skep 1.0.1__tar.gz

skep-1.0.1/.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,28 @@
+---
+name: Bug report
+about: Something skep did wrong — a crash, a wrong verdict, a stuck run
+labels: bug
+---
+
+**What happened**
+
+**What you expected**
+
+**Environment**
+
+- `skep --version`:
+- OS and sandbox backend (paste the `skep doctor` output):
+
+```
+(skep doctor output here)
+```
+
+**Reproduction**
+
+Steps, or the failing command. If a run is involved, the run id and the
+relevant lines from the run view help a lot.
+
+**Safety note**
+
+If this looks exploitable (sandbox escape, approval bypass, allowlist
+bypass), do NOT file it here — see [SECURITY.md](../../SECURITY.md).

skep-1.0.1/.github/ISSUE_TEMPLATE/question.md

@@ -0,0 +1,21 @@
+---
+name: Question / configuration help
+about: How do I…? Why does my setup…?
+labels: question
+---
+
+**What are you trying to do**
+
+**What you tried**
+
+**Environment**
+
+- `skep --version`:
+- `skep doctor` output (redact anything private):
+
+```
+(skep doctor output here)
+```
+
+Check the [docs index](../../docs/README.md) first — quickstart,
+configuration, and the approvals guide answer the most common questions.

skep-1.0.1/.github/workflows/ci.yml

@@ -0,0 +1,79 @@
+name: CI
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  checks:
+    name: checks (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          python-version: "3.12"
+      - name: Install Linux sandbox backend
+        if: runner.os == 'Linux'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y bubblewrap ripgrep
+      - name: Install ripgrep (macOS)
+        if: runner.os == 'macOS'
+        run: brew install ripgrep
+      - name: Sync
+        run: uv sync --frozen
+      - name: Lint
+        run: |
+          uv run ruff check .
+          uv run ruff format --check src/skep tests scripts
+      - name: Types
+        run: uv run mypy
+      - name: Unit tests
+        # TMPDIR outside /tmp is mandatory wherever bubblewrap runs: bwrap
+        # tmpfs-masks /tmp, which eats sandbox evidence files and wedges
+        # dispatched test runs into worker_timeout (same rule as CLAUDE.md's
+        # local gates).
+        run: |
+          mkdir -p "$HOME/.cache/skep-test-tmp"
+          TMPDIR="$HOME/.cache/skep-test-tmp" uv run pytest -m "not smoke and not container"
+      - name: First-party smoke
+        run: make smoke
+      - name: Linux sandbox smoke
+        if: runner.os == 'Linux'
+        run: UV_CACHE_DIR=.uv-cache scripts/linux-sandbox-smoke.sh
+      - name: Release hygiene scan
+        if: runner.os == 'Linux'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh release download --repo gitleaks/gitleaks \
+            --pattern 'gitleaks_*_linux_x64.tar.gz' --output - | tar -xz gitleaks
+          sudo mv gitleaks /usr/local/bin/gitleaks
+          ./scripts/release-hygiene-scan.sh
+
+  image:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v4
+      - name: Build and boot-check image
+        run: |
+          SKEP_DOCKER_IMAGE=ghcr.io/anmolnoor/skep:ci \
+          SKEP_DOCKER_CONTAINER=skep-ci \
+          SKEP_DOCKER_PORT=8765 \
+          scripts/docker-image-smoke.sh
+      - name: Push on tag
+        if: startsWith(github.ref, 'refs/tags/v')
+        run: |
+          echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
+          docker tag ghcr.io/anmolnoor/skep:ci "ghcr.io/anmolnoor/skep:${{ github.ref_name }}"
+          docker tag ghcr.io/anmolnoor/skep:ci ghcr.io/anmolnoor/skep:latest
+          docker push "ghcr.io/anmolnoor/skep:${{ github.ref_name }}"
+          docker push ghcr.io/anmolnoor/skep:latest

skep-1.0.1/.github/workflows/release.yml

@@ -0,0 +1,95 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*"
+  # Manual trigger runs the TestPyPI rehearsal lane only (see the
+  # testpypi-rehearsal job); it can never publish to real PyPI or cut a
+  # GitHub release.
+  workflow_dispatch:
+
+jobs:
+  release-gate:
+    name: Release gate
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          python-version: "3.12"
+      - name: Install Linux sandbox backend
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y bubblewrap ripgrep
+      - name: Sync
+        run: uv sync --frozen
+      - name: Install gitleaks
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh release download --repo gitleaks/gitleaks \
+            --pattern 'gitleaks_*_linux_x64.tar.gz' --output - | tar -xz gitleaks
+          sudo mv gitleaks /usr/local/bin/gitleaks
+      - name: Gate
+        # TMPDIR outside /tmp, same rule as ci.yml's unit tests and
+        # CLAUDE.md's local gates: bwrap tmpfs-masks /tmp.
+        run: |
+          mkdir -p "$HOME/.cache/skep-test-tmp"
+          TMPDIR="$HOME/.cache/skep-test-tmp" UV_CACHE_DIR=.uv-cache scripts/local-release-gates.sh
+
+  package:
+    needs: release-gate
+    # Tags only — a manual dispatch must never reach the GitHub-release step.
+    if: startsWith(github.ref, 'refs/tags/')
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          python-version: "3.12"
+      - name: Build distribution
+        run: uv build
+      - name: Check distribution metadata
+        run: uvx twine check dist/*
+      - name: Install built wheel smoke
+        run: UV_CACHE_DIR=.uv-cache scripts/package-install-smoke.sh
+      # Publishes via the PyPI trusted publisher (Anmolnoor/skep +
+      # release.yml, configured at LAUNCH-1-L7); id-token: write above is the
+      # OIDC half of that handshake.
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+      - name: Create GitHub release
+        uses: softprops/action-gh-release@v2
+        with:
+          files: |
+            dist/skep-*.tar.gz
+            dist/skep-*-py3-none-any.whl
+          generate_release_notes: true
+
+  # v37-F1: the publish rehearsal. Manual-only; exercises the exact trusted-
+  # publisher OIDC path against test.pypi.org with zero public commitment.
+  # Requires a TestPyPI trusted publisher (repository Anmolnoor/skep,
+  # workflow release.yml) — see docs/releases/README.md "Go/no-go".
+  testpypi-rehearsal:
+    needs: release-gate
+    if: github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          python-version: "3.12"
+      - name: Build distribution
+        run: uv build
+      - name: Check distribution metadata
+        run: uvx twine check dist/*
+      - name: Publish to TestPyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          repository-url: https://test.pypi.org/legacy/

skep-1.0.1/.gitignore

@@ -0,0 +1,17 @@
+__pycache__/
+*.py[cod]
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.uv-cache/
+.venv/
+.claude/
+output/
+reports/
+dist/
+build/
+*.egg-info/
+.skep-dev/
+.skep-dev.reset-*/
+.skep-linux-sandbox.*/
+.DS_Store

skep-1.0.1/CLAUDE.md

@@ -0,0 +1,115 @@
+# skep — assistant context
+
+Local-first autonomous coding supervisor. A Queen (chat daemon) dispatches
+disposable, contract-governed workers into isolated git worktrees; every side
+effect goes through the policy/capability engine; completed work lands as a
+**patch via a human approval** — landing IS the commit.
+
+## Non-negotiable safety posture
+
+Patch-as-approval, supervisor-side re-verification (G10), the Queen/worker
+split, the trust engine, no shadow permission systems. Workers can NEVER push,
+pull, fetch, or switch branches (guards: v19-F3/F5) — no allowlist, grant, or
+verify label overrides those denies, and the same list binds the Queen
+(v83-F9). `git add`/`git commit` are denied through `shell.run` (v22-F2) but
+grantable via the explicit `git.stage`/`git.commit` capability path — safe
+because the worktree is disposable and the patch diffs against the startup
+baseline, not because it is absolute (see I4). G10 re-verifies with the
+project's pinned `verify_command`, not the worker's own nomination (v88-F4) —
+re-running the worker's choice of command is still trusting it. Since v91-F1
+project setup infers that pin from the repo's own entry point, so it is the
+default; a repo with no detectable entry point is pinned to nothing on
+purpose and keeps the worker-nominated fallback.
+
+## Gates (run after every fix commit, all green before moving on)
+
+```sh
+TMPDIR=$HOME/.cache/skep-test-tmp uv run pytest   # TMPDIR outside /tmp is
+uv run ruff check .                               # MANDATORY on Linux: bwrap
+uv run ruff format --check src/skep tests scripts # tmpfs-masks /tmp
+uv run mypy
+TMPDIR=$HOME/.cache/skep-test-tmp uv run python scripts/scorecard.py  # Overall: PASS
+```
+
+(`ruff format --check` joined the list at LAUNCH-1: CI always ran it, the
+local ritual never did, and 174 files drifted before the public repo's first
+CI run caught it.)
+
+The suite is fully green — NO pre-existing failures are allowed. (History: the
+stale-links failure was fixed in v27-F1; the Linux per-domain egress skip —
+v14-7 — was closed in v28, so `test_default_coding_worker_uses_saved_
+assistant_llm_config` now passes on Linux. Any failure is yours.)
+
+## How this project evolves
+
+Every new plan and ADR starts from `docs/invariants.md` — the traits that
+must never be traded away (Part I + review checklist) and the refinement
+backlog (Part II). Cite the invariant numbers a change touches.
+
+**A new mutating verb needs an operator face** (ADR 0050, v104): reachable
+from the chat tool surface AND from the CLI or REST. Four rounds fixed this
+one key at a time (v94-F5, v100-F9, v101-F13, v104) before it became a rule —
+I5 says one authorization boundary, not that the operator gets the narrow half
+of it. `tests/supervisor/test_surface_parity.py` enforces it; genuine
+exceptions go in its `CHAT_ONLY` map with a reason.
+
+Field test → reconstruct findings from the store/audit trail → write an
+executor-style plan in `plans/vNN/README.md` (observed failure, root cause
+with file:line anchors, change, tests, acceptance) → implement fix-by-fix,
+one commit per fix (`vNN-F<N>: title`) → push to main. History:
+
+- v1–v17: the roadmap (v12–v17 implemented in one unattended run; the
+  authoritative record is `plans/EXECUTION_LEDGER.md`).
+- v19–v24: field-test friction fixes. Read `plans/v19/README.md` for the
+  house-rules briefing every later plan inherits, and skim v20→v24 for the
+  landing/policy arc. v18 (public release) is intentionally not done.
+- Resolved (v30, was the v24 deferral): maintain-phase auto-apply accumulates
+  on ONE integration branch `skep/maintain` (project policy `auto_apply_branch`,
+  constrained to the `skep/` namespace); other phases keep per-task
+  `skep/<task_id>`. `main` never advances automatically. The landing branch is
+  persisted on the approval (`approvals.landing_branch`) so `applied_branch`
+  is accurate for every landing path.
+
+## Operational notes
+
+- Operator state lives in `~/.skep` (sqlite store, serve token, registered
+  repos incl. the `skep-testing` test repo). NEVER mutate it in tests — use a
+  temp home. Server: `uv run skep serve` (port 8765, log `~/.skep/serve.log`).
+- `make` is not installed on the dev machine; call scripts via `uv run`.
+- Container builds use podman (docker CLI points at an absent Docker Desktop).
+- The chat Queen runs a small model (glm-5.2 via ollama.com); it skims tool
+  descriptions — treat tool descriptions as load-bearing code and keep them
+  truthful (a stale preset description once caused repeated "hallucinations").
+- The UI is a NO-BUILD static app (`src/skep/supervisor/serve/static/`) — no
+  bundler, no npm; plain ES modules + CSS tokens; fonts vendored.
+- Skills (v85): `skep skill shelf add <dir>` registers external Agent Skills
+  shelves (`~/.claude/skills` convention) — instruction packs load zero-grant;
+  script-shipping packs draft onto the v17 ladder (`skill_packs.py`, ADR 0045)
+  and activate only via `skep skill promote` / the `promote_skill_pack` card.
+- Coding engines (v90, ADR 0047; hardened v94): the `coding_engine`
+  project-policy key picks which agent runs a coding task — `builtin` (skep's
+  own worker, defers to `SKEP_WORKER_CMD`/`--worker-cmd`) or a CLI adapter
+  (`claude_code`, `codex`, `aider`); set it with `skep project setup --engine`
+  (v94-F5), from chat via `setup_project engine=`, or per-dispatch via
+  `dispatch_run engine=` — an explicit per-dispatch choice always cards
+  (v95-F3/F4). An external agent's own commands do NOT pass the capability layer —
+  the sandbox confines it — so it requires a project-pinned `verify_command`
+  (its built-in verify is `git diff --check`), is FORCED into sandbox execution
+  (v94-F4), and declares the env it needs in the engine registry (v94-F3:
+  claude_code needs USER/LOGNAME for keychain auth). `skep doctor` probes each
+  binary. Re-verify primes uv deps from the baseline before applying the patch
+  so the default `uv run pytest` pin confirms offline (v94-F7).
+- The command deck (v25): chat messages starting with `/` are parsed client-side
+  (`COMMANDS` in app.js) and mapped onto existing verbs — the model never sees
+  them. Mutations become `chat_actions` rows with `source='operator'`, resolved
+  on `/api/chats/{id}/commands/{action_id}/confirm|deny` under actor
+  `operator-command`. `/workon <path>` is the local-dir on-ramp (confirmed git
+  baseline, then project setup). Keep `COMMANDS`, the executor, and `/help` in
+  lockstep — a test pins the table against the parser branches.
+
+## Where to look first
+
+`plans/` (all plans + `EXECUTION_LEDGER.md`), `docs/version-history.md`,
+`src/skep/supervisor/policy_resolver.py` (run policy), `serve/actions.py`
+(shared verbs), `serve/tools.py` (chat tool surface), `workers/capabilities.py`
+(worker-side gates), `apply.py` (landing).

skep-1.0.1/CONTRIBUTING.md

@@ -0,0 +1,76 @@
+# Contributing
+
+Thanks for working on Skep. This project is a local supervisor for coding
+agents, so changes should preserve the core safety model: sandbox when requested,
+record durable evidence, re-verify claims, and land patches only through review.
+
+## Development Setup
+
+```sh
+git clone https://github.com/Anmolnoor/skep.git
+cd skep
+uv sync --frozen
+```
+
+Run the full default gate before opening a pull request:
+
+```sh
+make all
+```
+
+That runs lint, type checking, and the default test suite. The default suite is
+hermetic: no live model, no credentials, no network dependency, and no Docker.
+
+## Focused Checks
+
+Use the smallest relevant check while iterating:
+
+```sh
+make lint
+make type
+uv run pytest tests/supervisor/test_reverify.py
+uv run pytest tests/supervisor/test_sandbox_bubblewrap.py
+make smoke
+```
+
+Use opt-in checks only when the change touches that surface:
+
+```sh
+make container
+make image
+```
+
+`make container` needs Docker. `make image` builds the local container image.
+
+## Coding Standards
+
+- Keep changes surgical and tied to the issue or roadmap item.
+- Add or update tests for behavior changes.
+- Prefer existing supervisor, worker-contract, and serve APIs over new
+  abstractions.
+- Keep user-facing docs honest about what is physically enforced, what is policy,
+  and what is planned.
+- Do not add secrets, local state, screenshots, build output, or machine-specific
+  launcher files.
+
+## Security Model Expectations
+
+When changing worker execution, approval, sandboxing, or re-verification, include
+tests that prove the failure path:
+
+- sandbox unavailable means the worker does not silently start unsandboxed in
+  sandbox mode
+- unconfirmed re-verification blocks auto-approval
+- denied approvals stop or leave the run pending without granting the action
+- workers do not mutate the user's active checkout or default branch directly
+
+## Pull Request Notes
+
+In the PR description, include:
+
+- what changed
+- how it was verified
+- any safety boundary affected
+- any known limits or follow-up work
+
+Keep generated artifacts out of the diff unless they are the actual deliverable.

skep-1.0.1/Dockerfile

@@ -0,0 +1,41 @@
+# The box. Build from this skep checkout:
+#
+#   docker build -f Dockerfile -t ghcr.io/anmolnoor/skep .
+#
+# or `make image`.
+#
+# One runtime stage. A node stage does not exist at all (the UI is no-build
+# static files, RFC decision 1).
+
+FROM python:3.12-slim
+
+# git: worktrees + repo clones. bubblewrap: Linux sandbox. gh: the PR action (U1 land).
+# curl: gh's apt repo.
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends git bubblewrap curl ca-certificates \
+    && curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
+        -o /usr/share/keyrings/githubcli-archive-keyring.gpg \
+    && echo "deb [arch=$(dpkg --print-architecture) \
+        signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] \
+        https://cli.github.com/packages stable main" \
+        > /etc/apt/sources.list.d/github-cli.list \
+    && apt-get update \
+    && apt-get install -y --no-install-recommends gh \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv
+ENV UV_PYTHON_DOWNLOADS=never
+
+WORKDIR /opt/skep
+COPY . .
+
+RUN uv sync --frozen --no-dev
+
+# Everything skep writes lives under SKEP_HOME -> one disposable volume (D2).
+ENV PATH="/opt/skep/.venv/bin:${PATH}" \
+    SKEP_HOME=/data/skep
+
+VOLUME /data
+EXPOSE 8765
+
+ENTRYPOINT ["skep", "serve", "--host", "0.0.0.0", "--port", "8765"]

skep-1.0.1/Dockerfile.dockerignore

@@ -0,0 +1,19 @@
+# BuildKit per-Dockerfile ignore. The build context is this skep checkout.
+.git
+.venv
+# Dev state carries secrets (llm-secret, serve-token) — never bake it in.
+.skep-dev*
+.uv-cache
+__pycache__
+.pytest_cache
+.mypy_cache
+.ruff_cache
+.DS_Store
+dist
+build
+*.egg-info
+output
+node_modules
+plans
+plan
+.claude

skep-1.0.1/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Anmol Noor
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

skep-1.0.1/Makefile

@@ -0,0 +1,90 @@
+.PHONY: all lint format type unit smoke test u1 templates skills public-free whole-app-external container image image-smoke linux-sandbox-docker-smoke docs-link-smoke release-hygiene-scan local-release-gates serve scorecard
+
+all: lint type test
+
+lint:
+	uv run ruff check .
+	uv run ruff format --check src/skep tests scripts
+
+format:
+	uv run ruff check --fix .
+	uv run ruff format src/skep tests scripts
+
+type:
+	uv run mypy
+
+unit:
+	uv run pytest -m "not smoke and not container"
+
+# Default smoke: first-party skep paths only.
+smoke:
+	uv run pytest tests/smoke -m smoke
+
+# The v3 acceptance demo (U1): the nightly dependency/audit bot — scheduled,
+# audit caste, G10 re-verified, D3 auto-approval active. Deterministic, offline.
+u1:
+	uv run pytest tests/smoke/test_u1_acceptance.py -m smoke -v
+
+# The v3.5 acceptance demo: author a workflow template once, then both run it on
+# demand AND bind it to a schedule. Deterministic, offline (audit caste).
+templates:
+	uv run pytest tests/smoke/test_templates_acceptance.py -m smoke -v
+
+# The v4 acceptance demo: from observed successful runs, GENERATE a candidate skill,
+# TEST it (G10 gate), a human APPROVES it into the registry, then run AND schedule it
+# exactly like a v3.5 template — and prove a failed-test or denied candidate NEVER
+# enters the registry. Deterministic, offline (audit caste).
+skills:
+	uv run pytest tests/smoke/test_skills_acceptance.py -m smoke -v
+
+# The v11 public-free acceptance demo: preview/save the first-party pack,
+# confirm zero-cost assumptions, seed templates/schedules, and dispatch once.
+public-free:
+	uv run pytest tests/smoke/test_public_free_acceptance.py -m smoke -v
+
+# Opt-in whole-app proof against a real external provider — needs OLLAMA_API_KEY,
+# a running Docker daemon; never the gate.
+whole-app-external:
+	@test -n "$$OLLAMA_API_KEY" || (echo "OLLAMA_API_KEY is required" >&2; exit 2)
+	SKEP_WHOLE_APP_EXTERNAL=1 uv run pytest tests/external/test_whole_app_external.py -m external_app --override-ini "addopts=" -v
+
+# The v5 acceptance demo: the whole loop over the HTTP API — boot, token auth,
+# assign, SSE-stream the events, approve (patch lands on a branch), edit a
+# policy.
+serve:
+	uv run pytest \
+		tests/supervisor/test_serve.py \
+		tests/supervisor/test_serve_approvals.py \
+		tests/supervisor/test_serve_policy.py \
+		-q
+
+# The v12 autonomy scorecard: run the deterministic trust-loop suites and emit
+# output/scorecard/scorecard.{json,md}. Fails (non-zero) on any verdict drift.
+scorecard:
+	uv run python scripts/scorecard.py
+
+test:
+	uv run pytest
+
+# Opt-in container portability proof (Q1-B) — needs Docker, never the gate.
+container:
+	SKEP_CONTAINER=1 uv run pytest -m container --override-ini "addopts=" -v
+
+# The box: build the image from this skep checkout.
+image:
+	docker build -f Dockerfile -t ghcr.io/anmolnoor/skep:dev .
+
+image-smoke:
+	scripts/docker-image-smoke.sh
+
+linux-sandbox-docker-smoke:
+	scripts/linux-sandbox-docker-smoke.sh
+
+docs-link-smoke:
+	uv run python scripts/docs-link-smoke.py
+
+release-hygiene-scan:
+	scripts/release-hygiene-scan.sh
+
+local-release-gates:
+	scripts/local-release-gates.sh