Update to The 5th Ledger

{
  "description": "Assess deployment health, validation coverage, observation or soak completion, documentation, rollback, approval, and release readiness from exact identity-bound project evidence. Use when asked whether a build, package, service, migration, deployment, promotion, or release is ready, healthy, or blocked. This workflow is read-only and never authorises deployment, publication, promotion, tagging, or release.",
  "included_files": [
    {
      "relative_path": "agents/openai.yaml",
      "size_in_bytes": 273
    }
  ],
  "name": "review-release-evidence",
  "skill_md_contents": "---\nname: review-release-evidence\ndescription: \"Assess deployment health, validation coverage, observation or soak completion, documentation, rollback, approval, and release readiness from exact identity-bound project evidence. Use when asked whether a build, package, service, migration, deployment, promotion, or release is ready, healthy, or blocked. This workflow is read-only and never authorises deployment, publication, promotion, tagging, or release.\"\n---\n\n# Review Release Evidence\n\nRead `../../references/untrusted-evidence.md` before inspecting release artifacts or provider output.\n\nAssess evidence, not intent. Keep readiness separate from authority to release.\n\n## Establish identity\n\nConfirm the relevant source revision, version, artifact or package hash, build,\nenvironment, deployment, installed or active identity, evidence timestamps, and target\nrelease channel. Reject mixed, stale, ambiguous, or superseded identities.\n\nRecord these lifecycle facts separately:\n\n- candidate version declared by source or metadata;\n- published artifact identity and publication evidence;\n- provider validation identity, observation time, and result;\n- explicit human release decision and decision owner.\n\nNone substitutes for another. A matching candidate version, configured provider\nworkflow, or changelog entry does not prove publication, provider success, or release\napproval.\n\nRead the project profile and canonical release contract. If either is absent, state\nwhich gates can still be assessed and which remain project-defined.\n\n## Evaluate gates independently\n\nReport each applicable gate as `pass`, `fail`, `incomplete`, or `unavailable`:\n\n- source and artifact integrity;\n- deployment transport and activation;\n- runtime or production health;\n- required test, migration, compatibility, security, privacy, and rollback coverage;\n- observation window, cadence, sample completeness, and identity continuity;\n- changed-surface coverage across APIs, schemas, UI, generated artifacts, docs, and\n  support material;\n- publication, approval, promotion, and release authority.\n\nDo not repair a missed checkpoint with a later healthy sample. Do not treat a passing\ntest, merged commit, healthy deployment, generated report, or reviewer recommendation\nas human release approval unless the release contract explicitly says so.\n\nUse `$run-independent-review` when Level 3 or project rules require multiple review\nlenses. External security, compliance, or operational controls remain external.\n\n## Return the gate report\n\nReturn exact identity and freshness, per-gate results, contradictions, observation\nprogress, changed-surface coverage, approval status, missing evidence, residual risk,\nand the next read-only action or exact human decision required.\n\nDo not deploy, restart, promote, tag, publish, or release from this skill. Route a\nrequested mutation through `$establish-governance-boundary` as a separate action.\n"
}