Apache-2.0 licensed skill packages — preview.7

Apache-2.0 licensing release for Security Skills Architect.

The repository and both standalone skill packages now include the complete official Apache License, Version 2.0, with SPDX declarations and updated reuse instructions.

Packages: skill-architect 0.3.0-preview.5 and application-defence 0.2.0-preview.4.

Validation: 54 offline tooling tests, both engineered validators and required GitHub CI passed. Packaged files, embedded licences and checksums match merged commit 598a1738bd772acf42d6cb770f28040fcff4a27a. Engineering readiness remains conditional; this licensing update does not certify behavioural, native-host or production acceptance. Historical anonymisation remains pending.

Security/privacy tooling correction — preview.6

Security/privacy correction for the public engineering tooling. Use this preview for new evaluations.

• Hidden/cache files and unsupported resources no longer enter evaluation context; the plan lists selected paths and bytes before execution. This is not general secret redaction.
• Package/template root links are rejected, generated artifact writes are confined/create-only, and recursive/oversized inputs fail visibly without frontmatter echo.
• Combined stdout/stderr capture is stream-bounded and ordinary process-group children are cleaned up after completion or timeout. Execution requires POSIX and trusts the CLI/login/environment; this does not sandbox a hostile executable.
• CI uses current SHA-pinned first-party actions, read-only permissions, no retained checkout credentials, a timeout and hash-locked binary development dependencies.
• Secret scanning/push protection, dependency alerts, private vulnerability reporting and protected-main PR/check gates are enabled.

Validation: 54 offline tooling tests passed, both package validators passed with no warnings, package/checksum checks passed, and GitHub CI passed on the reviewed PR. Two local full-history credential scans and downloaded release-attachment scans found no credential patterns. PyYAML 6.0.3 advisory audit found no known matches at review time. No provider/model or credential-validity calls were made for this audit.

Packages: skill-architect 0.3.0-preview.4 (corrected tooling) and application-defence 0.2.0-preview.3 (unchanged). Public skill behaviour/native-host acceptance remains unexecuted; the independent private runtime's tests are separate evidence. Production certification and signed release provenance are not claimed.

Current contents and attachments were checked for operational identifiers. Older source history retains approval-gated anonymisation work; do not interpret this release as erasing previous commits, author metadata, source archives, clones or caches. No private application profile, runtime, raw audit or operational identity is included. Public reuse licensing remains pending.

Source binding: merged commit f5a319e62fcce926db77c240b1a0139e3abdc4e6. All 40 packaged files and archive checksums were verified against this commit; the main-branch quality workflow passed. This preview replaces the withdrawn preview.5 distribution.

Withdrawn preview — source binding check

Withdrawn during publication verification: the source tag did not identify the corrected package commit. The attachments have been removed; they have not been silently replaced. Use the next verified preview linked from the repository README. The tag is retained as a historical record. No private application evidence was attached.

Security Skills Architect — pilot security lessons preview

Superseded tooling preview: Use preview.6 for new evaluations. It contains the merged security tooling corrections and verified packages. This older preview does not include those fixes.

This preview carries the latest scoped security-review lessons into both reusable skill packages.

• Preserve historical exploitation separately from current catalogue membership and derive urgency after reconciliation.
• Model advisory withdrawal/reinstatement explicitly and prohibit silent baseline resets for enrolled applications.
• Require consistent committed evidence/stores, create-only run history and concurrency-aware freshness; secure individual writes do not imply a multi-artifact transaction.
• Treat workload inventory as self-report rather than attestation; separate unprivileged analysis from a narrowly enforced collector, keeping code/configuration immutable.
• Keep model explanations advisory-only and require independent notification plus verified operator delivery for the associated coverage claims.
• Add seven planned application scenarios and one general architect boundary case; publish a sanitized security-review follow-up.

Packages: application-defence 0.2.0-preview.3 and skill-architect 0.3.0-preview.3. All 34 tooling tests, both structural validators, archive/privacy/checksum checks passed. Application evaluation plan: 26 scenarios plus eight trigger cases, 60 calls. General architect evaluation plan: five scenarios plus six trigger cases, 16 calls. These factory model evaluations remain planned, not executed.

A separate private reference runtime passed 29 independently repeated tests and six earlier regression probes; its revised enrolled pilot completed a staged run and same-host freshness check. This supports a bounded pilot, not general factory accuracy or production certification. Authority separation, independent inventory trust, transactions/recovery, resources, delivery, model quality and distribution/update trust remain open production gates.

The downloads do not include the private executor, application profile, raw security audit or findings. Installing these instructions does not start a monitor. No host or private application identities are included. krnali Ops remains the intended unverified handoff. Public reuse licensing is still awaiting the owner's decision.

Security Skills Architect — reviewed and anonymised preview

Superseded tooling preview: Use preview.6 for new evaluations. It contains the merged security tooling corrections and verified packages. This older preview does not include those fixes.

Sanitized, reviewed preview superseding the earlier downloads.

• Removes private application and infrastructure identities from current documentation and README artwork.
• Corrects package versions, release/feedback information and the intended krnali Ops destination.
• Carries private-pilot lessons into the reusable builder: keep untrusted context separate from instructions, treat unassessed reachability as unknown, and distinguish completed inference from accepted reasoning.
• Adds three planned regression scenarios and a sanitized seven-gate review record.

Packages: application-defence 0.2.0-preview.2 and skill-architect 0.3.0-preview.2. Both packages passed selected engineered checks. All 34 tooling tests passed, the 46-call plan for 19 application scenarios plus eight trigger cases validated, and new archives/checksums were verified. The planned model evaluations were not executed.

These downloads contain reusable skill instructions, references and engineering tooling. The private application executor, profiles and findings are not included. Installing a skill does not start monitoring. Native activation, broad model quality, production recovery and live Ops delivery remain unverified. Advisory matching does not discover undisclosed zero-days. Public reuse licensing remains awaiting the owner's decision.

Security Skills Architect — emerging vulnerability preview

Superseded tooling preview: Use preview.6 for new evaluations. It contains the merged security tooling corrections and verified packages. This older preview does not include those fixes.

Superseded by the reviewed and anonymised preview.

The earlier application-defence attachment was withdrawn during a privacy review because its documentation contained a private application identity. Its manifest and checksum list were also removed so they do not describe an incomplete download set. Those bytes have not been silently replaced. Use preview.3 for both reviewed skill packages, the complete manifest and checksums.

The unchanged earlier architect attachment is retained for historical reference. These previews contain instructions and tooling, not a running monitor. Operational and behavioural acceptance remain conditional; no public reuse licence has been selected.

Security Skills Architect — first preview

Superseded tooling preview: Use preview.6 for new evaluations. It contains the merged security tooling corrections and verified packages. This older preview does not include those fixes.

Security Skills Architect: first public preview.

Includes Skill Architect 0.3.0-preview.1 and Application Defence 0.1.0-preview.1. See the repository README for installation, first-use prompts, expected application outputs and monitoring/ITSM setup.

Download the individual skill ZIPs plus manifest.json and SHA256SUMS. Both archives passed unpacked structural validation and checksum verification. 34 local tooling tests passed.

This is a conditional engineering preview. Application-specific live behavior, native host acceptance, recurring monitoring and ITSM integration remain unverified. No monitoring service or API connector is installed by these packages. A public reuse licence is still pending owner selection.

The manifest records local build provenance; publication does not promote the engineering verdict to production-ready.