tracker-sync — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited tracker-sync (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Keeps The Bridge's task state and the GitHub Project boards aligned, with a persistent local snapshot as the pivot. Three deterministic engine subcommands (scripts/tracker-sync.py) plus one gated write path.
Provider scope: GitHub Projects V2 only for now — other trackers (e.g. ADO) are readable via trackers/*.md playbooks but are not covered by snapshot/diff/push.
Model — remote-authoritative. The team works in GitHub, so the board owns shared status. The Bridge mirrors it, surfaces drift, and stages your pushes. Pull is autonomous (read-only); every cross-write is a proposal:
/briefing calls the pull side automatically (see references/workflow.md)| Verb | What | Gate |
|---|---|---|
pull | refresh snapshots from all enabled GitHub boards | autonomous (read-only) |
status / diff | render the delta table (the control surface) | read-only |
push | apply local_ahead rows to GitHub | gated, via github-projects-manager |
sync | pull → diff → offer push | gated at the push step only |
python3 scripts/tracker-sync.py pull # all boards from ecosystem.yaml
python3 scripts/tracker-sync.py pull --project <slug>Writes work/trackers/github/<slug>.json + work/trackers/_index.yaml with a pulled_at stamp. Best-effort: if gh is missing/unauthed it warns and skips — never blocks. The git history of work/trackers/ IS the dated dump history.
python3 scripts/tracker-sync.py diff # table
python3 scripts/tracker-sync.py diff --format json
python3 scripts/tracker-sync.py diff --exit-code # exit 2 if actionable driftEach row is one linked issue, classified (see references/diff-model.md). Present the table, then offer the obvious next action per class:
| Class | Means | Offer |
|---|---|---|
in_sync | local == board | nothing |
remote_ahead | board moved past local (e.g. a teammate moved it to Done) | propose STATUS.md update (gated; never auto) |
local_ahead | local moved past board | push (gated) |
state_mismatch | blocked/odd divergence | surface, ask |
orphan_local | STATUS links an issue not in any snapshot | re-pull / fix repo / unlink |
board_stale | issue closed/merged but its card never moved to Done | propose board-hygiene push (card → Done), gated |
orphan_remote | your open board item linked to no task | propose link or new task |
pull fetches each repo's closed issues/PRs and stamps item.closed; in diff the issue lifecycle wins over the board Status field (a closed issue on a New card is still done). --no-issue-state skips this for a faster pull.
python3 scripts/tracker-sync.py plan --format json → list of Status-field ops.[y/n] (or one batch [y]).workflow/projects/<slug>.yaml for the real field IDs + exact option names and runs the gh GraphQL mutation). NEVER write the board from this script.
pull and re-diff to confirm the row is now in_sync. Verify-before-claim.Boards without a workflow/projects/<slug>.yaml registry can be pulled and diffed, but push degrades: plan emits to_option: null (no field-ID mapping). Surface that honestly and offer to scaffold the registry from workflow/projects/_template.yaml rather than pushing blind.
Uses the same integrations.github block as /briefing Stream B (enabled, projects: ecosystem, assignee_me). Optional per-board sync_policy: in workflow/projects/<slug>.yaml (authority, auto_pull) — see references/diff-model.md. No config = remote-authoritative default.
Status; pull proposes, never overwrites STATUS.work/trackers/) — never promoted upstream.stays with the skill + the human.
scripts/tracker-sync.py — the engine · tests: scripts/tests/test-tracker-sync.shreferences/diff-model.md — full classification + phase-bucket rulesreferences/workflow.md — pull/diff/push playbook + /briefing integrationskills/github-projects-manager/ — the gated write executor (push handoff)protocols/standing-orders/task-sync.md — the per-task sync.github resolvertrackers/README.md — normalized item schema (== the snapshot format)workflow/projects/<slug>.yaml — board registry (fields, state_map, sync_policy)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.