ship-8b6902 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited ship-8b6902 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Turn a finished evo run into a change a maintainer would merge.
The optimize loop leaves a tree of committed experiments. The winning worktree diff is not mergeable as-is: it carries debug prints, search-process churn, over-broad edits, and sometimes a test that was relaxed to clear a gate. Shipping is the step that re-derives the minimal clean change reproducing the winning behaviour, lands it the way the repo expects (PR or merge), and reports how mergeable it is.
Correctness is the floor, not the goal. The score says the behaviour works; this skill decides whether the diff is fit to merge.
/evo:ship # ship the auto-selected winner
/evo:ship exp_0042 # ship a specific experiment insteadPick the experiment to ship, then confirm it with the user before touching their tree.
evo status # current best valid score + counts
evo report # top valid experiments table + score chartnot the frontier. evo frontier is for choosing where to branch next; it can exclude an exhausted branch whose score is still the right thing to ship. An explicit exp_id argument overrides auto-selection.
committed, or pruned withprune_kind=exhausted, with a commit and score, no gate_result === false, and no invalid-pruned ancestor. Never select discarded, failed, active, evaluated, legacy-pruned nodes with no prune_kind, prune_kind=invalid, or descendants of invalid-pruned nodes. If no valid candidate exists, stop and report why nothing is safe to ship.
evo diff <root_id> <winner_id> # target-scoped cumulative diff, baseline -> winnerFor changes outside the benchmark target, diff the commits directly (git diff <baseline_commit> <winner_commit>); each node carries .commit.
the winning hypothesis, and a diffstat. Get a go before proceeding.
Work on a fresh branch off the user's current HEAD, not in the experiment worktree. Re-derive the change so it stands on its own:
experiment scaffolding, debug logging, commented-out attempts, and churn the search introduced and then abandoned. Smaller, local diffs merge; sprawl does not.
a gate, restore it. New behaviour that changes outputs needs a test that covers it. Never ship a green benchmark that rode on a loosened test -- call it out instead.
whitespace, no reordered imports unless the repo does that.
The diff should read like the file it lands in.
Then confirm the behaviour survived the distillation:
evo run <winner_id> --check # or the project's benchmark / test commandIf the distilled change no longer reproduces the winning score, do not paper over it -- report the gap (which part of the experiment diff was load-bearing) and let the user decide. Best-effort means honest about what could not be cleaned up, not silently shipping the raw worktree.
Detect how the repo expects changes to arrive:
git remote -vbranch, push, and gh pr create with the mergeability report (Stage 4) as the body. Do not push or open the PR without the user's go.
single clean commit. Do not force, do not rewrite existing history.
The landed commit message carries provenance: the winning experiment id, the score delta, and the one-line hypothesis. State what changed and why it is safe; do not narrate the search process.
Always produce the report. It never blocks the merge -- it tells the user, and a future reviewer, how mergeable the change is across the axes a maintainer judges on:
concretely (the algorithm, data structure, or mechanism), not the search story. Distilled from the winning hypothesis: "replaced the O(n^2) dedup with a hash set", not "exp_0042 improved throughput". This is what a reviewer reads first.
status after distillation.
weakened, or removed, with detail; whether new behaviour is covered.
Lead with a plain-language summary: what changed and why it is safe to merge. On a remote repo this is the PR body. With no remote, print it and save it alongside the run so the user can paste it into a review later.
Everything above is method you can adapt to the repo. These are not:
did, restore it and report it.
evaluated, gate-failed, or invalid-lineage nodes. Only exhausted pruned nodes remain normal ship candidates.
report the gap instead.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.