coding-agent-skills 0.2.8 → 0.2.9

package/scripts/render-route-trace.mjs

@@ -0,0 +1,8 @@
+import { routeTraceCliResult } from "./lib/route-trace.mjs";
+
+const outcome = routeTraceCliResult(process.argv[2]);
+for (const line of outcome.lines) {
+  if (outcome.stream === "stdout") console.log(line);
+  else console.error(line);
+}
+process.exitCode = outcome.exitCode;

package/scripts/test-pack.mjs

@@ -42,6 +42,11 @@ import {
   buildAdapterRepoMapReport,
   renderAdapterRepoMapReport,
 } from "./lib/adapter-repo-map.mjs";
+import {
+  buildRouteTraceReport,
+  renderRouteTraceReport,
+  routeTraceCliResult,
+} from "./lib/route-trace.mjs";
 import {
   adapterUpgradeCliResult,
   checkAdapterUpgrade,
@@ -256,6 +261,7 @@ test("local CLI maps approved commands to existing safe scripts", () => {
   assert.ok(cliText.includes("scripts/validate-pack.mjs"));
   assert.ok(cliText.includes("scripts/validate-project-adapters.mjs"));
   assert.ok(cliText.includes("scripts/render-adapter-repo-map.mjs"));
+  assert.ok(cliText.includes("scripts/render-route-trace.mjs"));
   assert.ok(cliText.includes("scripts/validate-adapters.mjs"));
   assert.ok(!cliText.includes(".env"));
 
@@ -277,6 +283,10 @@ test("local CLI maps approved commands to existing safe scripts", () => {
       ["repo-map", path.join(fixtureRoot, "project-adapter-installation", "valid-exact-pin")],
       /# Adapter-Aware Repo Map/,
     ],
+    [
+      ["route-trace", path.join(fixtureRoot, "route-trace", "static-project")],
+      /# Route Trace Report/,
+    ],
   ];
 
   for (const [args, expected] of commands) {
@@ -301,7 +311,7 @@ test("local CLI maps approved commands to existing safe scripts", () => {
 test("npm package metadata is public-ready and dependency-free", () => {
   const packageJson = readJson("package.json");
   assert.equal(packageJson.name, "coding-agent-skills");
-  assert.equal(packageJson.version, "0.2.8");
+  assert.equal(packageJson.version, "0.2.9");
   assert.equal(
     packageJson.description,
     "Evidence-first, read-only coding-agent skills and project adapter tooling.",
@@ -313,6 +323,7 @@ test("npm package metadata is public-ready and dependency-free", () => {
     "coding-agent",
     "agent-skills",
     "repo-map",
+    "route-trace",
     "project-adapters",
     "code-validation",
     "cli",
@@ -363,6 +374,83 @@ test("npm package metadata is public-ready and dependency-free", () => {
   assert.match(read("docs/release/npm-package.md"), /npm install -g coding-agent-skills/);
 });
 
+test("route-trace renderer identifies static route files and inferred patterns", () => {
+  const result = buildRouteTraceReport(
+    path.join(root, "tests", "fixtures", "route-trace", "static-project"),
+    { coreRoot: root },
+  );
+  assert.equal(result.ok, true);
+  assert.equal(result.status, "complete");
+  assert.equal(result.adapter.present, false);
+  assert.ok(
+    result.verifiedRouteFiles.some(
+      (record) => record.route === "/api/users" && record.file === "app/api/users/route.ts",
+    ),
+  );
+  assert.ok(
+    result.verifiedRouteFiles.some(
+      (record) => record.route === "/blog/[slug]" && record.file === "app/blog/[slug]/page.tsx",
+    ),
+  );
+  assert.ok(
+    result.verifiedRouteFiles.some(
+      (record) => record.route === "/api/hello" && record.file === "pages/api/hello.ts",
+    ),
+  );
+  assert.ok(
+    result.inferredRoutePatterns.some(
+      (record) => record.route === "/dashboard" && record.kind === "react-router-route-declaration",
+    ),
+  );
+  assert.ok(
+    result.inferredRoutePatterns.some(
+      (record) => record.route === "/health" && record.method === "GET",
+    ),
+  );
+  assert.ok(result.notVerified.includes("runtime-generated routes"));
+  assert.ok(renderRouteTraceReport(result).includes("No target project build"));
+});
+
+test("route-trace renderer respects adapter-declared scope", () => {
+  const result = buildRouteTraceReport(
+    path.join(root, "tests", "fixtures", "route-trace", "adapter-project"),
+    { coreRoot: root },
+  );
+  assert.equal(result.ok, true);
+  assert.equal(result.status, "complete");
+  assert.equal(result.adapter.present, true);
+  assert.equal(result.adapter.enabled, true);
+  assert.deepEqual(result.adapter.scopePaths, ["app", "pages", "src"]);
+  assert.ok(
+    result.verifiedRouteFiles.some(
+      (record) => record.route === "/api/items" && record.file === "app/api/items/route.ts",
+    ),
+  );
+  assert.ok(
+    result.inferredRoutePatterns.some((record) => record.route === "/adapter-health"),
+  );
+
+  const cli = routeTraceCliResult(
+    path.join(root, "tests", "fixtures", "route-trace", "adapter-project"),
+    { coreRoot: root },
+  );
+  assert.equal(cli.exitCode, 0);
+  assert.match(cli.lines.join("\n"), /route-trace used adapter-declared safe read paths only/);
+});
+
+test("route-trace does not broaden a repo-map-only project adapter", () => {
+  const result = buildRouteTraceReport(
+    path.join(root, "tests", "fixtures", "project-adapter-installation", "valid-exact-pin"),
+    { coreRoot: root },
+  );
+  assert.equal(result.ok, true);
+  assert.equal(result.status, "partial");
+  assert.equal(result.adapter.present, true);
+  assert.equal(result.adapter.enabled, false);
+  assert.deepEqual(result.scannedFiles, []);
+  assert.match(renderRouteTraceReport(result), /route-trace is not enabled/);
+});
+
 test("validate-pack accepts installed package trees without source-only gitignore", () => {
   const temporaryRoot = fs.mkdtempSync(path.join(os.tmpdir(), "installed-package-"));
   const installedRoot = path.join(temporaryRoot, "coding-agent-skills");

package/scripts/validate-pack.mjs

@@ -95,11 +95,13 @@ const requiredRootFiles = [
   "scripts/verify-evidence-bundle.mjs",
   "scripts/render-evidence-archive-report.mjs",
   "scripts/render-adapter-repo-map.mjs",
+  "scripts/render-route-trace.mjs",
   "scripts/check-adapter-upgrade.mjs",
   "scripts/check-adapter-upgrade-chain.mjs",
   "scripts/validate-adapters.mjs",
   "scripts/validate-project-adapters.mjs",
   "scripts/lib/adapter-repo-map.mjs",
+  "scripts/lib/route-trace.mjs",
   "scripts/lib/adapter-upgrade.mjs",
   "scripts/lib/adapter-upgrade-chain.mjs",
   "scripts/lib/adapter-discovery.mjs",
@@ -673,8 +675,8 @@ if (packageJson) {
   if (packageJson.name !== "coding-agent-skills") {
     failures.push("package.json has unexpected package name");
   }
-  if (packageJson.version !== "0.2.8") {
-    failures.push("package.json version must be 0.2.8 for public package validation");
+  if (packageJson.version !== "0.2.9") {
+    failures.push("package.json version must be 0.2.9 for public package validation");
   }
   if (packageJson.type !== "module") failures.push("package.json must preserve ESM mode");
   if (packageJson.private !== false) {
@@ -692,6 +694,7 @@ if (packageJson) {
       "coding-agent",
       "agent-skills",
       "repo-map",
+      "route-trace",
       "project-adapters",
       "code-validation",
       "cli",

package/skills/route-trace/SKILL.md

@@ -0,0 +1,58 @@
+---
+name: route-trace
+description: Trace statically visible application route surfaces without executing project code or changing state. Use when Codex must identify Next.js, API, React Router, Express/Fastify/Hono, or route-config surfaces from files before editing, reviewing, or planning route work; do not use for runtime URL probing, server execution, builds, tests, deployment checks, migrations, or runtime truth claims.
+---
+
+# Route Trace
+
+Identify route surfaces from static project files and emit an evidence-backed report. Remain audit-only and fail closed when route evidence would require execution or secret-bearing configuration.
+
+This skill must not change project files, Git state, dependencies, runtime state, services,
+databases, remotes, or deployment state.
+
+## Purpose And Use
+
+Use this skill to locate and classify statically visible routes before changing application code, reviewing API surfaces, or planning route-level work. It can identify verified route files and inferred route declarations, but it must not claim that a route works at runtime.
+
+Do not use this skill for live endpoint checks, server startup, browser tests, build verification, deployment readiness, migrations, database inspection, or secret auditing.
+
+## Inputs
+
+Require a project root or starting path. Optionally accept a project adapter, intended route area, maximum static scan depth, or named route framework to prioritize.
+
+Do not assume every route is statically discoverable, every route file is reachable in production, framework conventions are current, an adapter covers all route surfaces, or documentation route lists are authoritative.
+
+## Procedure
+
+1. Record user intent, project root, declared scope, adapter state, and safety boundary.
+2. Validate a project adapter when present before reading adapter-declared metadata.
+3. If an adapter is present but does not enable `route-trace`, stop static file reading and report the adapter-limited skip.
+4. Build the scan scope from adapter safe read paths when available; otherwise use a bounded generic static scan.
+5. Apply ignored paths and secret-file exclusions before reading any file.
+6. Identify verified route files from static conventions such as Next.js `app/` and `pages/` route files.
+7. Identify inferred route patterns from visible declarations such as React Router paths, Express/Fastify/Hono registrations, and route config objects.
+8. Label every finding as verified, inferred, skipped, not verified, or adapter-limited.
+9. Report skipped files, unverified runtime-dependent areas, branch state warnings, and safety refusals.
+10. Emit the shared evidence pack or route-trace report before claiming completion.
+
+Use [checklist.md](checklist.md). Consult [failure-modes.md](failure-modes.md), [adapter-interface.md](adapter-interface.md), and [examples.md](examples.md). Format findings with [evidence-template.md](evidence-template.md).
+
+## Evidence, Recovery, And Dependencies
+
+Emit repository identity, adapter state, scan scope, ignored paths, verified route files, inferred route patterns, skipped items, not-verified route classes, warnings, and changed-state declaration through the shared evidence-pack contract.
+
+Recover from missing adapters, unsupported frameworks, unreadable files, or ambiguous route declarations by narrowing scope and reporting uncertainty. Never recover by installing dependencies, running app code, starting servers, hitting URLs, broadening adapter scope, reading `.env`, or mutating files.
+
+This skill depends on the evidence-pack contract and may consume validated project adapters. Adapters may add safe paths, ignored paths, documentation precedence, and evidence requirements, but cannot weaken policy or turn this skill into runtime verification.
+
+## Approval Boundary
+
+Explicit approval may permit one named non-secret static file read outside normal route paths. Approval does not permit package installation, builds, tests, runtime checks, server startup, URL probing, database inspection, migrations, deployments, Git mutation, or secret-file reads.
+
+## Completion
+
+Claim `complete` only when the declared static scan scope was inspected, route findings are labeled by evidence type, skipped and not-verified areas are recorded with consequences, adapter limitations are explicit, and no project, Git, dependency, runtime, service, or remote state changed.
+
+Report `partial`, `failed`, or `blocked` when adapter scope prevents route scanning, route evidence requires execution, the project root cannot be established, or safety exclusions prevent a requested conclusion. Never claim runtime availability or route correctness from static findings alone.
+
+These conditions are both the acceptance criteria and definition of done.

package/skills/route-trace/adapter-interface.md

@@ -0,0 +1,20 @@
+# Route Trace Adapter Interface
+
+Project adapters may enable `route-trace` only as an audit-only static inspection skill.
+
+Adapters may provide:
+
+- `safeReadPaths` for route-bearing source and route config files.
+- `ignoredPaths` for generated output, dependency folders, and non-route surfaces.
+- `documentationPrecedence` for route documentation that should be reviewed separately.
+- `requiredEvidence` such as route files inspected, adapter scope, skipped paths, and not-verified runtime classes.
+- `expectedPackageManagers` as metadata only.
+
+Adapters must not:
+
+- Add commands for `route-trace`.
+- Permit builds, tests, package installs, server startup, URL probing, deployment, migration, database inspection, or secret reads.
+- Remove inherited restrictions.
+- Change `route-trace` from `audit-only` to action-capable.
+- Expand scanning outside the declared project root without named approval.
+- Suppress skipped checks, warnings, uncertainty, or completion requirements.

package/skills/route-trace/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Route Trace"
+  short_description: "Trace static route surfaces without changing the project"
+  default_prompt: "Trace the statically visible route surfaces in this repository without modifying project, runtime, dependency, or external state."

package/skills/route-trace/checklist.md

@@ -0,0 +1,11 @@
+# Route Trace Checklist
+
+- Confirm project root and declared scope.
+- Validate any project adapter before consuming adapter metadata.
+- If the adapter is present but does not enable `route-trace`, stop and report the adapter-limited skip.
+- Build a bounded static scan scope from adapter safe paths or generic repository-local defaults.
+- Exclude `.env`, secret-bearing files, generated output, dependencies, and ignored paths.
+- Identify verified route files separately from inferred route declarations.
+- Record skipped paths and not-verified runtime-dependent route classes.
+- State that no server, build, test, runtime check, deployment, migration, package install, or secret read was performed.
+- Emit an evidence pack or route-trace report before claiming completion.

package/skills/route-trace/evidence-template.md

@@ -0,0 +1,18 @@
+# Route Trace Evidence Template
+
+Use the shared evidence-pack contract and include:
+
+- Skill: `route-trace`
+- Repository root, branch, HEAD, and working-tree state
+- User intent and declared route scope
+- Project adapter ID or `null`
+- Static scan scope and ignored paths
+- Verified route files with file paths and route patterns
+- Inferred route declarations with evidence file paths
+- Skipped paths with reasons and consequences
+- Not-verified runtime-dependent route classes
+- Safety refusals
+- Changed state: `false`
+- Recommended next action
+
+Completion requires evidence for both findings and boundaries. A static route trace is not runtime truth.

package/skills/route-trace/examples.md

@@ -0,0 +1,32 @@
+# Route Trace Examples
+
+## Safe
+
+- Inspect a repository for statically visible Next.js `app/` and `pages/` routes.
+- Trace route declarations in React Router config without running the app.
+- Identify Express, Fastify, or Hono-style route registrations from visible source files.
+- Report that a project adapter prevents route scanning because `route-trace` is not enabled.
+
+## Unsafe
+
+- Start a dev server to see which URLs respond.
+- Run browser tests or fetch live endpoints.
+- Read `.env` to determine route prefixes.
+- Run migrations, seed databases, deploy, or inspect production infrastructure.
+- Claim that a static route finding proves runtime availability.
+
+## Example Output Shape
+
+```text
+# Route Trace Report
+Status: complete
+
+## Verified Route Files
+- /api/users (next-app-api-route-file) in app/api/users/route.ts
+
+## Inferred Route Patterns
+- GET /health (express-style-route-registration) in server/routes.ts
+
+## Not Verified
+- runtime-generated routes
+```

package/skills/route-trace/failure-modes.md

@@ -0,0 +1,9 @@
+# Route Trace Failure Modes
+
+- **No project root**: stop with `failed`; do not search outside the declared scope.
+- **Malformed adapter**: stop with adapter validation failure; do not fall back to broader scanning.
+- **Adapter present but not enabled**: report `partial` with adapter-limited scope and no target-file reads.
+- **Unreadable or large files**: skip and record the consequence.
+- **Secret-bearing path**: skip; do not request contents unless the user gives a named-file approval and the file is non-secret.
+- **Runtime-dependent routing**: mark as not verified instead of running the app.
+- **Ambiguous route declaration**: label as inferred or unresolved; do not upgrade it to verified.

package/tests/fixtures/route-trace/adapter-project/.coding-agent/adapters/route-trace-fixture/adapter.json

@@ -0,0 +1,59 @@
+{
+  "adapterId": "route-trace-fixture",
+  "adapterVersion": "1.0.0",
+  "project": {
+    "id": "route-trace-fixture",
+    "detection": {
+      "rootMarkers": [{"kind": "file", "path": "package.json"}],
+      "maximumDepth": 2,
+      "scope": "declared-project-root",
+      "requireApprovalOutsideScope": true
+    }
+  },
+  "supportedSkills": [
+    {
+      "id": "route-trace",
+      "compatibleVersions": ["0.2.x"],
+      "declaredMode": "audit-only"
+    }
+  ],
+  "extensions": {
+    "safeReadPaths": ["app", "pages", "src"],
+    "ignoredPaths": ["dist", "build", "node_modules"],
+    "documentationPrecedence": ["README.md"],
+    "commandAliases": [],
+    "safeStatusCommands": [],
+    "requiredEvidence": [
+      "adapter scope",
+      "verified route files",
+      "inferred route patterns",
+      "skipped route paths",
+      "not-verified runtime classes"
+    ],
+    "expectedRuntimeManagers": [],
+    "expectedPackageManagers": ["npm"]
+  },
+  "approvalRequirements": [],
+  "inheritance": {
+    "sharedRestrictions": "required",
+    "deniedOperationCategories": [
+      "file-write",
+      "package-install",
+      "deployment",
+      "git-mutation",
+      "unrestricted-scan",
+      "secret-read",
+      "process-mutation",
+      "service-mutation",
+      "migration-apply",
+      "privileged-api"
+    ],
+    "allowRestrictionRemoval": false,
+    "allowModeOverride": false,
+    "allowFailureSuppression": false,
+    "allowCompletionOverride": false,
+    "allowSecretExposure": false,
+    "allowRequiredEvidenceRemoval": false,
+    "allowScopeExpansionWithoutApproval": false
+  }
+}

package/tests/fixtures/route-trace/adapter-project/.coding-agent/skills.json

@@ -0,0 +1,23 @@
+{
+  "declarationVersion": "1.0.0",
+  "projectId": "route-trace-fixture",
+  "adapterRoot": ".coding-agent/adapters",
+  "adapterSchemaVersion": "1.0.0",
+  "core": {
+    "id": "coding-agent-skills",
+    "expectedVersion": "0.2.3",
+    "versionPin": ">=0.2.3 <0.3.0"
+  },
+  "compatibleSkillIds": ["route-trace"],
+  "adapters": [
+    {
+      "id": "route-trace-fixture",
+      "version": "1.0.0",
+      "skillIds": ["route-trace"]
+    }
+  ],
+  "validationCommand": "node <shared-core>/scripts/validate-project-adapters.mjs <project-root>",
+  "evidenceOutput": "validation-output/route-trace.json",
+  "approvalPolicyReference": "docs/coding-agent-approval-policy.md",
+  "noSecrets": true
+}

package/tests/fixtures/route-trace/adapter-project/README.md

@@ -0,0 +1,3 @@
+# Route Trace Adapter Fixture
+
+Synthetic adapter-scoped route tracing fixture.

package/tests/fixtures/route-trace/adapter-project/app/api/items/route.ts

@@ -0,0 +1,3 @@
+export async function GET() {
+  return Response.json({ items: [] });
+}

package/tests/fixtures/route-trace/adapter-project/package.json

@@ -0,0 +1,5 @@
+{
+  "name": "route-trace-adapter-fixture",
+  "private": true,
+  "type": "module"
+}

package/tests/fixtures/route-trace/adapter-project/pages/index.tsx

@@ -0,0 +1,3 @@
+export default function IndexPage() {
+  return <main>Index</main>;
+}

package/tests/fixtures/route-trace/adapter-project/src/routes.ts

@@ -0,0 +1,3 @@
+export function register(app) {
+  app.get("/adapter-health", () => ({ ok: true }));
+}

package/tests/fixtures/route-trace/static-project/.env.example

@@ -0,0 +1 @@
+PUBLIC_EXAMPLE=value

package/tests/fixtures/route-trace/static-project/README.md

@@ -0,0 +1,3 @@
+# Route Trace Static Fixture
+
+Synthetic fixture for static route tracing. It is not an installable project.

package/tests/fixtures/route-trace/static-project/app/api/users/route.ts

@@ -0,0 +1,3 @@
+export async function GET() {
+  return Response.json({ ok: true });
+}

package/tests/fixtures/route-trace/static-project/app/blog/[slug]/page.tsx

@@ -0,0 +1,3 @@
+export default function BlogPostPage() {
+  return <article>Post</article>;
+}

package/tests/fixtures/route-trace/static-project/app/page.tsx

@@ -0,0 +1,3 @@
+export default function HomePage() {
+  return <main>Home</main>;
+}

package/tests/fixtures/route-trace/static-project/package.json

@@ -0,0 +1,5 @@
+{
+  "name": "route-trace-static-fixture",
+  "private": true,
+  "type": "module"
+}

package/tests/fixtures/route-trace/static-project/pages/about.tsx

@@ -0,0 +1,3 @@
+export default function AboutPage() {
+  return <main>About</main>;
+}

package/tests/fixtures/route-trace/static-project/pages/api/hello.ts

@@ -0,0 +1,3 @@
+export default function handler(_request, response) {
+  response.status(200).json({ ok: true });
+}

package/tests/fixtures/route-trace/static-project/server/routes.ts

@@ -0,0 +1,4 @@
+export function registerRoutes(app) {
+  app.get("/health", () => ({ ok: true }));
+  app.post("/api/widgets", () => ({ ok: true }));
+}

package/tests/fixtures/route-trace/static-project/src/route-config.ts

@@ -0,0 +1,4 @@
+export const routes = [
+  { path: "/reports" },
+  { path: "/reports/:id" },
+];

package/tests/fixtures/route-trace/static-project/src/router.tsx

@@ -0,0 +1,10 @@
+import { Route } from "react-router-dom";
+
+export function Routes() {
+  return (
+    <>
+      <Route path="/dashboard" element={null} />
+      <Route path="/settings/profile" element={null} />
+    </>
+  );
+}

package/tests/fixtures/triggers/cases.json

@@ -19,6 +19,18 @@
       "expectedSkill": "repo-map",
       "notSkills": ["llm-drift-control"]
     },
+    {
+      "id": "route-trace-static-routes",
+      "prompt": "Trace the static route surface and identify Next.js API route files before I edit a handler.",
+      "expectedSkill": "route-trace",
+      "notSkills": ["repo-map", "runtime-truth"]
+    },
+    {
+      "id": "route-trace-express",
+      "prompt": "Find the Express routes and React Router paths that are statically visible without running the app.",
+      "expectedSkill": "route-trace",
+      "notSkills": ["build-verify", "runtime-truth"]
+    },
     {
       "id": "build-after-implementation",
       "prompt": "The implementation is finished. Run the existing typecheck, tests, and build.",
@@ -71,7 +83,7 @@
       "id": "negative-deploy",
       "prompt": "Deploy this application to production.",
       "expectedSkill": null,
-      "notSkills": ["repo-map", "build-verify", "git-preflight", "runtime-truth", "llm-drift-control"]
+      "notSkills": ["repo-map", "route-trace", "build-verify", "git-preflight", "runtime-truth", "llm-drift-control"]
     },
     {
       "id": "negative-install",

package/tests/trigger/README.md

@@ -3,6 +3,7 @@
 `tests/fixtures/triggers/cases.json` provides executable positive, negative, and wrong-skill cases for every pilot skill.
 
 - Repository orientation must trigger `repo-map`, not build or runtime validation.
+- Static route-surface tracing must trigger `route-trace`, not repository mapping or runtime truth.
 - Local validation must trigger `build-verify` only when project-native checks are requested.
 - Git readiness must trigger `git-preflight`, not publication.
 - Process/listener/health questions must trigger `runtime-truth`, not restart behavior.

package/work-ledger.md

@@ -4,24 +4,25 @@
 
 - Repository: `coding-agent-skills`
 - Branch: `main`
-- Pilot skills: `repo-map`, `build-verify`, `git-preflight`, `runtime-truth`, `llm-drift-control`
+- Pilot skills: `repo-map`, `route-trace`, `build-verify`, `git-preflight`, `runtime-truth`, `llm-drift-control`
 - Adapter discovery, project adapter installation, stale-pin detection, upgrade evidence, compatibility-chain validation, evidence-bundle verification, retention policy, provenance design, archive-report rendering, archive-index fixtures, retention-expiry advisory reporting, and detached-signature verification planning are implemented.
 - Real-project adapter adoption readiness is documented as a planning-only approval gate.
 - First external project-owned adapter adoption completed for `/home/oneclickwebsitedesignfactory/tax-lien-platform` at candidate commit `c548b1a6cbb3455a70b89d0e301e22435bfccac9`.
 - The adopted adapter is `repo-map` only, docs/metadata-only, and contains no commands, runtime checks, build/test/package behavior, platform/deployment behavior, or secret-aware behavior.
 - The shared repository does not contain real adapter manifests; real project adapters remain owned by their project repositories.
-- Public npm package release `v0.2.8` exposes the existing dependency-free
+- Public npm package release `v0.2.9` exposes the dependency-free
   `coding-agent-skills` CLI under MIT license.
-- New skills are not approved.
+- `route-trace` is implemented as an audit-only static route tracing skill. Additional new
+  skills are not approved.
 
 ## Last Completed Version
 
-`v0.2.8`
+`v0.2.9`
 
 ## Current Recommended Milestone
 
-The public npm release is complete for the existing CLI surface. No further real
-adapters, adapter expansion, new skills, platform skills, deployment/preflight work,
+The `route-trace` public npm release is complete for the approved CLI surface. No further
+real adapters, adapter expansion, new skills, platform skills, deployment/preflight work,
 signing infrastructure, or evidence-harness milestone is approved.
 
 ## Allowed Next Actions
@@ -40,7 +41,7 @@ signing infrastructure, or evidence-harness milestone is approved.
 
 ## Blocked Actions
 
-- Adding new skills.
+- Adding more new skills.
 - Creating real project adapters.
 - Modifying real project repositories.
 - Publishing release artifacts without explicit approval.
@@ -105,6 +106,17 @@ No autonomous maintainer-loop run has been recorded yet.
   skills require separate human approval.
 
 
+### 2026-07-03T00:00:00Z
+
+- Latest tag observed: `v0.2.8`
+- Implemented milestone: `route-trace` audit-only static route tracing skill and CLI command.
+- Required permission: `skill-implementation`
+- Validation result: pass pending final publication evidence
+- Next recommended milestone: no next runner command is queued; future real adapter
+  expansion, new skills, platform work, deployment/preflight skills, and release-policy
+  changes require separate human approval.
+
+
 ### 2026-06-15T21:02:34.116Z
 
 - Latest tag observed: `v0.2.0`