Add tested public-source release safety gate

README.md

@@ -1,6 +1,6 @@
 # 51Code Agent Skills
 
-This repository is the source package for 15 skills maintained by 51Code and
+This repository is the source package for 16 skills maintained by 51Code and
 the bootstrap for our reviewed machine-global skill baseline.
 
 The repository intentionally has no catalog, registry, generated lock, sync
@@ -9,14 +9,15 @@ package directly.
 
 ## Global baseline
 
-The global baseline supports Codex and Claude Code and contains these 38 skills:
+The global baseline supports Codex and Claude Code and contains these 39 skills:
 
 - 51Code-owned: `code-review`, `gemini-files-api`, `harness-engineering`,
   `hint-overlay-visual-verification`, `ios-xcodegen`,
   `lifecycle-and-side-effects-correctness`, `local-model-serving`,
   `mechanism-audit`,
-  `meeting-transcription`, `silent-pushes-setup`, `spec-creation-updating`,
-  `swift-testing`, `swiftui-view-refactor`, `xcode-build`, and `xcode-cloud`
+  `meeting-transcription`, `public-source-release-audit`,
+  `silent-pushes-setup`, `spec-creation-updating`, `swift-testing`,
+  `swiftui-view-refactor`, `xcode-build`, and `xcode-cloud`
 
 - Third-party: `swift-concurrency` and the 22 `asc-*` App Store Connect CLI
   skills from `rorkai/app-store-connect-cli-skills`
@@ -37,7 +38,7 @@ idempotent. The script uses `skills@1.5.14`, explicit Git tags or commits, and
 explicit skill names. In this CLI, `#ref` selects a Git branch or tag; `@name`
 selects a skill and must not be used as a version pin. Sources pinned to a raw
 commit are checked out and verified before being passed to the manager as a
-local source. Before reporting success, the script verifies all 38 entrypoints
+local source. Before reporting success, the script verifies all 39 entrypoints
 in the shared and Claude Code manager roots and bootstraps the copied
 `gemini-files-api` dependencies in both roots. The Claude Code root honors
 `CLAUDE_CONFIG_DIR` when it is set. The script also converts the pinned
@@ -46,6 +47,26 @@ manager's partial-install result into a non-zero bootstrap failure.
 The script installs and reconciles the baseline names only. It does not remove
 retired names or unrelated global skills installed outside this baseline.
 
+## Public-source safety
+
+`public-source-release-audit` includes the repository's deterministic safety
+gate. It audits committed files and the Git index, including filenames,
+symlink targets, common encoding variants, high-confidence credentials,
+private-key blocks, Git LFS pointers, and public-workflow trust boundaries.
+Stage the intended publication candidate before relying on a local result:
+
+```bash
+node public-source-release-audit/scripts/public-source-release-audit.mjs \
+  --repo .
+```
+
+Before making a repository public or closing a suspected leak, run the same
+gate with `--history` from a complete clone. Add `--github OWNER/REPO` and one
+`--required-check NAME` per expected check to verify live GitHub visibility,
+secret scanning, push protection, GitHub Actions check binding, branch rules,
+and runner isolation. The gate's fixture suite runs as part of
+`scripts/verify.sh`.
+
 ## Updating the baseline
 
 1. Update the 51Code-owned skill folders in this repository.

THIRD_PARTY_NOTICES.md

@@ -25,6 +25,17 @@ registry-local forks below also retain their reviewed upstream MIT notices.
 - Upstream notice: `Copyright (c) 2026 Thomas Ricouard`
 - Local state: modified maintained fork
 
+## public-source-release-audit scanner
+
+- Source: [Codex Autopilot public safety audit](https://github.com/fiveonecode/autopilot/blob/9dd7ecb8a1aecb3d757b935a970991fd3461f5f4/agent-harness/src/lib/public-safety-audit.ts)
+- Reviewed upstream commit: `9dd7ecb8a1aecb3d757b935a970991fd3461f5f4`
+- Upstream notice: `Copyright (c) 2026 Codex Autopilot contributors`
+- Local state: dependency-free JavaScript port with a repository-release wrapper
+
+The scanner is distributed under the MIT License reproduced in this
+repository's [LICENSE](LICENSE). Keep local behavior changes fixture-backed and
+reconcile future upstream changes deliberately.
+
 The global bootstrap also installs `swift-concurrency` directly from its pinned
 upstream repository. It is not vendored here; its upstream license and notices
 remain authoritative. Impeccable remains an optional project-local install

bootstrap.sh

@@ -39,6 +39,7 @@ owned_skills=(
   local-model-serving
   mechanism-audit
   meeting-transcription
+  public-source-release-audit
   silent-pushes-setup
   spec-creation-updating
   swift-testing

public-source-release-audit/SKILL.md

@@ -0,0 +1,67 @@
+---
+name: public-source-release-audit
+description: Audit a repository before public publication when committed files, Git history, workflow runner trust, credentials, private machine paths, or GitHub protection settings could leak or weaken the public source boundary. Use for public-repository launches, release readiness, repository visibility changes, or investigation of a suspected public-source leak; do not use it as a substitute for product security review.
+---
+
+# Public Source Release Audit
+
+Use the bundled gate as the deterministic oracle, then apply judgment only to
+the residual public meaning that a scanner cannot decide.
+
+## Run The Gate
+
+From the repository being audited, resolve this skill's installed directory
+and run:
+
+```bash
+node <skill-directory>/scripts/public-source-release-audit.mjs --repo .
+```
+
+This scans `HEAD` and the Git index, not dirty working-tree replacements. Stage
+the intended publication candidate before relying on the result.
+
+Before a public launch or after a suspected leak, use a complete, non-shallow
+clone with all public refs and Git LFS objects present, then add `--history`.
+History mode fails closed for shallow or grafted repositories.
+
+For live GitHub controls, add the canonical repository and every required check:
+
+```bash
+node <skill-directory>/scripts/public-source-release-audit.mjs \
+  --repo . --github OWNER/REPO --required-check CHECK_NAME
+```
+
+The GitHub mode requires evidence for public visibility, secret scanning, push
+protection, strict default-branch status checks bound to GitHub Actions,
+deletion and force-push protection, zero ruleset bypass actors, and no
+self-hosted runner available to the public repository. Inability to read
+required evidence is a failure, not a clean result.
+
+## Interpret Results
+
+- Any error finding blocks publication. Do not bypass it by scanning a dirty
+  replacement, dropping history, or weakening a rule.
+- The gate never prints matched credential or path values. Preserve that
+  redaction in reports, issues, logs, and review comments.
+- Workflow advisories identify mutable action refs, `pull_request_target`, or
+  dynamic runner selection that needs threat-model review. Use
+  `--fail-on-warning` when the repository has adopted those stricter policies.
+- A historical credential requires credential revocation and a decision about
+  history remediation. Removing it only from the current tree is not closure.
+- Fetch and verify missing Git LFS objects; do not allowlist an unaudited
+  pointer.
+
+## Finish The Human Audit
+
+The gate detects high-confidence credentials, private-key blocks, non-generic
+machine homes, sensitive filenames and symlink targets, encoding variants,
+and mechanical repository controls. It cannot decide whether ordinary prose,
+screenshots, customer facts, private repository links, internal task names, or
+business context are approved for publication. Review the staged diff, commit
+messages, workflows, generated artifacts, and public-facing metadata for those
+semantic leaks before declaring the source safe.
+
+Report the exact command, audited ref, whether history and live GitHub evidence
+were included, error/advisory rule IDs, remediation, and remaining uncertainty.
+Do not change GitHub settings, rewrite history, revoke credentials, push, or
+publish without the authorization required for that separate action.

public-source-release-audit/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Public Source Release Audit"
+  short_description: "Audit repositories before public release"
+  default_prompt: "Use $public-source-release-audit to verify this repository's committed source, history, workflow trust, and live GitHub protections before publication."