# Fold skill maintenance

The authoritative agent skill is [`skills/fold-sast/SKILL.md`](../../skills/fold-sast/SKILL.md).
Do not edit a second prose copy in this directory.

`scripts/generate_embedded_skill.py` converts the canonical Markdown into the
C++ header used by `fold skill`. Meson generates the build header whenever the
canonical skill or generator changes. The checked-in
`include/fold/cli/embedded_skill.hpp` is a reviewable generated mirror and must
remain byte-equivalent to the same generator output.

Regenerate and verify the mirror with:

```sh
python3 scripts/generate_embedded_skill.py \
  --input skills/fold-sast/SKILL.md \
  --output include/fold/cli/embedded_skill.hpp
python3 scripts/generate_embedded_skill.py \
  --input skills/fold-sast/SKILL.md \
  --output include/fold/cli/embedded_skill.hpp --check
```

After building, verify the user-facing artifact exactly matches its source and
that version provenance agrees across operator artifacts:

```sh
build/release/src/cli/fold skill -o /tmp/fold-skill.md
cmp skills/fold-sast/SKILL.md /tmp/fold-skill.md
build/release/src/cli/fold --version
# Compare that value with SARIF runs[0].tool.driver.version,
# native JSON tool.version, and profile JSON version.
```

## Last workflow validation

On 2026-07-29 the canonical recipes were exercised before adoption:

| Workflow | Evidence | Result |
| --- | --- | --- |
| Source | Clone scan over the `exact.cpp` and `renamed.cpp` fixtures | Exit `1`; expected actionable finding and valid SARIF |
| Binary | Security scan over `bof_x64`, capped at four functions | Exit `0`; valid SARIF |
| Hybrid | Merge-only source clone plus binary security scan | Exit `1`; expected actionable finding and merged SARIF |
| Query | Fixed-string rule query over the source SARIF | Exit `1`; one deterministic actionable match |
| Queued MCP | `fold.scan_start` through status, job query, activation, and context | `fold:mcp_stdio` passed |
| Embedded output | `fold skill` byte comparison with canonical Markdown | Passed |
| Version/artifacts | CLI, SARIF, native JSON, profile, and run-artifact provenance | One Meson semantic version plus Git revision/dirty state |

Exit `1` is the documented success status when actionable findings or query
matches exist. No recipe, parser, policy, or tool failure was observed. Full
reports and logs were retained under `/tmp/fold-task30-examples` for that run.
No Sage publication or activation was performed.

Do not publish or activate this skill through Sage without explicit approval.