What problem does it solve? Code changes to security-critical paths can silently break isolation boundaries, guard ordering, or fail-closed defaults. This Skill provides a structured checklist and runnable test evidence to confirm that core security invariants still hold before pushing PRs that touch src/shim, guards.rs, headers.rs, writer.rs, sandbox.rs, workspace.rs, or config.default.yaml. ## Core Features & Use Cases - Invariant Boundary Verification: Checks I6 process isolation (server never imports agentic code), guard chain order, CSRF contracts, and clone jail contracts against current INVARIANTS.md and source. - Runnable Test Evidence: Maps each boundary to concrete cargo test commands such as invariant_guard, auth_guards, write_policy, and web_research suites. - Fail-Closed Config Auditing: Confirms master/deepagent/clone-write gates default to false, auth/TLS defaults to true, and the URL allowlist starts empty. - Use Case: Before merging a PR that modifies guards.rs, run this Skill to walk each boundary table row, execute the listed test suites with isolated homes, and record tested source, commands, outcomes, and unresolved limits. ## Quick Start Verify that all core security invariants still hold after my changes to guards.rs and writer.rs before I push this PR.
