Internal AI SDLC skill, not client-facing by default. Integrity and provenance evidence do not grant install or execution authority.

• Skill name:

  ai-sdlc-package-trust

• Primary audience: Security, Delivery, Release
• Supporting audience: Dev, Architecture
• Audience tags: Security, Delivery, Release, Dev
• SDLC stage: Package trust and local observability
• Purpose: Fail closed on untrusted packages and measure delivery without content collection.
• Output:

  _ai_sdlc/trust/<package-id>/decision.{toon,json,md}

  or

  _ai_sdlc/metrics/local.{toon,json,md}

• Package root, versioned manifest, allowed origins/capabilities, active harness API, and provenance policy.
• Repository-local runtime and evidence records for metrics.

• Ask when trust policy or package root is ambiguous.
• Reject unsafe paths, symlinks, hash drift, incompatible APIs, undeclared or disallowed capabilities, and missing required provenance.
• Never equate a digest with author identity or approval.

• Support

  --quick-flow

  and

  --full-flow

  ; full flow takes precedence.
• Full flow reviews every file, capability, origin, provenance claim, and privacy field.

• Default to complete TOON trust decisions or content-free aggregate metrics.
• Return summaries directly in the Codex response.
• Emit

  ai-sdlc-handoff/v1

  with

  result

  ,

  blockers

  ,

  next_required

  , and

  next_optional

  ; actions include

  reason

  ,

  command

  , and

  expected_artifact

  .
• Do not create

  summary.txt

  ,

  *-summary.txt

  , or another standalone summary file.

• Write generated decisions and metrics only below

  _ai_sdlc/

  .
• Never rewrite package files, manifests, runtime records, or evidence ledgers.

• Read owning feature

  _ai_sdlc/state.toon

  before using a trust decision.
• Trust and metrics do not advance feature state.

• Related Markdown uses canonical

  artifact_metadata

  and

  metatags

  .
• Machine records use versioned package, trust-decision, and local-metrics schemas.

• Read

  _ai_sdlc/specs-index.toon

  first and use

  specs-index.md

  for human review.
• Trust and metrics outputs do not refresh either index.

• Read

  references/trust-metrics-contract.md

  before interpreting results.
• Validate manifests with

  references/package.schema.json

  .
• Use

  scripts/package_trust.py

  for trust and

  scripts/metrics.py

  for aggregation.

1. Validate manifest structure, safe inventory, origin, API range, and capabilities.
2. Rehash every declared regular file and the normalized inventory.
3. Validate required provenance fields without claiming cryptographic identity.
4. Emit an explainable allow or deny decision; never install the package.
5. Aggregate local run states and evidence coverage using counts and numeric budgets only.
6. Reject any metrics structure containing content-bearing field names.
7. Emit deterministic TOON-first local metrics with explicit insufficient-data state.

• Do not install, execute, publish, sign, approve, or delete packages.
• Do not upload metrics or collect content-bearing fields.
• Do not weaken allowed origins, capabilities, or provenance policy.