oc-release-ops — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited oc-release-ops (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
On first invocation, read `references/orchestrator.md` and follow its welcome protocol.
Release-ops sits between oc-git-ops and oc-deploy-ops at release boundaries. The recurring "scope → sprint plan → changelog → version bump → ship" pattern that opchain itself uses (and that any opchain-managed project will eventually want) is what this skill owns. v1.3 dogfoods this skill for its own release.
Boundary: oc-release-ops is not a deployer. It produces the artefacts a release needs (changelog entry, version bumps, release announcement, release ticket) and hands off to oc-git-ops for the merge / tag and oc-deploy-ops for staging + prod. Every action is reversible up to the moment oc-deploy-ops ships.
RELEASE OPS COMMANDS
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
END-TO-END
/oc-release Show this menu
/oc-release ship Run the full pipeline: plan → draft → bump → announce → hand off
STEPWISE
/oc-release plan Propose the next semver from changelog gaps + sprint outputs
/oc-release draft Draft the /changelog entry from sprint checkpoints + merged PRs
/oc-release bump Bump every skill version + styleguide badge atomically
/oc-release announce Compose homepage release-pill + release ticket + announcement copy
UTILITIES
/oc-release status Where in the pipeline am I?
/oc-release verify Pre-ship sanity gate (tests / catalog / validator / build)
/oc-release rollback Revert the last bump if not yet shipped
SESSION
/checkpoint Show oc-release-ops checkpoint
/checkpoint show Full checkpoint JSON
/checkpoint reset Archive and restart
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Type any command to begin. /oc-release to see this again.RELEASE TRIGGER
│
▼
┌───────────────┐ reads sprint checkpoints, /changelog gaps, merged PRs since
│ /oc-release │ the last release; proposes next semver per the decision tree
│ plan │ in references/semver-decisions.md.
└───────┬───────┘
│
▼
┌───────────────┐ composes the /changelog entry from sprint deliverables +
│ /oc-release │ PR titles + skill-version diffs; produces draft markdown
│ draft │ ready for human review.
└───────┬───────┘
│
▼
┌───────────────┐ rewrites every skills/<id>/SKILL.md `version:` field +
│ /oc-release │ styleguide badge; updates homepage release-pill href and
│ bump │ copy; commits as one atomic change.
└───────┬───────┘
│
▼
┌───────────────┐ composes release announcement (release ticket via PM-MCP +
│ /oc-release │ internal announcement copy + external blog/social copy);
│ announce │ per oc-integrations-engineer pm-mcp-protocol.md.
└───────┬───────┘
│
▼
┌───────────────┐ invokes /oc-release verify → npm run prebuild gates;
│ /oc-release │ hands the branch to oc-git-ops /oc-git-sync and tells the user
│ ship │ to run /oc-deploy staging → /oc-deploy prod.
└───────────────┘/oc-release planThe first step. Decides the next semver and the release theme.
.checkpoints/*.checkpoint.json — every skill's progress since last release.skills/*/SKILL.md version: frontmatter — current versions across the catalog.site/src/pages/changelog.astro — last shipped release's entry (its tag isthe last shipped semver).
git log <last-release-tag>..HEAD --oneline — merged commits since the lastrelease (oc-release-ops resolves the last tag from the changelog page if there is no git tag).
references/semver-decisions.md. Patch / minor /major decided from the kinds of work merged: bug-fix only → patch; backward- compatible feature work → minor; breaking changes / new skill → minor with release-note callout; auth/protocol/spec breakages → major.
automated releases").
with the release version, per the v1.2 precedent).
/oc-release draft order).Write checkpoint: phase plan-approved.
/oc-release draftProduce a /changelog entry ready for review.
/changelog entries (summary lede →"What's new" → "Two new scenarios" → "Configuration" → "Compatibility" → "Security posture") for stylistic consistency.
implementation detail. "oc-git-ops now reads ticket state via real MCP tool names" beats "Replaced placeholder mcp.<provider>.<verb> patterns."
"Scenarios" with a deep link to /demo#<id>.
.opchain/*.yaml keys or env vars.no migration required" OR a list of migration steps with a deadline.
flows / new external surfaces. Optional otherwise.
The draft is appended to site/src/pages/changelog.astro as a new <section class="release release--current">, with the previous current release demoted to <section class="release"> and rel-tag rel-tag--past.
/oc-release verify (run automatically after draft) gates:
<section> rel-date is the current date (YYYY-MM-DD).Write checkpoint: phase draft-approved.
/oc-release bumpAtomic version bump across the catalog.
skills/*/SKILL.md frontmatter version: field, in lockstep with therelease version. (v1.2 precedent: every skill version equals the release version.)
site/src/pages/styleguide.astro badge (e.g. v1.2.0 → v1.3.0).site/src/pages/index.astro release-pill href and label(e.g. v1.2 → v1.3).
references/version-locations.md.
The bump is one git commit (or a single file write batch in a Claude Code session). Partial bumps leave the catalog in a state where scripts/gen-skills-catalog.mjs may still validate but the homepage and styleguide disagree on version — confusing to readers. Always run /oc-release bump end-to-end; if it fails midway, revert and retry.
package.json "version" — the worker version is git-SHA-stamped at buildtime per CLAUDE.md. Marketing version and runtime version are decoupled by design; do not couple them.
__OPCHAIN_VERSION__ — same reason.Write checkpoint: phase bump-applied.
/oc-release announceCompose the announcement surfaces.
oc-integrations-engineer/references/pm-mcp-protocol.md §3 idempotency rules). Marker: <!-- opchain:oc-release-ops:release-ticket:v<semver> -->. Title: Release v<semver> — <theme>. Description: the changelog summary + links to the new scenarios + the bump commit.
user uses (Slack / email / Telegram). Generated to a file at releases/v<semver>/announcement-internal.md.
Generated to releases/v<semver>/announcement-external.md. Optional; the user opts in.
/oc-release bump;announce phase verifies it points to the new /changelog#v<semver> anchor.
--retry-pm flushIf the PM call fails, the release-ticket payload is recorded to oc-release-ops.checkpoint.json pm_deferred_actions[] per the protocol §4. /oc-release announce --retry-pm flushes later. The release proceeds; the PM ticket is enrichment.
Write checkpoint: phase announced.
/oc-release shipEnd-of-pipeline handoff.
/oc-release verify — run the full pre-ship gate. Hard-blocks on any failure.oc-git-ops:chaining).
/oc-git-sync v<semver> with the bump commit. oc-git-ops opens / mergesthe release PR.
oc-deploy-ops:/oc-deploy staging first; user eyeballs./oc-deploy (prod) on user confirmation.marker <!-- opchain:oc-release-ops:release-shipped:v<semver> -->.
shipped, status complete./oc-release verify (the gate)Runs in order; aborts on the first failure:
| Check | Implementation |
|---|---|
| Catalog validates | npm run gen-catalog |
| PM-MCP integration validates | npm run validate-pm-mcp |
| Flag registry mirror is current | npm run gen-flags |
| Tests pass | npm test |
| Site builds | npm run site:build |
/changelog has the new release entry | grep for rel-tag.*v<semver> |
| All skill versions match the release version | parse every SKILL.md frontmatter |
| Styleguide badge matches | parse site/src/pages/styleguide.astro |
/oc-release rollbackIf the release was bumped but not yet shipped (/oc-deploy not yet run):
git revert the bump commit./changelog section ordering.rolled-back.If the release has shipped, do NOT use /oc-release rollback — invoke oc-deploy-ops /oc-rollback to revert the worker, then file a fresh release with an incremented patch version that documents the rollback. oc-release-ops never overwrites a shipped release in-place.
In an opchain-managed project (where opchain itself is not the artefact), oc-release-ops produces the same outputs but operates on the project's own versioned surfaces. Configuration lives in .opchain/release.yaml:
version_locations:
- { file: "package.json", path: "version" }
- { file: "src/version.ts", regex: "VERSION = \"(.+)\"" }
changelog_path: "CHANGELOG.md"
changelog_format: "keep-a-changelog" # or "opchain-astro"
release_branch_pattern: "release/v{semver}"
release_ticket_type: "Release" # from pm.yaml.issue_typesopchain itself uses neither — its version locations are documented in references/version-locations.md because the SSOT is the catalog of SKILL.md files, not a single package.json.
{project-dir}/.checkpoints/oc-release-ops.checkpoint.json
| Event | What to Save |
|---|---|
/oc-release plan approved | proposed_semver, theme, headline_items |
/oc-release draft approved | changelog_diff_path, sections_added |
/oc-release bump applied | bumped_versions[], commit_sha |
/oc-release announce complete | release_ticket_id, announcement_paths |
/oc-release verify ran | gate_results[], pass/fail per check |
/oc-release ship complete | shipped_at, deploy_ticket_id |
/oc-release rollback invoked | rolled_back_at, prior_versions[] |
{
"current_release": {
"semver": "1.3.0",
"theme": "Runtime PM, real platforms, automated releases",
"phase": "bump-applied",
"release_ticket_id": "REL-201",
"started_at": "2026-05-07T19:00:00Z"
},
"history": [
{
"semver": "1.2.0",
"theme": "PM-tool MCP integration",
"shipped_at": "2026-05-05T22:30:00Z"
}
]
}| Reads from | Why |
|---|---|
every skill's *.checkpoint.json | What shipped per skill since last release |
oc-app-architect.checkpoint.json | Sprint outputs feed the changelog draft |
oc-git-ops.checkpoint.json | Merged-PR list feeds "What's new" bullets |
oc-deploy-ops.checkpoint.json | Last-shipped commit SHA |
| Read by | Why |
|---|---|
oc-git-ops | Knows a release is in flight; /oc-git-sync shapes the release PR specifically |
oc-deploy-ops | Treats oc-release-ops handoff as authoritative for the release tag |
oc-monitoring-ops | Tags incidents in the first 24h after a release with post-release |
oc-release-ops creates a release ticket per release and updates it through the pipeline.
The runtime contract — concrete tool names, retry policy, idempotency markers, the pm_deferred_actions[] schema — lives in oc-integrations-engineer/references/pm-mcp-protocol.md. All MCP calls below honour that contract; this section says only how oc-release-ops shapes the release ticket.
/oc-release announce)<!-- opchain:oc-release-ops:release-ticket:v<semver> --> followed by the changelog summary, scenario links, and the bump commit SHA.
list_issues (Linear:mcp__claude_ai_Linear__list_issues; GitHub: mcp__mcp-server-github__list_issues) filtered to project + pm.yaml.issue_types.release (default "Release" or "Task" if missing) + description-text query for the marker. If found, reuse.
create_issue (Linear:mcp__claude_ai_Linear__save_issue; GitHub: mcp__mcp-server-github__issue_write action=create).
oc-release-ops.checkpoint.jsonskill_state.current_release.release_ticket_id.
| Event | Marker | Action |
|---|---|---|
| Bump committed | <!-- opchain:oc-release-ops:bump-committed:v<semver> --> | add_comment linking the bump commit. |
| Staging shipped (from oc-deploy-ops handoff) | <!-- opchain:oc-release-ops:staging:v<semver> --> | add_comment with staging URL. |
| Production shipped | <!-- opchain:oc-release-ops:shipped:v<semver> --> | add_comment with prod URL + version stamp; transition release ticket → shipped (resolved from pm.yaml.states.extended). |
/oc-release announce --retry-pmInvokes the protocol §4 flush against oc-release-ops.checkpoint.json pm_deferred_actions[]. Filter to skill: "oc-release-ops" and retriable: true. The release proceeds even if the PM write fails; flush is reconciliation only.
retriable: false; surface to user;the bump commit and changelog entry are unaffected.
about what changed and why; the commits are evidence, not the artefact.
user reading /changelog should be able to summarise the release in one sentence.
release version, even those untouched. Drift breeds confusion about which version is "current".
the catalog is semver-stamped. Don't couple them.
"back-compatible with X.Y" or lists migration steps. Silence is a bug.
oc-deploy-ops ships. Three skills, one pipeline.
/oc-deploy is reversible.After prod, fix forward with a new release.
releases — the v1.3 release shipped via /oc-release ship v1.3.0.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.