A third-party audit of all 20 sovereign-skills produced reproducible bug fixes across deployment blockers, security gaps, and logic errors in every skill.
Adapted from @AlexZio00sovereign-skills v6.5.11 — audit-driven bug-fix release Commissioned an independent third-party audit of the v6.5.9 snapshot: static review + test execution + boundary-input reproduction + official-doc cross-check. Every one of the 20 skills got at least one real fix. Two deployment blockers: • Codex install docs were wrong — per OpenAI's official spec, Codex discovers skills via .agents/skills/<name>/SKILL.md, not by appending agents/openai.yaml to AGENTS.md. Fixed across all 5 READMEs + all 20 yaml files. • 7 plugin manifests were failing `claude plugin validate` with an invalid schema field — now validates clean across all 20. Reproduced bugs, not just style nits: • pre-push — secrets scan only checked staged diff; git push sends outgoing commits too. Fixed. • project-overview — a corrupted marker pair could silently delete manually-written text; one bad-encoding file killed the whole run; status always said WORKING even when partial. • session-checkpoint — quarantined entries could leak into memory promotion; attestation timing caused false "tampered" reports on the next session. • scope — malformed input (wrong keys, out-of-range values) silently passed validation. • code-autopsy — a cheap-to-fix catastrophic bug could dodge the Critical severity gate. Plus fixes across setup, project-init, project-check, session-start, collab-audit, skill-ops, integration-intake, clean-room, eval-leakage-audit, doc-drift, goal-lock, full-audit (new AUDIT_ONLY/PROPOSE/APPLY_APPROVED mode gate), freeze, next-action, stepback. All 9 test suites in the repo pass (204 assertions). Full detail in CHANGELOG.md. git clone https://t.co/3Angw4C8lM CHANGELOG: https://t.co/kS7T3HHK6G
