engineering — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited engineering (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
engineering 是純施工 skill。唯一施工來源是 authoritative task.md;JIRA、PR、 review comments、CI 都只是 side effect 或 revision signal,不是施工圖。規劃、估點、 RCA、scope ownership 由 bug-triage / breakdown / refinement 持有。
package scripts)不是 engineering 修補面;CI parity / config 問題要停下記錄 owner decision;BLOCKED_ENV 語意與 retry/escalation contract 以 ci-local-env-blocker.md 為準。
Test Environment、depends_on)不可由 engineering 手動改;需要改時走 scope escalation。
validate-task-md.sh、validate-task-md-deps.sh、validate-breakdown-ready.sh、resolve-task-base.sh、 resolve-task-branch.sh),並在 fresh worktree 建立後寫入 planner-owned 欄位 baseline snapshot。finalize / completion / revision gate 若偵測 snapshot 缺失或 mismatch,必須 停止並走 scope escalation;不得就地修改 task.md 讓 gate 通過。
deliverable / extension_deliverable / status move-first closeout。
linked docs;缺 company handbook 要明記,不可跳過 repo handbook。
scripts/env/install-project-deps.sh --task-md <task.md> --cwd <repo> 消費 ## Required Tools 與 project dependency contract。缺 ticket-scoped 工具且 task.md 沒有可執行 install command 時,視為 BLOCKED_ENV,依 handoff_hint 提醒使用者安裝或授權。
sub-agent-roles.md 並注入 Completion Envelope;Codex runtime / model fallback contract 見該 reference § Runtime Adapter Contract / Fallback Behavior。Implementation、CI/debug、PR review 與 correctness review 不得降到 small_fast / realtime_fast。
workspace-language-policy.md;specs Markdown 另遵守 starlight-authoring-contract.md。
pipeline-handoff.md § Artifact Schemas,再讀refinement-artifact.md / task-md-schema.md 等對應 artifact-specific schema。atom ownership 邊界以 pipeline-handoff-atom-matrix.md 為準;SKILL 主文不複製完整 schema 表。
task.md(Allowed Files / Scope Trace Matrix / Verify Command)。engineering 不直接讀 refinement.json 的 acceptance_criteria / modules 補 scope authority; work-order derivation 是 breakdown 的 owning scope。需要改 scope 時走 scope escalation 回 breakdown,不從 refinement.json 自行 re-derive(atom matrix t_task_work_order row)。
pr-body-builder.md,並依該 reference 的 L1→L2→L3template detection 讀 repo PR template;PR body draft 必須從 template skeleton 起稿,不可先 用 generic summary 再等 gate-pr-body-template.sh 擋下重寫。
engineering 作為 consumer,預設 traverse breakdown 產出的 canonical task.md schema(Allowed Files / Scope Trace Matrix / Verify Command)作為唯一施工輸入,不 改去解析 refinement / breakdown 的 LLM freeform prose 補 scope 缺口(對齊上方 Consumer boundary 條文)。engineering 作為 producer,寫入 canonical proof-of-work marker 與 deliverable lifecycle metadata 給下游 verify-AC / closeout 機械消費。LLM freeform 只在 standalone 情境合法——亦即該產出沒有下游 pipeline consumer 會機械消費它(例如對使用者 的 status 說明)。會被下一段 skill 機械消費的 handoff artifact 一律走 canonical schema。 本契約只約束 handoff artifact 介面,不約束 engineering 內部如何 TDD、debug 或組織實作 reasoning。完整契約見 .claude/skills/references/pipeline-handoff.md § Canonical Schema Traversal Contract。
先讀 engineering-entry-resolution.md,用 resolver 找到單一 task.md,再由 work order 派生 mode:
| Condition | Mode | Reference |
|---|---|---|
deliverable.pr_url empty | first-cut | engineering-first-cut-flow.md |
deliverable.pr_url open PR | revision | engineering-revision-flow.md |
| local policy declares extension for this DP task | first-cut + local extension tail | engineering-local-extension.md |
| multiple inputs | batch dispatch | engineering-entry-resolution.md |
| gate failure needs planner-owned field change | scope escalation | engineering-scope-escalation.md |
所有 implementation / revision 都必須讀 engineer-delivery-flow.md,並依 role 執行:
triggered → behavior contract compare if declared → evidence upload bundle if local media evidence exists → base freshness → commit → PR → JIRA → completion gate → worktree cleanup。
extension 不得降低 gate。
pr-state-contract.md,再 consume shared PR state:resolve-pr-work-source.sh → pr-state-snapshot.sh → pr-action-classifier.sh。對外 readiness 語彙只能使用 review_required、awaiting_re_review、mergeable_ready、needs_code_changes、 blocked_conflict、unsupported_mutation、wait_ci、planning_gap。
order。
metadata / closeout,不施工。
不開第二條 implementation branch。
framework-owned dirty source(scripts/**、.claude/skills/**、.claude/rules/**、 .claude/instructions/**、CLAUDE.md、AGENTS.md、.codex/**、.agents/** 等) 是 fail-stop;不得把 main dirty 當成可直接續做的施工面。
unsupported_mutation、blocked_conflict、或stale_downstream,停止把 revision lane 說成「已收斂」或「可 review」。
breakdown 或 refinement。
pr_freshness、completion_gate、blocked_conflict、unsupported_mutation、ci_local marker 的 owning writer;Layer B verify marker 的 writer 維持 run-verify-command.sh。Marker schema、 producer mapping 與 freshness rule 以 auto-pass-proof-of-work.md / scripts/lib/evidence-producers.json 為準;不得以 final answer、JIRA-only state 或 /tmp only artifact 代替 durable marker。
engineering session 開始 implementation 之前(branch / worktree 建好後)必須 呼叫 skill-workflow-boundary baseline writer,並把 task.md 路徑傳進來,scope 會由 task.md ## Allowed Files 推導:
bash scripts/skill-workflow-boundary-gate.sh --skill engineering --start \
--source-container "$SOURCE_CONTAINER" --task-md "$TASK_MD"commit / PR / completion gate 之前(也就是 engineer-delivery-flow.md 的 Scope Gate 步驟內)必須再跑 --check:
bash scripts/skill-workflow-boundary-gate.sh --skill engineering --check \
--source-container "$SOURCE_CONTAINER" --task-md "$TASK_MD"任何 Allowed Files 之外的新增/修改都會 exit 1 + 輸出 POLARIS_SKILL_WORKFLOW_BOUNDARY_BLOCKED:engineering;engineering 不得就地改 Allowed Files 來通過 gate,必須走 engineering-scope-escalation.md。
POLARIS_LANGUAGE_POLICY_BYPASS / POLARIS_SKILL_BOUNDARY_BYPASS 等 env 不能 silence 這個 gate(AC-NEG16)。
Delivery tail 依 engineer-delivery-flow.md 執行;framework 相關變更需呼叫 scripts/check-version-bump-reminder.sh。
完成 write flow 後必須呼叫 scripts/check-feedback-signals.sh。
見 post-task-reflection-checkpoint.md;write 後必跑、不可跳過。
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.