
+Synthetic project used to verify static deployment readiness mapping.

package/tests/fixtures/deployment-preflight/static-project/docs/deployment.md

@@ -0,0 +1,4 @@
+# Deployment Notes
+
+Deployments use synthetic Cloudflare-style configuration. Production values are not stored
+in this fixture.

package/tests/fixtures/deployment-preflight/static-project/package.json

@@ -0,0 +1,6 @@
+{
+  "scripts": {
+    "deploy": "wrangler deploy",
+    "preview": "wrangler pages dev"
+  }
+}

package/tests/fixtures/deployment-preflight/static-project/src/index.js

@@ -0,0 +1 @@
+export const handler = () => "ok";

package/tests/fixtures/deployment-preflight/static-project/wrangler.toml

@@ -0,0 +1,3 @@
+name = "synthetic-worker"
+compatibility_date = "2026-07-03"
+main = "src/index.js"

package/tests/fixtures/triggers/cases.json

@@ -91,6 +91,18 @@
       "expectedSkill": "github-handoff",
       "notSkills": ["runtime-truth", "deployment-preflight"]
     },
+    {
+      "id": "deployment-preflight-static",
+      "prompt": "Run a deployment preflight and map static deployment config, docs, and package script keys without deploying.",
+      "expectedSkill": "deployment-preflight",
+      "notSkills": ["runtime-truth", "build-verify"]
+    },
+    {
+      "id": "deployment-preflight-readiness",
+      "prompt": "Map deployment readiness evidence before release, but do not call provider APIs or run builds.",
+      "expectedSkill": "deployment-preflight",
+      "notSkills": ["github-handoff", "migration-review"]
+    },
     {
       "id": "build-after-implementation",
       "prompt": "The implementation is finished. Run the existing typecheck, tests, and build.",
@@ -143,7 +155,7 @@
       "id": "negative-deploy",
       "prompt": "Deploy this application to production.",
       "expectedSkill": null,
-      "notSkills": ["repo-map", "route-trace", "env-audit", "secret-audit", "api-contract-audit", "migration-review", "github-handoff", "build-verify", "git-preflight", "runtime-truth", "llm-drift-control"]
+      "notSkills": ["repo-map", "route-trace", "env-audit", "secret-audit", "api-contract-audit", "migration-review", "github-handoff", "deployment-preflight", "build-verify", "git-preflight", "runtime-truth", "llm-drift-control"]
     },
     {
       "id": "negative-install",

package/tests/trigger/README.md

@@ -14,6 +14,8 @@
   deployment, or migration execution.
 - Local GitHub handoff evidence must trigger `github-handoff`, not publication,
   pull request creation, or Git mutation.
+- Static deployment readiness mapping must trigger `deployment-preflight`, not deployment,
+  provider API calls, or runtime mutation.
 - Local validation must trigger `build-verify` only when project-native checks are requested.
 - Git readiness must trigger `git-preflight`, not publication.
 - Process/listener/health questions must trigger `runtime-truth`, not restart behavior.