---
name: static-release-preflight
description: Check a built static website export against an approved file scope and trusted baseline; verify selected HTML canonical tags, headings and local resource references, then produce a JSON release-preflight report.
metadata:
  version: 1.0.0
  author: Agent Skills Hub
---

# Static release preflight

Use for a local static export with trailing-slash HTML routes, before a separate preview or publication decision. This package is original Agent Skills Hub code, MIT licensed. It needs Python 3.10+ and only the standard library. No network calls, account or model are required for the checker itself.

## Inputs and execution

1. Identify the built public export, a trusted prior export manifest and the owner's intended change scope. Do not point the checker at a source repository or secrets directory. Do not rebuild or deploy merely to run this skill.
2. Review `scope.json`: `origin` is the intended production HTTP(S) origin; `pages` are selected routes ending in `/`; `allowed_changes` are exact relative artifact paths or deliberately narrow fnmatch globs. Globs match across `/`: `*` allows the entire export. Do not expand scope just to make failures pass. New hashed assets and Next route data need explicit scope too.
3. If a trusted manifest is missing, create it from a known prior export, never the changed candidate: `python scripts/preflight.py snapshot --root PATH_TO_PRIOR_EXPORT > baseline.json`. Keep manifest and report OUTSIDE the scanned export. A snapshot without a trusted old version cannot prove isolation.
4. Run `python scripts/preflight.py audit --root PATH_TO_CANDIDATE --baseline baseline.json --scope scope.json > report.json` from this skill folder, using absolute input paths when needed. On Windows `py -3` can replace `python`. Read the JSON and exit code: 0 PASS, 1 detected failures, 2 invalid inputs/execution error.
5. Report baseline/candidate counts, added/changed/removed files, failures and unchecked areas. Correct only authorized source defects, build through the project's existing flow, and rerun when changed. A scope mismatch may be an unrelated change to exclude, not a new permission to edit it. Do not reset/stash/clean other work. Preserve evidence before any approved correction.
6. After a local PASS, use the existing preview for manual browser and live HTTP checks if authorized. Inspect actual desktop/mobile layout, navigation/download buttons, redirects, headers and runtime errors. Separate those results from this script's PASS. Commit, push and production deployment still require their own matching authorization.

## Try the included practice fixture

From this folder run:

```sh
python scripts/preflight.py audit --root practice/export --baseline practice/baseline.json --scope practice/scope.json
```

Expected PASS, 2 candidate files and 1 checked page. `practice/` is synthetic. To see a failure, make a disposable copy of `practice/export`, change the canonical URL in its `index.html`, then run against that copy with the original baseline and scope. Expect exit 1 with CANONICAL_MISMATCH. Do not alter your real site for this exercise.

## Evidence and limits

`examples/agentskillshub-20261025.json` records a real replay of the retained AgentSkillsHub six-guide production export with this version of the checker. Historical HTTP/browser release checks in its context are separate; this package did not perform them. See the workflow page for version history and results.

The script checks file hashes, scope, one main/H1, canonical, meta noindex and selected HTML script src/stylesheet href/image src references. It does not execute JavaScript, follow external URLs, inspect CSS url()/srcset/dynamic imports, validate all page links, check live headers/Worker behavior/redirects, measure accessibility or prove indexing. HTML outside `pages` is not inspected. PASS means only those local checks passed.

No controlled same-model prompt comparison was performed. The reusable contribution is a fixed checker and report format, not a demonstrated time-saving percentage. Source files are read; only shell redirection writes the requested report. No credentials, installed agents, project settings or network state are modified.