ralphi — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited ralphi (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Etymology — Ralph Wiggum (The Simpsons): persistent retry until it works. The -i suffix marks the inspection family.The lean discipline-gate version. Bounds token spend per cycle and forbids philosophy regressions from sneaking in between cycles. If you need the full file-type-aware inspection skill (criteria-prd / criteria-skill / criteria-script / criteria-code + Necessity Check), use harnish:ralphi.
If invoked bare (no cycle goal), ask: "What is this cycle's narrow goal? e.g. `migrate 3 callers off legacy adapter`, `remove 5 dead exports` — name something verifiable in one cycle."
| # | Phase | Budget | What runs |
|---|---|---|---|
| 1 | Setup | ≤ 500 tokens | State the cycle goal in one sentence; list affected files via rg -l (not rg); confirm baseline branch + SHA. No file reads. |
| 2 | Worker Dispatch | ≤ 4 parallel sub-agents, each ≤ 2000 tokens out | Each worker emits {file, change, 3-line summary} — no full-file contents in worker output. |
| 3 | Verifier | ≤ 1000 tokens | One verifier sub-agent re-reads ONLY changed lines via rg -A 3 -B 3 'pattern' <file>; never full files. Apply the Necessity Check (below) per diff hunk. |
| 4 | Philosophy Sweep | ≤ 200 tokens | rg sweep across the new diff for ROP / version-name violations (below). Halt if any hit. |
| 5 | Commit | n/a | One commit per cycle. Never batch multiple cycles into a single commit. |
| 6 | Handoff | ≤ 300 tokens | 5-line summary: what changed, what verified, next cycle's narrow goal. Then advance counter or pause. |
If any phase exceeds its budget, write tmp/ralphi-state-<n>.json (cycle counter, goal, pending files, last verifier output) and pause. Next invocation resumes from that state.
Apply to each diff hunk in the Verifier phase. Lifted from the original harnish:ralphi — the only inspection method that gates on purpose before correctness.
Verdict. Q1 and Q4 are the only gates. Q2 and Q3 are scaffolding to reach honest answers. Items failing Q1 or Q4 → [warning] unjustified existence (kept only by convention / inheritance / authority).
Fix discipline. Subtraction is the default. For [critical/warning], minimal additive patches are allowed (null check, missing import, type fix, error guard). Do NOT introduce new abstractions, modules, or features. If a fix would require new abstraction/module/feature → tag [unfixed] structural change required and hand off to the user.
Run between cycles, before advancing the counter. Halt the loop and surface to the user on any hit.
# ROP — defensive timeouts / silent catches added by this cycle
git diff HEAD~1 | rg -n 'withTimeout|timeout:\s*\d+|catch\s*\([^)]*\)\s*\{[^}]*//' \
&& echo "VIOLATION: possible ROP breach in last cycle"
# SSOT — hardcoded version-specific field names
git diff HEAD~1 | rg -n 'v\d+\.\w+|schema_v\d' \
&& echo "VIOLATION: possible hardcoded version"Baseline note: HEAD~1 assumes the previous cycle already committed. If running against a feature branch with multiple cycles, prefer git diff $(git merge-base HEAD main)..HEAD for the full branch range.
[unfixed] structural change required → halt the autonomous loop, hand off to userharnish:ralphi)galmuri:polish (completion-claim gate) or galmuri:self-audit (single-session audit)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.