verify-and-ship

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: no behavioural pass.

.claude/skills/cyrus-setup

.claude/skills/cyrus-setup-claude-auth

.claude/skills/cyrus-setup-endpoint

.claude/skills/cyrus-setup-github

.claude/skills/cyrus-setup-gitlab

Audit 0.4.1 · source sha 2c67e9ae404e · 31 Oct 2026Report an issue or request a re-scan

• Publisherceedaragents GitHub organizationOwner of the repository this skill is read from
• Source folderceedaragents/cyrus/skills/verify-and-shipThe exact folder we audited
• LicenceApache-2.0As the repository states it
• Commit pinned for this verdict2c67e9ae404eA new audit runs when the source changes
• Repository statusNot archivedPushed today
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Choose proportionate validation, fix failures, update the changelog, commit, push, and create/update the pull request or merge request.

---
name: verify-and-ship
description: Choose proportionate validation, fix failures, update the changelog, commit, push, and create/update the pull request or merge request.
---

# Verify and Ship

After implementing your changes, follow these steps to verify quality and ship the work.

## 1. Acceptance Criteria Validation (CRITICAL)

Use the issue tracker `get_issue` tool to fetch the current issue details. Extract ALL acceptance criteria from the issue description and verify each one is satisfied by the implementation. If no explicit criteria exist, validate against the implied requirements from the issue title and description.

## 2. Quality Checks

Choose validation by changed behavior, risk, and existing coverage. Verification
is required; new automated tests and a full-suite run are not required for every
change. Follow repository-specific checks and CI gates where applicable.

- **Direct verification** — For routine release scripts, packaging/build metadata,
  CI, documentation, and instruction edits, prefer syntax checks, a safe dry run,
  artifact inspection, an isolated install smoke check, or a consistency review
  when those are sufficient. Record the command/result or review performed in
  the PR; no new test file or validation report is needed merely to show work.
- **Automated tests** — Run relevant existing tests. Add or retain a regression
  test only when it catches a concrete consequential failure and its protection
  justifies its maintenance. Examples include publishing the wrong artifact,
  unintentionally moving stable tags, or accepting invalid release evidence.
  Explain the failure each new test catches. Do not add brittle assertions on
  documentation wording or source text, tests that mirror implementation, or
  elaborate scaffolding for low-risk edits. A script filename alone neither
  requires tests nor exempts consequential behavior from protection.
- **Scope** — Broaden testing when shared behavior, failures, or unresolved risk
  warrants it; do not automatically run the full suite or generate coverage
  reports. Once sufficient checks pass, stop repeating them unless changes or
  new evidence justify another run. Investigate relevant failures rather than
  retrying unchanged commands. Report any unresolved failures honestly.
- **Lint, types, build** — Run checks relevant to the changed files and required
  repository gates. Fix introduced failures.
- **Review** — Check correctness, scope, and maintainability, including whether
  proposed tests provide useful protection.

Where the repository uses F1, apply its canonical
`skills/f1-test-drive/SKILL.md` applicability policy before invoking a drive or
requesting evidence. Nonapplicable changes need proportionate checks and a brief
PR note, without an F1 run or report. Do not infer an F1 requirement from this
skill. Preserve existing safeguards for consequential failures.

## 3. Changelog Update

Check if the project has changelog files:
```bash
ls -la CHANGELOG.md CHANGELOG.internal.md 2>/dev/null || echo "NO_CHANGELOG"
```

If changelog files exist, diff against the base branch to detect entries already added by this branch:

```bash
# See what changelog lines this branch has added compared to the base branch
# Replace <base_branch> with the actual base branch from the issue context
git diff <base_branch> -- CHANGELOG.md CHANGELOG.internal.md 2>/dev/null
```

**Handling existing entries:**
- If the diff shows this branch already added a changelog entry for the current issue (matching the issue identifier), **update that entry in-place** (e.g., to add the PR/MR link or refine the description). Do NOT add a duplicate entry.
- If the diff shows this branch added changelog entries for a different issue or no entries at all, add a new entry.

**Adding or updating entries:**
- Place entries under `## [Unreleased]` in the appropriate subsection (`### Added`, `### Changed`, `### Fixed`, `### Removed`)
- Focus on end-user impact — be concise but descriptive
- Include the Linear issue identifier and PR/MR link (format: `([ISSUE-ID](linear_url), [#NUMBER](PR_OR_MR_URL))`)
- Follow [Keep a Changelog](https://keepachangelog.com/) format

## 4. Commit and Push

- Stage all relevant changes (including changelog updates)
- Commit with clear, descriptive messages following the project's commit conventions
- Push to the remote repository

## 5. Create or Update PR/MR

Determine the platform from the repository context (`<github_url>` or `<gitlab_url>` in the issue context). Use the appropriate tool for the platform.

### GitHub (when `<github_url>` is present)

```bash
git push -u origin HEAD
gh pr view --json url,number 2>/dev/null || gh pr create --draft --base [base_branch from context] --title "[descriptive title]" --body "Work in progress"
```

### GitLab (when `<gitlab_url>` is present)

```bash
git push -u origin HEAD
glab mr view 2>/dev/null || glab mr create --draft --target-branch [base_branch from context] --title "[descriptive title]" --description "Work in progress"
```

### PR/MR Description

Update the PR/MR with a comprehensive description:
- **Assignee attribution**: If `<github_username>` is available in the assignee context, add `Assignee: @username ([Display Name](linear_profile_url))` at the top of the body. If only a linear profile URL is available, use `Assignee: [Display Name](linear_profile_url)`.
- **Summary** of changes, implementation approach, and testing performed
- **Link** to the Linear issue
- **Cyrus marker**: Include `<!-- generated-by-cyrus -->` as a hidden HTML comment at the end of the body
- **Interaction tip**: Add this at the end (before the marker), using the bot username from `<github_bot_username>` or `<gitlab_bot_username>` in the `<agent_context>` block of the system prompt. If `<agent_context>` is not present, default to `cyrusagent`:
  ```
  ---
  > **Tip:** I will respond to comments that @ mention @<bot_username> on this PR/MR. You can also submit a review with all your feed

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

git clone https://github.com/ceedaragents/cyrus
git -C cyrus checkout 2c67e9ae404e

Works in

1. 2026-10-31
   !CAUTION B 89 / 100

   first audit · source 2c67e9ae404e

Questions about verify-and-ship

• github.com/ceedaragents/cyrus/tree/main/skills/verify-and-ship — the audited source at commit 2c67e9ae404e and every finding aboveObserved · 31 Oct 2026

Spotted something wrong? Report a correction · Methodology