菜单
Archived live-content verification law retained for audit provenance. Do not use as the active deployment verifier; use the current runtime verification skill for HTTP body, content-type, handler, redirect, and region checks.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Produces a seven-repository federation release manifest proving tag, commit, CI, artifact, and deployed-runtime parity. Never overwrites existing tags — issues corrected tags when drift is detected. Outputs signed JSON manifest with per-repo evidence chain.
High-level governance layer for pull request review across the federation. Ensures separation of duties, required signers, and constitutional compliance before merge. This is the **policy layer** that decides who must approve. The **checklist** lives in `github-pr-review`; do not duplicate it here.
Controller skill for repository intelligence across the arifOS Federation. Exposes 9 modes (inventory, map, delta, pr_review, ci_diagnose, issue_triage, security, cross_repo_impact, release_audit) and orchestrates existing GitHub micro-skills rather than duplicating their logic. Every mode outputs a minimum evidence envelope with repo, ref, commit_sha, working_tree, tag_delta, changed_files, critical_paths, tests, ci, security, contract_impacts, runtime_probe, risk_tier, proposed_action, rollback, evidence_class, and unknowns.
End-of-session seal ritual for Grok/AAA agents: inventory done vs open, write forge_work receipt, update session-state and daily memory, hand off next-agent INIT prompt. Use when: seal session, end of turn, session seal, handoff, close session, DITEMPA seal.
Wire, verify, and operate federation Session Capability Tokens (SCT) across arifOS mint/validate and organ ingress gates (A-FORGE, GEOX, WEALTH, WELL, AAA). Use when: SCT gate, session_token, federation_sct, SCT_AMBIGUOUS, tool_authority, FORGE_SCT_REQUIRE_MUTATE, 65-case matrix, decision event.
Close remaining Seal-A gates after P0 proof/identity/SCT/T3a work. Use when: Seal-A, stage 000, SE stage engine, SOT v2, BOOT, T3a binding, free_nonce, constitutional_grade, remaining seal tasks.
| name | verify-live-content |
| description | Archived live-content verification law retained for audit provenance. Do not use as the active deployment verifier; use the current runtime verification skill for HTTP body, content-type, handler, redirect, and region checks. |
DITEMPA BUKAN DIBERI — Forged, not given. Born from: False SEAL incident 2026-07-15 (verified bundle SHA, not URL content)
Agent verified: ✅ SHA on disk, ✅ HTTP 200, ✅ 13 slugs in bundle. Agent did NOT verify: ❌ Response body contains intended content, ❌ Correct handler served it.
200 OK ≠ correct content. SHA matched ≠ artifact served.
A deploy is NOT SEAL until ALL pass:
sha256sum /path/to/file
# Compare to expected
curl -sk -o /dev/null -w "%{http_code}" $URL
# Must be 200
curl -sk $URL | grep -q "EXPECTED_MARKER"
# Marker = unique string ONLY present in intended content
# If marker absent → verdict is VOID, not SEAL
curl -skI $URL | grep -i content-type
# HTML → text/html
# JSON → application/json
# MCP → application/json or text/event-stream
# Add to Caddy handler: header X-Caddy-Handler wealth-narrative
curl -skI $URL | grep -i x-caddy-handler
# Must match intended handler name
curl -skI $WRONG_URL | grep -i location
# Must redirect to correct plane
# Verify redirect target, not just status code
Every deploy receipt MUST include:
{
"url": "https://...",
"status": 200,
"content_type": "text/html",
"handler": "wealth-narrative",
"body_marker": "data-canon-id=\"makcik-cerita-v1\"",
"body_marker_found": true,
"bundle_sha": "sha256:...",
"verdict": "SEAL" | "VOID" | "PARTIAL"
}
If body_marker_found is false → verdict is VOID.
for region in header chart decision nav footer; do
curl -sk $URL | grep -q "data-region=\"$region\"" || echo "❌ REGION $region MISSING"
done
200 OK proves the server responded. Not that user reached intended content.SHA on disk proves artifact exists. Not that artifact is served.