the cold-agent adoption test passed by hand (a no-context subagent correctly discovered secrets, derived from .dev.vars, minted the random one, FLAGGED the user-only one without inventing it, wrote a valid .hush, wired 'hush exec'). worth turning into a repeatable CI check so the SKILL.md guidance can't silently rot.
shape: a fixture repo (.dev.vars + wrangler.jsonc + code refs + README) + a scripted check of the adoption STEPS (deterministic, not a live LLM): seed via set/mint, write .hush, assert 'hush exec' injects the right vars, assert the never-print contract. one env is plenty (the adoption logic is OS-agnostic; backends are already matrix-tested). low priority / nice-to-have.
the cold-agent adoption test passed by hand (a no-context subagent correctly discovered secrets, derived from .dev.vars, minted the random one, FLAGGED the user-only one without inventing it, wrote a valid .hush, wired 'hush exec'). worth turning into a repeatable CI check so the SKILL.md guidance can't silently rot.
shape: a fixture repo (.dev.vars + wrangler.jsonc + code refs + README) + a scripted check of the adoption STEPS (deterministic, not a live LLM): seed via set/mint, write .hush, assert 'hush exec' injects the right vars, assert the never-print contract. one env is plenty (the adoption logic is OS-agnostic; backends are already matrix-tested). low priority / nice-to-have.