#183)

* trailmark: update skills to use v0.4.0 features

* fix: resolve code review findings for PR #183

Redraws the version boundary to match the actual Trailmark release
history, verified against the v0.2.0/v0.2.1/v0.2.2/v0.3.1/v0.4.0 tags
of trailofbits/trailmark:

P1 (misclassified APIs, fixed):
- ancestors_of(), reachable_from(), entrypoint_paths_to(),
  nodes_with_annotation(), clear_annotations() and the diff/entrypoints
  CLI exist since v0.2.0 — moved from the v0.4+ list to the v0.2-safe
  baseline; removed needless hasattr() gates and degraded fallbacks
- supported_languages()/detect_languages() (trailmark.parse) are 0.3+
  modules, not v0.2-safe — annotated as such
- CLI --version/version were added in 0.2.2, not 0.4 — documented as
  0.2.2+ and version-probe failure semantics clarified
- graph-evolution/SKILL.md reverted to main: native diff has existed
  since v0.2.0 with identical args, so the 0.2.x-fallback rewrite was
  built on a false premise (also resolves the quality-checklist
  contradiction flagged in review)

P3 (fixed): lexical version comparison hazard noted; stale
diagramming-code checklist label; README baseline list now defers to
the SKILL.md Version Gate instead of keeping a second divergent copy

Dismissed: 'diff CLI signatures contradict' (both forms valid — before/
after positionals accept paths or git refs, --repo/--json exist since
0.2.0); 'subgraph_edges has no edge_kinds param' (v0.4.0 signature has
edge_kinds keyword); 'diagram.py fallback broken on 0.2.x'
(trailmark.diagram module exists in 0.2.x; only the CLI subcommand is
new); 'phantom diff_against()' (real, v0.2-safe, now in baseline)

Verified: check_claude_loadability.py, check_codex_loadability.py,
pre-commit hooks pass; all SKILL.md files under 500 lines

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* trailmark: add assurance workflow skills (#187)

* trailmark: add assurance workflow skills

* fix: drop hasattr gates on v0.2-baseline query APIs

entrypoint_paths_to() and reachable_from() are in the v0.2-safe
baseline, so the hasattr fallbacks were dead code — and the
entrypoint_paths_to fallback indexed attack_surface() entries with
entry["name"] instead of node_id, which would raise KeyError.
Addresses PR #187 review feedback.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

* fix(trailmark): make detect_languages import v0.2-safe in operational skills

The trailmark-summary and trailmark-structural skills claimed v0.2-safe
workflows but unconditionally imported trailmark.parse, a 0.3+ module.
detect_languages() has existed in trailmark.query.api since v0.2.0 (kept
as a deprecated alias in 0.3+), so gate the import with a fallback
instead of relabeling the skills as 0.3+. Version Gate docs updated to
document the v0.2-safe import path; supported_languages() remains 0.3+
with no 0.2.x equivalent.

Verified against trailmark v0.2.0 source (fallback branch) and the
current 0.4 line (canonical branch).

Addresses review feedback on PR #183.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* trailmark: document and enable v0.5.0 features

Trailmark 0.5.0 adds a PostgreSQL-oriented sql parser (node kinds
schema/table/view/procedure), the stable .trailmark/links.toml
configuration for cross-language/FFI/RPC/external links, repository
links/proxies/type_uses edges on single-language parses, Solidity
entrypoints from parser metadata (visibility/mutability/overridden-by
attributes), node attributes in attack_surface() entries, TypeScript
constructed-receiver resolution, and C# file-scoped namespaces.

Updates the Version Gate with a v0.5+ section and a structural probe
('SCHEMA' in NodeKind.__members__ — 0.5.0 adds no new QueryEngine
methods, so hasattr() cannot detect it), adds a Repository Links
section and cross-boundary query recipe, extends the parser list and
graph model docs, notes the reachability-vs-taint limitation, and
threads the 0.5 output additions through trailmark-structural and
audit-augmentation. Plugin version 0.9.0 -> 0.10.0.

All version claims verified against trailofbits/trailmark v0.2.0 and
v0.5.0 builds, including a live links.toml materialization test.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* trailmark: add slicing-code-context skill (#203)

Adds a skill for delegating focused code tasks to constrained or locally
hosted models using bounded, graph-informed Trailmark source packets:

- scripts/build_slice_packet.py: deterministic PEP 723 packet builder
  (Trailmark 0.5.x) with five selection modes, whole-unit budget admission,
  explicit omission accounting, path-traversal rejection, an embedded
  untrusted-source notice, and structured JSON errors (26 tests, including
  a real Trailmark integration test)
- agents/code-slice-worker.md: repository-tool-free Haiku worker returning
  a source-cited JSON contract
- SKILL.md + references/slice-packet.md: coordinator workflow, packet and
  worker response contracts, and validation rules

Reviewed with a multi-agent Claude pass and two Codex passes; fixes from
those reviews are included (doc/selection-order reconciliation, relationship
deduplication, line-range anchors no longer expand to full nodes in
path/entrypoint modes, background-safe worker toolset, structured io_error
handling, replacement-packet expansion semantics).

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Dan Guido <dan@trailofbits.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>