Fix skill template gaps — data-access security, coding-standards error rule

Two skill templates ship with gaps that affect every new Anatomia project. The data-access template has no security guidance — teams start without IDOR prevention at the data layer. The coding-standards template has an absolutist error-handling rule that contradicts intentional graceful degradation patterns. Fix both.

verdict PASSscore 8 / 8findings 3 (0 risk · 0 debt · 3 obs)duration 1h 48mrejection cycles 0shipped Apr 16, 2026

Pipeline timeline

Intent to proven code in 1h 48m across Think, Plan, Build, and Verify.

Think
25m
Plan
25m
Build
58m
Verify
0m

Assertion ledger

8 claims, each independently verified.

IDSaysMatcher
A001The data-access template includes guidance on scoping queries to authorized usersverifiedok
A002The data-access template names IDOR as the consequence of missing authorization scopingverifiedok
A003The data-access template still has all four original rules unchangedverifiedok
A004The coding-standards error rule bans empty catch blocksverifiedok
A005The coding-standards error rule permits intentional graceful degradationverifiedok
A006The coding-standards error rule requires degradation to be logged and observableverifiedok
A007The coding-standards template still has exactly six rulesverifiedok
A008No existing rules were modified except the error-handling rule in coding-standardsverifiedok

Findings 3 total

obs→ closed
Contract assertions A007 and A008 were sealed with incorrect values. The planner counted 6 rules in coding-standards but main has 7. A007 says 6 rules, should say 7. A008 says 5 unchanged rules, should say 6 (7 - 1 modified = 6). The BUILD is correct — the contract is not.
obs→ closed
The error-handling rule is now longer than the others (spans multiple sentences where most rules are one sentence + why). This is appropriate given the nuance being expressed, but worth noting as a slight voice deviation — the rule is more complex because the guidance is more complex.
obs→ closed
No test coverage for template content. These are static files copied verbatim during init, so testing would require either snapshot tests or parsing the markdown. Current approach (visual inspection against spec) is reasonable for static templates. If templates grow more complex, consider adding a test that at least validates markdown structure.

Integrity seal

scopesha256:b12c0eb2a2ac5...
contractsha256:3b30e6f15173f...
plansha256:63fcc6bbc4167...
specsha256:835c5794871a1...
build-reportsha256:659994144d5b1...
audit cmd$ ana proof audit fix-skill-template-gaps   → all hashes match