Defame1297
92c13b997f
## Why agent-author produces paired agent definition files (Claude Code .md + Copilot .agent.md) but had no companion audit skill to validate them. agent-audit fills that gap, giving the same structured PASS/FAIL report that skill-audit provides for SKILL.md files. ## Implementation Notes - validate.sh uses scope detection (walk up for plugin.json / .git) to locate the counterpart file and determine whether plugin-silently-ignored fields (hooks, mcpServers, permissionMode) should be flagged - CC-only and silently-ignored field lists are read from references/field-inventory.md at runtime rather than hardcoded — provenance back to the research corpus; see ADR-0019 - Single-file invocation (pass either file, counterpart derived) chosen over directory or name+root — see ADR-0018 - 12 bats tests cover provider detection, scope detection, all FAIL paths, and clean-pair pass ## Impact - kyberforge bumped to v1.1.2 - agent-author close step should be updated to reference agent-audit (#11) - Provenance/sources chain check deferred to #60 ADR: docs/adr/0018-agent-audit-single-file-invocation.md ADR: docs/adr/0019-agent-audit-field-inventory-reference.md Refs: #11 Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0147vXtL5sP6vorDdqXGJJU9
31 lines
1.7 KiB
Markdown
31 lines
1.7 KiB
Markdown
# agent-audit reads field lists from a reference file, not hardcoded script arrays
|
|
|
|
`agent-audit`'s `validate.sh` checks for Claude Code-only fields in Copilot files and
|
|
silently-ignored fields in plugin agents. Rather than hardcoding those field lists in the
|
|
script, the script reads `references/field-inventory.md` at runtime. This keeps field list
|
|
maintenance decoupled from script logic and preserves a provenance chain back to the
|
|
research corpus that sourced the lists.
|
|
|
|
## Considered options
|
|
|
|
**Hardcode in validate.sh (rejected)** — field lists live as literal arrays in the
|
|
bash/python script. Rejected because: (1) the lists came from research docs
|
|
(`claude-code-plugins/agent-definition.md` and `github-copilot-plugins/agent-definition.md`)
|
|
and should maintain a provenance chain back to those sources via `source_keys` frontmatter;
|
|
(2) both provider APIs evolve — updating a structured markdown file is lower friction than
|
|
editing a script and less likely to introduce bugs; (3) it breaks the bidirectional reference
|
|
principle already established for this repo, where research-derived content carries explicit
|
|
source attribution.
|
|
|
|
## Consequences
|
|
|
|
- `validate.sh` must parse `references/field-inventory.md` to extract field lists — the
|
|
file format must be machine-parseable (section headings the script can grep, or a simple
|
|
list structure).
|
|
- `field-inventory.md` carries `source_keys` frontmatter referencing
|
|
`claude-code-plugins-docs` and `github-custom-agents-configuration` slugs.
|
|
- The script exits with a clear error if `references/field-inventory.md` is not found —
|
|
fail-fast, not silent.
|
|
- Field list updates (new provider field, deprecated field) require only editing
|
|
`field-inventory.md`; no script change needed.
|