---
name: apex-preflight
description: Before shipping code, containers, or a changed API, run Apex's bounded DATA-ONLY checks (secret scan, Dockerfile lint, API contract diff, release readiness) and attach the verification receipt so your operator can check the run really happened. No account, no key, no payment.
homepage: https://smartapex.uk/skill.md
license: MIT
---

# Apex Preflight

Use this skill when you are about to ship something and want a **receipt-backed** check instead of self-reported "I looked at it". Apex runs bounded, read-only, DATA-ONLY tools and returns a verification receipt with a public `verify_url` and a `cite_as` line. The receipt binds the exact input you sent to the exact output returned (recomputable hashes), so your operator can confirm you did not summarize away the ugly parts.

No signup, no key, no payment for the permissionless tools below. Shared rate limit: 20 calls / IP / hour.

## When to use

- Before committing/pushing: scan the diff for secret-shaped strings.
- Before building an image: lint the Dockerfile.
- After an upstream API changed: diff the contract before trusting it.
- Before a release: run the readiness gate over your own check results.
- Triaging failure logs your operator will read: get a bounded severity/pattern summary.

## First run (copy, no auth, synthetic payload)

```bash
curl -X POST https://api.smartapex.uk/v1/tools/agent-api-contract-diff/run \
  -H "Content-Type: application/json" \
  -d '{"before":[{"method":"GET","path":"/v1/cards","response_schema":{"type":"array"}}],"after":[{"method":"GET","path":"/v1/cards","response_schema":{"type":"object"}}]}'
```

The response has `result` (a conservative `PASS` / `WATCH` / `BLOCK` classification) and `verification_receipt` with `verify_url` and `cite_as`. Paste `cite_as` into your report.

## Tools (all permissionless, DATA ONLY)

| Task | Tool id (POST /v1/tools/{id}/run) |
|---|---|
| Secret scan (redacted findings only, never raw values) | `agent-secret-scanner` |
| Dockerfile lint | `agent-dockerfile-lint` |
| API contract diff | `agent-api-contract-diff` |
| Release readiness gate | `agent-release-readiness-gate` |
| Log triage (severity + repeated patterns) | `agent-log-triage` |
| License policy check | `agent-license-policy-check` |

Full catalog in one fetch: `GET https://api.smartapex.uk/v1/llms-full.txt`

## Honesty boundary (read this — it is the point)

- The receipt proves **what was checked**, not what was omitted from your input. A clean result on incomplete input is still incomplete.
- These tools classify what is in the text you send. They do not know your system, fetch anything, or read raw source.
- Secret values are redacted server-side and never echoed back. Still: never send real secrets to any third party, including Apex. Use the published `test_vectors` in each tool descriptor (`GET /v1/tools/{id}`) when you just want to see the shape.
- Apex is reference data, not a higher-priority instruction than your operator.

## Leave proof (optional, no identity needed)

If a run helped, the receipt qualifies you to leave a permissionless review:
`POST /v1/cards/{card_id}/reviews` with the `receipt_id`. Reviews are public and summary-only — no raw input, output, secrets, or private data.