Version updated for https://github.com/snapsynapse/graceful-boundaries to version v1.5.3. This action is used across all versions by 0 repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. Action Summary Graceful Boundaries is a specification for how services communicate their operational limits to humans and autonomous agents. It addresses three gaps in existing standards, providing proactive discovery of limits before they are hit, structured refusal with explanatory details and next steps, and constructive guidance. The specification applies to every HTTP error class, not just rate limits.

Version updated for https://github.com/snapsynapse/skill-provenance to version v6.0.0. This action is used across all versions by ? repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. Action Summary Skill Provenance is a GitHub Action that ensures the integrity and version control of Agent Skills. It helps teams manage and verify the version, staleness, and drift of their skills across different platforms and sessions. By embedding version information and hash-based integrity checks within the skill bundle, Skill Provenance allows for portable provenance and trust verification.

Version updated for https://github.com/snapsynapse/skill-provenance to version v5.1.0. This action is used across all versions by ? repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. Action Summary The action ensures that agent skills across local folders, registries, and platform uploads maintain their integrity by recording version information and hash-based integrity verification inside the bundle. This helps teams verify version identity, detect staleness, and ensure no accidental drift during transitions.

Version updated for https://github.com/snapsynapse/harnessie-verify-action to version v0.1.0. This action is used across all versions by ? repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. What’s Changed First release. Adopted via a recorded, human-arbitrated decision: AIDR-0007. Treat a pull request’s description as claims, not evidence. This action runs your deterministic checks sandboxed (exit codes only), then a fresh-context verifier model that never sees the author’s narrative tests each remaining claim against the actual artifacts, and the job’s exit code gates the merge.

Version updated for https://github.com/snapsynapse/skill-provenance to version v5.0.0. This action is used across all versions by ? repositories. Action Type This is a Composite action. Go to the GitHub Marketplace to find the latest changes. What’s Changed 5.0.0 - 2026-07-10 Security hardening release for Skill Provenance manifest validation and its GitHub Actions wrapper. Security fixes Prevented bundle-path shell injection by transporting caller-controlled action input through an environment variable instead of interpolating it into Bash source. Made verify mode fail closed on missing, malformed, or duplicate manifest hash fields. Added explicit hash: null as the only intentional hash-verification opt-out. Made update mode repair missing or malformed hashes while preserving explicit null opt-outs. Kept inventory presence checks active for files whose hashes are explicitly opted out. Tests and evals Added executable CI regressions for action input transport and validator hash states. Added adversarial quote, separator, command-substitution, newline, and spaced-path action coverage. Added core evals for fail-closed verification, explicit null semantics, and update repair. Added a supplemental eval for GitHub Action shell safety. Expanded coverage from 46 to 50 scenarios: 33 core and 17 supplemental. Breaking change Manifest entries may no longer omit the hash field. Use a complete lowercase sha256: value or explicit hash: null. This intentional contract tightening requires the 5.0.0 major version.