fanout-cve-task-guardianlisted

End-to-end maintenance skill for the fanout-cve-rollout task (<TASK_ID>). Owns pre-push safety checks, local quality/anatomy gates, push, Oracle validation, and rollout monitoring. This is a REWARD-SHAPED task (5 independent subscores, 0.2 each) — the goal is a dense, correct partial-credit gradient that guides agents through the full remediation, NOT the avg < <TARGET_MEAN> variance target of the sibling tasks. Calls fanout-cve-validation-debugger when Oracle fails and fanout-cve-score-tuner when the gradient is wrong.
omonuj/claude-horizon-skills · ★ 0 · AI & Automation · score 62

Install: claude install-skill omonuj/claude-horizon-skills

# fanout-cve-task-guardian ## Step 0 — QC Spec design gate (READ FIRST, every iteration) Before editing ANY task file and again before every push, read the QC Spec — `.claude/QC-SPEC.md`. It is the priority-ordered rubric (Critical → Error → Legitimacy) `horizon check-quality` and reviewers grade against. Confirm the intended/current design does not violate any Critical or Error item. The ones to hold for this reward-shaped task: - **No Binary Bundling** — keep the 5 subscores independent; never AND heterogeneous checks into one. - **Functional Tests as Subscores** — `pods_rolled_live_env` exercises live behavior (`kubectl exec` of pod env); keep it functional, not a spec read. - **Incremental Rewards / No Dead Weights / Functional Subscore Variance** — every 0.2 subscore represents real progress and takes ≥2 distinct values across a batch. - **Equal Weights** — all five subscores equal (0.2). - **No Answer Leakage** — the grader judges CVE truth off root-only `/opt/grader-cve.json`, never an agent-editable artefact. If a change would breach a Critical/Error item, stop and rework it before pushing. ## Execution Mode — FULLY AUTONOMOUS **NEVER ask the user for confirmation** on any command, edit, push, validation, or live-probe. The ONLY user-facing handoff is Step 4c (trigger the rollout batch in the Horizon UI). Everything else runs without asking. Two valid paths → pick the safer. ## Goal Keep fanout-cve-rollout shippable every push: setup.sh runs cleanly, Oracle scor