From 3e0d30d5695adac47c38a779f2bdba49561fce0c Mon Sep 17 00:00:00 2001
From: aoirint <aoirint@gmail.com>
Date: Wed, 12 Aug 2026 00:01:22 +0900
Subject: [PATCH 1/2] build: update agent skills

Co-authored-by: Codex <noreply@openai.com>
---
 .agents/skills/apm-workflow/SKILL.md          | 32 +++++++++
 .agents/skills/docker-quality-check/SKILL.md  | 58 +++++++++++-----
 .../docker-quality-check/agents/openai.yaml   |  7 +-
 .../actions/check-docker-source/action.yml    | 18 +----
 .../check-docker-source/install-hadolint.sh   | 29 --------
 .../assets/github/workflows/main.yml          | 15 +++-
 .../assets/github/workflows/pull-request.yml  | 15 +++-
 .../references/ci-template-contract.md        | 22 +++---
 .../references/registry-image-deletion.md     | 58 ++++++++++++++++
 .agents/skills/security-check/SKILL.md        | 44 +++++++++++-
 .../skills/security-check/agents/openai.yaml  |  7 +-
 .../distributed-software-licensing.md         | 65 +++++++++++++++++
 THIRD_PARTY_NOTICES.md                        |  4 +-
 apm.lock.yaml                                 | 69 +++++++++++--------
 apm.yml                                       |  2 +-
 15 files changed, 327 insertions(+), 118 deletions(-)
 delete mode 100644 .agents/skills/docker-quality-check/assets/github/actions/check-docker-source/install-hadolint.sh
 create mode 100644 .agents/skills/docker-quality-check/references/registry-image-deletion.md
 create mode 100644 .agents/skills/security-check/references/distributed-software-licensing.md

diff --git a/.agents/skills/apm-workflow/SKILL.md b/.agents/skills/apm-workflow/SKILL.md
index 205147c..0ff451a 100644
--- a/.agents/skills/apm-workflow/SKILL.md
+++ b/.agents/skills/apm-workflow/SKILL.md
@@ -61,6 +61,38 @@ hashes, and review for every changed third-party dependency.
 10. Treat the CLI and agent dependencies as supply-chain-sensitive code. Check the
    repository policy and any organization policy before proceeding.
 
+### 1.1 Regenerate a lockfile without losing deployment ownership
+
+When a CLI migration or ledger repair requires deleting and rebuilding the lockfile,
+preserve the old lockfile's ownership evidence before removing it. Generated target
+files can remain on disk after the ledger is gone; a new resolver may then classify
+them as unmanaged local content, skip the collision, and silently omit a requested
+Skill or resource from the new lockfile.
+
+1. From the old lockfile, record the selected packages and Skill subsets, deployment
+   owners, deployed paths, content hashes, target roots, and generator version. Compare
+   this snapshot with `apm.yml` and the filesystem before changing anything.
+2. Identify collisions in the actual target root. Distinguish paths owned by the old
+   APM ledger from project-authored Skills, files owned by another package, and unknown
+   local content. Never move or delete a path whose ownership is ambiguous.
+3. Before removing the old lockfile, move only the exact, verified APM-owned generated
+   collision paths to a task-specific temporary backup outside the repository. Preserve
+   relative paths and hashes so the old deployment can be restored. Do not use
+   `--force` to overwrite a collision or clear the entire agent target.
+4. Remove only the validated project lockfile, regenerate it with the selected CLI, and
+   run the frozen install. A skipped-file or collision warning is a blocker, even when
+   the command exits successfully.
+5. Compare the new package list, requested Skill subsets, deployed paths, and target
+   roots with the manifest and the old snapshot. Every removed or added path needs an
+   expected dependency or generator explanation; an unexpectedly missing selected
+   Skill is lock-generation failure.
+6. Run `apm audit --ci` and directly verify representative restored files and hashes.
+   If regeneration, installation, comparison, or audit fails, restore the old lockfile
+   and backed-up paths instead of accepting a partial deployment.
+7. Delete the temporary backup only after the new lockfile, deployed output, diff, and
+   audit all pass. Record any ownership ambiguity or tool collision behavior in the
+   handoff.
+
 ## 2. Obtain the selected eligible APM version safely
 
 Reuse an installed copy only when its exact version matches the selected
diff --git a/.agents/skills/docker-quality-check/SKILL.md b/.agents/skills/docker-quality-check/SKILL.md
index f065539..8b129c3 100644
--- a/.agents/skills/docker-quality-check/SKILL.md
+++ b/.agents/skills/docker-quality-check/SKILL.md
@@ -3,7 +3,8 @@ name: docker-quality-check
 description: >-
   Quality-check Dockerfiles, Compose configurations, container startup scripts,
   image CI, and container documentation. Use when creating, editing, or reviewing
-  container build, runtime, orchestration, or publication changes.
+  container build, runtime, orchestration, publication, or explicitly authorized
+  registry image deletion changes.
 ---
 
 # Docker Quality Check
@@ -11,7 +12,7 @@ description: >-
 ## When to Use
 
 - Use for changes to Dockerfiles, Compose files, container entrypoints, image build
-  automation, or container-facing documentation.
+  automation, registry publication or deletion, or container-facing documentation.
 - Use before committing or publishing container changes.
 
 ## Goals
@@ -19,6 +20,8 @@ description: >-
 - Keep container builds reproducible, minimal, and suitable for the intended runtime.
 - Validate both Dockerfile syntax and the changed build or Compose behavior.
 - Make third-party images, downloaded tools, and CI actions traceable and reviewable.
+- Keep notices for software distributed in the image visible and distinct from
+  development-only dependency notices.
 
 ## Workflow
 
@@ -26,8 +29,12 @@ description: >-
    runtime user, exposed services, mounted paths, environment variables, and expected
    startup behavior.
 2. Run the repository's documented container checks. When no project-specific command
-   exists, use `hadolint` for each changed Dockerfile and `docker compose config` for
-   each changed Compose configuration.
+   exists, use the Dockerfile frontend's official build checks (`docker buildx build
+   --check`) for each changed Dockerfile and `docker compose config` for each changed
+   Compose configuration. Pass the same context, file, target, platform, and build
+   arguments as the affected build contract. Treat hadolint as an optional additive
+   check only when the repository intentionally relies on its ShellCheck or package
+   policy rules and the selected hadolint parser supports the Dockerfile syntax.
 3. Build the affected image or target with `docker build` or `docker compose build`.
    Pass only the build arguments and secrets required by the documented build contract;
    never place credentials in image layers, build logs, or committed configuration.
@@ -37,7 +44,16 @@ description: >-
 5. Inspect image and runtime safety: use a non-root user where feasible, keep the final
    image free of build-only tooling and secrets, define a clear entrypoint, and avoid
    mutable base-image tags when an immutable digest is practical.
-6. For newly introduced or updated external images, downloaded executables, or GitHub
+6. Inventory third-party software copied, installed, linked, or otherwise distributed in
+   the final image. Put notices for the primary bundled application and other shipped
+   runtime content at the top of `THIRD_PARTY_NOTICES.md`, before build tools, CI Actions,
+   Agent Skills, or other development-only dependencies. For each primary bundled
+   application, record its source, bundled location, version source, and license. Verify
+   that required upstream license and notice files remain in the final image. Add a
+   README disclosure that names the application, version source, and license and links to
+   both `THIRD_PARTY_NOTICES.md` and upstream license information. Mark unavailable
+   version, license, or final-image evidence as unverified rather than inferring a pass.
+7. For newly introduced or updated external images, downloaded executables, or GitHub
    Actions, use `security-check` to assess provenance, version or digest pinning,
    release age, checksums, permissions, and runtime behavior. Pin GitHub Actions to
    full commit SHAs with accurate version comments. Use
@@ -46,24 +62,33 @@ description: >-
    `apm-workflow` and keep `apm audit --ci` in the outer source-check action.
    Keep Markdown source validation in that same action so container-only
    changes cannot bypass the repository documentation gate.
-7. Summarize commands run, build and smoke-test results, and every skipped check with a
+8. Summarize commands run, build and smoke-test results, and every skipped check with a
    concrete reason.
+9. For an explicitly authorized registry image deletion, follow
+   [registry-image-deletion.md](references/registry-image-deletion.md). Treat registry
+   state as the source of truth: resolve exact targets before mutation, account for
+   shared manifests and registry-specific deletion units, and verify retained and
+   removed references independently afterward. This procedure does not define a
+   retention policy or recommend when deletion should occur.
 
-## CI Tool Pinning
+## Dockerfile Check Selection
 
-When a workflow installs hadolint, pin both the release version and the SHA-256 of the
-exact platform asset. Download over HTTPS, verify the hash before making the file
-executable, and install it only into the runner's temporary directory. Before changing
-a pin, verify the official release provenance and the repository's required adoption
-cooldown. Use the bundled `check-docker-source` action when its single-Dockerfile contract fits.
+Prefer BuildKit build checks because they use the Dockerfile frontend selected by the
+repository and validate build options as well as the file. In GitHub Actions, use
+`docker/build-push-action` with `call: check`, or the equivalent
+`docker buildx build --check` command after setting up Buildx. A check invocation does
+not execute the image build, so keep a real build as a separate integrated-source gate.
 
-Replace the version and checksum together only after independently verifying the
-official release asset. Do not use a floating download URL or skip hash verification.
+Do not silently substitute hadolint when BuildKit checks are available. Hadolint parses
+the Dockerfile independently and can reject supported frontend syntax before its rules
+run. When a repository adds hadolint for complementary rules, document that purpose,
+verify syntax compatibility, and pin the version and exact asset SHA-256 under the
+repository's adoption policy.
 
 ## Default Checks
 
 ```shell
-hadolint Dockerfile
+docker buildx build --check .
 docker build -t local-validation .
 docker compose config
 ```
@@ -76,6 +101,7 @@ builds or starts correctly.
 
 Read [ci-template-contract.md](references/ci-template-contract.md) before creating or
 repairing Docker CI. The bundled files under `assets/github/` keep pull-request checks
-limited to lint and reserve image builds for the exact integrated main-branch commit.
+limited to source and BuildKit validation and reserve image builds for the exact integrated
+main-branch commit.
 Apply `github-actions-quality-check` for shared event, permission, runner, pinning, and
 repository-enforcement policy.
diff --git a/.agents/skills/docker-quality-check/agents/openai.yaml b/.agents/skills/docker-quality-check/agents/openai.yaml
index f5b373b..a3e8004 100644
--- a/.agents/skills/docker-quality-check/agents/openai.yaml
+++ b/.agents/skills/docker-quality-check/agents/openai.yaml
@@ -1,6 +1,7 @@
 interface:
   display_name: "Docker Quality Check"
-  short_description: "Review container build and runtime changes."
+  short_description: "Review container lifecycle changes safely."
   default_prompt: >-
-    Use $docker-quality-check to review this Dockerfile, Compose, entrypoint, or
-    container CI change for build correctness, runtime safety, pinning, and validation.
+    Use $docker-quality-check to review this Dockerfile, Compose, entrypoint,
+    container CI, publication, or authorized registry deletion change for build
+    correctness, runtime safety, pinning, and validation.
diff --git a/.agents/skills/docker-quality-check/assets/github/actions/check-docker-source/action.yml b/.agents/skills/docker-quality-check/assets/github/actions/check-docker-source/action.yml
index b3979ed..c86fe66 100644
--- a/.agents/skills/docker-quality-check/assets/github/actions/check-docker-source/action.yml
+++ b/.agents/skills/docker-quality-check/assets/github/actions/check-docker-source/action.yml
@@ -1,5 +1,5 @@
 name: Check Docker source
-description: Audit APM, lint Docker and Markdown source, and remove action-owned tools.
+description: Audit APM and lint Markdown source before Docker frontend checks.
 
 runs:
   using: composite
@@ -14,24 +14,8 @@ runs:
       shell: bash
       run: apm audit --ci
 
-    - name: Install checksum-verified hadolint
-      shell: bash
-      env:
-        HADOLINT_VERSION: v2.15.1
-        HADOLINT_SHA256: c7187db94eeeeca956519a6af171adc31453941a1e777961f6e680f697c8c507
-      run: bash "${{ github.action_path }}/install-hadolint.sh"
-
-    - name: Lint Dockerfile
-      shell: bash
-      run: hadolint Dockerfile
-
     - name: Lint Markdown source
       uses: DavidAnson/markdownlint-cli2-action@ce4853d43830c74c1753b39f3cf40f71c2031eb9 # v23.0.0
       with:
         config: .markdownlint-cli2.yaml
         globs: "**/*.md"
-
-    - name: Remove hadolint
-      if: always()
-      shell: bash
-      run: rm -rf -- "${RUNNER_TEMP}/hadolint"
diff --git a/.agents/skills/docker-quality-check/assets/github/actions/check-docker-source/install-hadolint.sh b/.agents/skills/docker-quality-check/assets/github/actions/check-docker-source/install-hadolint.sh
deleted file mode 100644
index 30d7a78..0000000
--- a/.agents/skills/docker-quality-check/assets/github/actions/check-docker-source/install-hadolint.sh
+++ /dev/null
@@ -1,29 +0,0 @@
-#!/usr/bin/env bash
-
-set -euo pipefail
-
-main() {
-  : "${HADOLINT_VERSION:?HADOLINT_VERSION is required}"
-  : "${HADOLINT_SHA256:?HADOLINT_SHA256 is required}"
-  : "${RUNNER_TEMP:?RUNNER_TEMP is required}"
-  : "${GITHUB_PATH:?GITHUB_PATH is required}"
-
-  local asset=hadolint-linux-x86_64
-  local install_dir="${RUNNER_TEMP}/hadolint/bin"
-  local download_path="${install_dir}/${asset}"
-  mkdir -p "$install_dir"
-  curl \
-    --fail \
-    --location \
-    --show-error \
-    --silent \
-    --output "$download_path" \
-    "https://github.com/hadolint/hadolint/releases/download/${HADOLINT_VERSION}/${asset}"
-  printf '%s  %s\n' "$HADOLINT_SHA256" "$download_path" |
-    sha256sum --check --strict
-  mv "$download_path" "${install_dir}/hadolint"
-  chmod 0755 "${install_dir}/hadolint"
-  printf '%s\n' "$install_dir" >>"$GITHUB_PATH"
-}
-
-main "$@"
diff --git a/.agents/skills/docker-quality-check/assets/github/workflows/main.yml b/.agents/skills/docker-quality-check/assets/github/workflows/main.yml
index 9fd2eae..2429f20 100644
--- a/.agents/skills/docker-quality-check/assets/github/workflows/main.yml
+++ b/.agents/skills/docker-quality-check/assets/github/workflows/main.yml
@@ -15,9 +15,8 @@ concurrency:
 jobs:
   check:
     name: Check
-    # Keep the lightweight gate independent from Docker daemon requirements.
-    runs-on: ubuntu-slim
-    timeout-minutes: 5
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
 
     steps:
       - name: Checkout integrated source
@@ -28,6 +27,16 @@ jobs:
       - name: Lint Docker source
         uses: ./.github/actions/check-docker-source
 
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+
+      - name: Check Docker build configuration
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          call: check
+          context: .
+          file: ./Dockerfile
+
   build:
     name: Build
     needs:
diff --git a/.agents/skills/docker-quality-check/assets/github/workflows/pull-request.yml b/.agents/skills/docker-quality-check/assets/github/workflows/pull-request.yml
index 4e324bd..3cafa7b 100644
--- a/.agents/skills/docker-quality-check/assets/github/workflows/pull-request.yml
+++ b/.agents/skills/docker-quality-check/assets/github/workflows/pull-request.yml
@@ -18,9 +18,8 @@ concurrency:
 jobs:
   check:
     name: Check
-    # Avoid a network-intensive image build for proposed source.
-    runs-on: ubuntu-slim
-    timeout-minutes: 5
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
 
     steps:
       - name: Checkout proposed source
@@ -30,3 +29,13 @@ jobs:
 
       - name: Lint Docker source
         uses: ./.github/actions/check-docker-source
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+
+      - name: Check Docker build configuration
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          call: check
+          context: .
+          file: ./Dockerfile
diff --git a/.agents/skills/docker-quality-check/references/ci-template-contract.md b/.agents/skills/docker-quality-check/references/ci-template-contract.md
index fb0e112..dbd2d91 100644
--- a/.agents/skills/docker-quality-check/references/ci-template-contract.md
+++ b/.agents/skills/docker-quality-check/references/ci-template-contract.md
@@ -2,17 +2,17 @@
 
 ## Purpose
 
-Use the bundled baseline for a repository with one root `Dockerfile`. It keeps proposed-source
-checks fast by running hadolint only. The integrated main-branch workflow repeats lint and then
-builds the exact merged commit without publishing it.
+Use the bundled baseline for a repository with one root `Dockerfile`. Proposed-source checks use
+the official Dockerfile frontend without executing a build. The integrated main-branch workflow
+repeats the check and then builds the exact merged commit without publishing it.
 
 ## Files
 
 | Skill asset | Consumer path | Contract |
 | --- | --- | --- |
-| `assets/github/actions/check-docker-source/action.yml` | `.github/actions/check-docker-source/action.yml` | Install checksum-verified hadolint and lint the root `Dockerfile`. |
-| `assets/github/workflows/pull-request.yml` | `.github/workflows/pull-request.yml` | Lint pull-request and merge-queue source; cancel superseded runs. |
-| `assets/github/workflows/main.yml` | `.github/workflows/main.yml` | Re-run lint and build the integrated commit; never cancel it. |
+| `assets/github/actions/check-docker-source/action.yml` | `.github/actions/check-docker-source/action.yml` | Audit APM and lint Markdown independently from Docker setup. |
+| `assets/github/workflows/pull-request.yml` | `.github/workflows/pull-request.yml` | Run BuildKit checks for pull-request and merge-queue source; cancel superseded runs. |
+| `assets/github/workflows/main.yml` | `.github/workflows/main.yml` | Re-run BuildKit checks and build the integrated commit; never cancel it. |
 
 Copy the files into the consumer repository. Consumer workflows must run committed
 repository-owned files and must not execute the installed Skill at runtime.
@@ -20,7 +20,7 @@ repository-owned files and must not execute the installed Skill at runtime.
 ## Allowed substitutions
 
 - Replace `main` only with the confirmed protected integration branch.
-- Replace the root Dockerfile path or add a lint matrix when the repository owns multiple
+- Replace the root Dockerfile path or add a check matrix when the repository owns multiple
   Dockerfiles.
 - Pass repository-evidenced build contexts, Dockerfile paths, targets, build arguments, secrets,
   or cache settings to the integrated build.
@@ -28,8 +28,10 @@ repository-owned files and must not execute the installed Skill at runtime.
 - Add registry authentication and publication only in an integration job with the minimum required
   permissions and secrets.
 - Make an immutable release depend directly on the published image and every required image test.
-- Update external Action pins or the hadolint version and checksum only after `security-check`
-  verifies provenance, runtime behavior, exact identity, and cooldown eligibility.
+- Add hadolint only for documented complementary rules after verifying that it supports the
+  selected Dockerfile frontend syntax. Apply `security-check` to its version and asset checksum.
+- Update external Action pins only after `security-check` verifies provenance, runtime behavior,
+  exact identity, and cooldown eligibility.
 
 Do not add Docker build or publication to the pull-request workflow merely to mirror main. Do not
 expose registry credentials to proposed source, rebuild an image in a release job, or create a
@@ -40,7 +42,7 @@ release before the published image passes its required tests.
 1. Inventory existing workflow responsibilities and retire only duplicated entry workflows.
 2. Apply `github-actions-quality-check` and preserve its event, permission, concurrency, runner,
    and immutable-pin requirements.
-3. Run hadolint locally against every selected Dockerfile.
+3. Run `docker buildx build --check` locally with the selected build contract.
 4. Run actionlint across workflows and actions, ShellCheck against changed standalone shell
    scripts, and `pinact run --check --min-age 7`.
 5. Observe the Checks job on a pull request and both Checks and Build jobs on the integrated commit
diff --git a/.agents/skills/docker-quality-check/references/registry-image-deletion.md b/.agents/skills/docker-quality-check/references/registry-image-deletion.md
new file mode 100644
index 0000000..8689b84
--- /dev/null
+++ b/.agents/skills/docker-quality-check/references/registry-image-deletion.md
@@ -0,0 +1,58 @@
+# Registry Image Deletion
+
+Use this procedure only after the user or maintainer has explicitly authorized a
+registry deletion and identified its scope. It governs safe execution and verification;
+it does not define retention policy or recommend when images should be deleted.
+
+## Resolve the deletion plan
+
+1. Inventory every in-scope registry read-only before changing state. Enumerate tags,
+   manifests, package versions, untagged manifests, attestations, and other related
+   artifacts exposed by that registry.
+2. Record the requested boundary as explicit delete and retain sets. Do not infer the
+   set from SemVer alone: repositories can contain prefixes, suffixes, prereleases,
+   date-based versions, legacy aliases, cache tags, and untagged artifacts.
+3. Resolve tags and package versions to immutable digests or registry object IDs when
+   the API exposes them. Check whether retained aliases share a manifest with a target.
+4. Identify the registry's deletion unit. A tag, manifest, package version, index, and
+   child or attestation manifest are not interchangeable, and deleting one can remove
+   or expose related objects differently across registries.
+5. Present or record the exact planned targets and retained references before the
+   first mutation. Stop if the requested boundary cannot be mapped unambiguously to
+   registry objects.
+
+## Authenticate and mutate safely
+
+- Use the least-privileged credential that can list and delete the in-scope objects.
+  Registry read and delete scopes are commonly distinct. Confirm the effective account,
+  repository, package, and permission before mutation.
+- Keep tokens out of command arguments, logs, shell history, committed files, and
+  durable temporary files. Prefer the platform credential store or process-scoped
+  secret injection.
+- Delete only resolved object IDs, digests, or exact references. Avoid broad globs,
+  unresolved variables, or mutable list positions.
+- Make the operation restartable. Record completed targets and treat an already-absent
+  response as success only when it refers to an exact planned target; stop on other
+  unexpected status codes or response bodies.
+- Re-enumerate related objects after each deletion group when a registry can cascade
+  from an index or package version to child, untagged, signature, provenance, or
+  attestation artifacts.
+
+## Verify registry state
+
+Do not rely on a successful delete response or one listing endpoint. Registry indexes,
+counts, pagination cursors, and mirrors can be eventually consistent.
+
+1. Re-list the repository or package and compare the observed objects with both the
+   delete and retain sets.
+2. Probe removed references through an independent manifest lookup or pull path and
+   confirm that they no longer resolve.
+3. Probe every retained release or alias and confirm that it still resolves to the
+   expected digest. When the image is published to multiple registries, compare the
+   intended cross-registry digest correspondence.
+4. Investigate stale counts, pagination links, cached metadata, or contradictory API
+   responses instead of treating them as proof of success. Record any scope that remains
+   unverified.
+5. Record the final target list, immutable identifiers where available, commands or APIs
+   used, verification evidence, and the registry's documented recovery path or lack of
+   one. A deletion is not complete until both absence and retention checks pass.
diff --git a/.agents/skills/security-check/SKILL.md b/.agents/skills/security-check/SKILL.md
index 5c289b8..8f6f88b 100644
--- a/.agents/skills/security-check/SKILL.md
+++ b/.agents/skills/security-check/SKILL.md
@@ -4,8 +4,10 @@ description: >-
   Review repository changes for practical security and supply-chain risks. Use
   when work touches secrets, permissions, untrusted input, dependencies,
   executable or downloaded artifacts, CI or deployment configuration,
-  containers, or vendored/generated files; skip documentation-only changes with
-  no security-sensitive surface.
+  containers, vendored/generated files, or compiled and bundled software whose
+  redistribution terms depend on build features or linked libraries, including
+  GitHub content that could expose private repositories; skip documentation-only
+  changes with no security-sensitive surface.
 ---
 
 # Security Check
@@ -101,6 +103,31 @@ description: >-
    - Follow-up issues for ecosystem-specific controls that exceed this
      general security skill.
 
+## GitHub Private Repository Disclosure Boundary
+
+- Do not mention or link to a private repository in content stored on GitHub when
+  the destination repository is public or could be made public later. Treat
+  uncertain future visibility as public for this check.
+- Protected identifiers include the private repository's owner/name, URL, issue or
+  pull-request references, branch names, private-only paths, code names, and wording
+  that reveals or makes its existence reasonably inferable. The prohibition applies
+  to commits, pull requests, issues, comments, reviews, release notes, documentation,
+  workflow output, badges, configuration, fixtures, screenshots, and generated files.
+- Do not copy access failures, policy-discovery warnings, API responses, or command
+  output into GitHub artifacts when they identify a private repository. Sanitize the
+  complete artifact, not only the surrounding prose.
+- When work depends on private evidence, describe only the non-identifying constraint
+  or outcome, such as `an internal policy source was unavailable`. Keep the exact
+  source and evidence in an approved non-GitHub private channel or system.
+- Do not add a private-repository reference merely because both repositories are
+  currently private. If the destination could later be published, the reference is
+  prohibited. When destination visibility or publication plans are unclear, omit the
+  reference and report the evidence boundary without identifying the source.
+- Before publishing or updating GitHub content, inspect the rendered body and every
+  attached or generated artifact for private-repository identifiers. If useful context
+  cannot be preserved without disclosure, stop the GitHub write and request a secure
+  handoff channel instead.
+
 ## Supply-Chain Baseline
 
 - For tool-specific fixed-install and execution patterns, consult
@@ -109,6 +136,12 @@ description: >-
 - For archives, installers, bundles, release assets, or packaged applications,
   apply [artifact-inspection.md](references/artifact-inspection.md) to the final
   artifact rather than trusting the staging directory or build log.
+- For compiled or bundled software distributed in an image, installer, archive,
+  or release asset, apply
+  [distributed-software-licensing.md](references/distributed-software-licensing.md).
+  Review the final feature and dependency combination rather than inferring
+  redistributability from the upstream project's headline license. Use its FFmpeg
+  section whenever FFmpeg is built or redistributed.
 - Treat new or updated third-party packages, package-runner invocations,
   downloaded CLI tools, GitHub Actions, containers, vendored artifacts,
   generated code from external tools, copied files, and dependency lockfile
@@ -203,11 +236,18 @@ description: >-
 - Distributed artifacts were inspected as final containers, with unsafe member
   types and paths rejected and payload/provenance checked against an explicit
   contract, or the unverified scope was recorded.
+- Compiled or bundled software was checked for build-time license combinations,
+  final-artifact license evidence, required notices, and variant differences;
+  FFmpeg builds additionally passed the FFmpeg-specific checks, or the unverified
+  or non-redistributable scope was recorded.
 - Every third-party resolution, download, build, load, or execution path passed
   the mechanism-neutral execution gate; tool names and delivery channels were
   treated as examples, not exemptions.
 - Secrets, permissions, unsafe defaults, and untrusted input paths were checked
   when relevant.
+- Public or potentially public GitHub content and attached artifacts contain no
+  private-repository identifiers or existence disclosures; private evidence was
+  reduced to non-identifying outcomes and kept in an approved non-GitHub channel.
 - Example hostnames and URLs name the intentional real service or use an
   RFC-reserved example domain without introducing accidental live traffic.
 - Suspected vulnerabilities were kept out of public channels when sensitive
diff --git a/.agents/skills/security-check/agents/openai.yaml b/.agents/skills/security-check/agents/openai.yaml
index 747d264..62afb43 100644
--- a/.agents/skills/security-check/agents/openai.yaml
+++ b/.agents/skills/security-check/agents/openai.yaml
@@ -1,8 +1,9 @@
 interface:
   display_name: "Security Check"
-  short_description: "Review security and supply-chain risks."
+  short_description: "Review security, supply-chain, and distribution risks."
   default_prompt: >-
     Use $security-check to review this repository work for security and supply-chain risks, including
     secrets, permissions, unsafe defaults, supply-chain-sensitive artifacts,
-    ad hoc executable tools, dependencies, CI actions, containers, and
-    reviewer-visible blockers or residual risk.
+    ad hoc executable tools, dependencies, CI actions, containers, compiled or
+    bundled software licensing, FFmpeg configurations, private-repository
+    disclosure boundaries, and reviewer-visible blockers or residual risk.
diff --git a/.agents/skills/security-check/references/distributed-software-licensing.md b/.agents/skills/security-check/references/distributed-software-licensing.md
new file mode 100644
index 0000000..9fd8c2d
--- /dev/null
+++ b/.agents/skills/security-check/references/distributed-software-licensing.md
@@ -0,0 +1,65 @@
+# Distributed Software Licensing
+
+Use this checklist when a repository compiles, links, bundles, or redistributes
+third-party software. Treat licensing as an artifact property: the upstream project's
+headline license and a successful build do not by themselves establish that the final
+combination can be redistributed.
+
+## Review the actual combination
+
+1. Inventory the primary program, every statically or dynamically linked library,
+   copied runtime component, enabled optional feature, and build flag for each shipped
+   variant.
+2. Consult authoritative license text and upstream compatibility guidance for the exact
+   versions and configuration. Record evidence and uncertainty; do not make an unsupported
+   legal conclusion from license names alone.
+3. Identify flags or dependencies that change the resulting license, impose source or
+   notice obligations, or mark the binary non-redistributable. Treat removing such a
+   dependency or feature as a product change that needs explicit review and testing.
+4. Inspect the artifact that will actually be published. Use any built-in license report,
+   dependency inventory, binary-linkage inspection, and container/archive inspection that
+   applies. Do not substitute Dockerfile intent, configure output, or builder contents for
+   final-artifact evidence.
+5. Verify every published variant independently. CPU, GPU, platform, and feature variants
+   can use different configure flags, linked libraries, and resulting terms.
+6. Include required license and notice files in the final artifact, and keep repository
+   disclosures synchronized with what is actually shipped. Apply `docker-quality-check`
+   for container-specific `THIRD_PARTY_NOTICES.md`, README, and final-image checks.
+7. Block publication when authoritative compatibility evidence, final-artifact evidence,
+   or a required variant cannot be checked. Record the exact unverified scope instead of
+   inferring a pass.
+
+## FFmpeg builds and redistribution
+
+FFmpeg is a frequent configuration-sensitive case. For every shipped FFmpeg binary and
+image variant:
+
+1. Capture the exact FFmpeg version or commit, configure line, enabled external libraries,
+   and final binary digest. Review FFmpeg's current authoritative legal and license
+   documentation together with the licenses of enabled libraries.
+2. Inspect flags that change redistribution status or license compatibility, especially
+   `--enable-gpl`, `--enable-version3`, and `--enable-nonfree`. Do not assume that adding
+   `--enable-nonfree` merely enables another codec; FFmpeg uses it to identify a resulting
+   build that is not redistributable.
+3. Check external libraries in combination with those flags. A commonly problematic
+   example is enabling `libfdk_aac` together with GPL components: verify the current
+   upstream guidance rather than relying on the libraries' individual licenses.
+4. Inspect GPU variants separately. Options and libraries such as CUDA toolkit components
+   or `libnpp` can change the resulting status even when NVENC/NVDEC support through
+   `nv-codec-headers` remains available. Verify the exact current flags; do not copy a
+   conclusion from the CPU variant.
+5. Run the final binary's `ffmpeg -L` and retain the full output as evidence. Fail the
+   publication gate if it reports `nonfree`, `unredistributable`, or equivalent wording
+   inconsistent with the intended distribution. Also verify `ffmpeg -buildconf` or the
+   embedded configuration against the reviewed build contract.
+6. Verify required upstream license files, such as the license selected by the resulting
+   configuration, are present in the final image or package. Confirm repository notices
+   name FFmpeg prominently and describe the shipped version source and license without
+   hiding it among development-only dependencies.
+7. Exercise representative codecs, filters, and hardware paths after a compliance-driven
+   flag or library change. Record intentionally removed features so a licensing correction
+   is not misreported as behavior-preserving maintenance.
+
+Do not generalize a result across versions or variants. FFmpeg configuration rules and
+external dependency terms are version-sensitive; re-check authoritative sources whenever
+the FFmpeg version, build flags, linked libraries, or image variants change.
diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md
index cb43131..263f96b 100644
--- a/THIRD_PARTY_NOTICES.md
+++ b/THIRD_PARTY_NOTICES.md
@@ -18,7 +18,7 @@ that are present in that checkout.
 - Source: [aoirint/skills](https://github.com/aoirint/skills), selected from
   `.apm/skills/`
 - Pinned commit:
-  [`9831bb2c9d41ffbd9d41336b840384b3e303e2e8`](https://github.com/aoirint/skills/tree/9831bb2c9d41ffbd9d41336b840384b3e303e2e8)
+  [`f97f2cf209112a3dfafff5618bd5466f6f502e72`](https://github.com/aoirint/skills/tree/f97f2cf209112a3dfafff5618bd5466f6f502e72)
 - Deployed paths: `.agents/skills/{apm-workflow,changelog-workflow,code-quality-check,commit-message-quality-check,docker-quality-check,git-worktree-workflow,github-workflow,gitignore-workflow,prose-quality-check,python-quality-check,release-note-workflow,security-check}/`
-- License: [MIT](https://github.com/aoirint/skills/blob/9831bb2c9d41ffbd9d41336b840384b3e303e2e8/LICENSE)
+- License: [MIT](https://github.com/aoirint/skills/blob/f97f2cf209112a3dfafff5618bd5466f6f502e72/LICENSE)
 - Copyright: Copyright (c) 2026 aoirint
diff --git a/apm.lock.yaml b/apm.lock.yaml
index 4d78bf5..3b01737 100644
--- a/apm.lock.yaml
+++ b/apm.lock.yaml
@@ -1,12 +1,12 @@
 lockfile_version: '1'
-generated_at: '2026-08-11T08:47:49.748747+00:00'
+generated_at: '2026-08-11T14:59:34.939366+00:00'
 apm_version: 0.27.0
 dependencies:
 - repo_url: aoirint/skills
   name: skills
   host: github.com
-  resolved_commit: 9831bb2c9d41ffbd9d41336b840384b3e303e2e8
-  resolved_ref: 9831bb2c9d41ffbd9d41336b840384b3e303e2e8
+  resolved_commit: f97f2cf209112a3dfafff5618bd5466f6f502e72
+  resolved_ref: f97f2cf209112a3dfafff5618bd5466f6f502e72
   version: 0.0.0
   package_type: apm_package
   deployed_files:
@@ -34,10 +34,10 @@ dependencies:
   - .agents/skills/docker-quality-check/SKILL.md
   - .agents/skills/docker-quality-check/agents/openai.yaml
   - .agents/skills/docker-quality-check/assets/github/actions/check-docker-source/action.yml
-  - .agents/skills/docker-quality-check/assets/github/actions/check-docker-source/install-hadolint.sh
   - .agents/skills/docker-quality-check/assets/github/workflows/main.yml
   - .agents/skills/docker-quality-check/assets/github/workflows/pull-request.yml
   - .agents/skills/docker-quality-check/references/ci-template-contract.md
+  - .agents/skills/docker-quality-check/references/registry-image-deletion.md
   - .agents/skills/git-worktree-workflow
   - .agents/skills/git-worktree-workflow/README.md
   - .agents/skills/git-worktree-workflow/SKILL.md
@@ -80,10 +80,11 @@ dependencies:
   - .agents/skills/security-check/SKILL.md
   - .agents/skills/security-check/agents/openai.yaml
   - .agents/skills/security-check/references/artifact-inspection.md
+  - .agents/skills/security-check/references/distributed-software-licensing.md
   - .agents/skills/security-check/references/external-code-execution.md
   deployed_file_hashes:
     .agents/skills/apm-workflow/README.md: sha256:e346edab06f5ec792cdb77edcaa8042f523af67753dc4fe72498ae1899b87c89
-    .agents/skills/apm-workflow/SKILL.md: sha256:4191b0fbc4ea9e832ecaede048693f280d36bead7c98276a2cdd0966edc3b88e
+    .agents/skills/apm-workflow/SKILL.md: sha256:bbddd9935373713999b78e5390b3c38e0886299beeb410d6eb338d13e25154fa
     .agents/skills/apm-workflow/agents/openai.yaml: sha256:f3c083196472ec9253886b369202ddeb8eb2534fd2da9799798bae2eb33b2e55
     .agents/skills/apm-workflow/references/apm-bootstrap.json: sha256:e0ebfd624fc79e35c5a5a305d77476860ff87019edc3afc0b37b5cd2884276b1
     .agents/skills/apm-workflow/scripts/propose_bootstrap_update.py: sha256:5c8d079ff9caa4175a971c5d231bc24d8143d47d238496cace60b1d91d8d00d8
@@ -98,13 +99,13 @@ dependencies:
     .agents/skills/commit-message-quality-check/SKILL.md: sha256:db272bb7467bcb6a6c3d837dec60a34f7081c135fcd40a9e00cf4a84e29ffabe
     .agents/skills/commit-message-quality-check/agents/openai.yaml: sha256:faffd948a0989dcfc87dcd3b0580c4a7003d01ef436e66dab9f280df57de652c
     .agents/skills/docker-quality-check/README.md: sha256:912a73d3de06babc6eed1ecdaf275139ae465797083dc5427affb54d00c57bf0
-    .agents/skills/docker-quality-check/SKILL.md: sha256:1f63030c08c7c12ce586b5c759789da36f7cdc0957a5697545796dc7889c0edf
-    .agents/skills/docker-quality-check/agents/openai.yaml: sha256:8abdaaa5a0458e86821080f50a2dfc34374c5c673a6c257fa351a2a96a16d064
-    .agents/skills/docker-quality-check/assets/github/actions/check-docker-source/action.yml: sha256:d7aaecc6000e0fd8b5bc05c20226ff2772367d7442b28826b1008ad3f24456bd
-    .agents/skills/docker-quality-check/assets/github/actions/check-docker-source/install-hadolint.sh: sha256:1a2e0159029597ed5fc8c51759bfd784447cd5e1ffc3db17d3be36b9a11c2f74
-    .agents/skills/docker-quality-check/assets/github/workflows/main.yml: sha256:92ef7f067110e0403652b5096fe65b5ade523fa0c10fbe56bb555b0b2fb89f1a
-    .agents/skills/docker-quality-check/assets/github/workflows/pull-request.yml: sha256:78486f8ba5ca32f5e298cda33d2f553e3f7ec36b688929d01ba5369461f23ecb
-    .agents/skills/docker-quality-check/references/ci-template-contract.md: sha256:af78ac12c756d4901cf664bd1edf69c2425b56968ee477492b7ec5f5abe826ae
+    .agents/skills/docker-quality-check/SKILL.md: sha256:dd8ea471f8789bf7362f4990a95d38eee244483faab874507364f439e8414d3e
+    .agents/skills/docker-quality-check/agents/openai.yaml: sha256:56a5f1b83f050b12555bbf85d1fd66c206016b8f939b79370e250b4e661cafd7
+    .agents/skills/docker-quality-check/assets/github/actions/check-docker-source/action.yml: sha256:4b6cc86c0e91a8908d28b4f705c8122f299691d55e56a584cc56307dd4881690
+    .agents/skills/docker-quality-check/assets/github/workflows/main.yml: sha256:7aaaecf2bc58c849c1877264f8c1363cd3376a158d25f948111f2adda7a1bf51
+    .agents/skills/docker-quality-check/assets/github/workflows/pull-request.yml: sha256:f2571d65cf632f40ecdaca58334cb1ff793c7770aafffa0d691450216cf50a83
+    .agents/skills/docker-quality-check/references/ci-template-contract.md: sha256:e9d1a4f0c2e472dbe18f062a968f79e10daf10a87fa54091edfaead7222749b9
+    .agents/skills/docker-quality-check/references/registry-image-deletion.md: sha256:a02688f52be5fccef96a2f25a70451eb8c579a46aa21ce27ee57ebc3a3f71a7e
     .agents/skills/git-worktree-workflow/README.md: sha256:fa6483b5919a01b84fa0d6ffcbaae20b84ed3807e18029e8807e61b0ee4f9de9
     .agents/skills/git-worktree-workflow/SKILL.md: sha256:67e2474b9878cc6cb209ae30b19c233f65969abe5b5d543f0c9a16e46f1d40d2
     .agents/skills/git-worktree-workflow/agents/openai.yaml: sha256:3eb9da73e7a041e77d82f0d5c3a8c67e914575cff8651b71d077db30fe3da99a
@@ -137,11 +138,12 @@ dependencies:
     .agents/skills/release-note-workflow/SKILL.md: sha256:518296cb00d1ef181785ea8abd0150b9704b5cdd05a48fc0390284c548ef421c
     .agents/skills/release-note-workflow/agents/openai.yaml: sha256:30cfe7d4520783cfc8c72f5f81cc3e7a5708a5827e691f0003a665d89558fda0
     .agents/skills/security-check/README.md: sha256:d321689b998388180ac852fdb6374ab3b79bec508a53d00461a9db79fb246d2e
-    .agents/skills/security-check/SKILL.md: sha256:b343a0f82623298ec8499b44859f80029fdf97ea0367b96da88ff9dcd5bd3297
-    .agents/skills/security-check/agents/openai.yaml: sha256:87edf0cc1e8717194d0c536f2d5ac0cc1ac9ec04402311d34e953d2e2b23fa19
+    .agents/skills/security-check/SKILL.md: sha256:e000b686cc36ae4308b502bdf3d89c287b27a62cc6d024e55ac72f04f8188013
+    .agents/skills/security-check/agents/openai.yaml: sha256:b1021ca2df7466813d0a376fc8bdff83603f568b02ef712e236fb2cfeef377c0
     .agents/skills/security-check/references/artifact-inspection.md: sha256:9842555f4789e77e6cf3d22b000116497207ecf6fa5587f2b1fe0dc20e7dffda
+    .agents/skills/security-check/references/distributed-software-licensing.md: sha256:dce7c9fbfe665eb875388ab732b63b0226a5fd4592b12a62c42b6d1372c0d025
     .agents/skills/security-check/references/external-code-execution.md: sha256:87ca817baa02ef6b955e5878f0cd79c875abdb0be6e0177cfce158968e628bc3
-  content_hash: sha256:068e0f032e5c782828b09e908faca88110fb59323e8e153aca9c69547fd6d74a
+  content_hash: sha256:1bdde1f36202c833f222c7e38265999ab21e0d3ede12eae173718cd716e488c0
   skill_subset:
   - apm-workflow
   - changelog-workflow
@@ -183,7 +185,7 @@ deployments:
   owners:
   - aoirint/skills
   active_owner: aoirint/skills
-  content_hash: sha256:4191b0fbc4ea9e832ecaede048693f280d36bead7c98276a2cdd0966edc3b88e
+  content_hash: sha256:bbddd9935373713999b78e5390b3c38e0886299beeb410d6eb338d13e25154fa
 - kind: project-relative
   target: codex
   value: .agents/skills/apm-workflow/agents/openai.yaml
@@ -354,7 +356,7 @@ deployments:
   owners:
   - aoirint/skills
   active_owner: aoirint/skills
-  content_hash: sha256:1f63030c08c7c12ce586b5c759789da36f7cdc0957a5697545796dc7889c0edf
+  content_hash: sha256:dd8ea471f8789bf7362f4990a95d38eee244483faab874507364f439e8414d3e
 - kind: project-relative
   target: codex
   value: .agents/skills/docker-quality-check/agents/openai.yaml
@@ -363,7 +365,7 @@ deployments:
   owners:
   - aoirint/skills
   active_owner: aoirint/skills
-  content_hash: sha256:8abdaaa5a0458e86821080f50a2dfc34374c5c673a6c257fa351a2a96a16d064
+  content_hash: sha256:56a5f1b83f050b12555bbf85d1fd66c206016b8f939b79370e250b4e661cafd7
 - kind: project-relative
   target: codex
   value: .agents/skills/docker-quality-check/assets/github/actions/check-docker-source/action.yml
@@ -372,43 +374,43 @@ deployments:
   owners:
   - aoirint/skills
   active_owner: aoirint/skills
-  content_hash: sha256:d7aaecc6000e0fd8b5bc05c20226ff2772367d7442b28826b1008ad3f24456bd
+  content_hash: sha256:4b6cc86c0e91a8908d28b4f705c8122f299691d55e56a584cc56307dd4881690
 - kind: project-relative
   target: codex
-  value: .agents/skills/docker-quality-check/assets/github/actions/check-docker-source/install-hadolint.sh
+  value: .agents/skills/docker-quality-check/assets/github/workflows/main.yml
   runtime: null
   scope: project
   owners:
   - aoirint/skills
   active_owner: aoirint/skills
-  content_hash: sha256:1a2e0159029597ed5fc8c51759bfd784447cd5e1ffc3db17d3be36b9a11c2f74
+  content_hash: sha256:7aaaecf2bc58c849c1877264f8c1363cd3376a158d25f948111f2adda7a1bf51
 - kind: project-relative
   target: codex
-  value: .agents/skills/docker-quality-check/assets/github/workflows/main.yml
+  value: .agents/skills/docker-quality-check/assets/github/workflows/pull-request.yml
   runtime: null
   scope: project
   owners:
   - aoirint/skills
   active_owner: aoirint/skills
-  content_hash: sha256:92ef7f067110e0403652b5096fe65b5ade523fa0c10fbe56bb555b0b2fb89f1a
+  content_hash: sha256:f2571d65cf632f40ecdaca58334cb1ff793c7770aafffa0d691450216cf50a83
 - kind: project-relative
   target: codex
-  value: .agents/skills/docker-quality-check/assets/github/workflows/pull-request.yml
+  value: .agents/skills/docker-quality-check/references/ci-template-contract.md
   runtime: null
   scope: project
   owners:
   - aoirint/skills
   active_owner: aoirint/skills
-  content_hash: sha256:78486f8ba5ca32f5e298cda33d2f553e3f7ec36b688929d01ba5369461f23ecb
+  content_hash: sha256:e9d1a4f0c2e472dbe18f062a968f79e10daf10a87fa54091edfaead7222749b9
 - kind: project-relative
   target: codex
-  value: .agents/skills/docker-quality-check/references/ci-template-contract.md
+  value: .agents/skills/docker-quality-check/references/registry-image-deletion.md
   runtime: null
   scope: project
   owners:
   - aoirint/skills
   active_owner: aoirint/skills
-  content_hash: sha256:af78ac12c756d4901cf664bd1edf69c2425b56968ee477492b7ec5f5abe826ae
+  content_hash: sha256:a02688f52be5fccef96a2f25a70451eb8c579a46aa21ce27ee57ebc3a3f71a7e
 - kind: project-relative
   target: codex
   value: .agents/skills/git-worktree-workflow
@@ -768,7 +770,7 @@ deployments:
   owners:
   - aoirint/skills
   active_owner: aoirint/skills
-  content_hash: sha256:b343a0f82623298ec8499b44859f80029fdf97ea0367b96da88ff9dcd5bd3297
+  content_hash: sha256:e000b686cc36ae4308b502bdf3d89c287b27a62cc6d024e55ac72f04f8188013
 - kind: project-relative
   target: codex
   value: .agents/skills/security-check/agents/openai.yaml
@@ -777,7 +779,7 @@ deployments:
   owners:
   - aoirint/skills
   active_owner: aoirint/skills
-  content_hash: sha256:87edf0cc1e8717194d0c536f2d5ac0cc1ac9ec04402311d34e953d2e2b23fa19
+  content_hash: sha256:b1021ca2df7466813d0a376fc8bdff83603f568b02ef712e236fb2cfeef377c0
 - kind: project-relative
   target: codex
   value: .agents/skills/security-check/references/artifact-inspection.md
@@ -787,6 +789,15 @@ deployments:
   - aoirint/skills
   active_owner: aoirint/skills
   content_hash: sha256:9842555f4789e77e6cf3d22b000116497207ecf6fa5587f2b1fe0dc20e7dffda
+- kind: project-relative
+  target: codex
+  value: .agents/skills/security-check/references/distributed-software-licensing.md
+  runtime: null
+  scope: project
+  owners:
+  - aoirint/skills
+  active_owner: aoirint/skills
+  content_hash: sha256:dce7c9fbfe665eb875388ab732b63b0226a5fd4592b12a62c42b6d1372c0d025
 - kind: project-relative
   target: codex
   value: .agents/skills/security-check/references/external-code-execution.md
diff --git a/apm.yml b/apm.yml
index 6d49023..94dcd37 100644
--- a/apm.yml
+++ b/apm.yml
@@ -8,7 +8,7 @@ targets:
 dependencies:
   apm:
     - git: aoirint/skills
-      ref: 9831bb2c9d41ffbd9d41336b840384b3e303e2e8
+      ref: f97f2cf209112a3dfafff5618bd5466f6f502e72
       skills:
         - apm-workflow
         - changelog-workflow

From 46ed0e8559a0719d16c24e7439750fb733497eeb Mon Sep 17 00:00:00 2001
From: aoirint <aoirint@gmail.com>
Date: Wed, 12 Aug 2026 00:13:27 +0900
Subject: [PATCH 2/2] build: update agent skills source

Co-authored-by: Codex <noreply@openai.com>
---
 .agents/skills/github-workflow/SKILL.md       | 40 +++++++++++++++-
 .../skills/github-workflow/agents/openai.yaml |  6 ++-
 .agents/skills/security-check/SKILL.md        | 46 ++++++++-----------
 THIRD_PARTY_NOTICES.md                        |  4 +-
 apm.lock.yaml                                 | 20 ++++----
 apm.yml                                       |  2 +-
 6 files changed, 74 insertions(+), 44 deletions(-)

diff --git a/.agents/skills/github-workflow/SKILL.md b/.agents/skills/github-workflow/SKILL.md
index 9d49fb7..e07e77d 100644
--- a/.agents/skills/github-workflow/SKILL.md
+++ b/.agents/skills/github-workflow/SKILL.md
@@ -3,8 +3,9 @@ name: github-workflow
 description: >-
   Quality-check GitHub repository issues, pull requests, reviews, replies,
   comments, and squash merges. Use when creating, editing, reviewing, or
-  publishing GitHub collaboration artifacts; use github-actions-quality-check
-  for workflows, local actions, Actions policy, and required-check design.
+  publishing GitHub collaboration artifacts, including preflight checks that
+  prevent private-repository disclosure; use github-actions-quality-check for
+  workflows, local actions, Actions policy, and required-check design.
 ---
 
 # GitHub Workflow
@@ -27,9 +28,44 @@ security-sensitive content and `prose-quality-check` for nuanced prose.
 - Disclose significant AI assistance consistently.
 - Preserve repository templates and policies without inventing requirements.
 - Validate exact stored text and squash-merge commit payloads.
+- Prevent private-repository identifiers from reaching public or potentially public
+  GitHub content by validating complete candidates before every write.
 
 ## Workflow
 
+### Private repository disclosure preflight
+
+Apply `security-check`'s private-resource disclosure boundary before every GitHub
+create, update, upload, push, or release operation.
+
+1. Determine the destination repository's current and possible future visibility.
+   Treat it as public when it is public, could later be published, or its future
+   visibility is uncertain. Current private-to-private access does not authorize a
+   private-repository reference in a potentially public destination.
+2. Protect the private repository's owner/name, URL, issue or pull-request reference,
+   branch or ref, private-only path, code name, and any wording or relationship that
+   makes its existence reasonably inferable. Authentication required to resolve or
+   execute a reference does not hide the reference itself.
+3. Inspect the exact complete candidate before the first GitHub write. Include titles,
+   body files, comments, reviews, commit and merge messages, repository diffs,
+   configuration and fixtures, workflow `uses:` references, copied command or API
+   output, annotations, SARIF, artifact and archive contents and filenames, badges,
+   screenshots, release notes, and generated metadata. Inspect the final rendered or
+   serialized form as well as source prose.
+4. Remove direct identifiers and indirect existence disclosures before calling `gh`,
+   an API, `git push`, an upload command, or another publishing tool. Keep only a
+   non-identifying requirement or outcome. Store the exact source and evidence in an
+   approved non-GitHub private channel or system; do not move it to another GitHub
+   issue, comment, private repository, attachment, hidden field, or code block.
+5. If any candidate or derivative cannot be inspected completely, or useful context
+   cannot be preserved without disclosure, stop before the write and request a secure
+   handoff. Do not publish first and plan to redact afterward.
+6. After a successful write, read back the complete stored artifact and verify it
+   against the approved candidate. This is a secondary integrity check, not a
+   substitute for preflight. For an existing disclosure, stop further publication,
+   inventory history, logs, artifacts, caches, notifications, and mirrors as
+   unverified exposure, and use a maintainer-approved cleanup process.
+
 ### Issues
 
 1. Identify whether the artifact is an issue title, body, reply, or combined
diff --git a/.agents/skills/github-workflow/agents/openai.yaml b/.agents/skills/github-workflow/agents/openai.yaml
index f845d95..08e3ea7 100644
--- a/.agents/skills/github-workflow/agents/openai.yaml
+++ b/.agents/skills/github-workflow/agents/openai.yaml
@@ -1,4 +1,6 @@
 interface:
   display_name: "GitHub Workflow"
-  short_description: "Review GitHub issues and pull requests."
-  default_prompt: "Use $github-workflow to create, review, or update a GitHub issue or pull request."
+  short_description: "Create and review safe GitHub artifacts."
+  default_prompt: >-
+    Use $github-workflow to preflight, create, review, or update a GitHub issue,
+    pull request, or related artifact without disclosing private repositories.
diff --git a/.agents/skills/security-check/SKILL.md b/.agents/skills/security-check/SKILL.md
index 8f6f88b..7374e2b 100644
--- a/.agents/skills/security-check/SKILL.md
+++ b/.agents/skills/security-check/SKILL.md
@@ -6,7 +6,7 @@ description: >-
   executable or downloaded artifacts, CI or deployment configuration,
   containers, vendored/generated files, or compiled and bundled software whose
   redistribution terms depend on build features or linked libraries, including
-  GitHub content that could expose private repositories; skip documentation-only
+  published content that could expose private resources; skip documentation-only
   changes with no security-sensitive surface.
 ---
 
@@ -103,30 +103,22 @@ description: >-
    - Follow-up issues for ecosystem-specific controls that exceed this
      general security skill.
 
-## GitHub Private Repository Disclosure Boundary
+## Private Resource Disclosure Boundary
 
-- Do not mention or link to a private repository in content stored on GitHub when
-  the destination repository is public or could be made public later. Treat
-  uncertain future visibility as public for this check.
-- Protected identifiers include the private repository's owner/name, URL, issue or
-  pull-request references, branch names, private-only paths, code names, and wording
-  that reveals or makes its existence reasonably inferable. The prohibition applies
-  to commits, pull requests, issues, comments, reviews, release notes, documentation,
-  workflow output, badges, configuration, fixtures, screenshots, and generated files.
-- Do not copy access failures, policy-discovery warnings, API responses, or command
-  output into GitHub artifacts when they identify a private repository. Sanitize the
-  complete artifact, not only the surrounding prose.
-- When work depends on private evidence, describe only the non-identifying constraint
-  or outcome, such as `an internal policy source was unavailable`. Keep the exact
-  source and evidence in an approved non-GitHub private channel or system.
-- Do not add a private-repository reference merely because both repositories are
-  currently private. If the destination could later be published, the reference is
-  prohibited. When destination visibility or publication plans are unclear, omit the
-  reference and report the evidence boundary without identifying the source.
-- Before publishing or updating GitHub content, inspect the rendered body and every
-  attached or generated artifact for private-repository identifiers. If useful context
-  cannot be preserved without disclosure, stop the GitHub write and request a secure
-  handoff channel instead.
+- Do not expose identifiers or existence-inference for a private resource in an
+  artifact that is public or could be published later. Treat uncertain destination
+  visibility as public for this check; current restricted access is not a lasting
+  disclosure control.
+- Apply the boundary to the complete candidate and all attached, embedded, generated,
+  and logged derivatives. Access controls on the private source do not make its name,
+  locator, metadata, failure output, code name, or relationship safe to disclose.
+- Preserve only the least-identifying constraint or outcome needed by the audience.
+  Keep exact private evidence in an approved private channel or system outside the
+  publication destination.
+- Complete this inspection before the first publish or update operation. Post-write
+  read-back is useful for verification but cannot prevent an initial disclosure. If
+  useful context cannot be preserved safely, stop publication and request a secure
+  handoff channel.
 
 ## Supply-Chain Baseline
 
@@ -245,9 +237,9 @@ description: >-
   treated as examples, not exemptions.
 - Secrets, permissions, unsafe defaults, and untrusted input paths were checked
   when relevant.
-- Public or potentially public GitHub content and attached artifacts contain no
-  private-repository identifiers or existence disclosures; private evidence was
-  reduced to non-identifying outcomes and kept in an approved non-GitHub channel.
+- Public or potentially public artifacts contain no private-resource identifiers or
+  existence disclosures; exact private evidence was reduced to non-identifying
+  outcomes and kept outside the publication destination.
 - Example hostnames and URLs name the intentional real service or use an
   RFC-reserved example domain without introducing accidental live traffic.
 - Suspected vulnerabilities were kept out of public channels when sensitive
diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md
index 263f96b..54646a6 100644
--- a/THIRD_PARTY_NOTICES.md
+++ b/THIRD_PARTY_NOTICES.md
@@ -18,7 +18,7 @@ that are present in that checkout.
 - Source: [aoirint/skills](https://github.com/aoirint/skills), selected from
   `.apm/skills/`
 - Pinned commit:
-  [`f97f2cf209112a3dfafff5618bd5466f6f502e72`](https://github.com/aoirint/skills/tree/f97f2cf209112a3dfafff5618bd5466f6f502e72)
+  [`f4aa56f4abffb1448c24c04ea4ae4463f5721d10`](https://github.com/aoirint/skills/tree/f4aa56f4abffb1448c24c04ea4ae4463f5721d10)
 - Deployed paths: `.agents/skills/{apm-workflow,changelog-workflow,code-quality-check,commit-message-quality-check,docker-quality-check,git-worktree-workflow,github-workflow,gitignore-workflow,prose-quality-check,python-quality-check,release-note-workflow,security-check}/`
-- License: [MIT](https://github.com/aoirint/skills/blob/f97f2cf209112a3dfafff5618bd5466f6f502e72/LICENSE)
+- License: [MIT](https://github.com/aoirint/skills/blob/f4aa56f4abffb1448c24c04ea4ae4463f5721d10/LICENSE)
 - Copyright: Copyright (c) 2026 aoirint
diff --git a/apm.lock.yaml b/apm.lock.yaml
index 3b01737..7214515 100644
--- a/apm.lock.yaml
+++ b/apm.lock.yaml
@@ -1,12 +1,12 @@
 lockfile_version: '1'
-generated_at: '2026-08-11T14:59:34.939366+00:00'
+generated_at: '2026-08-11T15:13:25.420184+00:00'
 apm_version: 0.27.0
 dependencies:
 - repo_url: aoirint/skills
   name: skills
   host: github.com
-  resolved_commit: f97f2cf209112a3dfafff5618bd5466f6f502e72
-  resolved_ref: f97f2cf209112a3dfafff5618bd5466f6f502e72
+  resolved_commit: f4aa56f4abffb1448c24c04ea4ae4463f5721d10
+  resolved_ref: f4aa56f4abffb1448c24c04ea4ae4463f5721d10
   version: 0.0.0
   package_type: apm_package
   deployed_files:
@@ -110,8 +110,8 @@ dependencies:
     .agents/skills/git-worktree-workflow/SKILL.md: sha256:67e2474b9878cc6cb209ae30b19c233f65969abe5b5d543f0c9a16e46f1d40d2
     .agents/skills/git-worktree-workflow/agents/openai.yaml: sha256:3eb9da73e7a041e77d82f0d5c3a8c67e914575cff8651b71d077db30fe3da99a
     .agents/skills/github-workflow/README.md: sha256:381a6c5fee202282fe66b35070b605c2b344f718aa63cf9b91abeca1936ab2d2
-    .agents/skills/github-workflow/SKILL.md: sha256:d48216b0fb3656228d1af7689cd538303a3114bcc7e0b74f1404258b836f7412
-    .agents/skills/github-workflow/agents/openai.yaml: sha256:1d8dfa53b85500f8d112c039d1c522dde129d140208c65d7145aa55e70eae329
+    .agents/skills/github-workflow/SKILL.md: sha256:797c679a0198155c8dd67b0ddbde02a8653715ee4cf30c10e29e606eabac3e17
+    .agents/skills/github-workflow/agents/openai.yaml: sha256:4d769a54de16656654a451b99a68289d2cd1efc65c86f58904f3445339bd2b22
     .agents/skills/github-workflow/references/fallback-pr-body.md: sha256:b98239e7d4cdddd8e267ab155f4e4c38fcc514526d9a32f13fcd5b21a1c07eb2
     .agents/skills/github-workflow/scripts/check_llm_disclosure.py: sha256:bc9c5cbd8efa77095eac42e53da714ed8dff86fa3b0e7870fc3e7eca1ca36e20
     .agents/skills/gitignore-workflow/README.md: sha256:0de188ebcdd40ea1aec701410e1c2182049b66bc4ec4d83a3bf55685b4267d47
@@ -138,12 +138,12 @@ dependencies:
     .agents/skills/release-note-workflow/SKILL.md: sha256:518296cb00d1ef181785ea8abd0150b9704b5cdd05a48fc0390284c548ef421c
     .agents/skills/release-note-workflow/agents/openai.yaml: sha256:30cfe7d4520783cfc8c72f5f81cc3e7a5708a5827e691f0003a665d89558fda0
     .agents/skills/security-check/README.md: sha256:d321689b998388180ac852fdb6374ab3b79bec508a53d00461a9db79fb246d2e
-    .agents/skills/security-check/SKILL.md: sha256:e000b686cc36ae4308b502bdf3d89c287b27a62cc6d024e55ac72f04f8188013
+    .agents/skills/security-check/SKILL.md: sha256:658368991ef988551e192551e7e539a6801f74d587b95039bbc9b36c6ab75345
     .agents/skills/security-check/agents/openai.yaml: sha256:b1021ca2df7466813d0a376fc8bdff83603f568b02ef712e236fb2cfeef377c0
     .agents/skills/security-check/references/artifact-inspection.md: sha256:9842555f4789e77e6cf3d22b000116497207ecf6fa5587f2b1fe0dc20e7dffda
     .agents/skills/security-check/references/distributed-software-licensing.md: sha256:dce7c9fbfe665eb875388ab732b63b0226a5fd4592b12a62c42b6d1372c0d025
     .agents/skills/security-check/references/external-code-execution.md: sha256:87ca817baa02ef6b955e5878f0cd79c875abdb0be6e0177cfce158968e628bc3
-  content_hash: sha256:1bdde1f36202c833f222c7e38265999ab21e0d3ede12eae173718cd716e488c0
+  content_hash: sha256:157c9a36a0efd2a912881899bc1db19168a6c54511a7a62b106c23af0ed3d500
   skill_subset:
   - apm-workflow
   - changelog-workflow
@@ -473,7 +473,7 @@ deployments:
   owners:
   - aoirint/skills
   active_owner: aoirint/skills
-  content_hash: sha256:d48216b0fb3656228d1af7689cd538303a3114bcc7e0b74f1404258b836f7412
+  content_hash: sha256:797c679a0198155c8dd67b0ddbde02a8653715ee4cf30c10e29e606eabac3e17
 - kind: project-relative
   target: codex
   value: .agents/skills/github-workflow/agents/openai.yaml
@@ -482,7 +482,7 @@ deployments:
   owners:
   - aoirint/skills
   active_owner: aoirint/skills
-  content_hash: sha256:1d8dfa53b85500f8d112c039d1c522dde129d140208c65d7145aa55e70eae329
+  content_hash: sha256:4d769a54de16656654a451b99a68289d2cd1efc65c86f58904f3445339bd2b22
 - kind: project-relative
   target: codex
   value: .agents/skills/github-workflow/references/fallback-pr-body.md
@@ -770,7 +770,7 @@ deployments:
   owners:
   - aoirint/skills
   active_owner: aoirint/skills
-  content_hash: sha256:e000b686cc36ae4308b502bdf3d89c287b27a62cc6d024e55ac72f04f8188013
+  content_hash: sha256:658368991ef988551e192551e7e539a6801f74d587b95039bbc9b36c6ab75345
 - kind: project-relative
   target: codex
   value: .agents/skills/security-check/agents/openai.yaml
diff --git a/apm.yml b/apm.yml
index 94dcd37..5cf4747 100644
--- a/apm.yml
+++ b/apm.yml
@@ -8,7 +8,7 @@ targets:
 dependencies:
   apm:
     - git: aoirint/skills
-      ref: f97f2cf209112a3dfafff5618bd5466f6f502e72
+      ref: f4aa56f4abffb1448c24c04ea4ae4463f5721d10
       skills:
         - apm-workflow
         - changelog-workflow