Aari cd34a1a504

fix(skills): don't attach model tracing to the in-graph skill security scan (#4252) ...

* fix(skills): don't attach model tracing to the in-graph skill security scan

* fix(skills): pass attach_tracing explicitly from the in-graph scan call site

Follow the tracing INVARIANT's own convention rather than detecting the call
context: scan_skill_content takes an attach_tracing flag, and _scan_or_raise --
the single in-graph choke point -- passes False. Standalone callers (Gateway
skill routes, installer) keep the default True.

The INVARIANT list named four sites and asks that new in-graph calls be added
to it; record this fifth one so a future audit of that list finds it.

---------

Co-authored-by: Willem Jiang <willem.jiang@gmail.com>

2026-07-20 08:18:23 +08:00

..

harness

fix(skills): don't attach model tracing to the in-graph skill security scan (#4252)

2026-07-20 08:18:23 +08:00