decision-graph-57d723 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited decision-graph-57d723 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are building a deciduous decision graph - a DAG that captures the evolution of design decisions in a codebase.
Use the deciduous CLI (at ~/.cargo/bin/deciduous) to build the graph. Run deciduous commands in the current directory (not inside the source repo).
For git commands to explore commit history, use git -C <repo-path> to target the source repo.
CRITICAL: Only use information from the repository itself (commits, code, comments, tests). Do not use your prior knowledge about the project. Everything must be grounded in what you find in the repo.
Use a layered strategy to find all relevant commits:
Layer 1: See all commits. Start with the full list when building narratives.
git log --oneline --after="..." --before="..." -- path/Layer 2: Keyword expansion. Once you have narratives, search for spelling variations and related terms you might have missed (e.g., "cache" → "caching", "cached", "LRU", "invalidate"). For each key identifier in your narratives, trace its full lifecycle:
If there's a feature flag controlling the feature, search for commits mentioning that flag.
Layer 3: Follow authors. If a narrative has a key author, check their commits ±1 month from known commits. They often work on related things.
git log ... | head -100 — NO. You will miss commits in the middle.git log ... | tail -200 — NO. Same problem.| wc -l), but then see them allNot every commit matters. Look for commits that change the model - how the system conceptualizes the problem:
Skip commits that are pure implementation (same model, different code) or routine fixes that just add tests.
Among model-changing commits, find the spine: what question keeps getting re-answered? What approach keeps getting replaced or refined? That's your central thread - build the graph around it.
Don't build the graph as you explore. First, collect commits into narratives.
Maintain narratives.md as you explore:
narratives.mdExample narratives.md:
## Cache Strategy
- a1b2c3d: Add in-memory cache
- e4f5g6h: Cache invalidation issues
- i7j8k9l: Switch to Redis
## API Rate Limiting
- m1n2o3p: Add basic throttling
- ...Before building the graph, take a critical pass over narratives.md:
After building initial narratives, harden them to ensure nothing is missed.
For each narrative, list the key concepts/APIs/identifiers and their lifecycle stage:
Example addition to narrative:
## Cache Strategy
Concepts: cache, LRUCache, cacheTimeout, invalidate
Lifecycle:
- cache: introduced (a1b2c3d), changed (e4f5g6h), renamed to LRUCache (x1y2z3)
- cacheTimeout: introduced (e4f5g6h), removed (i7j8k9l)
- LRUCache: introduced via rename (x1y2z3), marked stable (p1q2r3)
Commits:
- a1b2c3d: Add in-memory cache
- ...For each concept, search full commit messages (not just subject lines):
git log --all --after="..." --before="..." --grep="<concept>" --format="%H %s" -- path/For each match, read the full commit message:
git show <sha> --format="%B" --no-patchRewrite narratives.md integrating any newly discovered commits. The rewritten version should:
If a concept has an incomplete arc (e.g., introduced but never removed, yet it's not in current code), investigate further.
When building the graph, don't just branch everything from the goal. Capture how narratives relate:
Branch from the spine, not goal: If a narrative arose from work in another narrative, branch from that work.
goal → "How to preserve state?"outcome("timeout works") → "How to preserve state?" (the question arose after implementing timeout)Observations feed back: If an observation in one narrative influenced decisions in another, add an edge.
Keep truly independent things from goal: If a narrative is genuinely a separate concern that doesn't arise from other work, branching from goal is appropriate.
After consolidating, build the graph - one decision chain per narrative, with cross-links where they connect.
| Type | Purpose |
|---|---|
| goal | High-level objective being pursued |
| decision | A choice point with multiple possible paths |
| option | A possible approach to a decision |
| observation | Learning, insight, or new information discovered |
| action | Something that was done (must reference a commit) |
| outcome | Result or consequence of an action |
| revisit | Pivot point where a previous approach is reconsidered |
# Add nodes (returns node ID)
deciduous add goal "Title of the goal"
deciduous add decision "The question or choice point"
deciduous add option "One possible approach"
deciduous add observation "Something learned or discovered"
deciduous add action "Descriptive title of what was done"
deciduous add outcome "What resulted from the action"
deciduous add revisit "Reconsidering previous approach"
# Add nodes with descriptions (use -d for explanations and sources)
deciduous add action "Title" -d "Explanation of what happened and why.
Sources:
- abc123: 'Relevant quote from commit message'"
# Set status on options
deciduous status <id> rejected # option that wasn't chosen
deciduous status <id> completed # option that was chosen
# Connect nodes (from → to means "from leads_to to")
deciduous link <from-id> <to-id>
deciduous link <from-id> <to-id> -r "Why this led to that"
# View/restructure
deciduous nodes # list all
deciduous edges # list connections
deciduous unlink <from> <to> # remove edge
deciduous delete <id> # remove node and edgesYou're not collecting facts - you're crafting a story. Every node needs a _raison d'être_.
Before adding a node, stop and ask: Why does this exist? What prompted it?
Don't branch from the goal unless it's genuinely new. If you're about to draw an edge from the root goal, ask: does this replace or refine something we already designed? If yes, find that thing and connect there instead.
The test: can someone read your graph and understand not just _what_ happened, but _why_ each thing happened? Every node should feel inevitable given what came before it.
Think of commits as chapters in a story. Each chapter exists because of what happened in previous chapters. Your job is to find those causal threads and make them explicit.
Time flows forward. Past influences future, never reverse.
Options under a decision are alternatives considered _at the same time_. If an approach was tried, failed, and a new approach was designed later - that's a new decision node, connected by observations about why the old approach failed.
Example - DON'T model sequential attempts as parallel options:
# WRONG - these were decided years apart, not simultaneously
decision: "How to handle caching?"
├→ option: in-memory cache (2019)
├→ option: Redis (2020)
└→ option: CDN (2021)Example - DO model as chain of decisions with learning:
# RIGHT - each attempt informs the next, options are simultaneous alternatives
decision: "How to handle caching?" (2019)
├→ option: in-memory cache [chosen]
└→ option: no caching [rejected] "Perf requirements too strict"
↓
option: in-memory cache → action → outcome
↓
observation: "Doesn't scale across instances"
↓
decision: "How to share cache across instances?" (2020)
├→ option: Redis [chosen] "Team has Redis experience"
├→ option: Memcached [rejected] "Less feature-rich"
└→ option: database caching [rejected] "Adds DB load"
↓
option: Redis → action → outcome
↓
observation: "Latency too high for hot paths"
↓
decision: "How to reduce latency for static assets?" (2021)
└→ option: CDN [chosen]Multiple observations can converge into one decision. Multiple options can branch from one decision. But the graph flows forward in time.
Use specific edge types to show relationships:
deciduous link <from> <to> -t chosen -r "Why this was selected"
deciduous link <from> <to> -t rejected -r "Why this wasn't selected"
deciduous link <from> <to> -t leads_to -r "How this led to that"decision --chosen--> option - This option was selecteddecision --rejected--> option - This option was considered but not selected (with rationale)decision --leads_to--> option - Lists available optionsFor post-hoc abandonment (tried something, it failed later):
rejected: deciduous status <id> rejectedgoal → decision - Goal leads to choice pointdecision → option - Decision has options (use chosen/rejected edge types)option → action - Chosen option leads to implementationaction → outcome - Action produces resultoutcome → observation - Result reveals new insightobservation → decision - Insight triggers new choice (can have multiple observations converging)observation → revisit - Insight forces reconsideration of previous approachrevisit → decision - Pivot leads to new choice pointWhen a design approach is abandoned and replaced:
deciduous add observation "JWT too large for mobile"
deciduous add revisit "Reconsidering token strategy"
deciduous link <observation> <revisit> -r "forced rethinking"
deciduous status <old_decision> supersededRevisit nodes connect old approaches to new ones, capturing WHY things changed.
-d when adding the node.The graph is an alternative interface to browsing commit history. Someone reading a node should understand what happened without looking up commits.
Every node needs a description - especially outcome and observation nodes. The description should be readable to someone exploring the graph who doesn't have the commits open.
If you find your explanation doesn't make sense in context - something feels like a leap or a gap - that's a signal to dig deeper. There's probably a missing commit or transition you haven't found yet.
The relationship is many-to-many:
deciduous add decision "Should we switch from SQL to a document store?" -d "The team decided to switch from SQL to a document store.
This eliminated the impedance mismatch between the object model and storage,
at the cost of losing ad-hoc query capability (which wasn't being used anyway).
Sources:
- a1b2c3d: 'Our access patterns are almost entirely key-value lookups. The
JOIN operations we wrote are never actually used in production.'
- e4f5g6h: 'Document store removes the ORM layer entirely - one less thing
to maintain and debug.'"When done, run deciduous graph > graph.json to export.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.