opencode-skills-collection 3.1.17 → 3.1.19

package/bundled-skills/go-in-depth/scripts/workflow-script.js

@@ -0,0 +1,350 @@
+export const meta = {
+  name: 'go-in-depth',
+  description: 'Go in depth harness — fan-out web searches, fetch sources, adversarially verify claims, synthesize a cited report.',
+  whenToUse: 'When the user wants a deep, multi-source, fact-checked research report on any topic. BEFORE invoking, check if the question is specific enough to research directly — if underspecified (e.g., "what car to buy" without budget/use-case/region), ask 2-3 clarifying questions to narrow scope. Then pass the refined question as args, weaving the answers in.',
+  phases: [{"title":"Scope","detail":"Decompose question (from args) into 5 search angles"},{"title":"Search","detail":"5 parallel WebSearch agents, one per angle"},{"title":"Fetch","detail":"URL-dedup, fetch top 15 sources, extract falsifiable claims"},{"title":"Verify","detail":"3-vote adversarial verification per claim (need 2/3 refutes to kill)"},{"title":"Synthesize","detail":"Merge semantic dupes, rank by confidence, cite sources"}],
+}
+
+// go-in-depth: Scope → pipeline(Search → URL-dedup → Fetch+Extract) → 3-vote Verify → Synthesize
+// Uses a bug-hunting-style fan-out and verification pattern, adapted for web research.
+// Question is passed via Workflow({name: 'go-in-depth', args: '<question>'}).
+
+const VOTES_PER_CLAIM = 3
+const REFUTATIONS_REQUIRED = 2
+const MAX_FETCH = 15
+const MAX_VERIFY_CLAIMS = 25
+
+// ─── Schemas ───
+const SCOPE_SCHEMA = {
+  type: "object", required: ["question", "angles", "summary"],
+  properties: {
+    question: { type: "string" },
+    summary: { type: "string" },
+    angles: { type: "array", minItems: 3, maxItems: 6, items: {
+      type: "object", required: ["label", "query"],
+      properties: {
+        label: { type: "string" },
+        query: { type: "string" },
+        rationale: { type: "string" },
+      },
+    }},
+  },
+}
+const SEARCH_SCHEMA = {
+  type: "object", required: ["results"],
+  properties: {
+    results: { type: "array", maxItems: 6, items: {
+      type: "object", required: ["url", "title", "relevance"],
+      properties: {
+        url: { type: "string" },
+        title: { type: "string" },
+        snippet: { type: "string" },
+        relevance: { enum: ["high", "medium", "low"] },
+      },
+    }},
+  },
+}
+const EXTRACT_SCHEMA = {
+  type: "object", required: ["claims", "sourceQuality"],
+  properties: {
+    sourceQuality: { enum: ["primary", "secondary", "blog", "forum", "unreliable"] },
+    publishDate: { type: "string" },
+    claims: { type: "array", maxItems: 5, items: {
+      type: "object", required: ["claim", "quote", "importance"],
+      properties: {
+        claim: { type: "string" },
+        quote: { type: "string" },
+        importance: { enum: ["central", "supporting", "tangential"] },
+      },
+    }},
+  },
+}
+const VERDICT_SCHEMA = {
+  type: "object", required: ["refuted", "evidence", "confidence"],
+  properties: {
+    refuted: { type: "boolean" },
+    evidence: { type: "string" },
+    confidence: { enum: ["high", "medium", "low"] },
+    counterSource: { type: "string" },
+  },
+}
+const REPORT_SCHEMA = {
+  type: "object", required: ["summary", "findings", "caveats"],
+  properties: {
+    summary: { type: "string" },
+    findings: { type: "array", items: {
+      type: "object", required: ["claim", "confidence", "sources", "evidence"],
+      properties: {
+        claim: { type: "string" },
+        confidence: { enum: ["high", "medium", "low"] },
+        sources: { type: "array", items: { type: "string" } },
+        evidence: { type: "string" },
+        vote: { type: "string" },
+      },
+    }},
+    caveats: { type: "string" },
+    openQuestions: { type: "array", items: { type: "string" } },
+  },
+}
+
+// ─── Phase 0: Scope — decompose question into search angles ───
+phase("Scope")
+const QUESTION = (typeof args === "string" ? args.trim() : args?.query?.trim()) || ""
+if (!QUESTION) {
+  return { error: "No research question provided. Pass it as args: Workflow({name: 'go-in-depth', args: '<question>'})." }
+}
+const scope = await agent(
+  "Decompose this research question into complementary search angles.\n\n" +
+  "## Question\n" + QUESTION + "\n\n" +
+  "## Task\n" +
+  "Generate 5 distinct web search queries that together cover the question from different angles. Pick angles that suit the question's domain. Examples:\n" +
+  "- broad/primary  · academic/technical  · recent news  · contrarian/skeptical  · practitioner/implementation\n" +
+  "- For medical: anatomy · common causes · serious differentials · authoritative refs · red flags\n" +
+  "- For tech: state-of-art · benchmarks · limitations · industry adoption · cost/tradeoffs\n\n" +
+  "Make queries specific enough to surface high-signal results. Avoid redundancy.\n" +
+  "Return: the question (verbatim or lightly normalized), a 1-2 sentence decomposition strategy, and the angles.\n\nStructured output only.",
+  { label: "scope", schema: SCOPE_SCHEMA }
+)
+if (!scope) {
+  return { error: "Scope agent returned no result — cannot decompose the research question." }
+}
+log("Q: " + QUESTION.slice(0, 80) + (QUESTION.length > 80 ? "…" : ""))
+log("Decomposed into " + scope.angles.length + " angles: " + scope.angles.map(a => a.label).join(", "))
+
+// ─── Dedup state — accumulates across searchers as they complete ───
+const normURL = u => {
+  try {
+    const p = new URL(u)
+    return (p.hostname.replace(/^www\./, "") + p.pathname.replace(/\/$/, "")).toLowerCase()
+  } catch { return u.toLowerCase() }
+}
+const seen = new Map()
+const dupes = []
+const budgetDropped = []
+const relRank = { high: 0, medium: 1, low: 2 }
+let fetchSlots = MAX_FETCH
+
+// ─── Prompts ───
+const SEARCH_PROMPT = (angle) =>
+  "## Web Searcher: " + angle.label + "\n\n" +
+  "Research question: \"" + QUESTION + "\"\n\n" +
+  "Your angle: **" + angle.label + "** — " + (angle.rationale || "") + "\n" +
+  "Search query: `" + angle.query + "`\n\n" +
+  "## Task\nUse WebSearch with the query above (or a refined version). Return the top 4-6 most relevant results.\n" +
+  "Rank by relevance to the ORIGINAL question, not just the search query. Skip obvious SEO spam/content farms.\n" +
+  "Include a short snippet capturing why each result is relevant.\n\nStructured output only."
+
+const FETCH_PROMPT = (source, angle) =>
+  "## Source Extractor\n\n" +
+  "Research question: \"" + QUESTION + "\"\n\n" +
+  "Fetch and extract key claims from this source:\n" +
+  "**URL:** " + source.url + "\n**Title:** " + source.title + "\n**Found via:** " + angle + " search\n\n" +
+  "## Task\n1. Use WebFetch to retrieve the page content.\n" +
+  "2. Assess source quality: primary research/institution? secondary reporting? blog/opinion? forum? unreliable?\n" +
+  "3. Extract 2-5 FALSIFIABLE claims that bear on the research question. Each claim must:\n" +
+  "   - be a concrete, checkable statement (not vague generalities)\n" +
+  "   - include a direct quote from the source as support\n" +
+  "   - be rated central/supporting/tangential to the research question\n" +
+  "4. Note publish date if available.\n\n" +
+  "If the fetch fails or the page is irrelevant/paywalled, return claims: [] and sourceQuality: \"unreliable\".\n\nStructured output only."
+
+const VERIFY_PROMPT = (claim, v) =>
+  "## Adversarial Claim Verifier (voter " + (v + 1) + "/" + VOTES_PER_CLAIM + ")\n\n" +
+  "Be SKEPTICAL. Try to REFUTE this claim. ≥" + REFUTATIONS_REQUIRED + "/" + VOTES_PER_CLAIM + " refutations kill it.\n\n" +
+  "## Research question\n" + QUESTION + "\n\n" +
+  "## Claim under review\n\"" + claim.claim + "\"\n\n" +
+  "**Source:** " + claim.sourceUrl + " (" + claim.sourceQuality + ")\n" +
+  "**Supporting quote:** \"" + claim.quote + "\"\n\n" +
+  "## Checklist\n" +
+  "1. Is the claim actually supported by the quote, or is it an overreach/misread?\n" +
+  "2. WebSearch for contradicting evidence — does any credible source dispute or heavily qualify this?\n" +
+  "3. Is the source quality sufficient for the claim's strength? (extraordinary claims need primary sources)\n" +
+  "4. Is the claim outdated? (check dates — old claims about fast-moving fields are suspect)\n" +
+  "5. Is this a marketing claim / press release / cherry-picked benchmark / forum speculation?\n\n" +
+  "**refuted=true** if: unsupported by quote / contradicted / low-quality source for strong claim / outdated / marketing fluff.\n" +
+  "**refuted=false** ONLY if: claim is well-supported, current, and source quality matches claim strength.\n" +
+  "Default to refuted=true if uncertain.\n\nStructured output only. Evidence MUST be specific."
+
+// ─── Pipeline: search → dedup → fetch+extract (no barrier) ───
+const searchResults = await pipeline(
+  scope.angles,
+
+  angle => agent(SEARCH_PROMPT(angle), {
+    label: "search:" + angle.label, phase: "Search", schema: SEARCH_SCHEMA
+  }).then(r => {
+    if (!r) return null
+    log(angle.label + ": " + r.results.length + " results")
+    return { angle: angle.label, results: r.results }
+  }),
+
+  searchResult => {
+    const sorted = [...searchResult.results].sort((a, b) => relRank[a.relevance] - relRank[b.relevance])
+    const novel = sorted.filter(r => {
+      const key = normURL(r.url)
+      if (seen.has(key)) {
+        dupes.push({ ...r, angle: searchResult.angle, dupOf: seen.get(key) })
+        return false
+      }
+      if (fetchSlots <= 0) {
+        budgetDropped.push({ ...r, angle: searchResult.angle })
+        return false
+      }
+      seen.set(key, { angle: searchResult.angle, title: r.title })
+      fetchSlots--
+      return true
+    })
+    if (novel.length < searchResult.results.length) {
+      log(searchResult.angle + ": " + novel.length + " novel (" + (searchResult.results.length - novel.length) + " filtered)")
+    }
+    return parallel(
+      novel.map(source => () => {
+        let host = "unknown"
+        try { host = new URL(source.url).hostname.replace(/^www\./, "") } catch {}
+        return agent(FETCH_PROMPT(source, searchResult.angle), {
+          label: "fetch:" + host,
+          phase: "Fetch",
+          schema: EXTRACT_SCHEMA,
+        }).then(ext => {
+          // User-skip → null; drop it (filtered by searchResults.flat().filter(Boolean))
+          // rather than throwing into .catch() and mislabeling it "unreliable".
+          if (!ext) return null
+          return {
+            url: source.url, title: source.title, angle: searchResult.angle,
+            sourceQuality: ext.sourceQuality, publishDate: ext.publishDate,
+            claims: ext.claims.map(c => ({ ...c, sourceUrl: source.url, sourceQuality: ext.sourceQuality })),
+          }
+        }).catch(e => {
+          log("fetch failed: " + source.url + " — " + (e.message || e))
+          return { url: source.url, title: source.title, angle: searchResult.angle, sourceQuality: "unreliable", claims: [] }
+        })
+      })
+    )
+  }
+)
+
+const allSources = searchResults.flat().filter(Boolean)
+const allClaims = allSources.flatMap(s => s.claims)
+const impRank = { central: 0, supporting: 1, tangential: 2 }
+const qualRank = { primary: 0, secondary: 1, blog: 2, forum: 3, unreliable: 4 }
+
+const rankedClaims = [...allClaims]
+  .sort((a, b) => (impRank[a.importance] - impRank[b.importance]) || (qualRank[a.sourceQuality] - qualRank[b.sourceQuality]))
+  .slice(0, MAX_VERIFY_CLAIMS)
+
+log("Fetched " + allSources.length + " sources → " + allClaims.length + " claims → verifying top " + rankedClaims.length)
+
+if (rankedClaims.length === 0) {
+  return {
+    question: QUESTION,
+    summary: "No claims extracted. " + allSources.length + " sources fetched, all empty/failed. " + dupes.length + " URL dupes, " + budgetDropped.length + " budget-dropped.",
+    findings: [], refuted: [], sources: allSources.map(s => ({ url: s.url, quality: s.sourceQuality })),
+    stats: { angles: scope.angles.length, sources: allSources.length, claims: 0, dupes: dupes.length },
+  }
+}
+
+// ─── Verify: 3-vote adversarial ───
+// Barrier here is intentional — claim pool must be fully assembled before ranking/verification.
+phase("Verify")
+const voted = (await parallel(
+  rankedClaims.map(claim => () =>
+    parallel(
+      Array.from({ length: VOTES_PER_CLAIM }, (_, v) => () =>
+        agent(VERIFY_PROMPT(claim, v), {
+          label: "v" + v + ":" + claim.claim.slice(0, 40),
+          phase: "Verify",
+          schema: VERDICT_SCHEMA,
+        })
+      )
+    ).then(verdicts => {
+      // A vote can be null (user-skip or agent error) — treat as abstain.
+      const valid = verdicts.filter(Boolean)
+      const refuted = valid.filter(v => v.refuted).length
+      // Survive only if the claim was actually adjudicated: a quorum of
+      // valid votes AND fewer than REFUTATIONS_REQUIRED refuting. Too many
+      // abstentions = unverified, which must NOT pass into the report
+      // (otherwise all-abstain → refuted=0 → false survive).
+      const abstained = VOTES_PER_CLAIM - valid.length
+      const survives = valid.length >= REFUTATIONS_REQUIRED && refuted < REFUTATIONS_REQUIRED
+      log("\"" + claim.claim.slice(0, 50) + "…\": " + (valid.length - refuted) + "-" + refuted + (abstained > 0 ? " (" + abstained + " abstain)" : "") + " " + (survives ? "✓" : "✗"))
+      return { ...claim, verdicts: valid, refutedVotes: refuted, survives }
+    })
+  )
+)).filter(Boolean)
+
+const confirmed = voted.filter(c => c.survives)
+const killed = voted.filter(c => !c.survives)
+log("Verify done: " + voted.length + " claims → " + confirmed.length + " confirmed, " + killed.length + " killed")
+
+if (confirmed.length === 0) {
+  return {
+    question: QUESTION,
+    summary: "All " + voted.length + " claims refuted by adversarial verification. Research inconclusive — sources may be low-quality or claims overstated.",
+    findings: [],
+    refuted: killed.map(c => ({ claim: c.claim, vote: (c.verdicts.length - c.refutedVotes) + "-" + c.refutedVotes, source: c.sourceUrl })),
+    sources: allSources.map(s => ({ url: s.url, quality: s.sourceQuality, claimCount: s.claims.length })),
+    stats: { angles: scope.angles.length, sources: allSources.length, claims: allClaims.length, verified: voted.length, confirmed: 0, killed: killed.length },
+  }
+}
+
+// ─── Synthesize ───
+phase("Synthesize")
+const confRank = { high: 0, medium: 1, low: 2 }
+const block = confirmed.map((c, i) => {
+  const best = c.verdicts.filter(v => !v.refuted).sort((a, b) => confRank[a.confidence] - confRank[b.confidence])[0]
+  return "### [" + i + "] " + c.claim + "\n" +
+    "Vote: " + (c.verdicts.length - c.refutedVotes) + "-" + c.refutedVotes + " · Source: " + c.sourceUrl + " (" + c.sourceQuality + ")\n" +
+    "Quote: \"" + c.quote + "\"\nVerifier evidence (" + best.confidence + "): " + best.evidence + "\n"
+}).join("\n")
+
+const killedBlock = killed.length > 0
+  ? "\n## Refuted claims (for transparency)\n" +
+    killed.map(c => "- \"" + c.claim + "\" (" + c.sourceUrl + ", vote " + (c.verdicts.length - c.refutedVotes) + "-" + c.refutedVotes + ")").join("\n")
+  : ""
+
+const report = await agent(
+  "## Synthesis: research report\n\n" +
+  "**Question:** " + QUESTION + "\n\n" +
+  confirmed.length + " claims survived " + VOTES_PER_CLAIM + "-vote adversarial verification. Merge semantic duplicates and synthesize.\n\n" +
+  "## Confirmed claims\n" + block + "\n" + killedBlock + "\n\n" +
+  "## Instructions\n" +
+  "1. Identify claims that say the same thing — merge them, combine their sources.\n" +
+  "2. Group related claims into coherent findings. Each finding should directly address the research question.\n" +
+  "3. Assign confidence per finding: high (multiple primary sources, unanimous votes), medium (secondary sources or split votes), low (single source or blog-quality).\n" +
+  "4. Write a 3-5 sentence executive summary answering the research question.\n" +
+  "5. Note caveats: what's uncertain, what sources were weak, what time-sensitivity applies.\n" +
+  "6. List 2-4 open questions that emerged but weren't answered.\n\nStructured output only.",
+  { label: "synthesize", schema: REPORT_SCHEMA }
+)
+
+if (!report) {
+  // Synthesis skipped/errored — salvage the verified claims raw rather
+  // than throwing on report.findings and discarding the whole run.
+  return {
+    question: QUESTION,
+    summary: "Synthesis step was skipped or failed — returning " + confirmed.length + " verified claims unmerged.",
+    findings: [],
+    confirmed: confirmed.map(c => ({ claim: c.claim, source: c.sourceUrl, quote: c.quote, vote: (c.verdicts.length - c.refutedVotes) + "-" + c.refutedVotes })),
+    refuted: killed.map(c => ({ claim: c.claim, vote: (c.verdicts.length - c.refutedVotes) + "-" + c.refutedVotes, source: c.sourceUrl })),
+    sources: allSources.map(s => ({ url: s.url, quality: s.sourceQuality, claimCount: s.claims.length })),
+    stats: { angles: scope.angles.length, sources: allSources.length, claims: allClaims.length, verified: voted.length, confirmed: confirmed.length, killed: killed.length, afterSynthesis: 0 },
+  }
+}
+
+return {
+  question: QUESTION,
+  ...report,
+  refuted: killed.map(c => ({ claim: c.claim, vote: (c.verdicts.length - c.refutedVotes) + "-" + c.refutedVotes, source: c.sourceUrl })),
+  sources: allSources.map(s => ({ url: s.url, quality: s.sourceQuality, angle: s.angle, claimCount: s.claims.length })),
+  stats: {
+    angles: scope.angles.length,
+    sourcesFetched: allSources.length,
+    claimsExtracted: allClaims.length,
+    claimsVerified: voted.length,
+    confirmed: confirmed.length,
+    killed: killed.length,
+    afterSynthesis: report.findings.length,
+    urlDupes: dupes.length,
+    budgetDropped: budgetDropped.length,
+    agentCalls: 1 + scope.angles.length + allSources.length + (voted.length * VOTES_PER_CLAIM) + 1,
+  },
+}

package/bundled-skills/pilot-protocol/SKILL.md

@@ -0,0 +1,145 @@
+---
+name: pilot-protocol
+description: "Give an AI agent a permanent network address, encrypted P2P messaging, and an installable app store via Pilot Protocol"
+category: ai-agents
+risk: critical
+source: community
+source_repo: pilot-protocol/pilotprotocol
+source_type: official
+date_added: "2026-07-07"
+author: pilot-protocol
+tags: [agent-networking, p2p, nat-traversal, overlay-network, agent-apps]
+tools: [claude, cursor, gemini, codex]
+license: "AGPL-3.0"
+license_source: "https://github.com/pilot-protocol/pilotprotocol/blob/main/LICENSE"
+---
+
+# Pilot Protocol
+
+## Overview
+
+Pilot Protocol is an open-source overlay network that gives AI agents first-class
+network citizenship: a permanent virtual address, encrypted UDP tunnels, NAT
+traversal, and an explicit per-peer trust model. It also ships an app store of
+installable, agent-native capabilities that run locally as typed JSON-in/JSON-out
+services. Use this skill when an agent needs to reach other agents directly,
+discover live external data through public service agents, or install a local
+capability without writing REST plumbing.
+
+If this skill adapts material from an external GitHub repository, it declares:
+
+- `source_repo: pilot-protocol/pilotprotocol`
+- `source_type: official`
+
+## When to Use This Skill
+
+- Use when an agent needs a stable address that survives restarts, IP changes,
+  or moving across clouds (no more re-registering webhooks).
+- Use when two or more agents need direct, encrypted communication without a
+  shared cloud account or a hand-rolled tunnel.
+- Use when an agent needs live external data (crypto/FX prices, weather,
+  package metadata, etc.) via structured JSON instead of scraping HTML.
+- Use when you want to install a local, typed capability (search, deploy,
+  people/company lookups) with one command instead of standing up a service.
+
+## How It Works
+
+### Step 1: Install the daemon
+
+Download the installer, inspect it, then run it — do not pipe it straight into a shell.
+
+```bash
+curl -fsSL https://pilotprotocol.network/install.sh -o /tmp/pilot-install.sh
+less /tmp/pilot-install.sh   # review before executing
+sh /tmp/pilot-install.sh
+```
+
+### Step 2: Start the node and confirm it registered
+
+```bash
+pilotctl daemon start
+pilotctl info
+```
+
+### Step 3: Query a service agent (no handshake needed)
+
+Service agents in the public directory auto-approve incoming messages.
+
+```bash
+pilotctl send-message list-agents --data '/data {"search":"weather"}' --wait
+jq -r '.data' "$(ls -1t ~/.pilot/inbox/*.json | head -1)"
+```
+
+### Step 4: Handshake a peer agent for direct messaging
+
+Peer nodes (as opposed to service agents) require mutual approval before a
+tunnel works.
+
+```bash
+pilotctl handshake <hostname|node_id|address> "<reason>"
+pilotctl trust
+pilotctl send-message <peer> --data '<message>'
+```
+
+### Step 5: Install and call an agent app
+
+```bash
+pilotctl appstore catalogue
+pilotctl appstore install <app-id>
+pilotctl appstore call <app-id> <app>.help '{}'
+```
+
+## Examples
+
+### Example 1: Ask a live-data service agent
+
+```bash
+pilotctl send-message list-agents --data '/data {"search":"bitcoin"}' --wait
+jq -r '.data' "$(ls -1t ~/.pilot/inbox/*.json | head -1)"
+```
+
+### Example 2: Install and call a local capability app
+
+```bash
+pilotctl appstore install io.pilot.cosift
+pilotctl appstore call io.pilot.cosift cosift.answer '{"q":"What is HNSW?"}'
+```
+
+## Best Practices
+
+- ✅ Use `--wait` on `send-message` so the reply is guaranteed to be in the
+  inbox before you read it.
+- ✅ Query `list-agents` before guessing a hostname — the catalogue changes.
+- ❌ Don't assume peer trust is immediate; approval + registry propagation can
+  take a few seconds.
+- ❌ Don't set `--auto-answer` on your own node — it's a service-agent-only flag.
+
+## Limitations
+
+- This skill does not replace reading `pilotctl --help` or the project docs
+  for less common commands.
+- Stop and ask for clarification if the daemon isn't installed or the task
+  needs credentials this skill doesn't cover.
+
+## Security & Safety Notes
+
+- The install script fetches an installer from `pilotprotocol.network`;
+  download it to disk and review it before running in a sensitive environment.
+- `~/.pilot/identity.json` is a private keypair — never copy it between hosts.
+- Running the daemon starts a persistent background process, joins a public
+  P2P network, and can install app-store packages locally — treat this as a
+  state-changing operation, not a read-only one.
+
+## Common Pitfalls
+
+- **Problem:** A `send-message` to a peer silently fails right after a handshake.
+  **Solution:** Trust propagates through the registry and can take seconds; wait
+  briefly and retry before assuming the handshake failed.
+- **Problem:** Large replies arrive truncated in the inbox JSON.
+  **Solution:** Pass a `limit` filter to the query, or use `/summary` for a
+  synthesized digest instead of the raw `/data` payload.
+
+## Related Skills
+
+- `@network-101` - General networking background before diving into overlay
+  networks specifically.

package/bundled-skills/pre-ship-gate/SKILL.md

@@ -0,0 +1,129 @@
+---
+name: pre-ship-gate
+description: "A ship gate that runs before any production deploy: checks the silent failure modes that make a deploy 'succeed' while prod stays broken, then verifies the live revision instead of trusting deploy output."
+category: quality
+risk: safe
+source: community
+source_repo: Sharrmavishal/operating-kit
+source_type: community
+date_added: "2026-07-07"
+author: Sharrmavishal
+tags: [deployment, quality-gate, verification, ci-cd, production]
+tools: [claude, cursor, gemini]
+license: MIT
+license_source: "https://github.com/Sharrmavishal/operating-kit/blob/main/LICENSE"
+---
+
+# Pre-Ship Gate
+
+## Overview
+
+Most bad deploys do not fail loudly. The pipeline goes green, the CLI prints "deployed", and the old or broken version is still what users hit. This skill is the gate you run right before a production deploy and right after, so an agent stops trusting deploy output and starts confirming what is actually live. It exists because "the deploy command exited 0" and "the new version is serving traffic" are two different facts, and agents routinely confuse them.
+
+## When to Use This Skill
+
+- Use before running any command that pushes to a production or staging environment.
+- Use when an agent is about to report "shipped", "deployed", or "live".
+- Use when a deploy reported success but users still see the old behavior.
+- Use when a release involves database migrations, feature flags, or a staged rollout.
+
+## How It Works
+
+The gate has three phases. Do not skip to phase 3.
+
+### Phase 1: Pre-flight (before the deploy runs)
+
+Walk the silent failure catalog. These are the modes that let a deploy "succeed" while production stays broken. For each one, confirm it or flag it. Do not assume.
+
+- **Migrations**: Are schema migrations part of this release, and will they run against the target before the new code serves traffic? A deploy that ships code expecting a column that does not exist yet fails silently for users, not for the pipeline.
+- **Feature flags**: Is the flag that gates this change actually enabled in the target environment, not just in dev? Shipped code behind an off flag looks like a no-op deploy.
+- **Build cache / stale assets**: Could a cached build or CDN layer serve the previous bundle after deploy? Confirm the artifact hash or asset fingerprint changed.
+- **Release pointer**: Does the deploy update the symlink, active revision, or traffic pointer, or does it only upload the new build? Uploading is not releasing.
+- **Staged rollout / canary**: If traffic is staged, is it stuck at 0 percent or waiting on a manual promote? A canary that never promotes is not a deploy.
+- **Env and secrets**: Are the env vars and secrets the new code needs present in the target, not just locally? Missing config surfaces as runtime errors, not deploy errors.
+
+### Phase 2: Run the deploy
+
+The human or the deploy tooling runs the actual command. This skill does not execute the production deploy itself. It gates it.
+
+### Phase 3: Verify live (before saying "shipped")
+
+Confirm the running system, not the deploy log.
+
+- Fetch the live version or revision identifier from the running service and compare it to the one you intended to ship.
+- Hit a health or status endpoint and confirm it returns the expected version, not just HTTP 200.
+- Tail production logs for the first errors after cutover.
+- Only after the live revision matches the intended revision may you report "shipped". If it does not match, report the mismatch, not success.
+
+## Examples
+
+### Example 1: Verifying the live revision instead of trusting the deploy log
+
+```bash
+# You intended to ship this commit
+INTENDED="$(git rev-parse --short HEAD)"
+
+# Ask the running service what it is actually serving
+LIVE="$(curl -fsS https://your-service.example.com/health | jq -r '.revision')"
+
+if [ "$INTENDED" = "$LIVE" ]; then
+  echo "Live revision $LIVE matches intended $INTENDED: verified shipped."
+else
+  echo "MISMATCH: intended $INTENDED but live is $LIVE. Do not report shipped."
+fi
+```
+
+### Example 2: Pre-flight verdict format an agent can emit
+
+```markdown
+PRE-SHIP GATE, verdict: HOLD
+
+- Migrations: 1 pending (add_users_status_col): NOT yet applied to prod. BLOCK.
+- Feature flags: new_checkout flag is OFF in prod. Enabling required post-deploy.
+- Build assets: new bundle hash confirmed (a1b2c3 != previous 9f8e7d). OK.
+- Release pointer: deploy updates active symlink. OK.
+- Rollout: canary at 10%, manual promote required. NOTE.
+- Env/secrets: STRIPE_KEY present in prod. OK.
+
+Reason for HOLD: run migration add_users_status_col before cutover, or the
+new code will 500 on /orders.
+```
+
+## Best Practices
+
+- ✅ Treat "the command exited 0" and "the new version is live" as separate facts, and verify the second one.
+- ✅ Emit an explicit verdict (SHIP / HOLD) with the failing item named, not a vague "looks good".
+- ✅ Compare a live revision identifier against the intended one after every deploy.
+- ✅ Name the specific silent failure mode you are worried about, so a human can override with context.
+- ❌ Do not report "shipped" from deploy output alone.
+- ❌ Do not skip the pre-flight because the pipeline is green.
+- ❌ Do not treat a passing health check as proof the right version is live. Check the version field.
+
+## Limitations
+
+- This skill does not run the production deploy for you. It gates and verifies around it.
+- It cannot know your environment's exact health or version endpoint. Wire in the real one before relying on the verification phase.
+- The silent failure catalog is common cases, not exhaustive. Systems with unusual release mechanics need their own additions.
+- It does not replace environment-specific testing, load testing, or expert review.
+- Stop and ask for clarification if the target environment, the intended revision, or the verification endpoint is unknown.
+
+## Common Pitfalls
+
+- **Problem:** Health check returns 200 but users still see the old version.
+  **Solution:** The check is hitting a cached edge or the old pod. Verify the revision field in the response, not just the status code.
+- **Problem:** Migration runs after the new code is already serving traffic.
+  **Solution:** Sequence migrations before cutover, or gate the code path behind a flag until the migration lands.
+- **Problem:** Deploy "succeeds" but the canary is stuck at 0 percent.
+  **Solution:** Confirm the traffic pointer or promotion step, not just the upload step.
+
+## Security & Safety Notes
+
+- This skill is defensive and read-oriented. Its own commands are verification calls (fetching a version endpoint, tailing logs, comparing revisions). It does not itself mutate production.
+- The example commands use `curl -fsS` against a status endpoint and are illustrative. Replace the placeholder host and version field with your own before use.
+- The actual production deploy is performed by your existing tooling and is out of this skill's scope. Keep human confirmation on the deploy step.
+- No credentials or tokens are embedded. Do not paste secrets into health-check URLs.
+
+## Related Skills
+
+- `@codebase-audit-pre-push`: clean and audit the code before it ever reaches a deploy.
+- `@dos-verify-done-claims`: verify a "done" claim against git ground truth after the fact.