locus-release — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited locus-release (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Project development only. This skill operates on thelocussource repository. It is not part of the palace interface and should not be invoked from within the MCP server or against a user's palace directory. End users oflocus-mcpdo not need this skill.
Post-release verification skill for the locus project. Run this after every version tag to catch stale version strings, prevent test regressions, and keep benchmark charts current.
git tag vX.Y.Z && git push origin vX.Y.Zversion = <value of [project].version in pyproject.toml>uv run pytest tests/unit/ -qCheck the following files contain the current version (or auto-updating badges):
| File | What to check |
|---|---|
CHANGELOG.md | Has an entry for ## vX.Y.Z |
README.md | Roadmap table includes vX.Y milestone as Complete |
Dockerfile | ARG LOCUS_MCP_VERSION="X.Y.Z" matches current version |
pyproject.toml | Source of truth — already read in Step 1 |
If any file is stale, update it and commit with the version bump PR (not separately).
# Write structured JSON results — avoids relying on text output format
uv run python scripts/bench-mcp.py --json-out /tmp/bench-mcp-results.jsonThen verify from the JSON:
import json
r = json.load(open("/tmp/bench-mcp-results.json"))
assert r["summary"]["passed"] == 40, f"Expected 40, got {r['summary']['passed']}"
assert r["summary"]["p95_ms"] < 50, f"p95 latency regression: {r['summary']['p95_ms']}ms"uv run python scripts/bench-compare.py --json-out /tmp/bench-compare-results.jsonThen verify from the JSON:
import json
r = json.load(open("/tmp/bench-compare-results.json"))
palace_pass = r["palace"]["pass_rate"]
assert palace_pass >= 0.87, f"Palace pass rate regression: {palace_pass:.0%}"means palace lost its structural advantage).
uv run python scripts/generate-charts.pydocs/img/lines-comparison.svg and docs/img/latency-by-category.svg.chore(docs): update charts.Check all four badges in README.md are correct:
| Badge | Expected |
|---|---|
| CI | Points to .github/workflows/ci.yml on Nano-Nimbus/locus |
| PyPI version | Slug is locus-mcp; auto-updates from PyPI — verify the link resolves to the correct package |
| Python version | Matches requires-python in pyproject.toml (currently 3.11+) |
| License | Matches the LICENSE file (currently MIT) |
The PyPI badge is dynamic — if it shows a stale version after release, PyPI propagation takes a few minutes. Wait and refresh before concluding it is broken.
After the tag push triggers publish.yml:
# Check the workflow completed successfully
gh run list --workflow=publish.yml --limit=3
# Confirm the new version is live on PyPI
curl -s https://pypi.org/pypi/locus-mcp/json | python3 -c "
import json, sys
d = json.load(sys.stdin)
print('latest:', d['info']['version'])
print('all versions:', list(d['releases'].keys())[-5:])
"The version reported must match pyproject.toml. If publish.yml failed, check for the Docker/PyPI race condition (see MEMORY.md release gotchas) — rerun docker.yml after PyPI propagates.
After docker.yml completes:
# Confirm the image tag exists on GHCR
gh api /orgs/Nano-Nimbus/packages/container/locus-mcp/versions \
--jq '.[] | {tags: .metadata.container.tags, created: .created_at}' | head -20Expected: a version entry with tag X.Y.Z (and optionally latest).
Also verify Dockerfile ARG LOCUS_MCP_VERSION matches the release version:
grep "ARG LOCUS_MCP_VERSION" Dockerfile[ ] uv run pytest tests/unit/ — N tests, 0 failures
[ ] CHANGELOG.md has vX.Y.Z entry
[ ] README.md roadmap includes vX.Y milestone
[ ] README.md badges: CI workflow URL correct, PyPI slug correct, Python version matches pyproject.toml
[ ] Dockerfile ARG LOCUS_MCP_VERSION matches release version
[ ] PyPI: locus-mcp X.Y.Z live at pypi.org/project/locus-mcp/
[ ] GHCR: ghcr.io/nano-nimbus/locus-mcp:X.Y.Z image published
[ ] bench-mcp.py: 40/40 pass, p95 < 50ms
[ ] bench-compare.py: palace ≥ 87% pass
[ ] docs/img/ charts regenerated
[ ] spec/mcp-server.md currentserver.json) should be updated manually if the transportor package entry changes significantly.
docker.yml fails immediately after a tag push, wait for PyPIto propagate (~2 min) then rerun the Docker workflow via gh run rerun <run-id>.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.