Files

Defame1297 88866b81a3 fix(kyberforge): announce every provenance skip and scope checks 7-8 to source indexes

The clean provenance bill was an artifact. Checks 7 and 8 assume `Research doc:`
names a source index whose H2s are slugs, but 30 of 121 corpus entries point at
topic content documents whose H2s are topics. Those 30 produced every new check-7
INFO — all false positives. Check 8 aimed at the same documents, which carry no
`Status:` line at all, would have emitted a large false-FAIL flood; the only thing
preventing it was an unannounced `rd_status != extracted` skip. So "0 new FAILs"
rested on exactly the fail-open class this branch exists to remove, and naively
fixing the skip would have turned the branch red.

Checks 7/8 now run only when the research doc's basename is `sources.md`, and every
other case emits a visible INFO naming the slug. The dangling-path INFO stays ahead
of the basename gate, because a path that does not resolve is rot whatever it is
named. `parse_status` accepts the bullet form and a trailing note after the
backticked value, so a status it cannot read no longer reads as "nothing to check".

Corpus: 36 INFOs of which 30 were false, to 56 of which none are. FAIL stays 0, and
no Status line flipped to `extracted` under the new parser, so no FAIL was
suppressed by luck.

Also closed, each a silent pass: a nonexistent directory, a directory with no
SKILL.md, and extra arguments now exit 2; a UTF-8 BOM no longer defeats frontmatter
parsing; the bare `except Exception: return False` that turned an unreadable file
into a clean pass is gone, with all reads pinned to UTF-8; check 3 walks nested
`references/` subdirectories; `FILL IN:` at end of line no longer escapes checks 1
and 6; duplicate `## slug` blocks and repeated `Research doc:` lines are announced
rather than half-read.

The agent-audit copy carried all of the above unfixed and is now ported, minus the
four fixes that are genuinely N/A at agent scope — it reads a plugin-root
`sources.md` and has no checks 7/8 and no `references/` tree. Its silent exit 0 for
a file outside plugin scope is preserved deliberately: that is a verdict about a
valid file, not a skip, and `check-scope-walkup-sync.sh` pins it. Every exit-2 gate
therefore decides from the argument alone, before the walk-up runs.

`validation-scripts.md` said flatly that silence from the validator is a pass, not
a skip. That sentence is what made a typo'd path dangerous, and both copies are
corrected here. The matching SKILL.md exit-code guidance lands with the audit
rubric change, which touches the same files.

Tests: skill-audit 45 to 65, agent-audit 24 to 43, every new case proven by mutation.

Refs: #111, #118, #121

2026-09-01 12:37:50 +00:00

assets/vale

feat(kyberforge): enforce the ADR-0020 context contract for skills and agents

2026-08-14 21:13:13 +00:00

references

fix(kyberforge): announce every provenance skip and scope checks 7-8 to source indexes

2026-09-01 12:37:50 +00:00

scripts

fix(kyberforge): announce every provenance skip and scope checks 7-8 to source indexes

2026-09-01 12:37:50 +00:00

tests

fix(kyberforge): announce every provenance skip and scope checks 7-8 to source indexes

2026-09-01 12:37:50 +00:00

README.md

feat(kyberforge): enforce the ADR-0020 context contract for skills and agents

2026-08-14 21:13:13 +00:00

SKILL.md

refactor(kyberforge): move audit guidance out of the per-run rubric load

2026-08-31 08:02:19 +00:00

README.md

agent-audit

Audits an agent definition for correctness and quality against the Claude Code and Copilot agent references and the house context-budget contract (ADR-0020) — a single vendor-neutral file at plugin/APM scope, or a Claude Code and Copilot file pair at project/user scope.

What it does

Runs scripts/validate.sh and scripts/validate-provenance.sh for structural and provenance checks, plus scripts/vale-wrap.sh — a Vale prefilter that deterministically flags non-imperative description openers, composition and architecture notes, vague wording, padding phrases, "There is/are" sentence openers, and CC-specific "Use proactively" phrasing in a Copilot or vendor-neutral description
Reads the agent file, and its counterpart when one exists, then loads the contract for its scope
Applies qualitative checks across description, body, delegation and comment discipline, loading one rubric from references/ per group
Outputs a compact findings report — findings only, grouped by dimension, each with Why and Fix — and a result block with handoff to agent-author

Two things follow from ADR-0020 and are easy to get backwards. Agents take the same description gates a skill takes — 250 characters SUGGESTION, 400 FAIL, since a name + description is preloaded into every session either way — and no body word gate at all, because an agent body becomes the system prompt of a fresh context rather than competing with the caller's live conversation. Body length is judged through the delegation check instead: an agent body that restates a procedure owned by a skill it can invoke is a FAIL, because a plugin-scope agent has no sibling references/ directory to disclose to and can only delegate.

At plugin/APM scope the audit accepts the single .apm/agents/<name>.agent.md file — there is no counterpart, and pair consistency does not apply. validate.sh hard-FAILs any frontmatter field outside the vendor-neutral allowlist, since apm compile copies frontmatter verbatim to both harnesses and an unsafe field cannot be silently dropped for just one of them. The allowlist lives in the apm-agent-allowlist section of references/field-inventory.md, is read from there as data by the script, and is deliberately not restated anywhere else in this skill (ADR-0009).

At project/user scope the audit accepts either file in a CC .md / Copilot .agent.md pair, derives the counterpart automatically, and validates both, including the field-leakage checks in each direction.

Usage

/agent-audit

Pass the path to either agent file as the argument.

Files

File	Purpose
`SKILL.md`	Skill instructions for agents
`assets/vale/.vale.ini`	Vale config: scopes `Kyberforge` to `*/agents/.md`, `Kyberforge`+`KyberforgeCopilot` to `*/.agent.md`
`assets/vale/styles/Kyberforge/CompositionNote.yml`	Flags composition and architecture notes in a description ("cross-cutting", "entry point", "composes", "rather than duplicating") that belong in README.md
`assets/vale/styles/Kyberforge/DescriptionOpener.yml`	Flags descriptions opening with "This..." instead of an imperative "Use when..."
`assets/vale/styles/Kyberforge/PaddingPhrase.yml`	Flags generic "see references/ for info" pointers instead of specific file references
`assets/vale/styles/Kyberforge/SentenceOpenerThereIs.yml`	Flags sentences opening with "There is/are" instead of naming the subject directly
`assets/vale/styles/Kyberforge/VagueWording.yml`	Flags vague capability wording ("helps with", "utilize", "assists with", "used for") in descriptions
`assets/vale/styles/KyberforgeCopilot/ProactivePhrase.yml`	Flags CC-specific "Use proactively" phrasing with no effect in Copilot descriptions
`references/README.md`	Directory documentation for references/
`references/description-quality.md`	Rubric for the description dimension — three-part shape, the 250/400-character budget, the hand-invoked contract, and the internal-mechanics FAIL
`references/body-and-delegation.md`	Rubric for the body, delegation and comment-discipline dimensions — the delegation FAIL and why agents take no body word gate
`references/scope-plugin-apm.md`	Scope contract for a single vendor-neutral APM agent file — allowlist, dimension routing, and the dimensions that do not apply
`references/scope-project-user.md`	Scope contract for a CC / Copilot pair — counterpart derivation, provider field rules, pair consistency
`references/validation-scripts.md`	Loaded only when a Step 1 script fails or cannot run — scope-detection walk-up, manual fallback checks, known script failures
`references/field-inventory.md`	Authoritative field lists read as data by `validate.sh`: valid CC and Copilot agent fields, and the vendor-neutral plugin/APM-scope allowlist
`references/sources.md`	Research provenance for skill content
`scripts/README.md`	Directory documentation for scripts/
`scripts/validate.sh`	Structural validator — required fields, name format, placeholder detection, the ADR-0020 description budget, and the field rules for the detected scope
`scripts/validate-provenance.sh`	Provenance chain validation against `sources.md` at the package root (plugin/APM scope only)
`scripts/vale-wrap.sh`	Drop-in `vale` wrapper that works around a frontmatter-description NLP scope limitation
`tests/README.md`	(source-only) Bats test dependency and run instructions
`tests/validate.bats`	(source-only) Bats tests for validate.sh
`tests/validate-provenance.bats`	(source-only) Bats tests for validate-provenance.sh

Rows marked (source-only) exist in the authoring source (.apm/skills/agent-audit/) but are not present in an installed plugin: scripts/sync-plugin-content.sh strips <category>/<name>/tests when it generates the flat mirror, because these are dev-time fixtures no plugin host needs to discover (ADR-0017). Run them from a repo checkout, not from an install.