OpsTruth Verification

Skills

• audit-repository

  Use this when a user needs live, read-only evidence about a public GitHub repository, from a quick map to a broad readiness audit, environment review, secret-risk scan, API review or migration review. Do not use it for private repositories, credentials, code execution or write actions.

• reconcile-agent-claims

  Use this when a user asks whether an AI or agent really finished a public-repository task, whether claims drift from live evidence, or which lowest-authority verification capability should run next. Do not treat static files, signatures or one health response as proof of execution or correctness.

• review-change-safety

  Use this before implementation, pull-request handoff, migration, deployment or publication when a user needs static safety evidence about visible API, environment, secret or deployment changes in a public GitHub repository. Do not accept credentials or perform writes.

• trace-application

  Use this when a user asks how a public GitHub application is wired, where requests enter, which routes or API surfaces exist, or which runtime claims repository evidence can support. This is static tracing only and must not be used to claim reachability, authentication or application correctness.

• verify-action-receipt

  Use this when a user supplies an AgentProof v2 receipt, OpsTruth evidence receipt, complete OpsTruth v1 execution handoff, or sealed DoneState v2 verification handoff and needs integrity, signer trust or fresh outcome verification. Never execute, repeat or trust the underlying action merely because its receipt is cryptographically valid.

• verify-release-readiness

  Use this when a user asks whether a public GitHub repository has visible CI, deployment, packaging or handoff evidence for a release. It never deploys or publishes; conclude only with Ready for live validation, Insufficient evidence or Not ready.