trellis-update-spec-ff95ef — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited trellis-update-spec-ff95ef (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
When you learn something valuable (from debugging, implementing, or discussion), use this to update the relevant code-spec documents.
Timing: After completing a task, fixing a bug, or discovering a new pattern
In this project, "spec" for implementation work means code-spec:
If the change touches infra or cross-layer contracts, code-spec depth is mandatory.
Apply code-spec depth when the change includes any of:
For triggered tasks, include all sections below:
| Trigger | Example | Target Spec |
|---|---|---|
| Implemented a feature | Added a new integration or module | Relevant spec file |
| Made a design decision | Chose extensibility pattern over simplicity | Relevant spec + "Design Decisions" section |
| Fixed a bug | Found a subtle issue with error handling | Relevant spec (e.g., error-handling docs) |
| Discovered a pattern | Found a better way to structure code | Relevant spec file |
| Hit a gotcha | Learned that X must be done before Y | Relevant spec + "Common Mistakes" section |
| Established a convention | Team agreed on naming pattern | Quality guidelines |
| New thinking trigger | "Don't forget to check X before doing Y" | guides/*.md (as a checklist item) |
Key Insight: Code-spec updates are NOT just for problems. Every feature implementation contains design decisions and contracts that future AI/developers need to execute safely.
.trellis/spec/
├── <layer>/ # Per-layer coding standards (e.g., backend/, frontend/, api/)
│ ├── index.md # Overview and links
│ └── *.md # Topic-specific guidelines
└── guides/ # Thinking checklists (NOT coding specs!)
├── index.md # Guide index
└── *.md # Topic-specific guides| Type | Location | Purpose | Content Style |
|---|---|---|---|
| Code-Spec | <layer>/*.md | Tell AI "how to implement safely" | Signatures, contracts, matrices, cases, test points |
| Guide | guides/*.md | Help AI "what to think about" | Checklists, questions, pointers to specs |
Decision Rule: Ask yourself:
guides/Example:
| Learning | Wrong Location | Correct Location |
|---|---|---|
| "Use API X not API Y for this task" | ❌ guides/ (too specific for a thinking guide) | ✅ Relevant spec file (concrete convention) |
| "Remember to check X when doing Y" | ❌ Spec file (too abstract for a spec) | ✅ guides/ (thinking checklist) |
Guides should be short checklists that point to specs, not duplicate the detailed rules.
Answer these questions:
| Type | Description | Action |
|---|---|---|
| Design Decision | Why we chose approach X over Y | Add to "Design Decisions" section |
| Project Convention | How we do X in this project | Add to relevant section with examples |
| New Pattern | A reusable approach discovered | Add to "Patterns" section |
| Forbidden Pattern | Something that causes problems | Add to "Anti-patterns" or "Don't" section |
| Common Mistake | Easy-to-make error | Add to "Common Mistakes" section |
| Convention | Agreed-upon standard | Add to relevant section |
| Gotcha | Non-obvious behavior | Add warning callout |
Before editing, read the current code-spec to:
cat .trellis/spec/<category>/<file>.mdFollow these principles:
If you added a new section or the code-spec status changed, update the category's index.md.
## Scenario: <name>
### 1. Scope / Trigger
- Trigger: <why this requires code-spec depth>
### 2. Signatures
- Backend command/API/DB signature(s)
### 3. Contracts
- Request fields (name, type, constraints)
- Response fields (name, type, constraints)
- Environment keys (required/optional)
### 4. Validation & Error Matrix
- <condition> -> <error>
### 5. Good/Base/Bad Cases
- Good: ...
- Base: ...
- Bad: ...
### 6. Tests Required
- Unit/Integration/E2E with assertion points
### 7. Wrong vs Correct
#### Wrong
...
#### Correct
...### Design Decision: [Decision Name]
**Context**: What problem were we solving?
**Options Considered**:
1. Option A - brief description
2. Option B - brief description
**Decision**: We chose Option X because...
**Example**:
\`\`\`typescript
// How it's implemented
code example
\`\`\`
**Extensibility**: How to extend this in the future...### Convention: [Convention Name]
**What**: Brief description of the convention.
**Why**: Why we do it this way in this project.
**Example**:
\`\`\`typescript
// How to follow this convention
code example
\`\`\`
**Related**: Links to related conventions or specs.### Pattern Name
**Problem**: What problem does this solve?
**Solution**: Brief description of the approach.
**Example**:
\`\`\`
// Good
code example
// Bad
code example
\`\`\`
**Why**: Explanation of why this works better.### Don't: Pattern Name
**Problem**:
\`\`\`
// Don't do this
bad code example
\`\`\`
**Why it's bad**: Explanation of the issue.
**Instead**:
\`\`\`
// Do this instead
good code example
\`\`\`### Common Mistake: Description
**Symptom**: What goes wrong
**Cause**: Why this happens
**Fix**: How to correct it
**Prevention**: How to avoid it in the future> **Warning**: Brief description of the non-obvious behavior.
>
> Details about when this happens and how to handle it.If you're unsure what to update, answer these prompts:
Before finishing your code-spec update:
Development Flow:
Learn something → `update-spec` (Trellis command) → Knowledge captured
↑ ↓
`break-loop` (Trellis command) ←──────────────────── Future sessions benefit
(deep bug analysis)break-loop (Trellis command)` - Analyzes bugs deeply, often reveals spec updates neededupdate-spec (Trellis command)` - Actually makes the updatesfinish-work (Trellis command)` - Reminds you to check if specs need updatesCode-specs are living documents. Every debugging session, every "aha moment" is an opportunity to make the implementation contract clearer.
The goal is institutional memory:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.