coding-agent-skills 0.2.8

package/docs/safety/README.md

@@ -0,0 +1,94 @@
+# Safety
+
+## Audit-Only Rule
+
+`repo-map`, `git-preflight`, `runtime-truth`, and `llm-drift-control` must not alter project files, Git state, dependencies, processes, services, databases, remote systems, or deployment state.
+
+`build-verify` may run existing project-native validation commands. Build or test tools may create their normal local artifacts, but the skill must declare observed changes and must reject installation, fix modes, snapshot updates, deployment, migration, or unknown scripts.
+
+## Restricted Categories
+
+- File writes, deletion, permission changes, or generated output inside a target project.
+- Package installation, upgrade, or lockfile mutation.
+- Deployments and remote publication.
+- Commits, pushes, pulls, merges, rebases, resets, restores, cleans, checkouts, switches, or stashes.
+- Unbounded scans outside the declared repository scope.
+- Secret-file reads or commands that print credentials.
+- Process or service mutation.
+- Migration application or database mutation.
+- Privileged or authenticated API calls.
+
+An allowlisted executable does not make arbitrary arguments safe. Evaluate the complete shell structure and reject mixed chains containing restricted operations.
+
+Approval must name an exceptional read and its purpose. It cannot expand an audit-only skill into a mutation skill.
+
+## Adapter Inheritance
+
+Project adapters inherit every shared restriction. Schema fields that could weaken safety are fixed: adapters cannot remove restrictions, override mode, suppress failures, redefine completion, expose secrets, remove evidence requirements, or expand scope without approval.
+
+Adapter command aliases and status hints are parsed with the same command-policy harness as shared examples. A familiar alias never bypasses argument or composition checks.
+
+External discovery is bounded to declared adapter locations and the exact `adapter.json`
+filename. It rejects traversal, symlink escapes, non-regular manifests, oversized manifests,
+malformed JSON, secret-like content, and mixed roots containing any rejection. The validator
+does not execute adapter commands or read unrelated project files.
+
+Project installation adds a declaration but no new permissions. Exact or ranged core pins,
+adapter records, and skill IDs must agree with discovered manifests. Declaration paths remain
+repository-relative, `.env` files remain outside discovery, and the declared validation
+command is metadata rather than executable input.
+
+Upgrade checks preserve that boundary across revisions. They are advisory, do not write
+pins or manifests, and reject stale targets, unsupported cores, schema or skill drift,
+restriction weakening, audit-mode escalation, evidence removal, failure suppression,
+completion override, secret exposure, scope expansion, traversal, and symlink escape.
+
+Compatibility-chain checks apply the same boundary to every adjacent revision and require a
+current final target. They never apply upgrades. Optional evidence output is permitted only
+when explicitly requested, uses a new relative `.json` file beneath a non-symlink output
+base, and never overwrites existing content. Evidence omits raw project paths and project IDs.
+
+Evidence-bundle verification is read-only. Bundle entries must stay beneath the bundle
+directory, avoid local environment-file paths, avoid symlink escapes, match declared hashes,
+validate against known evidence contracts, and preserve baseline status. The verifier emits
+sanitized reports only and never executes commands from evidence.
+
+Evidence retention, provenance, archive-index, and archive-report checks are also
+read-only. Retention is validated as metadata only; expiry reporting is advisory and does
+not delete or move files. Signed provenance is a detached-signature design and verification
+planning contract, not a private-key operation and not live signature verification. Archive
+indexes and reports are sanitized metadata summaries unless a future milestone separately
+approves storage.
+
+## Maintainer Loop
+
+The local maintainer loop is a bounded repository coordinator. It may read repository Git
+state, tags, the roadmap, changelog, and work ledger; run local validators; select the next
+declared milestone; and append evidence to the repository-owned ledger files.
+
+Permission flags are explicit gates. They do not authorize new skills, real project
+adapters, external project changes, infrastructure work, credential access, policy
+weakening, or destructive Git operations.
+
+### Stop Boundaries
+
+The runner stops when the worktree is dirty, validation fails, no permission matches the
+next action, scope is blocked by the ledger, or human approval is required. It does not read
+local environment files, publish releases, apply database changes, mutate services, or
+perform deployment work.
+
+## Command Policy Limits
+
+Command policies declare executable families, argument strategy, parser invariants, composition rules, and denied categories. Property-style tests exercise obvious bypass combinations, but the parser is not a complete shell implementation. Unsupported syntax fails closed.
+
+## Restricted Evidence
+
+Historical or extracted restricted commands may inform deny rules and warnings. They must not be copied into recommended procedures, examples, templates, or adapters.
+
+## Secret Handling
+
+Never reproduce tokens, credentials, cookies, private keys, service-role values, or authenticated headers. Record only the secret type and affected location.
+
+Local `.env` files may intentionally provide credentials for separately approved authenticated operations. Load them without shell tracing, reference environment-variable names rather than literal values, and avoid output that may reveal credentials. Never commit `.env` files or place credentials in remote URLs.
+
+Recommend rotation only when evidence shows a credential was printed, copied into generated content, committed, pushed, or exposed outside its approved local environment.

package/docs/testing/README.md

@@ -0,0 +1,100 @@
+# Harness
+
+The harness is dependency-free and runs through:
+
+- `node scripts/validate-pack.mjs .`
+- `node scripts/test-pack.mjs`
+- `node scripts/validate-maintainer-loop.mjs .`
+- `node scripts/validate-adapters.mjs tests/fixtures/external-adapters/valid-basic`
+- `node scripts/validate-project-adapters.mjs tests/fixtures/project-adapter-installation/valid-exact-pin`
+- `node scripts/check-adapter-upgrade.mjs tests/fixtures/project-adapter-upgrades/valid-upgrade/before tests/fixtures/project-adapter-upgrades/valid-upgrade/after`
+- `node scripts/check-adapter-upgrade-chain.mjs tests/fixtures/project-adapter-upgrade-chains/valid-chain`
+- `node scripts/verify-evidence-bundle.mjs tests/fixtures/evidence-bundles/valid-bundle/evidence-bundle.json`
+- `node scripts/render-evidence-archive-report.mjs tests/fixtures/evidence-bundles/valid-bundle/evidence-bundle.json`
+- `node --test`
+
+## Trigger Classification
+
+Synthetic prompts identify the least-privileged matching pilot skill and reject mutation or publication requests. The classifier is a harness oracle, not a production router.
+
+## Command Policy
+
+The command analyzer handles obvious composition, multiline scripts, pipelines, wrappers, heredocs, redirects, project scripts, Git, provider-specific `npx`, curl approval, runtime status commands, and restricted arguments.
+
+Property-style tests generate combinations of safe prefixes, shell separators, and restricted suffixes. They exist to catch repeated bypass families without manually writing every combination.
+
+This is intentionally conservative and is not a complete POSIX parser. Unknown execution, quoting ambiguity, or unsupported shell syntax must fail closed.
+
+## Mutation Snapshots
+
+Audit-only Markdown is scanned for restricted commands presented as procedures. Commands in explicitly denied or negative contexts remain documentation. Synthetic snapshot targets are hashed before and after checks.
+
+## Privacy And Redaction
+
+Sensitive shapes are stored as ordered synthetic parts and reconstructed only in memory. Tests verify type detection, redaction, and absence from reusable skill content without printing fixture values.
+
+## Adapter Weakening
+
+Valid adapters must pass both JSON Schema validation and semantic compatibility checks. Tests cover narrowing, documentation precedence, and status-only hints, then reject deployment, Git publication, failure suppression, completion overrides, secret exposure, missing restrictions, stale skill versions, required-evidence removal, scope expansion, and audit-mode overrides.
+
+## External Adapter Discovery
+
+Disposable fixture roots exercise all three discovery conventions. The harness accepts valid
+roots and rejects malformed JSON, unknown manifests, incompatible skills and versions,
+restriction weakening, mixed roots, traversal, and symlink escapes. Missing roots fail;
+empty roots return a clear zero-adapter result. CLI tests also confirm stable exit codes and
+that summaries do not echo manifest commands or identifiers.
+
+## Project Installation And Pins
+
+Disposable project roots cover exact pins, compatible ranges, multiple adapters, missing or
+ambiguous declarations, unsupported old and future cores, malformed semver, unknown skills,
+adapter version mismatch, invalid locations, restriction weakening, secret exposure, scope
+expansion, traversal, and symlink escape. Privacy tests verify that unrelated `.env` files
+are ignored and secret-like declaration content is rejected without appearing in summaries.
+
+## Adapter Upgrade And Stale Pins
+
+Paired simulated revisions cover safe exact and ranged upgrades, stale exact pins, stale
+ranges, unsupported old and future cores, adapter schema drift, skill compatibility drift,
+restriction weakening, mode escalation, evidence removal, failure suppression, completion
+override, secret exposure, unknown skills, and traversal. CLI tests confirm stable exit
+codes and summaries that do not echo adapter identifiers or secret-like values.
+
+## Upgrade Evidence And Chains
+
+Upgrade evidence examples validate against a dedicated JSON Schema and always declare
+`changedState.changed: false`. Pair and chain CLIs support sanitized `--json` output and a
+non-overwriting relative `--output` file.
+
+Ordered chain fixtures cover accepted patch progression, stale pins, broken core and skill
+compatibility, schema drift, restriction weakening, evidence removal, failure suppression,
+completion override, mode escalation, `.env` avoidance, traversal, symlinks, and mutation
+snapshots. Chain summaries use ordinal revision labels rather than directory names.
+
+## Evidence Bundles
+
+Disposable evidence bundles cover valid replay, hash mismatch, missing entries,
+cross-release regression, path traversal, invalid retention windows, retention-expiry
+advisory status, provenance tag mismatch, unsafe archive policy, archive-index mismatch,
+and unsafe signature-verification planning. Tests verify schema validity, entry hashes,
+evidence-pack semantics, adapter-upgrade evidence semantics, deterministic report hashes,
+status preservation, detached-signature design metadata, verification-plan metadata,
+sanitized archive indexes, sanitized archive reports, and sanitized CLI output.
+
+## Maintainer Loop
+
+The maintainer-loop validator checks the required root files, ledger sections, run-log
+fields, executable runner mode, documented permission flags, unknown-flag rejection,
+restricted-command absence, documentation links, and CI integration.
+
+Release tests also invoke the runner without permissions and with an unknown permission.
+Both cases must fail before repository inspection or mutation. A successful autonomous run
+is intentionally tested after release from a clean worktree because it appends bounded
+ledger and run evidence.
+
+## False Completion
+
+Schema-valid evidence still fails semantic completion when required consequences, successful commands, material-risk resolution, known state, confidence reasons, repository identity, or supporting evidence are missing.
+
+Fixtures live under `tests/fixtures/`. Focused test documentation records both implemented checks and future extensions.

package/docs/usage/README.md

@@ -0,0 +1,89 @@
+# Using The Pilot Skills
+
+Select the least-privileged skill that matches the request:
+
+| Need | Skill |
+|---|---|
+| Understand repository identity and structure | `repo-map` |
+| Run existing local validation checks | `build-verify` |
+| Assess Git handoff readiness | `git-preflight` |
+| Determine what is actually running | `runtime-truth` |
+| Reconcile claims with evidence | `llm-drift-control` |
+
+## Typical Flow
+
+1. Use `repo-map` when repository identity or boundaries are not established.
+2. Perform implementation outside this pilot pack.
+3. Use `build-verify` for approved project-native checks.
+4. Use `git-preflight` before handoff or publication.
+5. Use `runtime-truth` only when live local state matters.
+6. Use `llm-drift-control` when claims and evidence may disagree.
+
+Every skill emits an evidence pack. Read `status`, skipped checks, failures, confidence, and changed state before relying on a completion claim.
+
+When a project owns a compatible adapter, render read-only adapter-aware `repo-map` context
+with:
+
+```bash
+node scripts/render-adapter-repo-map.mjs <project-root>
+```
+
+This validates the project adapter first, then reports adapter-declared documentation
+precedence, safe read paths, ignored paths, and required evidence. It is not a build,
+test, runtime, deployment, migration, package-install, or secret-reading flow.
+
+See [examples](../../examples/README.md) for safe concrete inputs and outputs.
+
+## Public CLI Surface
+
+Install the CLI from the public npm registry:
+
+```bash
+npm install -g coding-agent-skills
+```
+
+Run supported commands:
+
+```bash
+coding-agent-skills validate-pack
+coding-agent-skills validate-project /path/to/project
+coding-agent-skills repo-map /path/to/project
+coding-agent-skills validate-adapters /path/to/adapter-root
+```
+
+For one-off execution, use:
+
+```bash
+npx coding-agent-skills validate-pack
+```
+
+These commands wrap the same validated scripts shipped in the repository. `repo-map`
+validates the project adapter first, then renders adapter-declared documentation
+precedence, safe read paths, ignored paths, and required evidence.
+
+The installed CLI does not run target project builds or tests, perform runtime checks,
+deploy, migrate, mutate services or processes, or read `.env` files. Project adapters
+narrow context; they do not grant additional power or weaken shared restrictions.
+
+## Local Command Surface
+
+From the shared skill repository root, the same wrapper can be used directly:
+
+```bash
+bin/coding-agent-skills validate-pack
+bin/coding-agent-skills validate-project /path/to/project
+bin/coding-agent-skills repo-map /path/to/project
+bin/coding-agent-skills validate-adapters /path/to/adapter-root
+```
+
+If the repository's `bin/` directory is already on the shell path, the same commands can
+also be invoked as:
+
+```bash
+coding-agent-skills validate-pack
+coding-agent-skills validate-project /path/to/project
+coding-agent-skills repo-map /path/to/project
+coding-agent-skills validate-adapters /path/to/adapter-root
+```
+
+The local wrapper follows the same safety model as the published CLI.

package/docs/versioning/README.md

@@ -0,0 +1,30 @@
+# Versioning
+
+Use Semantic Versioning:
+
+- **Patch:** wording, validation, examples, or safety fixes that preserve behavior.
+- **Minor:** new approved skills, compatible schema fields, or new adapter capabilities.
+- **Major:** incompatible contracts, renamed skills, weakened compatibility, or changed completion semantics.
+
+Skill examples use the repository release version. Evidence packs separately record their contract version.
+
+Tags use `vMAJOR.MINOR.PATCH`. Tags are created only after validation passes, `main` is pushed, the working tree is clean, and local and remote branches are synchronized.
+
+## Project Pins
+
+A project-owned adapter declaration records the expected shared core version and one version
+pin. Supported forms are:
+
+- Exact pin: `0.2.3`
+- Compatible range: `>=0.2.2 <0.3.0`
+
+Ranges are conjunctions of plain Semantic Versioning comparators. Caret, tilde, wildcard,
+prerelease, build metadata, and logical-OR forms are not supported by the dependency-free
+pilot parser.
+
+The running core version must equal `expectedVersion` and satisfy `versionPin`. This rejects
+unsupported old or future cores, stale declarations, and ranges that do not include the
+current release. Adapter schema and adapter manifest versions are validated separately.
+
+See [adapter compatibility](adapter-compatibility.md) for stale-pin, schema-drift, skill
+compatibility, policy-preservation, and multi-step chain rules across project revisions.

package/docs/versioning/adapter-compatibility.md

@@ -0,0 +1,54 @@
+# Adapter Compatibility Across Upgrades
+
+Adapter upgrades compare four independent version surfaces:
+
+1. The before and after project core `expectedVersion`.
+2. The exact core pin or bounded compatible range.
+3. The declared adapter schema version and installed adapter version.
+4. Each adapter's compatible pilot skill versions.
+
+## Supported Transition
+
+The `v0.2.3` pair harness recognizes `0.2.2` as its supported source and `0.2.3` as its target.
+The source revision is validated against the version it declares. The target revision is
+then required to match the running core.
+
+This separation allows a valid older revision to be inspected without pretending its pin is
+current. A source older than the immediately preceding patch is an unsupported old core. A
+target newer than the running core is an unsupported future core.
+
+Multi-step chains may retain earlier synthetic revisions when every adjacent transition is
+a contiguous patch upgrade. Each step is evaluated against its own target core, while the
+last revision must target `0.2.3`.
+
+## Drift Rules
+
+- **Pin drift:** the target exact pin or range excludes the running core.
+- **Schema drift:** the project declares an adapter schema unsupported by the shared core.
+- **Adapter version drift:** the declared and discovered adapter versions disagree or
+  downgrade.
+- **Skill compatibility drift:** approved skill IDs, modes, or compatible versions no longer
+  agree.
+- **Policy drift:** the target removes restrictions, evidence, failure reporting, completion
+  integrity, secret protection, or approval boundaries.
+
+Project adapters may narrow reads and add required evidence. They must preserve all shared
+restrictions and all evidence already required by the before revision.
+
+## Upgrade Evidence
+
+A review should retain:
+
+- Both immutable project revision roots or equivalent commit identities.
+- The core target version.
+- The upgrade command and exit status.
+- Accepted adapter and skill counts.
+- Every rejection code or skipped comparison.
+- Confirmation that no project state changed.
+
+Upgrade evidence is advisory. It does not authorize edits, publication, deployment, or
+adoption in a real project.
+
+Structured pair and chain records validate against
+[`adapter-upgrade-evidence.schema.json`](../../schemas/adapter-upgrade-evidence.schema.json).
+They use ordinal project summaries and never store raw revision paths or project IDs.

package/examples/README.md

@@ -0,0 +1,12 @@
+# Pilot Examples
+
+All examples are synthetic and safe to publish.
+
+- [Skill manifests](manifests/)
+- [Command policies](command-policies/)
+- [Project adapters](adapters/)
+- [Evidence packs](evidence-packs/)
+- [Adapter upgrade evidence](upgrade-evidence/)
+- [Workflow guides](workflows/)
+
+Unsafe operations appear only as named restricted categories or clearly marked warnings. No example contains private paths, credentials, internal transcripts, or real service endpoints.

package/examples/adapters/README.md

@@ -0,0 +1,9 @@
+# Adapter Examples
+
+These synthetic examples validate against `schemas/project-adapter.schema.json`.
+
+- `narrow-repo-map.json` adds only bounded repository context.
+- `documentation-precedence.json` declares authoritative documentation order.
+- `runtime-status-hints.json` adds status-only runtime-manager hints.
+
+Examples are contracts, not installed project adapters. Real adapters belong in their owning project repositories.

package/examples/adapters/documentation-precedence.json

@@ -0,0 +1,62 @@
+{
+  "adapterId": "sample-documentation-precedence",
+  "adapterVersion": "1.0.0",
+  "project": {
+    "id": "sample-project",
+    "detection": {
+      "rootMarkers": [
+        {
+          "kind": "directory",
+          "path": "docs"
+        }
+      ],
+      "maximumDepth": 1,
+      "scope": "declared-project-root",
+      "requireApprovalOutsideScope": true
+    }
+  },
+  "supportedSkills": [
+    {
+      "id": "llm-drift-control",
+      "compatibleVersions": ["0.2.x"],
+      "declaredMode": "audit-only"
+    }
+  ],
+  "extensions": {
+    "safeReadPaths": ["README.md", "docs", "src", "test"],
+    "ignoredPaths": ["docs/generated"],
+    "documentationPrecedence": [
+      "docs/architecture/README.md",
+      "docs/product/README.md",
+      "README.md"
+    ],
+    "commandAliases": [],
+    "safeStatusCommands": [],
+    "requiredEvidence": ["source reference", "test reference", "documentation reference"],
+    "expectedRuntimeManagers": [],
+    "expectedPackageManagers": ["none"]
+  },
+  "approvalRequirements": [],
+  "inheritance": {
+    "sharedRestrictions": "required",
+    "deniedOperationCategories": [
+      "file-write",
+      "package-install",
+      "deployment",
+      "git-mutation",
+      "unrestricted-scan",
+      "secret-read",
+      "process-mutation",
+      "service-mutation",
+      "migration-apply",
+      "privileged-api"
+    ],
+    "allowRestrictionRemoval": false,
+    "allowModeOverride": false,
+    "allowFailureSuppression": false,
+    "allowCompletionOverride": false,
+    "allowSecretExposure": false,
+    "allowRequiredEvidenceRemoval": false,
+    "allowScopeExpansionWithoutApproval": false
+  }
+}

package/examples/adapters/narrow-repo-map.json

@@ -0,0 +1,64 @@
+{
+  "adapterId": "sample-repo-map",
+  "adapterVersion": "1.0.0",
+  "project": {
+    "id": "sample-project",
+    "detection": {
+      "rootMarkers": [
+        {
+          "kind": "file",
+          "path": "package.json"
+        }
+      ],
+      "maximumDepth": 2,
+      "scope": "declared-project-root",
+      "requireApprovalOutsideScope": true
+    }
+  },
+  "supportedSkills": [
+    {
+      "id": "repo-map",
+      "compatibleVersions": ["0.2.3"],
+      "declaredMode": "audit-only"
+    }
+  ],
+  "extensions": {
+    "safeReadPaths": ["README.md", "docs", "src"],
+    "ignoredPaths": ["dist", "coverage"],
+    "documentationPrecedence": [],
+    "commandAliases": [],
+    "safeStatusCommands": [],
+    "requiredEvidence": ["package manifest", "application entry point"],
+    "expectedRuntimeManagers": [],
+    "expectedPackageManagers": ["npm"]
+  },
+  "approvalRequirements": [
+    {
+      "operation": "read-outside-declared-scope",
+      "required": true,
+      "reason": "The adapter cannot expand repository scope implicitly."
+    }
+  ],
+  "inheritance": {
+    "sharedRestrictions": "required",
+    "deniedOperationCategories": [
+      "file-write",
+      "package-install",
+      "deployment",
+      "git-mutation",
+      "unrestricted-scan",
+      "secret-read",
+      "process-mutation",
+      "service-mutation",
+      "migration-apply",
+      "privileged-api"
+    ],
+    "allowRestrictionRemoval": false,
+    "allowModeOverride": false,
+    "allowFailureSuppression": false,
+    "allowCompletionOverride": false,
+    "allowSecretExposure": false,
+    "allowRequiredEvidenceRemoval": false,
+    "allowScopeExpansionWithoutApproval": false
+  }
+}

package/examples/adapters/runtime-status-hints.json

@@ -0,0 +1,76 @@
+{
+  "adapterId": "sample-runtime-status",
+  "adapterVersion": "1.0.0",
+  "project": {
+    "id": "sample-service",
+    "detection": {
+      "rootMarkers": [
+        {
+          "kind": "file",
+          "path": "package.json"
+        }
+      ],
+      "maximumDepth": 1,
+      "scope": "declared-project-root",
+      "requireApprovalOutsideScope": true
+    }
+  },
+  "supportedSkills": [
+    {
+      "id": "runtime-truth",
+      "compatibleVersions": ["0.2.3"],
+      "declaredMode": "audit-only"
+    }
+  ],
+  "extensions": {
+    "safeReadPaths": ["README.md", "package.json"],
+    "ignoredPaths": ["logs"],
+    "documentationPrecedence": ["README.md"],
+    "commandAliases": [
+      {
+        "alias": "service-status",
+        "skillId": "runtime-truth",
+        "family": "runtime-status",
+        "command": "systemctl --user status sample.service --no-pager"
+      }
+    ],
+    "safeStatusCommands": [
+      {
+        "manager": "systemd-user",
+        "command": "systemctl --user status sample.service --no-pager"
+      }
+    ],
+    "requiredEvidence": ["manager status", "listener ownership", "health response"],
+    "expectedRuntimeManagers": ["systemd-user"],
+    "expectedPackageManagers": ["npm"]
+  },
+  "approvalRequirements": [
+    {
+      "operation": "authenticated-health-check",
+      "required": true,
+      "reason": "Authenticated health checks require a separately approved workflow."
+    }
+  ],
+  "inheritance": {
+    "sharedRestrictions": "required",
+    "deniedOperationCategories": [
+      "file-write",
+      "package-install",
+      "deployment",
+      "git-mutation",
+      "unrestricted-scan",
+      "secret-read",
+      "process-mutation",
+      "service-mutation",
+      "migration-apply",
+      "privileged-api"
+    ],
+    "allowRestrictionRemoval": false,
+    "allowModeOverride": false,
+    "allowFailureSuppression": false,
+    "allowCompletionOverride": false,
+    "allowSecretExposure": false,
+    "allowRequiredEvidenceRemoval": false,
+    "allowScopeExpansionWithoutApproval": false
+  }
+}

package/examples/command-policies/README.md

@@ -0,0 +1,3 @@
+# Command-Policy Examples
+
+Policies describe allowed families and shared restricted categories. They are declarative examples, not runtime wrappers.

package/examples/command-policies/build-verify.json

@@ -0,0 +1,57 @@
+{
+  "version": "0.2.3",
+  "mode": "action-capable",
+  "parserPolicy": {
+    "inspectEverySegment": true,
+    "inspectScriptBodies": true,
+    "rejectUnknownExecutables": true,
+    "rejectShellWrappers": true,
+    "rejectHeredocs": true,
+    "rejectRedirection": true,
+    "providerSpecificNpx": true,
+    "authenticatedCurlRequiresApproval": true,
+    "boundedReadsRequired": true,
+    "allowedComposition": "read-only"
+  },
+  "allowedFamilies": [
+    {
+      "name": "manifest-inspection",
+      "executables": ["sed", "head", "jq"],
+      "argumentPolicy": {
+        "strategy": "pattern",
+        "allowedPatterns": ["known manifest and CI file reads"],
+        "deniedPatterns": ["secret files and paths outside the repository"]
+      },
+      "constraints": [
+        "Read only known project manifests and CI configuration."
+      ]
+    },
+    {
+      "name": "project-native-validation",
+      "executables": ["npm", "pnpm", "yarn", "node"],
+      "argumentPolicy": {
+        "strategy": "discovered-script",
+        "allowedPatterns": ["lint, typecheck, test, build, check, and validate"],
+        "deniedPatterns": ["install, fix, deploy, migrate, snapshot, watch, dev, and start"]
+      },
+      "constraints": [
+        "Run only scripts discovered in project manifests.",
+        "Allow lint without fix mode, typecheck, targeted tests, tests, and build.",
+        "Reject watch mode, installation, snapshot updates, and unknown scripts."
+      ]
+    }
+  ],
+  "restrictedCategories": [
+    "file-write",
+    "package-install",
+    "deployment",
+    "git-mutation",
+    "unrestricted-scan",
+    "secret-read",
+    "process-mutation",
+    "service-mutation",
+    "migration-apply",
+    "privileged-api"
+  ],
+  "approvalExceptions": []
+}