Menu
Check for meaning firewall violations - kernel crates must never import domain crates
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
ICN development companion for the InterCooperative Network Rust monorepo. Use when working on ICN code, docs, deployment, or protocol design. Provides crate-aware routing to specialist agents (icn-architect, icn-economist, icn-ops), enforces project conventions, and understands the current sprint state, cluster topology, and demo flow status. Triggers on: any ICN crate names, "cooperative contract", "mutual credit", "governance", "gossip", "K3s", "icn-dev", "ops/mcp", "Sprint", "demo flow", "CCL", "federation", "DID", "ledger", "trust graph", "icnd", "icnctl".
Full sprint-batch or stacked-PR integration pipeline. Owns merge order, rebases, local gates, and main sync.
Full sprint-batch or stacked-PR integration pipeline. Owns merge order, rebases, local gates, and main sync.
Show full ICN development status dashboard — active sessions, sprint tasks, worktree freshness, CI state, and cluster health
ICN session preflight. This skill should be used when the user explicitly invokes "/icn-agent-pack:preflight", or asks to "run preflight", "orient me on ICN", or "check the ICN session environment". Loads canonical docs and the latest handoff, then verifies branch, gh auth, ports, toolchain, and a light cargo check. Read-only; reports, never fixes.
ICN repo navigator / knowledge graph. This skill should be used when the user explicitly invokes "/icn-agent-pack:navigator", or asks to "map the repo", "build/refresh the knowledge graph", "trace this concept to its source", or "show the conceptual map / impact map". Begins the living repository knowledge-graph and conceptual-map workflow, grounded in the icn-ops MCP tools and (future) generated graph artifacts.
| name | firewall-check |
| description | Check for meaning firewall violations - kernel crates must never import domain crates |
| user-invocable | true |
| allowed-tools | Bash, Grep, Glob, Read |
Check for meaning firewall violations in the ICN codebase.
The kernel enforces constraints WITHOUT understanding their semantic origin. Domain semantics (trust scores, governance rules) stay in apps. Kernel only sees generic ConstraintSet and PolicyDecision.
Kernel crates (icn-net, icn-gateway, icn-gossip, icn-ledger, icn-core) must NEVER import domain crates.
Search for violations:
grep -rn 'use icn_trust::' icn/crates/icn-{net,gateway,gossip,ledger,core}/src/
grep -rn 'use icn_governance::' icn/crates/icn-{net,gateway,gossip,ledger,core}/src/
grep -rn 'use icn_ccl::' icn/crates/icn-{net,gateway,gossip,ledger,core}/src/
grep -rn 'use icn_coop::' icn/crates/icn-{net,gateway,gossip,ledger,core}/src/
grep -rn 'use icn_community::' icn/crates/icn-{net,gateway,gossip,ledger,core}/src/
Search for domain type references in kernel code:
grep -rn 'TrustClass\|TrustGraph\|GovernanceRole\|MembershipTier' icn/crates/icn-{gossip,net,gateway,ledger,core}/src/
Search for trust score thresholds in kernel code:
grep -rn '0\.7\|0\.4\|0\.1' icn/crates/icn-{gossip,net,gateway,ledger}/src/ | grep -i 'trust\|score\|threshold'
Search for constraint-to-domain reconstruction:
grep -rn 'match.*constraints\|match.*max_topics\|match.*rate_limit' icn/crates/icn-{gossip,net,gateway,ledger}/src/ | grep -i 'class\|tier\|level'
Verify kernel crate Cargo.toml files don't depend on domain crates:
grep -l 'icn-trust\|icn-governance\|icn-ccl' icn/crates/icn-{net,gateway,gossip,ledger,core}/Cargo.toml
## Meaning Firewall Check
### Import violations: <PASS/FAIL>
<details>
### Domain types in kernel: <PASS/FAIL>
<details>
### Hardcoded thresholds: <PASS/FAIL>
<details>
### Reverse firewall patterns: <PASS/FAIL>
<details>
### Cargo.toml dependencies: <PASS/FAIL>
<details>
### Overall: CLEAN / VIOLATIONS FOUND
If violations are found, explain exactly what needs to change and why.