What problem does it solve? Editing enforcement files — GitHub Actions workflows, lefthook.yml, ESLint, TypeScript, Vitest, Prettier, or Next.js configs — carries non-obvious risks: a mis-scoped ESLint block silently disables rules, an unpinned action opens a supply-chain hole, and a new check added to only one of check:source or ci.yml desynchronizes the two. This Skill encodes the rules, traps, and review obligations for changing any gate in this repository. ## Core Features & Use Cases - Gate synchronization rules: Explains that a new check requires three edits — the package script, the check:source composition, and the matching ci.yml step — kept in sync by tests/ci-sync.test.ts with explicit exception maps. - Workflow security linting knowledge: Documents every ERR_WORKFLOW_* rule enforced by tests/workflows.test.ts, including SHA-pinned actions, permissions blocks, concurrency rules, and fail-closed shell settings. - Hook and staged-content coverage: Details lefthook job ordering, the verify-never-install prepare script, and exactly what check-staged.mjs inspects (and deliberately skips, such as staged deletions). - Use Case: When asked to add a new CI job or loosen an ESLint rule, the Skill tells you which files must change together, which tests will fail if you skip one, and what the PR body must justify. ## Quick Start Ask the AI to add a new lint check to the repository's CI pipeline and explain which files must change together.
