coding-agent-skills 0.2.8 → 0.2.10

package/examples/evidence-packs/env-audit.json

@@ -0,0 +1,55 @@
+{
+  "contractVersion": "1.0.0",
+  "skill": {"name": "env-audit", "version": "0.2.3"},
+  "invocation": {
+    "id": "example-env-audit",
+    "startedAt": "2026-07-03T10:00:00Z",
+    "endedAt": "2026-07-03T10:01:00Z"
+  },
+  "repository": {
+    "root": "/workspace/example-project",
+    "branch": "main",
+    "head": "0123456789abcdef",
+    "workingTreeState": "clean"
+  },
+  "userIntent": "Identify environment variable names before updating setup documentation.",
+  "declaredScope": ["/workspace/example-project"],
+  "projectAdapter": "example-env-adapter",
+  "environmentSummary": {"platform": "linux", "shell": "bash"},
+  "status": "complete",
+  "confidence": {
+    "level": "high",
+    "reason": "Static env references, sample files, skipped secret paths, and not-verified runtime stores were recorded without values."
+  },
+  "commands": [
+    {
+      "command": "coding-agent-skills env-audit /workspace/example-project",
+      "family": "env-audit-renderer",
+      "workingDirectory": "/workspace/example-project",
+      "startedAt": "2026-07-03T10:00:20Z",
+      "endedAt": "2026-07-03T10:00:21Z",
+      "exitStatus": 0,
+      "resultStatus": "success",
+      "safetyClass": "allowed",
+      "approvalReference": null,
+      "purpose": "Render a value-free static env audit report.",
+      "outputSummary": "Found env variable names and sample declarations without reading .env files or printing values."
+    }
+  ],
+  "skippedChecks": [],
+  "findings": [
+    {
+      "summary": "Environment variable names were identified from static references and .env.example only.",
+      "evidence": ["src/config.ts", ".env.example"]
+    }
+  ],
+  "risks": [],
+  "failures": [],
+  "unresolvedQuestions": [],
+  "changedState": {
+    "changed": false,
+    "summary": "No project, Git, dependency, runtime, service, or remote state changed."
+  },
+  "handoffSummary": "Environment variable names are mapped without values; runtime stores remain unverified.",
+  "recommendedNextAction": "Review the reported names before updating documentation."
+}

package/examples/evidence-packs/route-trace.json

@@ -0,0 +1,55 @@
+{
+  "contractVersion": "1.0.0",
+  "skill": {"name": "route-trace", "version": "0.2.3"},
+  "invocation": {
+    "id": "example-route-trace",
+    "startedAt": "2026-07-02T10:00:00Z",
+    "endedAt": "2026-07-02T10:02:00Z"
+  },
+  "repository": {
+    "root": "/workspace/example-project",
+    "branch": "main",
+    "head": "0123456789abcdef",
+    "workingTreeState": "clean"
+  },
+  "userIntent": "Trace static route surfaces before editing an API handler.",
+  "declaredScope": ["/workspace/example-project"],
+  "projectAdapter": "example-route-adapter",
+  "environmentSummary": {"platform": "linux", "shell": "bash"},
+  "status": "complete",
+  "confidence": {
+    "level": "high",
+    "reason": "Adapter scope, route files, inferred route declarations, skipped paths, and not-verified runtime-dependent route classes were recorded."
+  },
+  "commands": [
+    {
+      "command": "coding-agent-skills route-trace /workspace/example-project",
+      "family": "route-trace-renderer",
+      "workingDirectory": "/workspace/example-project",
+      "startedAt": "2026-07-02T10:00:20Z",
+      "endedAt": "2026-07-02T10:00:21Z",
+      "exitStatus": 0,
+      "resultStatus": "success",
+      "safetyClass": "allowed",
+      "approvalReference": null,
+      "purpose": "Render a static route-trace report.",
+      "outputSummary": "Found Next.js API route files and inferred Express route declarations without runtime checks."
+    }
+  ],
+  "skippedChecks": [],
+  "findings": [
+    {
+      "summary": "Verified route files and inferred route declarations were identified from static files only.",
+      "evidence": ["app/api/users/route.ts", "server/routes.ts"]
+    }
+  ],
+  "risks": [],
+  "failures": [],
+  "unresolvedQuestions": [],
+  "changedState": {
+    "changed": false,
+    "summary": "No project, Git, dependency, runtime, service, or remote state changed."
+  },
+  "handoffSummary": "Static route surfaces are mapped with runtime-dependent areas explicitly not verified.",
+  "recommendedNextAction": "Review the relevant verified route file before editing."
+}

package/examples/manifests/env-audit.json

@@ -0,0 +1,14 @@
+{
+  "name": "env-audit",
+  "version": "0.2.3",
+  "mode": "audit-only",
+  "evidenceContract": "../../contracts/evidence-pack/evidence-pack.schema.json",
+  "commandPolicy": "../command-policies/env-audit.json",
+  "adapterSchema": "../../schemas/project-adapter.schema.json",
+  "adapterCompatibility": {
+    "contractVersion": "1.0.0",
+    "compatibleAdapterVersions": ["1.0.0"]
+  },
+  "adapterInterface": "../../skills/env-audit/adapter-interface.md",
+  "description": "Identify environment variable names without reading values."
+}

package/examples/manifests/route-trace.json

@@ -0,0 +1,14 @@
+{
+  "name": "route-trace",
+  "version": "0.2.3",
+  "mode": "audit-only",
+  "evidenceContract": "../../contracts/evidence-pack/evidence-pack.schema.json",
+  "commandPolicy": "../command-policies/route-trace.json",
+  "adapterSchema": "../../schemas/project-adapter.schema.json",
+  "adapterCompatibility": {
+    "contractVersion": "1.0.0",
+    "compatibleAdapterVersions": ["1.0.0"]
+  },
+  "adapterInterface": "../../skills/route-trace/adapter-interface.md",
+  "description": "Trace static route surfaces without executing project code."
+}

package/examples/workflows/env-audit.md

@@ -0,0 +1,16 @@
+# Env Audit Workflow
+
+Use `env-audit` before editing setup docs, config loaders, or handoff notes:
+
+```bash
+coding-agent-skills env-audit /workspace/project
+```
+
+Review:
+
+- names and classifications
+- sample files inspected
+- skipped secret-bearing paths
+- runtime and credential stores not verified
+
+Do not use the output as proof that values exist or credentials work.

package/examples/workflows/route-trace.md

@@ -0,0 +1,20 @@
+# Route Trace Workflow
+
+Use `route-trace` when the route surface must be understood from static files before
+editing or review.
+
+```bash
+coding-agent-skills route-trace /path/to/project
+```
+
+Expected evidence:
+
+- validated adapter state when present
+- adapter-limited or generic static scan scope
+- verified route files
+- inferred route declarations
+- skipped paths and not-verified runtime-dependent route classes
+- no state changes
+
+Do not run servers, hit URLs, read `.env`, install packages, build, test, deploy, migrate,
+or claim runtime availability from static route findings.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "coding-agent-skills",
-  "version": "0.2.8",
+  "version": "0.2.10",
   "description": "Evidence-first, read-only coding-agent skills and project adapter tooling.",
   "type": "module",
   "private": false,
@@ -9,6 +9,8 @@
     "coding-agent",
     "agent-skills",
     "repo-map",
+    "route-trace",
+    "env-audit",
     "project-adapters",
     "code-validation",
     "cli"

package/runs/skill-runs.md

@@ -160,3 +160,40 @@ This file records bounded maintainer-loop runs. Entries must not contain secrets
 - Validation result: pass pending final publication evidence
 - Commit/tag/push status: pending approved release workflow
 - Next state: no next runner command is queued after `v0.2.8`; future package releases, new skills, real adapter expansion, platform work, deployment/preflight skills, and release-policy changes require separate human approval
+
+
+## design-v0.2.9-route-trace
+
+- Run ID: `design-v0.2.9-route-trace`
+- Timestamp: `2026-07-03T00:00:00Z`
+- Command used: `manual approval for route-trace-skill implementation and release`
+- Permissions granted: `skill-implementation`, `test-hardening`, `docs-hardening`, `release-preflight`, `commit`, `push`, `tag`, `npm-publish`, `github-release`
+- Design summary: add `route-trace` as an audit-only static inspection skill and CLI command. It validates a project adapter when present, limits inspection to adapter-safe paths when available, skips ignored and secret-bearing paths, identifies visible route files and route declarations without executing project code, and labels findings as verified route files, inferred route patterns, skipped items, or not verified.
+- Supported static surfaces: Next.js `app/` and `pages/` routes, API route files, React Router-style declarations, Express/Fastify/Hono-style route registrations, route config files, and adapter-declared safe paths.
+- Safety scope: no `.env` reads, no target-project builds/tests/dev servers, no runtime URL probing, no app-code execution, no package installation, no deployments, no migrations, no database inspection, no process/service mutation, and no runtime truth claims.
+- Release target: `v0.2.9` / `coding-agent-skills@0.2.9`.
+
+
+## implementation-v0.2.9-route-trace
+
+- Run ID: `implementation-v0.2.9-route-trace`
+- Timestamp: `2026-07-03T00:00:00Z`
+- Command used: `resume interrupted route-trace-skill implementation and complete release loop`
+- Permissions granted: `skill-implementation`, `test-hardening`, `docs-hardening`, `release-preflight`, `commit`, `push`, `tag`, `npm-publish`, `github-release`
+- Files changed: `route-trace` skill, route-trace renderer and library, CLI wrapper, adapter schemas, pack rules, release tests, synthetic route fixtures, usage/release/safety/adapter docs, changelog, roadmap, work ledger, run log, and package metadata.
+- Route-trace scope: audit-only static route tracing for verified route files, inferred route patterns, skipped paths, not-verified runtime route classes, and adapter-limited scope.
+- Safety scope: no target-project builds, tests, dev servers, package installs, app-code execution, URL probing, deployments, migrations, database inspection, secret-file reads, project writes, or runtime truth claims.
+- Validation commands: `git diff --check`; `bin/coding-agent-skills validate-pack`; `bin/coding-agent-skills validate-adapters tests/fixtures/external-adapters/valid-basic`; `bin/coding-agent-skills validate-project /home/oneclickwebsitedesignfactory/tax-lien-platform`; `bin/coding-agent-skills repo-map /home/oneclickwebsitedesignfactory/tax-lien-platform`; `bin/coding-agent-skills route-trace tests/fixtures/route-trace/static-project`; `bin/coding-agent-skills route-trace /home/oneclickwebsitedesignfactory/tax-lien-platform`; `node scripts/validate-pack.mjs .`; `node scripts/test-pack.mjs`; `node scripts/validate-maintainer-loop.mjs .`; `node --test`; JSON parsing; package secret scan; npm publish dry-run; tarball install smoke.
+- Validation result: pass pending final commit, tag, publication, registry smoke, npm exec, and GitHub Release evidence.
+- Real project smoke: `/home/oneclickwebsitedesignfactory/tax-lien-platform` remained repo-map-only for adapters, so route-trace reported `partial` and did not read target project route files.
+
+## implementation-v0.2.10-env-audit
+
+- Run ID: `implementation-v0.2.10-env-audit`
+- Repository: `/home/oneclickwebsitedesignfactory/coding-agent-skills`
+- Command used: `builder-mode approval for env-audit-skill implementation and release`
+- Files changed: `env-audit` skill, env-audit renderer and library, CLI wrapper, adapter schemas, pack rules, release tests, synthetic env fixtures, usage/release/safety/adapter docs, changelog, roadmap, work ledger, run log, and package metadata.
+- Safety boundary: read-only, static-analysis only, no `.env` reads, no value printing, no credential validation, no API calls, no builds, no tests in target projects, no deploys, no migrations, and no target-project mutation.
+- Validation commands: pending final release validation matrix.
+- Result: pass pending final publication evidence.
+- Commit/tag/push status: pending approved release workflow.

package/schemas/project-adapter-installation.schema.json

@@ -65,6 +65,8 @@
         "type": "string",
         "enum": [
           "repo-map",
+          "route-trace",
+          "env-audit",
           "build-verify",
           "git-preflight",
           "runtime-truth",
@@ -96,9 +98,11 @@
             "items": {
               "type": "string",
               "enum": [
-                "repo-map",
-                "build-verify",
-                "git-preflight",
+              "repo-map",
+              "route-trace",
+              "env-audit",
+              "build-verify",
+              "git-preflight",
                 "runtime-truth",
                 "llm-drift-control"
               ]

package/schemas/project-adapter.schema.json

@@ -89,6 +89,8 @@
             "type": "string",
             "enum": [
               "repo-map",
+              "route-trace",
+              "env-audit",
               "build-verify",
               "git-preflight",
               "runtime-truth",
@@ -165,6 +167,8 @@
                 "type": "string",
                 "enum": [
                   "repo-map",
+                  "route-trace",
+                  "env-audit",
                   "build-verify",
                   "git-preflight",
                   "runtime-truth",