coding-agent-skills 0.2.9 → 0.2.10

package/CHANGELOG.md

@@ -2,6 +2,25 @@
 
 All notable changes follow [Semantic Versioning](docs/versioning/README.md).
 
+## [0.2.10] - 2026-07-03
+
+### Added
+
+- `env-audit` audit-only skill for static environment variable name mapping without values.
+- `coding-agent-skills env-audit <project-root>` CLI command.
+- Dependency-free env audit renderer for variable names, classifications, sample files,
+  skipped secret-bearing paths, not-verified runtime stores, adapter-limited scope, and
+  safety refusals.
+- Synthetic env-audit fixtures and release tests for generic static scans, adapter-scoped
+  scans, `.env` exclusion, `.env.example` inspection, and repo-map-only adapter skips.
+
+### Changed
+
+- Adapter schemas and validators now recognize `env-audit` as an audit-only skill while
+  preserving the existing `0.2.3` adapter contract compatibility baseline.
+- Builder-mode approval for completing the remaining read-only skill wave is recorded in
+  the roadmap, ledger, and run log.
+
 ## [0.2.9] - 2026-07-03
 
 ### Added

package/README.md

@@ -7,6 +7,7 @@ The pilot pack contains:
 - Shared evidence-pack contract.
 - `repo-map`: audit-only repository orientation.
 - `route-trace`: audit-only static route surface tracing.
+- `env-audit`: audit-only environment variable name mapping without values.
 - `build-verify`: controlled local validation using existing project commands.
 - `git-preflight`: audit-only Git readiness inspection.
 - `runtime-truth`: audit-only runtime evidence collection.
@@ -40,6 +41,7 @@ Every skill emits the evidence-pack contract. A command being attempted is never
 - Run `npx coding-agent-skills validate-pack` when a one-off npm execution is preferred.
 - From a clone, the same wrapper is available as `bin/coding-agent-skills validate-pack`.
 - Trace static route surfaces with `coding-agent-skills route-trace <project-root>`.
+- Map environment variable names with `coding-agent-skills env-audit <project-root>`.
 - Validate project adapters against [the formal adapter schema](schemas/project-adapter.schema.json).
 - Review [external adapter discovery](docs/adapters/discovery.md).
 - Run `node scripts/validate-adapters.mjs <adapter-root>` for a disposable external root.

package/ROADMAP.md

@@ -1,7 +1,8 @@
 # Roadmap
 
-The public package now contains six approved shared skills. Future work requires separate
-design and approval.
+The public package now contains seven approved shared skills. Builder-mode approval is
+active for the remaining read-only skill wave in this repository; real-world project
+execution constraints remain unchanged.
 
 ## Released Harness Milestones
 
@@ -29,15 +30,16 @@ design and approval.
   install smoke coverage.
 - `v0.2.9`: audit-only `route-trace` skill and CLI renderer for static route surface
   tracing.
+- `v0.2.10`: audit-only `env-audit` skill and CLI renderer for value-free environment
+  variable name mapping.
 
 The next milestone is recorded in [work-ledger.md](work-ledger.md). The
 [maintainer loop](RUNBOOK.md) may select and evidence that milestone, but it must stop
 before implementation until the relevant human approval is granted.
 
-No evidence-harness milestone is queued after `v0.2.3`. Additional real project adapters,
-new skills beyond `route-trace`, platform work, deployment/preflight work, and signing infrastructure remain
-separately gated. The public npm package exposes the existing read-only CLI surface; it
-does not approve new skills or target-project mutation.
+No evidence-harness milestone is queued after `v0.2.3`. Builder-mode approval permits the
+listed read-only skill wave inside this repository. Real project adapters, target-project
+mutation, signing infrastructure, and action-capable platform work remain separately gated.
 
 ## Planning Gates
 
@@ -71,20 +73,21 @@ Next safe milestone options:
 | Candidate | Scope | Mode | Current gate |
 |---|---|---|---|
 | `route-trace-skill` | General | Audit-only | Implemented in `v0.2.9` |
-| `env-audit-skill` | General | Audit-only | Needs more evidence |
-| `secret-audit-skill` | General | Audit-only | Blocked on privacy and approval model |
-| `deployment-preflight-skill` | General | Audit-only | Needs design review |
-| `cloudflare-preflight-skill` | Platform-specific | Audit-only | Needs more evidence |
+| `env-audit-skill` | General | Audit-only | Implemented in `v0.2.10` |
+| `secret-audit-skill` | General | Audit-only | Builder-mode approved; queued after `env-audit` |
+| `deployment-preflight-skill` | General | Audit-only | Builder-mode approved; later in wave |
+| `cloudflare-preflight-skill` | Platform-specific | Audit-only | Builder-mode approved; later in wave |
 | `cloudflare-deploy-skill` | Platform-specific | Action-capable | Blocked on approval model |
-| `supabase-rls-audit-skill` | Platform-specific | Audit-only | Needs more evidence |
-| `migration-review-skill` | General with platform adapters | Audit-only | Needs design review |
-| `api-contract-audit-skill` | General | Audit-only | Needs design review |
+| `supabase-rls-audit-skill` | Platform-specific | Audit-only | Builder-mode approved; later in wave |
+| `migration-review-skill` | General with platform adapters | Audit-only | Builder-mode approved; later in wave |
+| `api-contract-audit-skill` | General | Audit-only | Builder-mode approved; later in wave |
 | `repo-knowledge-sync-skill` | General | Action-capable | Blocked on write approval model |
 | `security-hardening-review-skill` | General coordinator | Audit-only | Needs more evidence |
 | `worker-queue-debug-skill` | General core with project adapters | Audit-only first | Needs more evidence |
 | `devvit-ingest-debug-skill` | Project-specific | Audit-only | Needs project evidence |
-| `github-handoff-skill` | Platform-specific | Action-capable | Blocked on approval model |
+| `github-handoff-skill` | General | Audit-only | Builder-mode approved; later in wave |
 | `session-extractor-skill` | General tooling | Action-capable | Blocked on privacy policy and more evidence |
 | `command-redaction-skill` | General tooling | Action-capable | Needs more evidence |
 
-No roadmap item is implicitly approved for implementation.
+Builder-mode approval applies only to the named read-only wave. No other roadmap item is
+implicitly approved for implementation.

package/bin/coding-agent-skills

@@ -29,6 +29,12 @@ const commands = {
     usage: "coding-agent-skills route-trace <project-root>",
     requiredArgs: 1,
   },
+  "env-audit": {
+    script: "scripts/render-env-audit.mjs",
+    args: ([projectRoot]) => [projectRoot],
+    usage: "coding-agent-skills env-audit <project-root>",
+    requiredArgs: 1,
+  },
   "validate-adapters": {
     script: "scripts/validate-adapters.mjs",
     args: ([adapterRoot]) => [adapterRoot],
@@ -46,6 +52,7 @@ function usage(exitCode = 0) {
     "  validate-project <project-root>",
     "  repo-map <project-root>",
     "  route-trace <project-root>",
+    "  env-audit <project-root>",
     "  validate-adapters <adapter-root>",
     "",
     "local wrapper for the published coding-agent-skills package",

package/docs/adapters/README.md

@@ -54,12 +54,29 @@ statically reports verified route files, inferred route patterns, skipped items,
 not-verified runtime-dependent routing classes. It does not execute target code, run
 servers, hit URLs, build, test, deploy, migrate, inspect databases, or read `.env` files.
 
+## Adapter-Aware Env Audit Consumption
+
+The shared pack can consume a validated project-owned adapter as bounded context for
+`env-audit`:
+
+```bash
+node scripts/render-env-audit.mjs <project-root>
+```
+
+The renderer validates the project declaration when present. If an adapter is present but
+does not enable `env-audit`, it reports an adapter-limited skip instead of broadening
+scope. When enabled, it reads only adapter-declared safe paths, excludes `.env` and
+secret-bearing files, and reports variable names, classifications, sample files inspected,
+skipped items, and not-verified runtime or credential stores. It never prints values or
+validates credentials.
+
 ## What Adapters May Do
 
 - Add bounded relative read paths and ignored paths.
 - Declare project-root markers and a bounded detection depth.
 - Add documentation precedence and package-manager hints.
 - Add route-trace safe read paths for static route files and route config.
+- Add env-audit safe read paths for static source, docs, sample, and config files.
 - Add command aliases that already satisfy the shared command policy.
 - Add status-only runtime commands and manager hints.
 - Require additional evidence or named approval for exceptional reads.

package/docs/adapters/project-installation.md

@@ -122,6 +122,17 @@ patterns, skipped paths, and not-verified runtime-dependent route classes. It do
 servers, hit URLs, execute app code, build, test, deploy, migrate, inspect databases, read
 `.env` files, or modify project state.
 
+A project-owned adapter can also enable read-only `env-audit` context:
+
+```bash
+node scripts/render-env-audit.mjs <project-root>
+```
+
+The env-audit renderer validates the project declaration when present. If the adapter is
+present but does not enable `env-audit`, it reports an adapter-limited skip. When enabled,
+it reads only adapter-declared safe paths, refuses `.env` and secret-bearing files, and
+reports environment variable names without values.
+
 ## Safety Boundary
 
 Project adapters are extension-only. They cannot remove denied operations, change an

package/docs/adapters/real-project-adoption.md

@@ -21,7 +21,8 @@ project repository is touched:
 - The project can declare exactly one installation file: `.coding-agent/skills.json` or
   `coding-agent.skills.json`.
 - The adapter need is bounded to existing pilot skills: `repo-map`, `route-trace`,
-  `build-verify`, `git-preflight`, `runtime-truth`, or `llm-drift-control`.
+  `env-audit`, `build-verify`, `git-preflight`, `runtime-truth`, or
+  `llm-drift-control`.
 - The adapter can narrow context with relative paths, documentation precedence, safe
   aliases, status-only hints, or extra evidence requirements.
 - The adapter does not require deployment, migration, package installation, Git

package/docs/architecture/README.md

@@ -13,6 +13,7 @@ Audit-only:
 
 - `repo-map`
 - `route-trace`
+- `env-audit`
 - `git-preflight`
 - `runtime-truth`
 - `llm-drift-control`

package/docs/release/README.md

@@ -19,8 +19,9 @@
 13. Inspect tarball contents for local-only files, credentials, `.env` files, dependency
     folders, generated output, and unrelated repositories.
 14. Install the tarball into a temporary npm prefix and smoke-test the installed CLI.
-15. Smoke-test any new CLI command such as `coding-agent-skills route-trace` against
-    synthetic fixtures only unless a real project read-only smoke is explicitly approved.
+15. Smoke-test any new CLI command such as `coding-agent-skills route-trace` or
+    `coding-agent-skills env-audit` against synthetic fixtures only unless a real project
+    read-only smoke is explicitly approved.
 16. Review changelog, ledger, run evidence, and versioning impact.
 17. Commit with approved identity.
 18. Push `main` using credential-free remotes.

package/docs/release/npm-package.md

@@ -7,7 +7,7 @@ safety model.
 ## Current Package Shape
 
 - Package name: `coding-agent-skills`.
-- Package version: `0.2.9`.
+- Package version: `0.2.10`.
 - CLI bin: `coding-agent-skills` mapped to `bin/coding-agent-skills`.
 - Module type: `module`.
 - Dependencies: none.
@@ -28,6 +28,7 @@ coding-agent-skills validate-pack
 coding-agent-skills validate-project /path/to/project
 coding-agent-skills repo-map /path/to/project
 coding-agent-skills route-trace /path/to/project
+coding-agent-skills env-audit /path/to/project
 coding-agent-skills validate-adapters /path/to/adapter-root
 ```
 
@@ -39,7 +40,9 @@ npx coding-agent-skills validate-pack
 
 Adapter compatibility remains controlled by the existing shared core and
 project-adapter validators. `route-trace` is static and audit-only; it reports route
-files and route declarations without executing the target project.
+files and route declarations without executing the target project. `env-audit` is static
+and audit-only; it reports environment variable names without reading `.env` files or
+printing values.
 
 `coding-agent-skills validate-pack` is package-aware. In a source checkout, it keeps
 source-only checks such as `.gitignore` validation. In an installed package tree, where

package/docs/safety/README.md

@@ -2,12 +2,16 @@
 
 ## Audit-Only Rule
 
-`repo-map`, `route-trace`, `git-preflight`, `runtime-truth`, and `llm-drift-control` must not alter project files, Git state, dependencies, processes, services, databases, remote systems, or deployment state.
+`repo-map`, `route-trace`, `env-audit`, `git-preflight`, `runtime-truth`, and `llm-drift-control` must not alter project files, Git state, dependencies, processes, services, databases, remote systems, or deployment state.
 
 `route-trace` is static only. It may read bounded non-secret route files and route
 configuration, but it must not execute app code, run servers, hit URLs, claim runtime
 truth, or broaden adapter scope when a project adapter is present.
 
+`env-audit` is value-free. It may read bounded non-secret source, docs, sample, and config
+files, including `.env.example`, but must not read `.env`, print values, validate
+credentials, contact APIs, or inspect secret stores.
+
 `build-verify` may run existing project-native validation commands. Build or test tools may create their normal local artifacts, but the skill must declare observed changes and must reject installation, fix modes, snapshot updates, deployment, migration, or unknown scripts.
 
 ## Restricted Categories

package/docs/testing/README.md

@@ -37,6 +37,13 @@ skipped paths, not-verified runtime route classes, and repo-map-only adapter ski
 Route-trace tests must never run a target project, hit URLs, build, test, deploy, migrate,
 or read `.env` files.
 
+## Env Audit
+
+Synthetic env-audit projects cover value-free variable-name detection, `.env` exclusion,
+`.env.example` inspection, adapter-declared scope, and adapter-present-but-not-enabled
+behavior. Env-audit tests must never print values, validate credentials, contact APIs,
+run target projects, build, test, deploy, migrate, or read `.env` files.
+
 ## Privacy And Redaction
 
 Sensitive shapes are stored as ordered synthetic parts and reconstructed only in memory. Tests verify type detection, redaction, and absence from reusable skill content without printing fixture values.

package/docs/usage/README.md

@@ -6,6 +6,7 @@ Select the least-privileged skill that matches the request:
 |---|---|
 | Understand repository identity and structure | `repo-map` |
 | Trace statically visible route surfaces | `route-trace` |
+| Map environment variable names without values | `env-audit` |
 | Run existing local validation checks | `build-verify` |
 | Assess Git handoff readiness | `git-preflight` |
 | Determine what is actually running | `runtime-truth` |
@@ -15,11 +16,13 @@ Select the least-privileged skill that matches the request:
 
 1. Use `repo-map` when repository identity or boundaries are not established.
 2. Use `route-trace` when route files or declarations must be mapped from static files.
-3. Perform implementation outside this pilot pack.
-4. Use `build-verify` for approved project-native checks.
-5. Use `git-preflight` before handoff or publication.
-6. Use `runtime-truth` only when live local state matters.
-7. Use `llm-drift-control` when claims and evidence may disagree.
+3. Use `env-audit` when environment variable names or sample config references must be
+   mapped without reading values.
+4. Perform implementation outside this pilot pack.
+5. Use `build-verify` for approved project-native checks.
+6. Use `git-preflight` before handoff or publication.
+7. Use `runtime-truth` only when live local state matters.
+8. Use `llm-drift-control` when claims and evidence may disagree.
 
 Every skill emits an evidence pack. Read `status`, skipped checks, failures, confidence, and changed state before relying on a completion claim.
 
@@ -51,6 +54,7 @@ coding-agent-skills validate-pack
 coding-agent-skills validate-project /path/to/project
 coding-agent-skills repo-map /path/to/project
 coding-agent-skills route-trace /path/to/project
+coding-agent-skills env-audit /path/to/project
 coding-agent-skills validate-adapters /path/to/adapter-root
 ```
 
@@ -66,6 +70,10 @@ precedence, safe read paths, ignored paths, and required evidence.
 `route-trace` validates a project adapter when present, uses adapter-declared safe paths
 when enabled, and statically reports verified route files, inferred route declarations,
 skipped items, and not-verified runtime-dependent route classes.
+`env-audit` validates a project adapter when present, uses adapter-declared safe paths
+when enabled, and statically reports environment variable names, classifications, sample
+files inspected, skipped secret-bearing paths, and not-verified runtime or credential
+stores without printing values.
 
 The installed CLI does not run target project builds or tests, perform runtime checks,
 deploy, migrate, mutate services or processes, or read `.env` files. Project adapters
@@ -80,6 +88,7 @@ bin/coding-agent-skills validate-pack
 bin/coding-agent-skills validate-project /path/to/project
 bin/coding-agent-skills repo-map /path/to/project
 bin/coding-agent-skills route-trace /path/to/project
+bin/coding-agent-skills env-audit /path/to/project
 bin/coding-agent-skills validate-adapters /path/to/adapter-root
 ```
 
@@ -91,6 +100,7 @@ coding-agent-skills validate-pack
 coding-agent-skills validate-project /path/to/project
 coding-agent-skills repo-map /path/to/project
 coding-agent-skills route-trace /path/to/project
+coding-agent-skills env-audit /path/to/project
 coding-agent-skills validate-adapters /path/to/adapter-root
 ```
 

package/examples/command-policies/env-audit.json

@@ -0,0 +1,73 @@
+{
+  "version": "0.2.3",
+  "mode": "audit-only",
+  "parserPolicy": {
+    "inspectEverySegment": true,
+    "inspectScriptBodies": true,
+    "rejectUnknownExecutables": true,
+    "rejectShellWrappers": true,
+    "rejectHeredocs": true,
+    "rejectRedirection": true,
+    "providerSpecificNpx": true,
+    "authenticatedCurlRequiresApproval": true,
+    "boundedReadsRequired": true,
+    "allowedComposition": "read-only"
+  },
+  "allowedFamilies": [
+    {
+      "name": "bounded-env-name-inspection",
+      "executables": ["pwd", "ls", "rg", "find", "sed", "head"],
+      "argumentPolicy": {
+        "strategy": "pattern",
+        "allowedPatterns": ["bounded repository-local static env-name inspection"],
+        "deniedPatterns": ["secret files, values, absolute home paths, app execution, and unbounded traversal"]
+      },
+      "constraints": [
+        "Remain inside the declared project scope.",
+        "Bound traversal depth and output.",
+        "Exclude .env, secret-bearing, generated, dependency, build, and runtime-output paths.",
+        "Report variable names only, never values."
+      ]
+    },
+    {
+      "name": "git-identity-inspection",
+      "executables": ["git"],
+      "argumentPolicy": {
+        "strategy": "exact",
+        "allowedPatterns": ["rev-parse and status --short --branch"],
+        "deniedPatterns": ["all Git mutation and publication subcommands"]
+      },
+      "constraints": [
+        "Allow only read-only repository identity and branch-state inspection."
+      ]
+    },
+    {
+      "name": "env-audit-renderer",
+      "executables": ["node", "coding-agent-skills"],
+      "argumentPolicy": {
+        "strategy": "exact",
+        "allowedPatterns": ["node scripts/render-env-audit.mjs <project-root>; coding-agent-skills env-audit <project-root>"],
+        "deniedPatterns": [".env reads, value printing, credential validation, API calls, builds, tests, deployment, migration, and package installation"]
+      },
+      "constraints": [
+        "The renderer must remain static and read-only.",
+        "Do not treat renderer output as credential presence or validity evidence."
+      ]
+    }
+  ],
+  "restrictedCategories": [
+    "file-write",
+    "package-install",
+    "deployment",
+    "git-mutation",
+    "unrestricted-scan",
+    "secret-read",
+    "process-mutation",
+    "service-mutation",
+    "migration-apply",
+    "privileged-api"
+  ],
+  "approvalExceptions": [
+    "A named-file approval may permit one otherwise excluded non-mutating static read when the file is not secret-bearing."
+  ]
+}

package/examples/evidence-packs/env-audit.json

@@ -0,0 +1,55 @@
+{
+  "contractVersion": "1.0.0",
+  "skill": {"name": "env-audit", "version": "0.2.3"},
+  "invocation": {
+    "id": "example-env-audit",
+    "startedAt": "2026-07-03T10:00:00Z",
+    "endedAt": "2026-07-03T10:01:00Z"
+  },
+  "repository": {
+    "root": "/workspace/example-project",
+    "branch": "main",
+    "head": "0123456789abcdef",
+    "workingTreeState": "clean"
+  },
+  "userIntent": "Identify environment variable names before updating setup documentation.",
+  "declaredScope": ["/workspace/example-project"],
+  "projectAdapter": "example-env-adapter",
+  "environmentSummary": {"platform": "linux", "shell": "bash"},
+  "status": "complete",
+  "confidence": {
+    "level": "high",
+    "reason": "Static env references, sample files, skipped secret paths, and not-verified runtime stores were recorded without values."
+  },
+  "commands": [
+    {
+      "command": "coding-agent-skills env-audit /workspace/example-project",
+      "family": "env-audit-renderer",
+      "workingDirectory": "/workspace/example-project",
+      "startedAt": "2026-07-03T10:00:20Z",
+      "endedAt": "2026-07-03T10:00:21Z",
+      "exitStatus": 0,
+      "resultStatus": "success",
+      "safetyClass": "allowed",
+      "approvalReference": null,
+      "purpose": "Render a value-free static env audit report.",
+      "outputSummary": "Found env variable names and sample declarations without reading .env files or printing values."
+    }
+  ],
+  "skippedChecks": [],
+  "findings": [
+    {
+      "summary": "Environment variable names were identified from static references and .env.example only.",
+      "evidence": ["src/config.ts", ".env.example"]
+    }
+  ],
+  "risks": [],
+  "failures": [],
+  "unresolvedQuestions": [],
+  "changedState": {
+    "changed": false,
+    "summary": "No project, Git, dependency, runtime, service, or remote state changed."
+  },
+  "handoffSummary": "Environment variable names are mapped without values; runtime stores remain unverified.",
+  "recommendedNextAction": "Review the reported names before updating documentation."
+}

package/examples/manifests/env-audit.json

@@ -0,0 +1,14 @@
+{
+  "name": "env-audit",
+  "version": "0.2.3",
+  "mode": "audit-only",
+  "evidenceContract": "../../contracts/evidence-pack/evidence-pack.schema.json",
+  "commandPolicy": "../command-policies/env-audit.json",
+  "adapterSchema": "../../schemas/project-adapter.schema.json",
+  "adapterCompatibility": {
+    "contractVersion": "1.0.0",
+    "compatibleAdapterVersions": ["1.0.0"]
+  },
+  "adapterInterface": "../../skills/env-audit/adapter-interface.md",
+  "description": "Identify environment variable names without reading values."
+}

package/examples/workflows/env-audit.md

@@ -0,0 +1,16 @@
+# Env Audit Workflow
+
+Use `env-audit` before editing setup docs, config loaders, or handoff notes:
+
+```bash
+coding-agent-skills env-audit /workspace/project
+```
+
+Review:
+
+- names and classifications
+- sample files inspected
+- skipped secret-bearing paths
+- runtime and credential stores not verified
+
+Do not use the output as proof that values exist or credentials work.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "coding-agent-skills",
-  "version": "0.2.9",
+  "version": "0.2.10",
   "description": "Evidence-first, read-only coding-agent skills and project adapter tooling.",
   "type": "module",
   "private": false,
@@ -10,6 +10,7 @@
     "agent-skills",
     "repo-map",
     "route-trace",
+    "env-audit",
     "project-adapters",
     "code-validation",
     "cli"

package/runs/skill-runs.md

@@ -186,4 +186,14 @@ This file records bounded maintainer-loop runs. Entries must not contain secrets
 - Validation commands: `git diff --check`; `bin/coding-agent-skills validate-pack`; `bin/coding-agent-skills validate-adapters tests/fixtures/external-adapters/valid-basic`; `bin/coding-agent-skills validate-project /home/oneclickwebsitedesignfactory/tax-lien-platform`; `bin/coding-agent-skills repo-map /home/oneclickwebsitedesignfactory/tax-lien-platform`; `bin/coding-agent-skills route-trace tests/fixtures/route-trace/static-project`; `bin/coding-agent-skills route-trace /home/oneclickwebsitedesignfactory/tax-lien-platform`; `node scripts/validate-pack.mjs .`; `node scripts/test-pack.mjs`; `node scripts/validate-maintainer-loop.mjs .`; `node --test`; JSON parsing; package secret scan; npm publish dry-run; tarball install smoke.
 - Validation result: pass pending final commit, tag, publication, registry smoke, npm exec, and GitHub Release evidence.
 - Real project smoke: `/home/oneclickwebsitedesignfactory/tax-lien-platform` remained repo-map-only for adapters, so route-trace reported `partial` and did not read target project route files.
+
+## implementation-v0.2.10-env-audit
+
+- Run ID: `implementation-v0.2.10-env-audit`
+- Repository: `/home/oneclickwebsitedesignfactory/coding-agent-skills`
+- Command used: `builder-mode approval for env-audit-skill implementation and release`
+- Files changed: `env-audit` skill, env-audit renderer and library, CLI wrapper, adapter schemas, pack rules, release tests, synthetic env fixtures, usage/release/safety/adapter docs, changelog, roadmap, work ledger, run log, and package metadata.
+- Safety boundary: read-only, static-analysis only, no `.env` reads, no value printing, no credential validation, no API calls, no builds, no tests in target projects, no deploys, no migrations, and no target-project mutation.
+- Validation commands: pending final release validation matrix.
+- Result: pass pending final publication evidence.
 - Commit/tag/push status: pending approved release workflow.

package/schemas/project-adapter-installation.schema.json

@@ -66,6 +66,7 @@
         "enum": [
           "repo-map",
           "route-trace",
+          "env-audit",
           "build-verify",
           "git-preflight",
           "runtime-truth",
@@ -99,6 +100,7 @@
               "enum": [
               "repo-map",
               "route-trace",
+              "env-audit",
               "build-verify",
               "git-preflight",
                 "runtime-truth",

package/schemas/project-adapter.schema.json

@@ -90,6 +90,7 @@
             "enum": [
               "repo-map",
               "route-trace",
+              "env-audit",
               "build-verify",
               "git-preflight",
               "runtime-truth",
@@ -167,6 +168,7 @@
                 "enum": [
                   "repo-map",
                   "route-trace",
+                  "env-audit",
                   "build-verify",
                   "git-preflight",
                   "runtime-truth",