菜单
Use when bringing this repo into compliance with a GeneFoundry fleet standard (tool-naming, response-envelope, container-hardening, versioning, MCP transport, or logging) or closing its tracking issue.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Use when `make ci-local` fails locally or a GitHub Actions run reports a CI failure (format, lint, line-budget, typecheck, or test errors).
Use when reviewing a diff, PR, or change set for correctness and quality before merge or handoff. For a deep security-only pass, use security-review instead.
Use when preparing to tag, publish, or deploy a genefoundry-router build.
Use when reviewing genefoundry-router security before deploy, when touching auth/proxy/logging/limits config, or when answering an infosec/DSB question.
Use when changing the router's authentication or authorization — JWT/OAuth modes, verifiers, resource/audience metadata, the secure-by-default bind guard, or the no-token-passthrough boundary.
Use when adding, removing, enabling/disabling, or reconfiguring a backend in the router's servers.yaml registry (URLs, namespaces, entrypoints, server_name/transform overrides).
| name | fleet-standard-adoption |
| description | Use when bringing this repo into compliance with a GeneFoundry fleet standard (tool-naming, response-envelope, container-hardening, versioning, MCP transport, or logging) or closing its tracking issue. |
Follow AGENTS.md first. The canonical standards live under docs/ (the sibling router repo for *-link; docs/ in the router):
TOOL-NAMING-STANDARD-v1.md — verb_noun snake_case, stable, collision-free names (lets the router drop any transform).RESPONSE-ENVELOPE-STANDARD-v1.1.md (current; supersedes v1) — success, the payload, flat execution-error fields (error_code / message / retryable / recovery_action), and _meta (data_version). v1.1 adds untrusted-content fencing and error-message sanitation (fixed/enum error fields — never reflect caller-supplied or upstream text into caller-visible fields or logs; see the FastMCP not-found reflection guard). The nested error:{...} shape is deferred — don't use it.CONTAINER-HARDENING-STANDARD-v1.md — non-root, read-only, cap-drop, digest-pin, Trivy + SBOM.VERSIONING-STANDARD-v1.md — single-source metadata version; no serverInfo.version framework leak.MCP-TRANSPORT-STANDARD-v1.md — single stateless /mcp (no 307 split), canonical serverInfo / health.make ci-local; note residual risk.