Defame1297
dac9cad912
skill-audit loaded roughly 4,268 words of rubric on every run, most of it criteria for findings a clean skill never triggers. The auditing guidance moves into finding-criteria.md, read only when a finding is actually raised, cutting a clean audit to about 999 words. The named-skill exemption is replaced with properties, so the rubric stops carrying a list that ages the moment a skill is renamed. apm-workflow's `type:` trap sat in one flow while biting several, so it is promoted to a common gate reachable from all of them; its claim to be self-contained was untrue once it started routing to apm-install. skill-author's contract had drifted from body-discipline.md and is realigned, and agent-audit's field inventory is brought in line with the same split.
2.3 KiB
source_keys
| source_keys | |||||
|---|---|---|---|---|---|
|
claude-code-fields
name description tools disallowedTools model effort maxTurns permissionMode skills mcpServers hooks memory background isolation color initialPrompt
claude-code-only-fields
maxTurns isolation memory permissionMode effort hooks mcpServers disallowedTools skills initialPrompt color background
copilot-fields
name description tools target model disable-model-invocation user-invocable mcp-servers metadata
copilot-only-fields
target disable-model-invocation user-invocable mcp-servers metadata
apm-agent-allowlist
name description model source_keys disallowedTools
Parsing note: validate.sh reads the first non-empty, non-#, non---- line under each
heading as a whitespace-separated token list, and stops there. Keep the token line immediately
below its heading; explanatory prose goes after it, as here.
Why disallowedTools is on a list that is otherwise vendor-neutral, when tools is not
(ADR-0016 and its 2026-08-14 amendment): the two are not symmetric. tools is an allowlist
whose vocabulary differs per harness — Claude Code names its own tools, Copilot CLI uses aliases
(execute/read/edit/search/agent/web) — so a value correct for one is wrong for the
other, and apm compile copies frontmatter verbatim with no per-target integrator to reconcile
them. disallowedTools is a denylist, and denying by name is safe under verbatim copy: a name
the other harness does not recognise denies nothing, so the worst case is that the fence is absent
there, never that the wrong capability is granted. Claude Code honours it for plugin subagents: its
plugin agent-definition reference names the fields plugin agents silently ignore (hooks,
mcpServers, permissionMode), and disallowedTools is not among them.
disallowedTools also appears in claude-code-only-fields above, and that stays correct: at
project/user scope it is still a Claude-only field and must not appear in a Copilot .agent.md.
The two lists answer different questions — "may this field cross the CC/Copilot file boundary" for
a real pair, versus "is this field safe under verbatim copy to every target" for a single
vendor-neutral APM file.