---
name: session-delivery-hygiene
description: Gate local-session scope, persistent delivery, live PR state, integration provenance, and owned cleanup. Use before implementing guidance changes, changing or pushing PR work, diagnosing package/output mismatches, or handing off implementation.
---
# Session delivery hygiene
Read [repository instructions](../../copilot-instructions.md) first. Apply only
the gates relevant to the task's risks; this skill grants no additional scope,
publication permission, or authority over another session.
## Risk-based gates
1. **Outcome and ownership.** Classify the request as analysis, implementation,
publication, or an explicitly requested combination. Improving reviewer or
workflow guidance means editing that guidance, not running or posting a
review. Preserve the requested repository, branch, paths, and exclusions.
Confirm the active worktree and existing changes before editing; do not
overwrite unrelated work or alter user-global settings or other sessions.
2. **Persistent delivery.** For implementation, inspect the actual final files
and Git diff, including staged and untracked files, against each requested
outcome. Inspect commits too when the worktree is clean. A plan, status
update, successful command, or agent's completion message is not a delivered
change. Validate the changed artifact itself; for guidance, check skill
metadata, local links, examples, and consistency with existing instructions.
If no change is needed, explain the evidence rather than claiming a fix.
3. **Live PR destination.** Immediately before editing PR-linked work or
pushing it, read the PR's live state, base/head repositories and refs, and
head SHA; confirm the destination still matches the requested work. Recheck
before publication if the state may have changed. Never push to or recreate
a merged PR's old head branch. Use a new follow-up branch and, only when
publication is authorized, a new PR targeting the intended base branch;
do not infer that target from a local checkout or default to `main`.
For a closed unmerged PR, stop publication unless reopening or a follow-up
is authorized. If live state cannot be read, do not push based on stale
session metadata. Local commits do not prove delivery to a live PR.
4. **Integration provenance.** Before diagnosing stale-package or launch
failures, identify the exact consumer checkout, configuration, TFM/RID,
executable/output layout, producer commit, and package ID/version. Inspect
the consumer's effective NuGet configuration, `NUGET_PACKAGES` or
`RestorePackagesPath`, and resolved paths in `project.assets.json`; a global
cache listing does not identify a repository-local restore. For packaged
apps, verify package identity/version, registration install location, and
the launched process/loaded binary paths belong to the output under test.
Establish or correct that provenance before concluding the implementation
is defective; rebuilding elsewhere is not proof the consumer used it.
5. **Owned cleanup.** Track only resources created or temporarily changed for
this task: process IDs and executable paths, exact package registrations and
install locations, temporary files, and prior override values. Reconfirm
ownership before cleanup; stop processes by specific PID, remove only
task-owned registrations/files, and restore temporary overrides to their
prior values. Never kill by process name, unregister all matching apps,
clear entire shared/global caches, or recursively delete broad directories.
Prefer isolated outputs/caches; even a targeted cache eviction requires
proof of the consumer's actual path and ownership. Leave borrowed resources
untouched and report any owned cleanup that could not be completed.
## Evidence-based handoff
Lead with the implemented outcome or concrete blocker, then name changed
artifacts and their actual delivery state. These states are not interchangeable:
| State | Required evidence |
| --- | --- |
| Local | Final file/diff exists in the identified worktree. |
| Committed | Commit SHA contains the intended changes. |
| Pushed | Read the destination remote ref and verify it contains that commit. |
| Published | Read the live PR/comment/other object and verify the intended content and current head where applicable. |
| CI-verified | Relevant checks passed for the exact published head SHA, not an earlier or merged PR. |
Include the decisive validation result and any remaining blocker or owned
cleanup. Do not label local validation as CI, or a push as publication. Existing
GitHub-body readback and composed-product validation requirements still apply.
Finish the requested work without status-only handoffs, invented follow-up
tasks, or unsolicited publication.