👻 fix/WSK-00108: plugin checks forbid model API keys in workflows; watch superpowers as a companion

src/wraith_tools/plugin_checks/test_workflows.py

@@ -183,20 +183,12 @@ def test_vet_job_holds_no_write_credentials():
     assert checkout["uses"].startswith("actions/checkout@")
     assert checkout["with"]["persist-credentials"] is False
     assert "GH_TOKEN" not in job_text("vet")
-    with_key = [s for s in vet["steps"] if "ANTHROPIC_API_KEY" in str(s)]
-    assert [s["name"] for s in with_key] == ["Machine read"]
+    assert not any(s.get("name") == "Machine read" for s in vet["steps"])
 
 
-def test_machine_read_has_no_tools_and_a_budget():
-    step = next(
-        s for s in job("vet")["steps"] if s.get("name") == "Machine read"
-    )
-    run = step["run"]
-    for flag in ("--bare", '--tools ""', "--no-session-persistence"):
-        assert flag in run
-    assert "--max-budget-usd 1" in run
-    for loose in ("--allowedTools", "bypassPermissions", "--dangerously"):
-        assert loose not in run
+def test_no_workflow_reads_a_model_api_key():
+    for path in sorted(WORKFLOWS.glob("*.yml")):
+        assert "ANTHROPIC_API_KEY" not in path.read_text(encoding="utf-8")
 
 
 def test_propose_job_opens_a_review_pr_and_never_merges():

src/wraith_tools/sync_upstream.py

@@ -12,10 +12,11 @@
 from dataclasses import dataclass, field
 from pathlib import Path
 
-COMPANIONS = ("DBT", "GCP", "TF")
+COMPANIONS = ("DBT", "GCP", "TF", "SP")
 # The companion skills wraith names, from the Decision sections of
-# docs/adr/0002 to 0004. Drift anywhere else in a vendor repo is out of
-# scope: wraith never vetted those skills and never points to them (#91).
+# docs/adr/0002 to 0004 and 0006. Drift anywhere else in a vendor repo is
+# out of scope: wraith never vetted those skills and never points to them
+# (#91).
 # The context-engineering skills named in ADR 0003 live in a repo this
 # sync does not fetch, so they are not listed here.
 NAMED = {
@@ -67,6 +68,23 @@
             "terraform-search-import",
         }
     ),
+    "SP": frozenset(
+        {
+            "brainstorming",
+            "writing-plans",
+            "executing-plans",
+            "subagent-driven-development",
+            "dispatching-parallel-agents",
+            "using-git-worktrees",
+            "test-driven-development",
+            "systematic-debugging",
+            "verification-before-completion",
+            "requesting-code-review",
+            "receiving-code-review",
+            "finishing-a-development-branch",
+            "writing-skills",
+        }
+    ),
 }
 SKIP_DIRS = {".git", ".upstream", ".venv", "node_modules"}
 

src/wraith_tools/vet_companion.py

@@ -29,6 +29,7 @@
     "DBT": "0002-companion-dbt.md",
     "GCP": "0003-companion-google.md",
     "TF": "0004-companion-hashicorp.md",
+    "SP": "0006-process-skills-to-companions.md",
 }
 DIFF_LIMIT = 150_000
 BODY_DIFF_LIMIT = 45_000

tests/test_sync_upstream.py

@@ -148,23 +148,23 @@ def test_clean_merge_applied_and_sha_rewritten(tmp_path):
 
 
 def test_prints_only_fully_clean_moved_keys(tmp_path, capsys):
-    sp = upstream(tmp_path / "old", "SP", {"f.md": BASE})
+    ka = upstream(tmp_path / "old", "KA", {"f.md": BASE})
     gs = upstream(tmp_path / "old", "GS", {"g.md": BASE})
     upstream(tmp_path / "old", "MP", {"m.md": BASE})
     upstream(tmp_path / "old", "TF", {"t.md": BASE})
-    upstream(tmp_path / "new", "SP", {"f.md": THEIRS})
+    upstream(tmp_path / "new", "KA", {"f.md": THEIRS})
     upstream(tmp_path / "new", "GS", {"g.md": THEIRS})
     upstream(tmp_path / "new", "MP", {"m.md": THEIRS})
     upstream(tmp_path / "new", "TF", {"t.md": THEIRS})
-    local(tmp_path / "root", "f.md", OURS, f"SP@{sp[:7]}:f.md")
+    local(tmp_path / "root", "f.md", OURS, f"KA@{ka[:7]}:f.md")
     local(
         tmp_path / "root",
         "g.md",
         BASE.replace("line6", "line6 ours"),
         f"GS@{gs[:7]}:g.md",
     )
     run(tmp_path)
-    assert capsys.readouterr().out.split() == ["MP", "SP"]
+    assert capsys.readouterr().out.split() == ["KA", "MP"]
 
 
 def test_conflict_left_untouched(tmp_path):