What problem does it solve? Changes to security-critical paths in the CG-agent-harness codebase (shim, guards, writer, sandbox, workspace, default config) can silently weaken shipped security gates. This Skill provides a repeatable procedure to assert that documented security invariants still hold before merging such changes. ## Core Features & Use Cases - Invariant contract review: Reads INVARIANTS.md and the core-path list in AGENTS.md to establish the security contract before testing. - Targeted Rust test execution: Runs the narrowest applicable integration test suites (invariant_guard, shim_and_agent_routes, real_repo_loop, agentic_foundations, auth_guards, security_headers) with cloud API keys blanked. - Structural boundary inspection: Manually diffs imports across src/server and src/agentic, verifies REGISTERED_PATHS, shim::ACTIONS whitelist updates, and fail-closed config defaults. - Use Case: Before merging a pull request touching src/agentic/writer.rs, run this Skill to confirm write gates, kill-switch AND-semantics, and approval binding still hold, then report PASS/FAIL per invariant section with test evidence. ## Quick Start Ask the AI to check whether the harness security invariants still hold for the current diff touching src/shim and assets/config.default.yaml.
