AgentStack
SKILL verified MIT Self-run

Ssot Preflight

skill-huangpufan-ssot-skill-ssot-preflight · by huangpufan

Repository SSOT preflight before substantive code, config, docs, review, debugging, refactoring, or planning work. Use to check SSOT/STATUS.md, open adjudications, documentation language, protocol version, minimal SSOT read routing, and in-task SSOT write triggers. Do not use for pure operations, trivial format-only edits, or non-repository chat.

No reviews yet
0 installs
13 views
0.0% view→install

Install

$ agentstack add skill-huangpufan-ssot-skill-ssot-preflight

✓ scanned · ✓ verified — works with Claude Code, Cursor, and more.

Security review

✓ Passed

No issues found. Passed automated security review. · v0.1.0 How review works →

  • Prompt-injection patterns
  • Secret / credential exfiltration
  • Dangerous shell & filesystem operations
  • Untrusted network calls
  • Known-malicious package signatures

What it can access

  • Network access No
  • Filesystem access No
  • Shell / process execution No
  • Environment & secrets No
  • Dynamic code execution No

From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.

Are you the author of Ssot Preflight? Claim this listing to set pricing, connect Stripe payouts, and keep 70% of every sale.
Sign up to claim

About

SSOT Preflight

You are at the start of substantive repository work. Your job here is not to do the work — it is to decide what's safe to read, what's blocked, and what durable facts you must capture as you go. Do not write code or docs until this gate clears.

Clear the gate

Read SSOT/STATUS.md first. Treat any substantive change as blocked until you have answered, in order:

  • Adjudications. Any pending item under ## 开放裁决项 (or legacy

## 待裁决项), or a deferred item whose revisit condition has fired, blocks ordinary work until resolved or re-deferred.

  • Documentation language. Read documentation_language and its

evidence; SSOT Markdown you write this task must match it — except for paths, commands, identifiers, enum values, API names, and direct quotes.

  • Protocol version. Compare this file's metadata.protocol_version

against STATUS.md tracked_skill_version. Project behind -> stop, route to $ssot-audit. Installed bundle behind project -> report stale install; never downgrade the project. If a source checkout under projects/SSOT-SKILL/ is newer than the runtime-installed skill copy currently being read (.agents/skills, .codex/skills, .claude/skills, etc.), report the install as stale and reinstall from the source checkout before relying on new protocol clauses.

Route your reads, don't bulk-load

Start from SSOT/README.md — its task-entry map is the project-specific router. Read only what the task needs. Always include product/README.md when the task may touch user value, PRD, capabilities, journeys, roadmap, or acceptance; include architecture/README.md unless the task is clearly product-only, operational, historical, or pure format.

Skip this entire skill only for non-repository chat, pure command execution, or mechanical typo/format edits that cannot alter architecture, contracts, state, behaviour, workflows, tests, doc truth, or external surfaces.

Capture durable facts as they surface

While working, watch for facts that outlive this task — new/removed APIs, schema, contracts, lifecycle, trust boundaries, deployment policy, test policy, confirmed root causes, user-locked decisions, product promises, "do not revive" paths, repeated-failure-derived agent discipline. When one appears, either update the unique authority immediately (when clear), or write a short delta and resolve it at $ssot-closeout before final response, claim_done, or commit. Detail (including the Rule / Trigger / Why / Evidence / Failure-mode discipline schema) lives in references/area-model.md §2.5 and in $ssot-closeout references — not here.

Surface task-relevant open risks

Before implementation or final planning, scan the SSOT owners routed by the task plus STATUS.md ## Open Gaps, active tech-debt/, active or recurred bugs/, and relevant gotchas/. Report the entries whose trigger, path glob, owner, capability, journey, runtime owner, command, or failure mode overlaps the task. These are recommendations, not automatic blockers: each one must be handled during the task by fixing it, explicitly deferring it with the owner and reason still valid, or naming the next action in closeout.

Classify each overlapping entry before work starts:

  • fix-now: current facts are wrong, misleading to the agent, or block

closeout alignment.

  • recommend-now: low-cost, high-confidence repair that should be handled in

this batch.

  • defer-visible: not blocking this batch, but deferral must name the owner or

owner record, reason, closure condition, revisit signal, verification guard, and next concrete action.

  • ignore-for-scope: no task overlap after inspection; name why it is outside

this batch.

defer-visible is a floor, not an excuse to disappear work. Vague wording such as "later", "someday", "future work", or a locked-language equivalent of "handle later" is invalid unless the same record or STATUS row carries the owner/record pointer and the retrigger/guard that makes the deferral visible to the next agent.

Do not treat downgraded working docs or historical source material as current open risk unless STATUS or an owner entry promotes the risk. Do not hide a fallback, compat shim, temporary workaround, TODO/FIXME/HACK, later-remove note, or waiver behind ordinary prose; it must have a registered owner, reason, closure condition, revisit signal, and verification guard in tech-debt/, bugs/, decisions/, or STATUS.md as appropriate.

Park user-directive signals

Watch the user's prompts for an explicit lift-or-kill directive ("promote this", "never again"), a repeated same-kind correction across turns, or recent prompts clustering in one domain. When one surfaces and the rule is not already a clear durable fact you can write into the unique authority per the section above, park one CAP- row (signal_source: user-directive, status: open) in SSOT/STATUS.md ## Pending Captures and let $ssot-closeout or $ssot-audit route it. Do not promote, do not edit any other SSOT file. Detail on the two evidence streams and the move schema lives in $ssot-closeout references/promotion-rationale.md.

When this skill is wrong, route out

| Situation | Skill | |---|---| | No SSOT/ yet, .bootstrap/ present, or coverage_result: bootstrap | $ssot-bootstrap | | About to commit, claim_done, or finalise after substantive change | $ssot-closeout | | Catch up commits / sessions, or protocol version is behind | $ssot-audit | | Health check, independent stop review, CORE-REF / ADAPTER / CONSUMPTION | $ssot-doctor | | Legacy $ssot-skill mention | route via ssot-skill shim back here |

Load on demand

| When the task hits | Read | |---|---| | STATUS coverage states, adjudications, gaps, waterlines, stop gates | references/status-protocol.md | | README/docs/ADR/runbook/PRD/core-ref classification and absorption | references/source-material.md | | Candidate / hypothesis / source-backed knowledge | references/knowledge-integrity.md | | Architecture root/views/domains, Reader Map, decomposition, coverage depth | references/architecture.md | | Top-level area responsibilities and task-entry mapping rules | references/area-model.md |

Things this gate must not be used for

  • A second code/schema/router source. Current implementation comes from

code, config, schema, tests, and actual behaviour — not SSOT.

  • Copying full source documents into SSOT. Absorb durable facts into one

authority with evidence; do not mirror.

  • Carrying candidate or hypothesis claims inside authoritative architecture

bodies.

  • Self-advancing tracked_commit, tracked_session,

tracked_skill_version, language lock, bootstrap passed, or converged without the required independent review.

  • Re-expanding this preflight file with bootstrap, doctor, audit, or

closeout procedures. Route to those skills.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

Install and usage instructions live in the source repository linked above.

Reviews

No reviews yet — be the first.

Versions

  • v0.1.0 Imported from the upstream source.