host-contract-verification SKILL.md skillA
host-contract-verification from devcodex-labs/devcodex is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add devcodex-labs/devcodex/host-contract-verification@git:20261018.fda4337Pins git:20261018.fda4337 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- devcodex-labs/devcodex
- Path
content/skills/host-contract-verification/SKILL.md- Versions recorded
- 5
- Latest version
- git:20261018.fda4337, committed Oct 18, 2026
- First version recorded
- Jul 30, 2026
- Size
- 14,825 bytes
- Repository stars
- 432
- License
- AGPL-3.0
宿主契约验证规范 — 为 Hook / CLI / bootstrap / visible envelope / workspace guard / LinkCapabilityDecision / MCP fallback 定义 direct replay、fixture replay、部署同步与证据路线.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Host Contract Verification Skill ## 职责 当任务涉及宿主事件契约、Hook 可见回复、workspace 项目识别、bootstrap 护栏、产物链接可点击性、MCP bridge fallback 或部署副本同步时，本 Skill 负责把“怎么证明宿主行为真的成立”收口为可复审的验证路线。 它不替代 `test-router`、`report` 或 runtime tests，而是为这些产物提供统一的宿主证据模型。 ## 触发条件 | 场景 | 是否触发 | |------|:--------:| | Hook runtime / 宿主适配 / Hook 输出契约变更 | 🔴 必须 | | Stop / PreCompact 可见回复验证语义变更 | 🔴 必须 | | sticky `activeProject` / `mode` / workspace guard 变更 | 🔴 必须 | | Bootstrap、部署副本、父链同步口径变更 | 🔴 必须 | | `EntryCheckModelV3` / `DevCodexVisibleEnvelopeV3` / V1/V2 只读兼容 / `PostCompletionActionSetV1` / `UserFacingArtifactSetV1` / `LinkCapabilityDecisionV1` / `HostLinkCapabilityDecisionV2` / `ArtifactDeliveryAttemptV1` 变更 | 🔴 必须 | | Copilot / Codex MCP bridge 报错、`profile_load` fallback、`invoke undefined` 恢复链变更 | 🔴 必须 | | `ContextReadPlanV2` / `ContextReadReceiptV2`（含 V1 兼容）、Pre/Post 相关性、内容身份/复用、上下文读取 allowlist 或 fallback 语义变更 | 🔴 必须 | | 公开本地 probe、checkpoint 证据语义或 trace show/replay 变更 | 🔴 必须 | | 仅普通业务代码改动 | N/A | ## HostContractRoute | 字段 | 必填 | 说明 | |------|:----:|------| | `hostSurface` | ✅ | Copilot / Claude Code / Codex / instruction-fallback 中本轮实际验证的宿主面 | …
Read the whole file at its exact version.
How to install
mdr add devcodex-labs/devcodex/host-contract-verification@sha256:3fa9f45dd4b8930cThe line at the top of this page pins the label git:20261018.fda4337, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_eonedoufvew2o7v4)
4 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 5 versions of this file, between Jul 30, 2026 and Oct 18, 2026, about one every 20 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20261018.fda4337 latest | 2026-10-18 | fda4337 | 14,825 B | A | view · diff |
| git:20260829.ef3a006 | 2026-08-29 | ef3a006 | 14,395 B | A | view · diff |
| git:20260827.f3bcda6 | 2026-08-27 | f3bcda6 | 14,167 B | A | view · diff |
| git:20260823.e3f0ff7 | 2026-08-23 | e3f0ff7 | 13,420 B | A | view · diff |
| git:20260730.6ee304a | 2026-07-30 | 6ee304a | 12,967 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (14825 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
devcodex-labs/devcodex · 432 stars · license AGPL-3.0 · pushed 2026-10-27 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_eonedoufvew2o7v4 GET https://markdownregistry.com/api/v1/resolve?ref=devcodex-labs/devcodex/host-contract-verification GET https://markdownregistry.com/api/v1/blob/3fa9f45dd4b8930c28d7f7532643a6904a1bf73df6af02eb78a30ad597cfc5b9
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.