Menü
Use when bringing this repo into compliance with a GeneFoundry fleet standard (tool-naming, response-envelope, container-hardening, versioning, MCP transport, or logging) or closing its tracking issue.
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Basierend auf der SOC-Berufsklassifikation
Use when `make ci-local` fails locally or a GitHub Actions run reports a CI failure (format, lint, line-budget, typecheck, or test errors).
Use when reviewing a diff, PR, or change set for correctness and quality before merge or handoff. For a deep security-only pass, use security-review instead.
Use when preparing to tag, publish, or deploy a genefoundry-router build.
Use when reviewing genefoundry-router security before deploy, when touching auth/proxy/logging/limits config, or when answering an infosec/DSB question.
Use when changing the router's authentication or authorization — JWT/OAuth modes, verifiers, resource/audience metadata, the secure-by-default bind guard, or the no-token-passthrough boundary.
Use when adding, removing, enabling/disabling, or reconfiguring a backend in the router's servers.yaml registry (URLs, namespaces, entrypoints, server_name/transform overrides).
| name | fleet-standard-adoption |
| description | Use when bringing this repo into compliance with a GeneFoundry fleet standard (tool-naming, response-envelope, container-hardening, versioning, MCP transport, or logging) or closing its tracking issue. |
Follow AGENTS.md first. The canonical standards live under docs/ (the sibling router repo for *-link; docs/ in the router):
TOOL-NAMING-STANDARD-v1.md — verb_noun snake_case, stable, collision-free names (lets the router drop any transform).RESPONSE-ENVELOPE-STANDARD-v1.1.md (current; supersedes v1) — success, the payload, flat execution-error fields (error_code / message / retryable / recovery_action), and _meta (data_version). v1.1 adds untrusted-content fencing and error-message sanitation (fixed/enum error fields — never reflect caller-supplied or upstream text into caller-visible fields or logs; see the FastMCP not-found reflection guard). The nested error:{...} shape is deferred — don't use it.CONTAINER-HARDENING-STANDARD-v1.md — non-root, read-only, cap-drop, digest-pin, Trivy + SBOM.VERSIONING-STANDARD-v1.md — single-source metadata version; no serverInfo.version framework leak.MCP-TRANSPORT-STANDARD-v1.md — single stateless /mcp (no 307 split), canonical serverInfo / health.make ci-local; note residual risk.