Defame1297
92c13b997f
## Why agent-author produces paired agent definition files (Claude Code .md + Copilot .agent.md) but had no companion audit skill to validate them. agent-audit fills that gap, giving the same structured PASS/FAIL report that skill-audit provides for SKILL.md files. ## Implementation Notes - validate.sh uses scope detection (walk up for plugin.json / .git) to locate the counterpart file and determine whether plugin-silently-ignored fields (hooks, mcpServers, permissionMode) should be flagged - CC-only and silently-ignored field lists are read from references/field-inventory.md at runtime rather than hardcoded — provenance back to the research corpus; see ADR-0019 - Single-file invocation (pass either file, counterpart derived) chosen over directory or name+root — see ADR-0018 - 12 bats tests cover provider detection, scope detection, all FAIL paths, and clean-pair pass ## Impact - kyberforge bumped to v1.1.2 - agent-author close step should be updated to reference agent-audit (#11) - Provenance/sources chain check deferred to #60 ADR: docs/adr/0018-agent-audit-single-file-invocation.md ADR: docs/adr/0019-agent-audit-field-inventory-reference.md Refs: #11 Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0147vXtL5sP6vorDdqXGJJU9
1.7 KiB
agent-audit reads field lists from a reference file, not hardcoded script arrays
agent-audit's validate.sh checks for Claude Code-only fields in Copilot files and
silently-ignored fields in plugin agents. Rather than hardcoding those field lists in the
script, the script reads references/field-inventory.md at runtime. This keeps field list
maintenance decoupled from script logic and preserves a provenance chain back to the
research corpus that sourced the lists.
Considered options
Hardcode in validate.sh (rejected) — field lists live as literal arrays in the
bash/python script. Rejected because: (1) the lists came from research docs
(claude-code-plugins/agent-definition.md and github-copilot-plugins/agent-definition.md)
and should maintain a provenance chain back to those sources via source_keys frontmatter;
(2) both provider APIs evolve — updating a structured markdown file is lower friction than
editing a script and less likely to introduce bugs; (3) it breaks the bidirectional reference
principle already established for this repo, where research-derived content carries explicit
source attribution.
Consequences
validate.shmust parsereferences/field-inventory.mdto extract field lists — the file format must be machine-parseable (section headings the script can grep, or a simple list structure).field-inventory.mdcarriessource_keysfrontmatter referencingclaude-code-plugins-docsandgithub-custom-agents-configurationslugs.- The script exits with a clear error if
references/field-inventory.mdis not found — fail-fast, not silent. - Field list updates (new provider field, deprecated field) require only editing
field-inventory.md; no script change needed.