Install
$ agentstack add skill-hsienw-ai-agent-engineering-playbook-type-boundary-contract ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Type Boundary Contract
Skill Interface
- Name: type-boundary-contract.
- Description: Design and review type contracts across package, service, frontend, backend, tool, event, and transport boundaries, including schemas, discriminated unions, runtime parsers, error envelopes, schemaVersion fields, and duplicated transport or domain types.
- Parameters: Boundary owner, producer and consumer types, domain and transport shapes, runtime parser, schema version, unknown-field behavior, error envelope, compatibility expectations, and contract test scenarios.
- Instructions: Use this skill before defining or changing cross-boundary types. Treat boundary types as runtime contracts, separate domain and transport types, validate external data on receipt, preserve compatibility, and test valid, invalid, unknown, and future-version payloads.
Types at a boundary are contracts. Compile-time TypeScript types do not validate runtime data from clients, servers, tools, providers, files, queues, or models.
Boundary Process
- Identify the boundary owner.
- Separate domain type from transport type.
- Define runtime validation at the receiving boundary.
- Define versioning and unknown-field behavior.
- Define error envelope shape.
- Add contract tests for both valid and invalid data.
- Document compatibility expectations before changing existing fields.
Type Rules
- Use discriminated unions for state, event, and result variants.
- Use
unknownfor external data until parsed. - Avoid
anyat boundaries. - Do not use type assertions to hide unvalidated data.
- Avoid optional fields when a union variant would model required state better.
- Keep stable machine identifiers separate from localized messages.
- Use explicit schema versions for structured cross-boundary payloads.
Generic Result Pattern
type BoundaryResult = {
schemaVersion: string;
kind: TKind;
status: TStatus;
data?: TData;
summary?: string;
};
The producer may use narrow literal types. The consumer may accept wider compatible types when it must tolerate future versions.
Error Envelope
Use stable machine-readable fields:
type ErrorEnvelope = {
error: {
source: string;
stage: string;
code: string;
message: string;
retryable?: boolean;
details?: Record;
};
};
Do not expose stack traces, private paths, tokens, secrets, or raw provider responses.
Compatibility Checklist
- Request schema.
- Response schema.
- Event schema.
- Tool input schema.
- Tool output schema.
- Error code and retryability.
- Terminal state.
- Correlation identifiers.
- Unknown fields and unknown variants.
- Migration or deprecation plan.
Verification
Test valid data, missing fields, unknown fields, unknown variants, invalid schema versions, error envelopes, and future-compatible payloads.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: HsienW
- Source: HsienW/ai-agent-engineering-playbook
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.