[velzepooz]

Summary

• Stop publishing internal STATUS and release-readiness documents while preserving their local files and copying them to the private workspace snapshot in skilltrust PR #190.
• Remove dead public doc-map links and reword forbidden-token matches in documentation, log warnings and test names without changing Action behavior.
• Keep the README prohibition test meaningful: workspace verification exempts only this exact test file because its negative assertions must name prohibited terms.

Checks

• make verify-clone passes against local commits in all three repositories; it checks tracked files and relative links in fresh clones.
• 31 focused renderer and report Bats tests, README prohibition Bats test and 13 Python tests pass.
• Full local macOS Bats: 120/122 pass; two pre-existing portability failures (BSD grep on NUL log; Bash 3.2 lowercase expansion) remain. CI Ubuntu will validate the full suite.

Publication cleanup cannot remove historical commits already fetched.

Amp thread: https://ampcode.com/threads/T-01a0e497-3af5-777e-a9af-278e87e7c9d6

[github-actions]

SkillTrust — Clean — no findings

SkillTrust check passes — no findings.

If this check is required, failure blocks merging.

Comparison off; new, existing and fixed status is unknown.

Next: No finding remediation is needed in the scanned scope. Review the rest of the PR as usual.

Current findings (0)

None.

Grades for the current scan

Grades describe findings, not whether this check fails. The policy above determines the check result.

Axis	Grade
Security	A
Permission hygiene	A
Transparency	A

Scan details and scope

Run	Value
Scope	tests/fixtures/clean-repo
Checkout	Workflow checkout
Engine	skill-detector 0.12.1
Mode	Gate policy
Files scanned	1
Comparison	Off

Supported boundary

SkillTrust checks supported agent configuration files in the selected scope. A clean result means no supported rule matched; it is not a guarantee that the repository is safe.

Complete result

The validated, unmodified JSON is retained at the scan-json-path output. To retrieve it after the job, upload that path with actions/upload-artifact; see the Action docs.

---

SkillTrust Action docs · scan-action@v1 · Detector 0.12.1