Use SKILL.md as the canonical entrypoint for this repository.
Read these before changing anything:
- SKILL.md
- docs/runtime-contract.md
- docs/operating-model.md
- docs/code-scanning-policy.md
- docs/secret-scanning-policy.md
- docs/review-gate.md
- docs/reporting-model.md
- the selected
profile.yaml
For one selected profile, run work in this order:
- account discovery
- profile lock
- exhaustive
Dependabot - allowlisted deterministic
code_scanning secret_scanningresponse- review gate
- reconcile stale or superseded PRs
- final reporting
- lock release
- The selected
profile.yamlis the live source of truth. - Do not invent policy beyond the selected profile and public docs.
secret_scanningcleanup PRs are review-required and never auto-merge.- Do not rotate credentials, dismiss alerts, or rewrite git history automatically.
- Treat
PLAN.md,profiles/local/, and.claude/as local-only material, not part of the public contract.