feat: agent-ready — installable SKILL.md skills, AGENTS.md, coding-ag…

[bearsyankees]

…ents docs

[greptile-apps]

Greptile Summary

Adds installable agent skills and supporting documentation for running Strix, remediating findings, using the cloud API, and configuring CI.

• Adds four SKILL.md workflows for pentesting, cloud API usage, finding remediation, and CI setup.
• Adds AGENTS.md and a coding-agent integration guide.
• Updates the README and documentation navigation to advertise the agent workflows.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
skills/strix-ci-setup/SKILL.md	Documents self-hosted and managed CI integration, including validated diff-base resolution and a fail-closed completion-status gate.
skills/strix-fix-findings/SKILL.md	Documents remediation and verification workflows while avoiding unsafe upstream and single-commit diff-base fallbacks.
skills/strix-pentest/SKILL.md	Adds agent instructions for self-hosted and managed scans, result interpretation, and truncated-run handling.
skills/strix-cloud-api/SKILL.md	Adds a managed-platform API workflow covering assets, scans, findings, reports, PR reviews, schedules, and webhooks.
docs/integrations/coding-agents.mdx	Adds user-facing documentation for installing and selecting the new coding-agent skills.
AGENTS.md	Adds a concise guide for agents using or contributing to Strix.

_{Reviews (5): Last reviewed commit: "docs(skills): enforce scan completion in..." | Re-trigger Greptile}

[devin-ai-integration]

@greptile

[devin-ai-integration]

@greptile

[devin-ai-integration]

@greptile

[devin-ai-integration]

@greptile

[devin-ai-integration]

Reviewed the skills against the actual implementations and pushed fixes in bd21342.

Wrong against strix-app's src/lib/api-v1/openapi.json (an agent following them got 4xx):

• domain registration used "asset_type":"web" — the enum is web_app | api | attack_surface
• repository registration wrapped the body in {"repositories":[...]} — the route accepts one object or a bare array, so the wrapped form failed with full_name is required for every repository
• report download used Accept: application/pdf — format/file type are query params (?format=technical&type=pdf|docx); Accept is ignored

Accuracy/caveats tightened:

• report downloads are gated on the Enterprise compliance_reports feature (DOCX doubly so), but PDF/DOCX reports were sold as a generic managed-cloud benefit in AGENTS.md, the docs page, and strix-pentest
• the CI "fail unless status == completed" gate only catches the hard budget stop (BudgetExceededError → stopped); a run that wraps up on a budget warning still calls finish_scan and records completed with partial coverage, so the note now says to also compare run.json's llm_usage.cost against --max-budget
• jq 'sort_by(.severity)' sorted alphabetically; replaced with an explicit severity order, plus the cloud severity/status enums

Everything else checked out: npx skills add discovers all four skills with valid frontmatter, CLI flags/exit codes/artifact names match strix/interface/main.py and strix/report/writer.py, and every linked URL resolves.