feat(autonomy): prerequisite-resolution slice for the setup skill (#2725)

[kyle-sexton]

Closes #2725

Summary

Phase 5 of the routine-capability-detection plan (ADR 0011): setup skill slice for prerequisite resolution — check reports verdicts with provenance; apply runs detect-diff-reconcile + prose proposals + human ratify into an additive binding section.

Fix

• Slice docs — SKILL.md section + context/prerequisite-resolution-slice.md.
• check-prerequisite-resolution.mjs — engine health-check wrapper over the Phase 4 resolver across declared surfaces.
• apply-prerequisite-resolution.mjs — propose (non-interactive assumptions) / --ratify write of prerequisite_resolution (surface_refs + declarations, no surfaces map); never writes security binding; narrowing-only enablement advice; org-rung stops.
• Tests — bare-repo check, reconcile finding (declaration vs ran-negative), ratify shape, signal-envelope against fixture binding.
• Evals 30–31 covering check/apply slice paths.
• Version bump to 0.22.0.

Stacked on #2796 (cursor/2724-prereq-resolver-14fb).

Verification

$ bash plugins/autonomy/skills/setup/scripts/check-prerequisite-resolution-slice.test.sh
$ node plugins/autonomy/skills/setup/scripts/check-signal-envelope.mjs \
    plugins/autonomy/skills/setup/scripts/fixtures/prerequisite-resolution/slice-binding/envelope.md \
    --binding plugins/autonomy/skills/setup/scripts/fixtures/prerequisite-resolution/slice-binding/repo/.claude/autonomy/binding.json
$ bash scripts/check-changelog-parity.sh --check-bump origin/main
$ bash scripts/check-orphaned-fixtures.sh --check
$ CHECK_SKILL_SKIP_MARKDOWNLINT=1 bash scripts/check-changed-skills.sh origin/main

Related

• ADR 0011; Refs spike: per-repo routine capability detection — promote to its own topic #2685; depends on feat(autonomy): deterministic prerequisite resolver #2724

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[claude]

Claude finished @kyle-sexton's task in 2m 24s —— View job

---

Security review

• Gather context (PR diff vs origin/cursor/2724-prereq-resolver-14fb)
• Apply skip-gate check
• Review changed files for security-relevant surface
• Report findings

I reviewed the 11 files changed in this PR (diff against origin/cursor/2724-prereq-resolver-14fb), focusing on the two new executable scripts (apply-prerequisite-resolution.mjs, check-prerequisite-resolution.mjs) since they're the only files with a security-relevant surface — both are local CLI tools invoked by the setup skill, not network-exposed, and both shell out via spawnSync with argument arrays (no shell interpolation, no injection risk).

No CRITICAL or IMPORTANT security findings.

One low-severity note worth a follow-up:

SUGGESTION — dead/mis-keyed guard in the "never write security binding" invariant.
apply-prerequisite-resolution.mjs (writeRatified):

if (existing.admission || existing.isolation || existing.executor_class) {
  throw new Error("refusing to write security-binding axes into autonomy binding");
}

Two issues with this guard as written:

1. It checks the pre-existing loaded binding object, not what this function is about to write — so it can never detect a security-binding key introduced by this code path. In current code that's moot only because writeRatified never assigns admission/isolation_bindings/executor_class itself (it only ever sets existing.prerequisite_resolution), so the real safety property holds by omission, not by this check.
2. The key name doesn't match the schema: the security-binding schema (plugins/autonomy/skills/setup/schemas/guardrails-security-binding.schema.json) uses isolation_bindings, not isolation — so that branch of the guard is unreachable in practice.

Not currently exploitable (there's no code path that lets --proposal content populate admission/isolation_bindings/executor_class, and the test suite doesn't exercise this branch either), so I'm not blocking on it. But as written this "refuse security keys" check is effectively inert and would give false confidence if a future change (e.g., broadening what fields --ratify merges from a proposal) accidentally opened a path to write those axes — the guard wouldn't catch it. Worth either fixing the key name and checking the outgoing write instead of the pre-existing object, or removing the dead check and relying solely on the fact that writeRatified only ever touches prerequisite_resolution.

Fix this →

No other issues found: no path traversal (all file paths derive from a trusted --repo CLI arg, not remote/user input), no command injection (spawnSync uses argument arrays throughout), no prototype-pollution vector in the declaration-merge logic, and the docs/CHANGELOG/fixture-only files carry no sensitive content.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 621d5656c3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-actions]

Last security-reviewed head: 621d5656c3c2413fe2355b2e6f91859801a8fe0e. On the next push, the relevance gate compares only the commits since this SHA; delete this comment to force a full re-review.

[claude]

Claude finished @kyle-sexton's task in 3m 29s —— View job

---

Code review complete

Todo list

• Gather context (diff vs origin/cursor/2724-prereq-resolver-14fb, repo CLAUDE.md, related files)
• Run /review:code-review procedure over the PR diff
• Post inline findings via create_inline_comment
• Post summary comment with cross-file findings and verdict

Summary

Reviewed the diff against origin/cursor/2724-prereq-resolver-14fb (11 files, +787/-3). The docs (SKILL.md, context/prerequisite-resolution-slice.md), check-prerequisite-resolution.mjs, evals, and fixtures are consistent and well-scoped. Two correctness bugs in apply-prerequisite-resolution.mjs, posted as inline comments:

1. apply-prerequisite-resolution.mjs#L229 — the "refuse security keys" guard checks whether the pre-existing binding.json already has top-level admission/isolation/executor_class keys, not whether the write itself introduces them. Since a fully security-bound repo (the realistic target state, per the plugin's own guardrail-matrix → prerequisite-resolution ordering) legitimately carries admission/executor_class at the top level (confirmed against evals/fixtures/security-binding/valid.json), --ratify will unconditionally throw on any already-secured repo, even though the write only ever touches prerequisite_resolution. Not caught by the co-located test because its fixture binding.json omits those keys.

2. apply-prerequisite-resolution.mjs#L146 — orgRungStops() reads row.connector_entitlement_rung off check output rows, but resolveIdentity() in resolve-prerequisites.mjs only returns {identity, verdict, signals, findings} — it never forwards connector_entitlement_rung from the emission record. org_rung_stops is therefore always [], silently breaking the documented "org-rung entitlements are interviewed, never auto-written" behavior (SKILL.md / eval 31). Currently latent since no v1 identity has a non-null rung yet, but will silently no-op once one does.

Both are static-analysis-confirmed (cross-checked resolver output shape, emission generator, and real security-binding fixtures) rather than executed live, since the sandbox here blocks writes under any .claude/ path.

No other issues found — the propose/ratify split, narrowing-only enablement advice, additive-section shape (surface_refs + declarations, no surfaces map), and envelope-conformance fixture all line up with the ADR 0011 / slice-doc contract.
· Branch: cursor/2725-prereq-setup-14fb

[github-actions]

Claude has reviewed this PR 1 time. The lane skips further automatic reviews after 5; deleting this comment resets the count.

[claude]

Claude encountered an error —— View job

---

I'll analyze this and get back to you.

[github-actions]

Warning

Automated review did not complete — this is an infrastructure failure, not a review verdict.

Treat any Claude comment on this PR (including a placeholder like "I'll analyze this and get back to you") as incomplete, not "no findings."

• Run: https://github.com/melodic-software/claude-code-plugins/actions/runs/31919144216
• Failure class: other
• Last SDK result: (no execution file was produced)

Re-run the job, or workflow_dispatch this workflow with the PR number, to retry the review. A new push re-triggers this lane only if the caller's pull_request triggers include synchronize (the canonical caller omits it).
An automatic retry may already have run — it is skipped when a partial review could duplicate comments, or when the failure class needs an operator (auth).