What this PR does
Why
What this PR does not do
Type of change
- [ ] Bug fix (non-breaking change that fixes an issue)
- [ ] New feature (non-breaking change that adds capability)
- [ ] Breaking change (fix or feature that would change existing behavior)
- [ ] Documentation update
- [ ] Skill contribution (see attestation below)
- [ ] Refactor (no behavioral change)
- [ ] Test / CI / tooling
Testing
- [ ] Unit tests added/updated
- [ ] Integration tests added/updated (if applicable)
- [ ] Manually tested against a real deployment (describe scenario below)
- [ ] Acceptance test plan updated (if changing skill behavior)
Manual testing notes (if applicable)
Documentation
- [ ] PRD updated (if user-facing behavior changes)
- [ ] README updated (if quickstart or capability list changes)
- [ ] Skill-authoring guide updated (if skill conventions change)
- [ ] Deployment cookbook updated (if deployment changes)
- [ ] Compliance documentation updated (if compliance posture changes)
- [ ] OpenAPI schema regenerated (if API endpoints change)
Transparency & governance invariants
- [ ] Egress (P1): any outbound third-party call goes through the gateway only — no direct egress from
api/.
- [ ] Closed set (P2): any new model/autonomous-invokable capability is a bounded, operator-controlled allowlist entry, not an open hook.
- [ ] No raw payloads (P3): no row or log line I add carries raw content (message bodies, tool args/results, fetched text, keys) — counts, types, ids, digests, outcomes only.
- [ ] Fail restrictive (P4): missing/broken config fails closed, and I tested that path, not just the happy path.
- [ ] Atomic audit (P5): state changes get an audit row committed in the same transaction (helpers flush, the handler commits).
- [ ] One governance path (P6): I reused the shared governance/audit helpers rather than re-deriving tier/cost/audit logic.
- [ ] Human gate (P7): anything destructive/irreversible is behind the confirmation gate and excluded from unattended/autonomous execution.
- [ ] Operator control (P8): any new capability has an operator enable/disable and appears on an admin surface.
- [ ] User owns data (P9): outbound matter context is anonymized; the change respects export/delete and data-residency guarantees.
- [ ] Contract is truth (P10): OpenAPI sketch / DB schema doc / relevant ADR updated in this PR; any architectural/authz decision is recorded or surfaced, not made silently.
DCO sign-off
- [ ] All commits in this PR are signed off per the DCO
Reviewer notes