onboard-simlisted

Adversarial onboarding-safety simulation. Builds a leak-SAFE sandbox that reproduces a fresh PUBLIC-origin open-bridge clone with the push guard armed, drives a naive first-time-user session inside it (default: a cheap model such as Haiku; or a model-free scripted run for CI), then DETERMINISTICALLY asserts that no USER data — identity/agent, work/, client content on a user/* branch — reached the would-be-public upstream. The whole sandbox upstream is a local bare repo, so testing for a leak can never cause one. Use to verify the public-origin push guard (rules/push-guard.md + scripts/hooks/pre-push) end-to-end whenever onboarding, the hook, rules/operations.md, or session-start change, and as the standing pre-promote / CI gate for that surface. Trigger: "/onboard-sim", "onboard sim", "simulate onboarding", "run the onboarding simulation", "leak sim", "test the push guard", "does my bridge leak", "mirror-safety sim".
bks-lab/open-bridge · ★ 8 · AI & Automation · score 74

Install: claude install-skill bks-lab/open-bridge

# onboard-sim — adversarial onboarding-safety simulation Proves an invariant the unit test can't: **a realistic naive first-time-user session, walking the real onboarding → commit → push path, cannot leak private data to a public upstream.** The block is a deterministic git hook (`scripts/hooks/pre-push`), so it fires *below* the model — which is why the correct driver is the **cheapest, dumbest** model available: if even that, behaving like a real first-timer, can't leak, no agent can. Cost and speed are the bonus; the model-independence is the actual claim. ## Why a simulation (not just the unit test) `scripts/tests/test-push-guard.sh` checks the hook's block/allow/bypass contract in isolation. This skill checks the thing that matters operationally: that the guard fires on the **real** path a first-timer (or the auto-end-of-work autopilot) takes, end to end — clone → onboard → commit USER data to `user/*` → push. ## Leak-safe by construction The sandbox's "public upstream" is a **local bare repo**. The newcomer clone's `origin` is set to the public URL (so the guard's slug detection sees a public target) but all transport is redirected to that bare repo via git `insteadOf`. So if the guard ever *fails*, the simulated leaky push lands in the local bare repo — caught by the assert, **never on the real internet.** Testing for a leak cannot cause one. ## How it runs (4 phases) 1. **Build** — `assets/build-sandbox.sh <open-bridge-checkout> [sandbox-dir]` prints the san