# Enterprise Skills CLI

Harness engineering for AI coding agents: 93 governed skills, deterministic
safety gates, audited multi-skill workflows, and compliance evidence — across
Cursor, VS Code, Claude Code, Windsurf, JetBrains, Neovim, Xcode, and plain CLI.

Your IDE's AI does the work. The Enterprise Skills engine decides what runs,
blocks what shouldn't, and keeps a local activity record.

## Install

```bash
npm install -g enterprise-skills
```

## Quickstart

```bash
# Have a license key? (free-tier keys available at https://enterpriseskills.ai)
enterprise-skills license activate <your-key>   # downloads your skill catalog

# Set up a project (renders IDE adapters, authority pack, orchestration hooks)
enterprise-skills onboard --with-init --install-cursor-hooks

# Not sure what to run? Ask the engine.
enterprise-skills orchestrate next
```

## The agentic layer

```bash
# Deterministic skill resolution for any task — same input, same answer
enterprise-skills preflight "fix the auth timeout before we ship"

# Multi-skill pipelines, some with evidence gates (13 built-in workflows)
enterprise-skills orchestrate workflow start release-readiness
enterprise-skills orchestrate workflow next
enterprise-skills orchestrate workflow complete <step-id>

# Fully autonomous, gates as hard stops (explicit opt-in; bring your own agent).
# The agent gets an ALLOWLISTED environment — pass the vendor key by name;
# --agent-cmd is an argv list (no shell), {prompt} becomes one argument.
# Untrusted PR content (forks, pull_request_target, non-member authors) is
# REFUSED outright — no enforceable isolation exists to run it under — with a
# stable code (ES_UNTRUSTED_ISOLATION_UNAVAILABLE); see docs/HEADLESS_CI_RECIPE.md.
enterprise-skills orchestrate workflow run release-readiness --yes \
  --pass-env ANTHROPIC_API_KEY \
  --agent-cmd "claude -p \"{prompt}\""

# Governance control detection with per-control evidence (all tiers)
enterprise-skills compliance controls

# SOC 2 / HIPAA / GDPR / ISO 27001 / PCI DSS / FedRAMP mapping (Enterprise tier)
enterprise-skills compliance report

# Deterministic Release Governor over the actual diff — classify base...HEAD
# risk, bind skill-output evidence to the commit, PASS/FAIL (exit 1 on FAIL in the default enforce mode);
# --post completes the PR's required check run
enterprise-skills govern --post --pr 42
```

The Governor consumes evidence from `.project-ai/skill-outputs/` — run the
domain audit skills (or `orchestrate workflow run release-readiness`) for the
current commit first. Missing evidence for a required domain fails closed by
policy; evidence produced for an earlier commit is rejected as stale.

Some gate decisions and workflow events are recorded in a SHA-256 hash-chained
log under `.project-ai/`, but the log is not a complete record: for example, a
gate check refused because no session is active, a workflow step that does not
finish its workflow, and `graduate report` add no entry. The chain is not
tamper-evident: anyone who can write the file can rewrite or shorten it without
verification noticing.

### Customer Evidence Center (Team and Enterprise)

Cloud synchronization is always opt-in per project. Preview the exact
allowlisted text artifacts before anything leaves the machine:

```bash
enterprise-skills evidence status
enterprise-skills evidence preview
enterprise-skills evidence sync
enterprise-skills evidence open
enterprise-skills evidence revoke <share-id>
```

The collector includes orchestration audit events, generated skill outputs, and
LaunchOps audit reports: the audit logs and the text files (`.json`, `.jsonl`,
`.md`, `.yaml`, `.yml`, `.csv`, `.html`, `.txt`) under
`.project-ai/skill-outputs/` and `.project-ai/launchops/reports/`. It redacts
values that match common secret patterns, but it does not recognise every
credential and does not otherwise filter what those files contain, so review
`evidence preview` before you sync. Team bundles retain for 90 days; Enterprise
bundles retain for 365 days unless a custom policy applies.

## Tiers

| Tier | Skills | Highlights |
|------|:------:|-----------|
| Free | 8 | Evaluation: core lifecycle + review skills, preflight resolver |
| Pro | 90 | All skills except four Enterprise-only ones, updates |
| Team | 90+ | Per-seat licensing, governance features, all IDE adapters |
| Enterprise | all | Compliance mapping, control plane, sales-led |

Pricing and docs: **https://enterpriseskills.ai** · Getting started:
**https://enterpriseskills.ai/getting-started**

## Telemetry

Usage telemetry is sent only when a license key is installed, and it includes
that key, so it is tied to your license. Disable it with
`ENTERPRISE_SKILLS_TELEMETRY=off`. Feedback reports and update checks
(`update check`, and the check that `update auto` runs before it applies
anything) are separate requests that do not need a license key. License
validation traffic is required for paid content delivery. Privacy policy:
https://enterpriseskills.ai/privacy

© ArcFusion Technologies Corp. License: see https://enterpriseskills.ai/terms