From 8b9f56be236eeb0640772ef0dc63bc7a5bbe69d0 Mon Sep 17 00:00:00 2001 From: Dotta Date: Thu, 16 Jul 2026 14:02:55 +0000 Subject: [PATCH] test(skills): guard reflection sweep guidance Co-Authored-By: Paperclip --- .../skills-catalog/src/shipped-catalog.test.ts | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/packages/skills-catalog/src/shipped-catalog.test.ts b/packages/skills-catalog/src/shipped-catalog.test.ts index 5457f24767b..396e6e603ff 100644 --- a/packages/skills-catalog/src/shipped-catalog.test.ts +++ b/packages/skills-catalog/src/shipped-catalog.test.ts @@ -178,6 +178,21 @@ describe("shipped skills catalog", () => { expect(resolveCatalogSkillRef(sample.slug)).toMatchObject({ key: sample.key }); }); + it("keeps review-bot and issue-authorization guidance explicit", () => { + const githubPrWorkflow = readFileSync( + new URL("../catalog/bundled/software-development/github-pr-workflow/SKILL.md", import.meta.url), + "utf8", + ); + const paperclipSkill = readFileSync(new URL("../../../skills/paperclip/SKILL.md", import.meta.url), "utf8"); + + expect(githubPrWorkflow).toContain("## Automated code-review bots"); + expect(githubPrWorkflow).toContain("top confidence with zero unresolved threads"); + expect(paperclipSkill).toContain("Paperclip evaluates `issue:read`, `issue:comment`, and `issue:mutate`"); + expect(paperclipSkill).toContain("separately. Local task-bridge credentials are run-scoped"); + expect(paperclipSkill).toContain("`authorizationBoundary` field"); + expect(paperclipSkill).toContain("do not infer mutation access"); + }); + it("keeps the Ramp wrapper fail-closed on mixed-provenance playbooks", () => { const rampSkill = readFileSync(new URL("../catalog/optional/finance/ramp/SKILL.md", import.meta.url), "utf8");