merge — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited merge (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Merge current branch's PR → main w/ release-note-ready commit message.
gh pr view --json number,title,body,urlgh pr checks — CI statusgh pr view --json mergeable — merge conflictsgh pr view --json reviewDecision — review approvalgh pr view --json isDraft — draft status2.5. Push gate (decision-gate per decision-gate invariant — worked example: mid-flow consequence-bearing prompt before squash-merge so unpushed local commits not merged):
git rev-list --count "origin/<branch>..HEAD" (<branch> is current branch).N == 0 → skip gate, proceed to §3.N > 0 → emit AskUserQuestion call:Push N unpushed commits before merge?Push and continue → git push origin <branch> then §3Force-push and continue → git push --force-with-lease origin <branch> then §3Cancel → exit w/ no mergePush gatereply ok/cancel form not allowed — selection drives remote-branch state change per decision-gate invariant.gh pr view --json commitsgh pr diff --name-only or git diff main..HEAD --statgh pr diff gh pr edit <number> --body "$(cat <<'EOF'
<updated description>
EOF
)"type(area): concise imperative description (#42)fix, feat, refactor, chore, docs, test<area>)gh pr comment <number> --body "$(cat <<'EOF'...EOF)"--delete-branch: gh pr merge <number> --squash --delete-branch --subject "<title>" --body "$(cat <<'EOF'
<body>
EOF
)"gh pr merge <number> --merge --delete-branchgh pr merge <number> --rebase --delete-branch--auto queues when checks pass: gh pr merge <number> --squash --auto --delete-branch--delete-branch explicitly. not short form -d. not omit.--delete-branch deletes local and remote branches for merged PRgit checkout maingit pull origin maingit fetch --prunegit log -1feat(server): add user authentication system (#42)
## Summary
Implements JWT-based authentication replacing the session-based system.
Users can now log in and receive tokens that expire after 24 hours.
## Changes
- Add JWT token generation and validation
- Create login and registration endpoints
- Add middleware for protected routes
- Add token refresh endpoint
## Breaking Changes
- Session cookies are no longer supported
- API clients must include Authorization headerPre-publish: rg --pcre2 '[∀∃∴⊥∈∉∧∨≤≥≠≡¬]' <body> on synced PR description (§4) before gh pr edit, squash commit body (§5) before §7 gh pr merge --body, insights comment (§6) before gh pr comment; match → bail and rewrite per core:steno register before mutation.
Apply core:steno to PR description (§4), squash commit body (§5), insights comment (§6). Conventional Commits prefix (type(area):) and (#number) suffix and identifiers / paths / #refs / SHAs preserved verbatim.
type(area): description (#number)core:steno skill)--delete-branch for branch cleanupHeading ## Next; 1–5 atomic items (one sentence each, no Reply prefix); positional dispatch (run <int> or run /<plugin>:<cmd> [args]). Merge landed → follow-up usually /gh:release (cut SemVer tag) or resume work on next branch or verify auto-deploy.
Canonical example after merge lands:
## Next
1. /gh:release — cut a SemVer tag for the new main
2. /sdd:build — start the next §T row
3. gh pr list --state open — review remaining open PRs~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.