feat(skills): reference contracts and invocation policies for airbase, auth, services and core skills

2026-09-30 12:33:27 +03:00
parent 59571b018f
commit 0ab353475f
13 changed files with 55 additions and 2 deletions
@@ -1,3 +1,5 @@
 interface:
  display_name: SHD authenticated profile
  short_description: Inspect and update the authenticated profile
+policy:
+  allow_implicit_invocation: false
@@ -0,0 +1,7 @@
+# Authenticated profile contract
+
+- Read the current-user resource before changing profile data and use the server's current concurrency values.
+- Change only fields explicitly requested by the user and accepted by the profile tool schema.
+- Treat email, password, sessions, recovery information, access flags, tokens and OIDC subjects as sensitive or out of scope.
+- Unlink OIDC only on an explicit request and after the server confirms another sign-in method remains available.
+- Preserve idempotency requirements and report the persisted server readback without exposing secrets.