coding-agent-skills 0.2.8 → 0.2.9

package/CHANGELOG.md

@@ -2,6 +2,25 @@
 
 All notable changes follow [Semantic Versioning](docs/versioning/README.md).
 
+## [0.2.9] - 2026-07-03
+
+### Added
+
+- `route-trace` audit-only skill for static route surface tracing.
+- `coding-agent-skills route-trace <project-root>` CLI command.
+- Dependency-free route trace renderer for verified route files, inferred route patterns,
+  skipped paths, not-verified runtime route classes, adapter-limited scope, and safety
+  refusals.
+- Synthetic route-trace fixtures and release tests for generic static scans, adapter-scoped
+  scans, and repo-map-only adapter skips.
+
+### Changed
+
+- Adapter schemas and validators now recognize `route-trace` as an audit-only skill while
+  preserving the existing `0.2.3` adapter contract compatibility baseline.
+- Package metadata, usage docs, release docs, roadmap, ledger, and run log now describe the
+  new read-only route-trace command.
+
 ## [0.2.8] - 2026-06-19
 
 ### Added

package/README.md

@@ -6,6 +6,7 @@ The pilot pack contains:
 
 - Shared evidence-pack contract.
 - `repo-map`: audit-only repository orientation.
+- `route-trace`: audit-only static route surface tracing.
 - `build-verify`: controlled local validation using existing project commands.
 - `git-preflight`: audit-only Git readiness inspection.
 - `runtime-truth`: audit-only runtime evidence collection.
@@ -38,6 +39,7 @@ Every skill emits the evidence-pack contract. A command being attempted is never
 - Run `coding-agent-skills validate-pack` to validate the installed pack.
 - Run `npx coding-agent-skills validate-pack` when a one-off npm execution is preferred.
 - From a clone, the same wrapper is available as `bin/coding-agent-skills validate-pack`.
+- Trace static route surfaces with `coding-agent-skills route-trace <project-root>`.
 - Validate project adapters against [the formal adapter schema](schemas/project-adapter.schema.json).
 - Review [external adapter discovery](docs/adapters/discovery.md).
 - Run `node scripts/validate-adapters.mjs <adapter-root>` for a disposable external root.
@@ -45,6 +47,8 @@ Every skill emits the evidence-pack contract. A command being attempted is never
 - Run `node scripts/validate-project-adapters.mjs <project-root>` for a declared project root.
 - Render adapter-aware `repo-map` orientation with
   `node scripts/render-adapter-repo-map.mjs <project-root>`.
+- Render a static route-trace report with
+  `node scripts/render-route-trace.mjs <project-root>`.
 - Review [adapter upgrade checks](docs/adapters/upgrades.md).
 - Run `node scripts/check-adapter-upgrade.mjs <before-project-root> <after-project-root>`
   for disposable project revisions.

package/ROADMAP.md

@@ -1,6 +1,7 @@
 # Roadmap
 
-The pilot release remains limited to five approved skills. Future work requires separate design and approval.
+The public package now contains six approved shared skills. Future work requires separate
+design and approval.
 
 ## Released Harness Milestones
 
@@ -26,13 +27,15 @@ The pilot release remains limited to five approved skills. Future work requires
 - `v0.2.7`: package-installed `validate-pack` support for tarball/global installs.
 - `v0.2.8`: first public npm release with MIT license, public metadata, and registry
   install smoke coverage.
+- `v0.2.9`: audit-only `route-trace` skill and CLI renderer for static route surface
+  tracing.
 
 The next milestone is recorded in [work-ledger.md](work-ledger.md). The
 [maintainer loop](RUNBOOK.md) may select and evidence that milestone, but it must stop
 before implementation until the relevant human approval is granted.
 
 No evidence-harness milestone is queued after `v0.2.3`. Additional real project adapters,
-new skills, platform work, deployment/preflight work, and signing infrastructure remain
+new skills beyond `route-trace`, platform work, deployment/preflight work, and signing infrastructure remain
 separately gated. The public npm package exposes the existing read-only CLI surface; it
 does not approve new skills or target-project mutation.
 
@@ -67,7 +70,7 @@ Next safe milestone options:
 
 | Candidate | Scope | Mode | Current gate |
 |---|---|---|---|
-| `route-trace-skill` | General | Audit-only | Needs design review |
+| `route-trace-skill` | General | Audit-only | Implemented in `v0.2.9` |
 | `env-audit-skill` | General | Audit-only | Needs more evidence |
 | `secret-audit-skill` | General | Audit-only | Blocked on privacy and approval model |
 | `deployment-preflight-skill` | General | Audit-only | Needs design review |

package/bin/coding-agent-skills

@@ -23,6 +23,12 @@ const commands = {
     usage: "coding-agent-skills repo-map <project-root>",
     requiredArgs: 1,
   },
+  "route-trace": {
+    script: "scripts/render-route-trace.mjs",
+    args: ([projectRoot]) => [projectRoot],
+    usage: "coding-agent-skills route-trace <project-root>",
+    requiredArgs: 1,
+  },
   "validate-adapters": {
     script: "scripts/validate-adapters.mjs",
     args: ([adapterRoot]) => [adapterRoot],
@@ -39,9 +45,10 @@ function usage(exitCode = 0) {
     "  validate-pack",
     "  validate-project <project-root>",
     "  repo-map <project-root>",
+    "  route-trace <project-root>",
     "  validate-adapters <adapter-root>",
     "",
-    "local-only wrapper; no npm package or global install is implied",
+    "local wrapper for the published coding-agent-skills package",
   ];
   const stream = exitCode === 0 ? process.stdout : process.stderr;
   stream.write(`${lines.join("\n")}\n`);

package/docs/adapters/README.md

@@ -38,11 +38,28 @@ builds, install packages, perform runtime checks, deploy, migrate, or read `.env
 This is agent context for safer repository understanding. It is not target-application
 product behavior.
 
+## Adapter-Aware Route Trace Consumption
+
+The shared pack can consume a validated project-owned adapter as bounded context for
+`route-trace`:
+
+```bash
+node scripts/render-route-trace.mjs <project-root>
+```
+
+The renderer validates the project declaration when present. If an adapter is present but
+does not enable `route-trace`, it reports an adapter-limited skip instead of broadening
+scope. When enabled, it reads only adapter-declared safe paths, applies ignored paths, and
+statically reports verified route files, inferred route patterns, skipped items, and
+not-verified runtime-dependent routing classes. It does not execute target code, run
+servers, hit URLs, build, test, deploy, migrate, inspect databases, or read `.env` files.
+
 ## What Adapters May Do
 
 - Add bounded relative read paths and ignored paths.
 - Declare project-root markers and a bounded detection depth.
 - Add documentation precedence and package-manager hints.
+- Add route-trace safe read paths for static route files and route config.
 - Add command aliases that already satisfy the shared command policy.
 - Add status-only runtime commands and manager hints.
 - Require additional evidence or named approval for exceptional reads.

package/docs/adapters/project-installation.md

@@ -85,7 +85,7 @@ The dependency-free validator:
 Exit `0` means the project declaration and all installed adapters are compatible. Exit `1`
 means validation failed. Exit `2` means the project-root argument is missing.
 
-## Repo-Map Consumption
+## Adapter-Aware Consumption
 
 After validation passes, a project-owned adapter can be consumed as read-only `repo-map`
 context:
@@ -109,6 +109,19 @@ The renderer is metadata-only. It does not read target project file contents, ru
 project tests, run builds, install packages, perform runtime checks, deploy, migrate, read
 `.env` files, or modify project state.
 
+A project-owned adapter can also enable read-only `route-trace` context:
+
+```bash
+node scripts/render-route-trace.mjs <project-root>
+```
+
+The route-trace renderer validates the project declaration when present. If the adapter is
+present but does not enable `route-trace`, it reports an adapter-limited skip. When enabled,
+it reads only adapter-declared safe paths and reports verified route files, inferred route
+patterns, skipped paths, and not-verified runtime-dependent route classes. It does not run
+servers, hit URLs, execute app code, build, test, deploy, migrate, inspect databases, read
+`.env` files, or modify project state.
+
 ## Safety Boundary
 
 Project adapters are extension-only. They cannot remove denied operations, change an

package/docs/adapters/real-project-adoption.md

@@ -20,8 +20,8 @@ project repository is touched:
   `.coding-agent/adapters/`, `coding-agent/adapters/`, or `adapters/coding-agent/`.
 - The project can declare exactly one installation file: `.coding-agent/skills.json` or
   `coding-agent.skills.json`.
-- The adapter need is bounded to existing pilot skills: `repo-map`, `build-verify`,
-  `git-preflight`, `runtime-truth`, or `llm-drift-control`.
+- The adapter need is bounded to existing pilot skills: `repo-map`, `route-trace`,
+  `build-verify`, `git-preflight`, `runtime-truth`, or `llm-drift-control`.
 - The adapter can narrow context with relative paths, documentation precedence, safe
   aliases, status-only hints, or extra evidence requirements.
 - The adapter does not require deployment, migration, package installation, Git

package/docs/architecture/README.md

@@ -12,6 +12,7 @@ Skills consume the evidence-pack contract but do not depend on hidden state. Aud
 Audit-only:
 
 - `repo-map`
+- `route-trace`
 - `git-preflight`
 - `runtime-truth`
 - `llm-drift-control`
@@ -20,4 +21,6 @@ Controlled local validation:
 
 - `build-verify`
 
-The evidence pack is a shared output contract, not an executable skill. Route tracing, environment and secret audits, deployment preflight, GitHub handoff, provider operations, and project adapters remain separate future work.
+The evidence pack is a shared output contract, not an executable skill. Environment and
+secret audits, deployment preflight, GitHub handoff, provider operations, and additional
+project adapters remain separate future work.

package/docs/release/README.md

@@ -19,14 +19,16 @@
 13. Inspect tarball contents for local-only files, credentials, `.env` files, dependency
     folders, generated output, and unrelated repositories.
 14. Install the tarball into a temporary npm prefix and smoke-test the installed CLI.
-15. Review changelog, ledger, run evidence, and versioning impact.
-16. Commit with approved identity.
-17. Push `main` using credential-free remotes.
-18. Confirm a clean synchronized worktree.
-19. Create and push the annotated version tag.
-20. Publish with `npm publish --access public --registry=https://registry.npmjs.org/`.
-21. Install the published package into a temporary prefix and smoke-test the installed CLI.
-22. Create the GitHub Release for the pushed tag.
+15. Smoke-test any new CLI command such as `coding-agent-skills route-trace` against
+    synthetic fixtures only unless a real project read-only smoke is explicitly approved.
+16. Review changelog, ledger, run evidence, and versioning impact.
+17. Commit with approved identity.
+18. Push `main` using credential-free remotes.
+19. Confirm a clean synchronized worktree.
+20. Create and push the annotated version tag.
+21. Publish with `npm publish --access public --registry=https://registry.npmjs.org/`.
+22. Install the published package into a temporary prefix and smoke-test the installed CLI.
+23. Create the GitHub Release for the pushed tag.
 
 Deployments, migrations, runtime mutation, platform actions, and target-project builds or
 tests remain outside this release process unless separately approved.

package/docs/release/npm-package.md

@@ -7,7 +7,7 @@ safety model.
 ## Current Package Shape
 
 - Package name: `coding-agent-skills`.
-- Package version: `0.2.8`.
+- Package version: `0.2.9`.
 - CLI bin: `coding-agent-skills` mapped to `bin/coding-agent-skills`.
 - Module type: `module`.
 - Dependencies: none.
@@ -27,6 +27,7 @@ The supported installed commands are:
 coding-agent-skills validate-pack
 coding-agent-skills validate-project /path/to/project
 coding-agent-skills repo-map /path/to/project
+coding-agent-skills route-trace /path/to/project
 coding-agent-skills validate-adapters /path/to/adapter-root
 ```
 
@@ -37,7 +38,8 @@ npx coding-agent-skills validate-pack
 ```
 
 Adapter compatibility remains controlled by the existing shared core and
-project-adapter validators.
+project-adapter validators. `route-trace` is static and audit-only; it reports route
+files and route declarations without executing the target project.
 
 `coding-agent-skills validate-pack` is package-aware. In a source checkout, it keeps
 source-only checks such as `.gitignore` validation. In an installed package tree, where
@@ -71,13 +73,14 @@ included.
 ## Safety Boundaries
 
 The public CLI remains read-only for target projects unless a specific underlying skill
-already permits a bounded local validation action. The installed `repo-map` and adapter
-flows do not:
+already permits a bounded local validation action. The installed `repo-map`,
+`route-trace`, and adapter flows do not:
 
 - deploy
 - run migrations
 - mutate runtime services or processes
 - read `.env` or secret files
+- execute target project application code
 - run target project builds or tests
 - grant adapters additional power
 

package/docs/safety/README.md

@@ -2,7 +2,11 @@
 
 ## Audit-Only Rule
 
-`repo-map`, `git-preflight`, `runtime-truth`, and `llm-drift-control` must not alter project files, Git state, dependencies, processes, services, databases, remote systems, or deployment state.
+`repo-map`, `route-trace`, `git-preflight`, `runtime-truth`, and `llm-drift-control` must not alter project files, Git state, dependencies, processes, services, databases, remote systems, or deployment state.
+
+`route-trace` is static only. It may read bounded non-secret route files and route
+configuration, but it must not execute app code, run servers, hit URLs, claim runtime
+truth, or broaden adapter scope when a project adapter is present.
 
 `build-verify` may run existing project-native validation commands. Build or test tools may create their normal local artifacts, but the skill must declare observed changes and must reject installation, fix modes, snapshot updates, deployment, migration, or unknown scripts.
 

package/docs/testing/README.md

@@ -29,6 +29,14 @@ This is intentionally conservative and is not a complete POSIX parser. Unknown e
 
 Audit-only Markdown is scanned for restricted commands presented as procedures. Commands in explicitly denied or negative contexts remain documentation. Synthetic snapshot targets are hashed before and after checks.
 
+## Route Trace
+
+Synthetic route-trace projects cover generic bounded static scanning, adapter-declared
+scope, verified Next.js route files, inferred React Router and Express-style declarations,
+skipped paths, not-verified runtime route classes, and repo-map-only adapter skips.
+Route-trace tests must never run a target project, hit URLs, build, test, deploy, migrate,
+or read `.env` files.
+
 ## Privacy And Redaction
 
 Sensitive shapes are stored as ordered synthetic parts and reconstructed only in memory. Tests verify type detection, redaction, and absence from reusable skill content without printing fixture values.

package/docs/usage/README.md

@@ -5,6 +5,7 @@ Select the least-privileged skill that matches the request:
 | Need | Skill |
 |---|---|
 | Understand repository identity and structure | `repo-map` |
+| Trace statically visible route surfaces | `route-trace` |
 | Run existing local validation checks | `build-verify` |
 | Assess Git handoff readiness | `git-preflight` |
 | Determine what is actually running | `runtime-truth` |
@@ -13,11 +14,12 @@ Select the least-privileged skill that matches the request:
 ## Typical Flow
 
 1. Use `repo-map` when repository identity or boundaries are not established.
-2. Perform implementation outside this pilot pack.
-3. Use `build-verify` for approved project-native checks.
-4. Use `git-preflight` before handoff or publication.
-5. Use `runtime-truth` only when live local state matters.
-6. Use `llm-drift-control` when claims and evidence may disagree.
+2. Use `route-trace` when route files or declarations must be mapped from static files.
+3. Perform implementation outside this pilot pack.
+4. Use `build-verify` for approved project-native checks.
+5. Use `git-preflight` before handoff or publication.
+6. Use `runtime-truth` only when live local state matters.
+7. Use `llm-drift-control` when claims and evidence may disagree.
 
 Every skill emits an evidence pack. Read `status`, skipped checks, failures, confidence, and changed state before relying on a completion claim.
 
@@ -48,6 +50,7 @@ Run supported commands:
 coding-agent-skills validate-pack
 coding-agent-skills validate-project /path/to/project
 coding-agent-skills repo-map /path/to/project
+coding-agent-skills route-trace /path/to/project
 coding-agent-skills validate-adapters /path/to/adapter-root
 ```
 
@@ -60,6 +63,9 @@ npx coding-agent-skills validate-pack
 These commands wrap the same validated scripts shipped in the repository. `repo-map`
 validates the project adapter first, then renders adapter-declared documentation
 precedence, safe read paths, ignored paths, and required evidence.
+`route-trace` validates a project adapter when present, uses adapter-declared safe paths
+when enabled, and statically reports verified route files, inferred route declarations,
+skipped items, and not-verified runtime-dependent route classes.
 
 The installed CLI does not run target project builds or tests, perform runtime checks,
 deploy, migrate, mutate services or processes, or read `.env` files. Project adapters
@@ -73,6 +79,7 @@ From the shared skill repository root, the same wrapper can be used directly:
 bin/coding-agent-skills validate-pack
 bin/coding-agent-skills validate-project /path/to/project
 bin/coding-agent-skills repo-map /path/to/project
+bin/coding-agent-skills route-trace /path/to/project
 bin/coding-agent-skills validate-adapters /path/to/adapter-root
 ```
 
@@ -83,6 +90,7 @@ also be invoked as:
 coding-agent-skills validate-pack
 coding-agent-skills validate-project /path/to/project
 coding-agent-skills repo-map /path/to/project
+coding-agent-skills route-trace /path/to/project
 coding-agent-skills validate-adapters /path/to/adapter-root
 ```
 

package/examples/command-policies/route-trace.json

@@ -0,0 +1,72 @@
+{
+  "version": "0.2.3",
+  "mode": "audit-only",
+  "parserPolicy": {
+    "inspectEverySegment": true,
+    "inspectScriptBodies": true,
+    "rejectUnknownExecutables": true,
+    "rejectShellWrappers": true,
+    "rejectHeredocs": true,
+    "rejectRedirection": true,
+    "providerSpecificNpx": true,
+    "authenticatedCurlRequiresApproval": true,
+    "boundedReadsRequired": true,
+    "allowedComposition": "read-only"
+  },
+  "allowedFamilies": [
+    {
+      "name": "bounded-route-inspection",
+      "executables": ["pwd", "ls", "rg", "find", "sed", "head"],
+      "argumentPolicy": {
+        "strategy": "pattern",
+        "allowedPatterns": ["bounded repository-local static route inspection"],
+        "deniedPatterns": ["absolute home paths, secret files, app execution, and unbounded traversal"]
+      },
+      "constraints": [
+        "Remain inside the declared project scope.",
+        "Bound traversal depth and output.",
+        "Exclude secret-bearing, generated, dependency, build, and runtime-output paths."
+      ]
+    },
+    {
+      "name": "git-identity-inspection",
+      "executables": ["git"],
+      "argumentPolicy": {
+        "strategy": "exact",
+        "allowedPatterns": ["rev-parse and status --short --branch"],
+        "deniedPatterns": ["all Git mutation and publication subcommands"]
+      },
+      "constraints": [
+        "Allow only read-only repository identity and branch-state inspection."
+      ]
+    },
+    {
+      "name": "route-trace-renderer",
+      "executables": ["node", "coding-agent-skills"],
+      "argumentPolicy": {
+        "strategy": "exact",
+        "allowedPatterns": ["node scripts/render-route-trace.mjs <project-root>; coding-agent-skills route-trace <project-root>"],
+        "deniedPatterns": ["builds, tests, dev servers, URL probing, app execution, deployment, migration, and package installation"]
+      },
+      "constraints": [
+        "The renderer must remain static and read-only.",
+        "Do not treat renderer output as runtime availability evidence."
+      ]
+    }
+  ],
+  "restrictedCategories": [
+    "file-write",
+    "package-install",
+    "deployment",
+    "git-mutation",
+    "unrestricted-scan",
+    "secret-read",
+    "process-mutation",
+    "service-mutation",
+    "migration-apply",
+    "privileged-api"
+  ],
+  "approvalExceptions": [
+    "A named-file approval may permit one otherwise excluded non-mutating static read when the file is not secret-bearing."
+  ]
+}

package/examples/evidence-packs/route-trace.json

@@ -0,0 +1,55 @@
+{
+  "contractVersion": "1.0.0",
+  "skill": {"name": "route-trace", "version": "0.2.3"},
+  "invocation": {
+    "id": "example-route-trace",
+    "startedAt": "2026-07-02T10:00:00Z",
+    "endedAt": "2026-07-02T10:02:00Z"
+  },
+  "repository": {
+    "root": "/workspace/example-project",
+    "branch": "main",
+    "head": "0123456789abcdef",
+    "workingTreeState": "clean"
+  },
+  "userIntent": "Trace static route surfaces before editing an API handler.",
+  "declaredScope": ["/workspace/example-project"],
+  "projectAdapter": "example-route-adapter",
+  "environmentSummary": {"platform": "linux", "shell": "bash"},
+  "status": "complete",
+  "confidence": {
+    "level": "high",
+    "reason": "Adapter scope, route files, inferred route declarations, skipped paths, and not-verified runtime-dependent route classes were recorded."
+  },
+  "commands": [
+    {
+      "command": "coding-agent-skills route-trace /workspace/example-project",
+      "family": "route-trace-renderer",
+      "workingDirectory": "/workspace/example-project",
+      "startedAt": "2026-07-02T10:00:20Z",
+      "endedAt": "2026-07-02T10:00:21Z",
+      "exitStatus": 0,
+      "resultStatus": "success",
+      "safetyClass": "allowed",
+      "approvalReference": null,
+      "purpose": "Render a static route-trace report.",
+      "outputSummary": "Found Next.js API route files and inferred Express route declarations without runtime checks."
+    }
+  ],
+  "skippedChecks": [],
+  "findings": [
+    {
+      "summary": "Verified route files and inferred route declarations were identified from static files only.",
+      "evidence": ["app/api/users/route.ts", "server/routes.ts"]
+    }
+  ],
+  "risks": [],
+  "failures": [],
+  "unresolvedQuestions": [],
+  "changedState": {
+    "changed": false,
+    "summary": "No project, Git, dependency, runtime, service, or remote state changed."
+  },
+  "handoffSummary": "Static route surfaces are mapped with runtime-dependent areas explicitly not verified.",
+  "recommendedNextAction": "Review the relevant verified route file before editing."
+}

package/examples/manifests/route-trace.json

@@ -0,0 +1,14 @@
+{
+  "name": "route-trace",
+  "version": "0.2.3",
+  "mode": "audit-only",
+  "evidenceContract": "../../contracts/evidence-pack/evidence-pack.schema.json",
+  "commandPolicy": "../command-policies/route-trace.json",
+  "adapterSchema": "../../schemas/project-adapter.schema.json",
+  "adapterCompatibility": {
+    "contractVersion": "1.0.0",
+    "compatibleAdapterVersions": ["1.0.0"]
+  },
+  "adapterInterface": "../../skills/route-trace/adapter-interface.md",
+  "description": "Trace static route surfaces without executing project code."
+}

package/examples/workflows/route-trace.md

@@ -0,0 +1,20 @@
+# Route Trace Workflow
+
+Use `route-trace` when the route surface must be understood from static files before
+editing or review.
+
+```bash
+coding-agent-skills route-trace /path/to/project
+```
+
+Expected evidence:
+
+- validated adapter state when present
+- adapter-limited or generic static scan scope
+- verified route files
+- inferred route declarations
+- skipped paths and not-verified runtime-dependent route classes
+- no state changes
+
+Do not run servers, hit URLs, read `.env`, install packages, build, test, deploy, migrate,
+or claim runtime availability from static route findings.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "coding-agent-skills",
-  "version": "0.2.8",
+  "version": "0.2.9",
   "description": "Evidence-first, read-only coding-agent skills and project adapter tooling.",
   "type": "module",
   "private": false,
@@ -9,6 +9,7 @@
     "coding-agent",
     "agent-skills",
     "repo-map",
+    "route-trace",
     "project-adapters",
     "code-validation",
     "cli"

package/runs/skill-runs.md

@@ -160,3 +160,30 @@ This file records bounded maintainer-loop runs. Entries must not contain secrets
 - Validation result: pass pending final publication evidence
 - Commit/tag/push status: pending approved release workflow
 - Next state: no next runner command is queued after `v0.2.8`; future package releases, new skills, real adapter expansion, platform work, deployment/preflight skills, and release-policy changes require separate human approval
+
+
+## design-v0.2.9-route-trace
+
+- Run ID: `design-v0.2.9-route-trace`
+- Timestamp: `2026-07-03T00:00:00Z`
+- Command used: `manual approval for route-trace-skill implementation and release`
+- Permissions granted: `skill-implementation`, `test-hardening`, `docs-hardening`, `release-preflight`, `commit`, `push`, `tag`, `npm-publish`, `github-release`
+- Design summary: add `route-trace` as an audit-only static inspection skill and CLI command. It validates a project adapter when present, limits inspection to adapter-safe paths when available, skips ignored and secret-bearing paths, identifies visible route files and route declarations without executing project code, and labels findings as verified route files, inferred route patterns, skipped items, or not verified.
+- Supported static surfaces: Next.js `app/` and `pages/` routes, API route files, React Router-style declarations, Express/Fastify/Hono-style route registrations, route config files, and adapter-declared safe paths.
+- Safety scope: no `.env` reads, no target-project builds/tests/dev servers, no runtime URL probing, no app-code execution, no package installation, no deployments, no migrations, no database inspection, no process/service mutation, and no runtime truth claims.
+- Release target: `v0.2.9` / `coding-agent-skills@0.2.9`.
+
+
+## implementation-v0.2.9-route-trace
+
+- Run ID: `implementation-v0.2.9-route-trace`
+- Timestamp: `2026-07-03T00:00:00Z`
+- Command used: `resume interrupted route-trace-skill implementation and complete release loop`
+- Permissions granted: `skill-implementation`, `test-hardening`, `docs-hardening`, `release-preflight`, `commit`, `push`, `tag`, `npm-publish`, `github-release`
+- Files changed: `route-trace` skill, route-trace renderer and library, CLI wrapper, adapter schemas, pack rules, release tests, synthetic route fixtures, usage/release/safety/adapter docs, changelog, roadmap, work ledger, run log, and package metadata.
+- Route-trace scope: audit-only static route tracing for verified route files, inferred route patterns, skipped paths, not-verified runtime route classes, and adapter-limited scope.
+- Safety scope: no target-project builds, tests, dev servers, package installs, app-code execution, URL probing, deployments, migrations, database inspection, secret-file reads, project writes, or runtime truth claims.
+- Validation commands: `git diff --check`; `bin/coding-agent-skills validate-pack`; `bin/coding-agent-skills validate-adapters tests/fixtures/external-adapters/valid-basic`; `bin/coding-agent-skills validate-project /home/oneclickwebsitedesignfactory/tax-lien-platform`; `bin/coding-agent-skills repo-map /home/oneclickwebsitedesignfactory/tax-lien-platform`; `bin/coding-agent-skills route-trace tests/fixtures/route-trace/static-project`; `bin/coding-agent-skills route-trace /home/oneclickwebsitedesignfactory/tax-lien-platform`; `node scripts/validate-pack.mjs .`; `node scripts/test-pack.mjs`; `node scripts/validate-maintainer-loop.mjs .`; `node --test`; JSON parsing; package secret scan; npm publish dry-run; tarball install smoke.
+- Validation result: pass pending final commit, tag, publication, registry smoke, npm exec, and GitHub Release evidence.
+- Real project smoke: `/home/oneclickwebsitedesignfactory/tax-lien-platform` remained repo-map-only for adapters, so route-trace reported `partial` and did not read target project route files.
+- Commit/tag/push status: pending approved release workflow.

package/schemas/project-adapter-installation.schema.json

@@ -65,6 +65,7 @@
         "type": "string",
         "enum": [
           "repo-map",
+          "route-trace",
           "build-verify",
           "git-preflight",
           "runtime-truth",
@@ -96,9 +97,10 @@
             "items": {
               "type": "string",
               "enum": [
-                "repo-map",
-                "build-verify",
-                "git-preflight",
+              "repo-map",
+              "route-trace",
+              "build-verify",
+              "git-preflight",
                 "runtime-truth",
                 "llm-drift-control"
               ]

package/schemas/project-adapter.schema.json

@@ -89,6 +89,7 @@
             "type": "string",
             "enum": [
               "repo-map",
+              "route-trace",
               "build-verify",
               "git-preflight",
               "runtime-truth",
@@ -165,6 +166,7 @@
                 "type": "string",
                 "enum": [
                   "repo-map",
+                  "route-trace",
                   "build-verify",
                   "git-preflight",
                   "runtime-truth",