release-audit

# Release Audit Prove each release boundary independently and report gaps without creating, moving, deleting, or publishing tags or releases. Prerequisites are `python3`, `git`, `gh`, and `cosign`; authentication must already be configured for read-only GitHub and signature verification. Agent presentation metadata is kept in [openai.yaml](agents/openai.yaml). Offline behavior is covered by [audit_test.py](scripts/audit_test.py) with [draft release](scripts/fixtures/draft-release.json), [missing assets](scripts/fixtures/missing-assets.json), [moved tag](scripts/fixtures/moved-tag.json), [stale CI](scripts/fixtures/stale-ci.json), and [valid source-only](scripts/fixtures/valid-source-only.json) fixtures. ## Contract Require a repository-owned `.release-audit.json` so an audit never invents an artifact requirement or assumes binaries exist: ```json { "schema": "fmind.dev/release-audit-contract/v1", "workflows": ["CI"], "artifacts": [] } ``` An empty `artifacts` list explicitly declares a source-only release. Artifact entries require `name` and `kind`; supported kinds are `asset`, `checksum` with `covers`, `sbom`, `signature` with `subject`, `certificate_identity`, and `certificate_oidc_issuer`, and `attestation` with `subject`. ## Audit Run from the repository checkout: ```bash python3 ~/.agents/skills/release-audit/scripts/audit.py <tag> [--contract .release-audit.json] python3 ~/.agents/skills/release-audit/scripts/audit.py <tag> --json ``` The collector is ...