On this page
Package contents
What ships in the skill package and which scripts support validation.
The skill package is smaller than the repo.
The shipped payload is the skill, references, templates, helper scripts, and plugin metadata.
Repo docs, tests, fixtures, release ledgers, generated portal output, and local run artifacts are maintenance material unless the package boundary changes.
Contents
The package includes SKILL.md, references/, templates/, helper scripts/, and plugin metadata.
In the repository those files live under skills/implementaudit/; in the built IMPLEMENTAUDIT.skill archive the skill payload is at archive root.
The source .claude-plugin/plugin.json uses skills: "./skills/"; the release builder generates archive-local metadata with skills: "./" for that archive-root layout.
Optional /dashboard/ content is not part of IMPLEMENTAUDIT.skill.
Shipped scripts
These helper scripts live in the repo under skills/implementaudit/scripts/ and ship in IMPLEMENTAUDIT.skill as root scripts/.
| Script | Plain role | Typical loop |
|---|---|---|
claim-run.sh | Atomically create a namespaced run folder; may advise a gitignore update but does not write it. | L2 run-state control |
detect-env.sh | Record host/tool orientation. | L1/L2 planning |
detect-stack.sh | Inspect repo stack and owner/source candidates. | L1/L3 planning and phase work |
repo-state.sh | Compare deliverable changes while excluding run-root evidence. | L3/L5 evidence |
summarize-repo.sh | Summarize repo surfaces for brownfield inspection and mandatory-command candidates. | L1 planning |
validate-audit-spec.sh | Check audit/goal/slice specs for owner/source, evidence, and rollback. | L1/L2 gates |
validate-phase.sh | Check a filled phase spec before dispatch. | L3 phase gate |
validate-run-root.sh | Check run-folder structure, status enum, Andon rows, and roadmap completeness during resume or final review. | L2/L5 closure |
custody-append.sh | Absent-safe append into a separately authorized non-authoritative ActiveGraph mirror. | L4/L5 optional mirror |
lane-survivor-inventory.sh | Print-only classification of declared lane outputs after interruption; advisory and deliberately unwired from closure gates. | L4 interruption recovery |
Script path boundary
Packaged helper invocations should resolve through ${IMPLEMENTAUDIT_SKILL_DIR:-skills/implementaudit}/scripts/<helper>.
Before installed-package use, resolve and export IMPLEMENTAUDIT_SKILL_DIR to the actual loaded skill directory containing SKILL.md, scripts/, references/, and templates/; the :-skills/implementaudit fallback keeps source-checkout commands working.
The repository root, the IMPLEMENTAUDIT.skill archive file, and IMPLEMENTAUDIT_BASE are not helper directories. IMPLEMENTAUDIT_BASE is the run-root base when used.
Helper failure semantics
Helpers are evidence aids, not authority.
If a helper is missing, fails, or cannot run in the host shell, the agent must record that fact, classify whether it blocks the current phase, and use the Markdown/run-folder fallback when possible.
- Missing optional helper: record absence and continue with manual evidence when the phase can still be verified.
- Failed required helper: enter stop-the-line handling, inspect cause, and rerun only after a bounded countermeasure.
- Host incompatibility: hand off with the exact command, error, environment, and next owner action when no safe fallback exists.
Release and package verification scripts live at the repo root; they are maintenance checks, not shipped runtime helpers.
Templates
STATE.md
- Owner
- Runtime
- Purpose
- Tracks status, current phase, decisions, failure rows, and closure state for a phased run.
- Proof boundary
- Run-state record; it does not prove the product change by itself.
ROADMAP.md
- Owner
- Planner
- Purpose
- Names phases, dependencies, dispatch order, milestones, and handoff shape.
- Proof boundary
- Planning evidence, not immutable scope or completion proof.
THINKING.md
- Owner
- Runtime
- Purpose
- Captures reviewable route, risks, owner/source notes, evidence strategy, and quality route.
- Proof boundary
- Reasoning record; final claims still need checks and audit evidence.
PROTOCOL.md
- Owner
- Runtime
- Purpose
- Defines the phase loop, resume rules, Andon escalation, continuity decisions, and final audit procedure.
- Proof boundary
- Rule surface; the transcript and run files prove whether it was followed.
sidecars.md
- Owner
- Runtime
- Purpose
- Records optional-tool availability, authorization, executable Graphify freshness, ActiveGraph checkpoint/mirror state, and Markdown fallback.
- Proof boundary
- Qualified orientation or non-authoritative mirror context only; live files and the run root win.
tools.md
- Owner
- Runtime
- Purpose
- Records skill-dir resolution, helper availability, shell/runtime checks, and optional tool status.
- Proof boundary
- Detection evidence only; missing optional tools are not a failure.
context.md
- Owner
- Runtime
- Purpose
- Records baseline ref, working-tree state, invocation shape, route, and repo instructions read.
- Proof boundary
- Intake context; live repository files and applicable
AGENTS.mdoutrank it.
phase-goal.txt
- Owner
- Planner
- Purpose
- Provides the per-phase work, criteria, evidence, rollback/defer path, and command skeleton.
- Proof boundary
- Phase dispatch scaffold, not authorization to widen scope.
child-agent-report.md
- Owner
- Reviewer
- Purpose
- Shapes read-only adversarial review output into findings, evidence, risks, and non-authority boundaries.
- Proof boundary
- Review input only; the parent run still verifies against source evidence.
Graphify and ActiveGraph are not required package dependencies; their optional boundary is documented in Optional tooling.
Source surfaces
skills/implementaudit/scripts/* and skills/implementaudit/templates/* describe shipped runtime surfaces.
Root scripts/* describe repo-only validation and release maintenance surfaces.
Canonical runtime behavior lives in skills/implementaudit/SKILL.md and the supporting references, templates, and helper scripts.
Do not recreate a tracked root IMPLEMENTAUDIT.md file; the package artifact is IMPLEMENTAUDIT.skill.AUDIT.md inputs remain valid work-record artifacts when a run points at findings.
Package tree
IMPLEMENTAUDIT.skill/
SKILL.md
references/
templates/
scripts/
.claude-plugin/
.claude-plugin/plugin.json (skills: "./")The archive must not contain a nested skills/ directory.
The release builder rejects skills/implementaudit/SKILL.md in the archive because host import expects SKILL.md at archive root.
Repo-only material
README.md, CHANGELOG.md, fixtures/, tests/, release ledgers, generated portal output, and local run artifacts are repo-side maintenance material unless a future owner decision changes the package boundary.
The marketplace entry at .claude-plugin/marketplace.json is package metadata.
Do not claim marketplace behavior was verified unless that host path was actually tested.
No LICENSE file exists until the owner selects a license and supplies license evidence.
Release maintenance gates
Release checks are repo-maintenance evidence, not permission to publish.
build-release-asset.shbuilds the archive and enforces the package allowlist.verify-package.shruns the broad repository validation suite.tests/release-asset-install.test.shandtests/release-asset-install-claude.test.share separate release-gate checks; each proves only the checked Codex or Claude extraction/copy path unless live host load is also verified.check-no-terminal-cap.shguards terminal-capability overclaims.- Identity, release asset, checksum, publication, and provenance gates remain separate owner decisions.
Package boundary
Do not claim a repo-only document or generated portal output shipped in the skill package unless the release asset readback shows it.
A checksum match checks artifact integrity. A published checksum manifest can support a separately authorized release provenance gate, but it is not a signature, SBOM, marketplace check, install check, or host-load proof.
Semantic preservation under footprint pressure
A smaller archive does not by itself close a package failure.
When footprint work changes shipped content, an owner, package membership, an installed path, generated/public material, or an evaluator surface, preserve exact before/after package identity and the owner-backed behaviours at risk.
Required runtime, checker, installed, generated, and public consumers must remain reachable and factually consistent.
Exact literals remain exact only when owned by a parser, checker, public promise, canonical event token, or interoperability contract; otherwise factual equivalence, rather than byte identity, is the test.
See skills/implementaudit/references/lean-operating-discipline.md in the source checkout for the full progressive contract.
This guidance does not alter package membership or claim that a later release exists.