apex

Only the latest minor release line is supported (SECURITY.md "Supported versions"); upgrading is reinstalling the plugin from the marketplace or release, and CHANGELOG.md plus the GitHub Release notes describe every change between versions.

GitHub Issues with bug-report and feature-request templates: https://github.com/zeybek/apex/issues

No vulnerabilities have been resolved in the last 12 months. SECURITY.md commits to crediting reporters in the release notes unless they ask to remain anonymous.

SECURITY.md "Response process": acknowledge, triage, fix (privately when needed) and release as a patch, disclose in release notes with credit within at most 90 days. https://github.com/zeybek/apex/blob/main/SECURITY.md

Python style is defined by the ruff and mypy configuration in pyproject.toml (line length, rule families, strict typing); Markdown by .markdownlint-cli2.jsonc; skill-content constraints in CONTRIBUTING.md. https://github.com/zeybek/apex/blob/main/pyproject.toml

CI runs ruff check, ruff format --check, mypy --strict, markdownlint-cli2, and the package validator on every pull request and blocks on any finding; the same hooks are available through .pre-commit-config.yaml.

No build step: the scripts are run directly from source and the release archive is a tar of the plugin directory.

No build or compilation occurs.

No build occurs; the Makefile only invokes validators and tests.

No build occurs (scripting language used directly); the release tarball is packaging, not compilation.

Installed and removed with the host plugin managers using their standard commands (claude plugin install/uninstall apex@apex, codex plugin add/remove apex@apex, gh skill install, npx skills add). https://github.com/zeybek/apex#install

Installation is performed by the host agent plugin manager into its own discovery path; there is no filesystem installer that would honor DESTDIR-style variables.

CONTRIBUTING.md "Development setup": git clone, then make validate / make test with the standard-library validators (no install step) and uv for the official validator and test tooling. https://github.com/zeybek/apex/blob/main/CONTRIBUTING.md

Runtime: none (standard library only). Development dependencies are declared in requirements-dev.in and locked with hashes in requirements-dev.txt; GitHub Actions are pinned by commit SHA in .github/workflows. https://github.com/zeybek/apex/blob/main/requirements-dev.txt

Dependabot alerts and security updates are enabled; Dependabot version updates run weekly for pip and GitHub Actions with a 7-day cooldown; CodeQL and OpenSSF Scorecard run on every change and weekly.

The delivered software reuses nothing beyond the Python standard library; development tooling is hash-pinned in requirements-dev.txt and refreshed by Dependabot, and each GitHub Action is pinned to a commit with a version comment.

The external interface is the set of skills and commands; the README tables and each SKILL.md description are updated in the same change as the behavior, and the package validator checks every SKILL.md description on each run.

GitHub Actions runs the full suite (validators on four Python versions, pytest, lint, type checks, official validator, schema checks, harness smoke, markdownlint, CodeQL) on every push and pull request and reports pass or fail per job. https://github.com/zeybek/apex/actions/workflows/ci.yml

No bugs have been fixed in the last six months (no fix: commits in the history; CHANGELOG has no Bug Fixes entries). The policy in CONTRIBUTING.md and docs/CODE_REVIEW.md requires a regression test or eval case with every fix.

pytest-cov in CI reports 90% statement coverage (and 88% branch coverage) for scripts/.

Formal written policy in CONTRIBUTING.md: new or changed behavior in scripts/ must come with tests in tests/, and a new or changed skill must come with its evals; CI blocks on failures. https://github.com/zeybek/apex/blob/main/CONTRIBUTING.md

Documented in CONTRIBUTING.md ("Before you open a pull request", "Changing or adding a skill"). https://github.com/zeybek/apex/blob/main/CONTRIBUTING.md

ruff runs every stable rule family applicable to the codebase, with each ignore justified inline in pyproject.toml; mypy runs in --strict mode on scripts/; markdownlint runs with its full default rule set; CI fails on any finding.

docs/ASSURANCE_CASE.md section 4 documents the secure-design principles applied (least functionality, least privilege, fail-safe defaults, complete mediation, open design, defense in depth, separation of privilege for the supply chain) and the controls that implement each. https://github.com/zeybek/apex/blob/main/docs/ASSURANCE_CASE.md

The software produced (Markdown skill instructions, JSON manifests, standard-library validators) implements and uses no cryptography and opens no network connections. Release signing is keyless Sigstore performed by GitHub Actions, outside the delivered software.

The software produced (Markdown skill instructions, JSON manifests, standard-library validators) implements and uses no cryptography and opens no network connections. Release signing is keyless Sigstore performed by GitHub Actions, outside the delivered software.

The software stores and transmits no credentials or authentication data.

The software opens no network connections.

The software opens no network connections.

The software opens no network connections.

The software opens no network connections.

Every release archive is signed with cosign (keyless Sigstore) and carries a SLSA build-provenance attestation; the signature, certificate, and provenance bundle are attached to the GitHub Release. docs/RELEASING.md "Verifying a release" documents verification with cosign verify-blob and gh attestation verify. Keys are ephemeral and bound to the release workflow identity, so no long-lived private key exists on any distribution site or with any person. https://github.com/zeybek/apex/blob/main/docs/RELEASING.md

The validators allowlist what they accept: frontmatter keys from a fixed set, names matching a strict pattern, JSON structures checked field by field, link targets restricted to the skill directory and one level deep, and eval files checked against JSON Schemas; the eval harness validates CLI arguments with typed converters (positive integers, probabilities, ISO dates) and rejects malformed result files.

The delivered software is Markdown and JSON with no execution surface; the standard-library validators fail closed on any finding, which is the only hardening mechanism applicable.

https://github.com/zeybek/apex/blob/main/docs/ASSURANCE_CASE.md: security requirements, threat model, trust-boundary table, secure-design principles applied, common weakness classes and their controls, evidence, and residual risks.

CodeQL default security suite for Python runs on every push and pull request and weekly.

Python is a memory-safe language; the project has no memory-unsafe components.