feat(skills): reference contracts and invocation policies for airbase, auth, services and core skills

2026-09-30 12:33:27 +03:00
parent 59571b018f
commit 0ab353475f
13 changed files with 55 additions and 2 deletions
@@ -2,4 +2,4 @@ interface:
  display_name: "Управление AirBase"
  short_description: "Изменение схемы, записей и доступа AirBase"
 policy:
-  allow_implicit_invocation: true
+  allow_implicit_invocation: false
@@ -0,0 +1,8 @@
 # AirBase mutation contract
 - Resolve the user's selected project and exact Base before any mutation. Use the returned project and Base identifiers.
 - Read the target table schema and current records first. Use field IDs, link targets and allowed values returned by SHD.
 - Validate record values before create or update. Preview bulk create/upsert with `dry_run=true` and resolve every conflict before writing.
 - Bulk cell updates have no dry-run. Review every record/field/value tuple before calling the mutation tool.
 - Read the action schema and field usages before schema changes. Require explicit intent and confirmation for destructive changes, public access changes and external-table detachment.
 - Keep AirBase project data separate from global System Base data.
@@ -2,4 +2,4 @@ interface:
  display_name: SHD AirBase queries
  short_description: Чтение записей и связей проекта
 policy:
-  allow_implicit_invocation: true
+  allow_implicit_invocation: false
@@ -0,0 +1,7 @@
 # AirBase query contract
 - Search the resolved Base by concrete terms, then follow populated record links by their returned IDs.
 - Relationship traversal is limited to four hops. Report `partial`, `truncated`, missing/failed reverse scans and depth-limit flags as limits on the result.
 - A missing reverse scan or incomplete traversal is not proof that no matching relationship exists.
 - Use live table and field IDs from returned schemas. Do not infer relationships from names, groups or expected wiring conventions.
 - Return the shortest supported evidence chain and identify its first missing link.
@@ -1,3 +1,5 @@
 interface:
  display_name: SHD authenticated profile
  short_description: Inspect and update the authenticated profile
 policy:
  allow_implicit_invocation: false
@@ -0,0 +1,7 @@
 # Authenticated profile contract
 - Read the current-user resource before changing profile data and use the server's current concurrency values.
 - Change only fields explicitly requested by the user and accepted by the profile tool schema.
 - Treat email, password, sessions, recovery information, access flags, tokens and OIDC subjects as sensitive or out of scope.
 - Unlink OIDC only on an explicit request and after the server confirms another sign-in method remains available.
 - Preserve idempotency requirements and report the persisted server readback without exposing secrets.
@@ -17,6 +17,8 @@ readback. Do not invent fields, statuses, identifiers, routes or capabilities.
 - AirBase project-data questions and relationship lookups: use AirBase tools
  and `shd-airbase-query`. For duplicates, broken links or a broader
  data-quality audit, use `shd-airbase-audit`.
 - AirBase schema, record, cell, field access, external table, public table
  access or import changes: use `shd-airbase-manage`.
 - Tasks, task projects, task status or task dates: use Tasks tools and the
  `shd-task-workflow` workflow.
 - Project files and paths: use Files tools and the `shd-project-files` workflow.
@@ -1,3 +1,5 @@
 interface:
  display_name: SHD services catalog
  short_description: Inspect and manage the SHD service catalog
 policy:
  allow_implicit_invocation: false
@@ -0,0 +1,7 @@
 # Service lifecycle contract
 - Resolve the organization, service, version, site and publication from server results before acting.
 - Read relevant service versions, usage and publication state before changing a lifecycle state.
 - Keep draft, pending approval, published, failed, revoked, archived and restored states distinct. A version status alone does not prove publication succeeded.
 - Editing a draft does not authorize publication. Publish, approve, archive, restore or revoke only the transition explicitly requested.
 - Use fresh idempotency keys for publication/retry operations and verify the persisted publication result. Do not expose private credentials.
@@ -1,3 +1,5 @@
 interface:
  display_name: SHD short links
  short_description: Manage SHD short links and aliases
 policy:
  allow_implicit_invocation: false
@@ -0,0 +1,7 @@
 # Short-link safety contract
 - Resolve the exact link, owner, project, alias and status from current server data before updating it.
 - Treat target URLs, public aliases, access flags and bearer tokens as sensitive. Never return bearer tokens or private redirect data.
 - Change only requested fields and preserve the server's expected-version and idempotency contract.
 - Rotation or revocation requires an explicit request, `confirm=true`, current concurrency data and a fresh idempotency key.
 - Report the link ID, alias, affected fields, resulting status and server readback.
@@ -1,3 +1,5 @@
 interface:
  display_name: SHD System Base
  short_description: Inspect allowlisted global SHD tables
 policy:
  allow_implicit_invocation: false
@@ -0,0 +1,7 @@
 # System Base contract
 - System Base is global and uses an allowlisted table set. Resolve table, record and field IDs from the server.
 - Read the schema and current record/cell before an update. Preserve the current expected value and `record_version`.
 - Update only the explicitly requested cell and use a fresh idempotency key.
 - Deletion requires an explicit request, `confirm=true`, the current expected version and persisted readback.
 - Keep System Base separate from project AirBase data; do not invent table names or broaden filters.