[reyreavman]

Summary

The werf-to-delivery-kit skill now knows the sign directive, so an agent migrating a module to the SBOM flow can move signing a file with a Vault/KMS key out of a shell stage, which loses its network once SBOM is enabled, instead of stopping on it.

What

• The before/after table maps shell signing (transit/sign, a Vault client in mount:, openssl smime/systemd-keyutil with a key) to sign:; the inventory step records what each image signs, with which key and format, and who verifies it.
• A new §3 subsection: when sign: applies (detached PKCS#7, SHA-256, RSA, no signed attributes, leaf certificate only), one key and certificate per run, positions, keeping the old verification in a later stage or a separate image, importing <path>.p7s with the file, and removing Vault secrets, mounts and giterminism entries only once nothing else uses them.
• The stage order section says where the signFiles* stages fall; before: install signs before gitArchive and packages.
• The final report lists what CI has to provide: delivery-kit ≥ v3.12.0-dk.2, WERF_SIGN_BUILD_FILE_*, the certificate in every job that runs delivery-kit with the config, and read on the transit key besides update on signing.
• §5 adds an audit grep and the expected missing-certificate error; a new stop condition covers signatures sign: does not produce (embedded in the file such as Authenticode/pesign, raw signatures, non-RSA keys, signed attributes, embedded chains).
• The frontmatter description triggers on moving file signing to sign.

[reyreavman]

Code Review Report

Base: main (@ 2.77.0-dk.2)
Diff: 1 file, +62/-6 (.agents/skills/werf-to-delivery-kit/SKILL.md)

Note: this is the author's own PR — this self-review is necessary but not sufficient.

Verdict

• Technical: Pure documentation addition to a skill; touches no code. The text is internally consistent — the example YAML, stage ordering, the rule for relocating signature verification, and the .p7s import all agree with each other.
• Product: The skill teaches an agent to move shell-based file signing onto sign:; the stop-conditions and CI requirements are concrete and actionable.
• Risk: The main risk is documentation drift from the implementation: the flag/env/stage names and the error-message string cannot be verified against the code on this branch (the feature targets v3.12.0-dk.2, which is not present here).

DoD Criteria

Criteria	Inferred?	Met?	Evidence
Skill knows the sign directive (before/after/end-of-image)	yes	✅	§3 "Подпись файлов → директива sign", stage order
before/after table maps shell signing to sign:	yes	✅	table row + §0 step 5 inventory
CI requirements (version, env, Vault policy) in report	yes	✅	§4 step 5: WERF_SIGN_BUILD_FILE_*, update/read on transit
Stop-condition for unsupported signatures	yes	✅	final "Стоп-условия" block
Frontmatter triggers on moving signing	yes	✅	description: "перенеси подпись файлов на sign"

Issues

• Minor — §3/§4: the names WERF_SIGN_BUILD_FILE_KEY/CERT/VAULT_*, the flag --sign-build-file-cert, the stage signFiles*, and the error string declare files to sign: specify the signing certificate with --sign-build-file-cert do not exist in the code on this branch (only --sign-key/--sign-cert exist, in pkg/signature/signing_gate.go:33-36). Before merge, reconcile these literals against the actual v3.12.0-dk.2 implementation — a typo in the env var / flag / error text would make §5 (the audit grep and the "expected failure") a misleading guide for the agent.
• Minor — §3, the digest rule: "Сертификат входит в digest стадии подписи, поэтому без WERF_SIGN_BUILD_FILE_CERT падает любая команда, вычисляющая стадии". This is a strong cache-invalidation / rollback claim and is not confirmed by the code on this branch. If correct, it also implies that rotating the certificate moves tags — worth making sure the wording is precise.

Risks

#	Risk	Type	Likelihood	Severity	Location	Circumstances	Consequences	Recommendation
1	env/flag/error names drifted from the implementation	Technical	Possible	Medium	SKILL.md §3–§5	Feature lives in v3.12.0-dk.2, not on this branch	Agent generates a non-working CI guide; the §5 grep won't match	Reconcile the literals against delivery-kit v3.12.0-dk.2 code/docs before shipping the skill

Not verified

• The sign: directive, WERF_SIGN_BUILD_FILE_*, the signFiles* stage, the error text, the "cert in the stage digest" claim, and the Vault policy (update on sign / read on keys) were not verified against code: the feature targets delivery-kit v3.12.0-dk.2, and this worktree (2.77.0-dk.2) does not contain its implementation — only SBOM/manifest/ELF signing (--sign-key/--sign-cert) is present.
• task build / test:unit not run — the change is documentation-only; no Go code is affected (static review as requested).