e2e-smoke-test — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited e2e-smoke-test (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Most repos ship a uv-managed Python harness under tools/e2e/; two exceptions: openlatch-website (browser smoke via playwright-cli instead) and openlatch-sectools (per-tool pytest + npx openlatch-provider register --dry-run --skip-preflight as the smoke). doctor + smoke run in seconds and catch the "did I break the contract?" class; deeper suites are paid for only when the diff touches their area. Read references/stacks.md now for entrypoints, probes, and expansion rules per repo — and route the two exception repos around the generic run block below.
Probe reachability first (per the reference). Running services → use them. Missing services → start the repo's local stack yourself (compose / dev servers), track what you started, kill it when done. If the stack genuinely can't come up on this machine (missing secrets, external dependency), skip with a LOUD logged reason — a skipped gate must never look like a green one.
cd "$REPO_ROOT/tools/e2e"
uv sync
E2E_CMD=$(awk '/^\[project\.scripts\]/{f=1;next} /^\[/{f=0} f&&/=/' pyproject.toml | head -1 | cut -d= -f1 | tr -d ' ')
uv run "$E2E_CMD" doctor
uv run "$E2E_CMD" smokeThen expand by diff (rules in the reference): touched routes/flows get their dedicated harness commands (e.g. saferskills upload_flow, item_detail; client/provider hooks/simulate). For openlatch-website: playwright-cli browser smoke — visit / plus every touched route/MDX page (derive URLs from Astro/Starlight conventions), assert HTTP 200 + zero console errors.
Failures: 3-strike fix loop — read the harness output AND the service logs, root-cause, smallest fix, re-run the failing command only. Distinguish honestly between the harness found a real regression (fix the code) and the harness itself is broken by an intentional change (fix the test, and say so explicitly). After 3: FAILED + diagnosis. Never let a caller open a PR on red E2E.
E2E-SMOKE — <PASS | FAIL | SKIPPED: reason>
doctor: <ok> | smoke: <ok | fixed | FAILED: root cause>
Expanded: <suite>: <result> …
Services: <reused | started+killed: what>~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.