steno — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited steno (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Audience: human reviewer scanning prose for facts — not a token-optimised model. Plain words and readable symbols; math glyphs belong to the glyph skill (sdd plugin).
Top criterion: a reviewer scans the text and the fact appears in the first sentence or bold-lead bullet of each block. Skim fails → rewrite the first clause; not retain dense form, not cut further words.
Self-check every paragraph or bullet:
Compression subordinate to this test — a word that aids the skim stays.
Criterion: human-facing terse prose for non-author reviewers — readers scan facts, benefit from compression w/o math-glyph load.
Common applications (not exhaustive):
not apply to:
type(area):) — fixed format.Four rules every prose sentence or bullet body:
Add X., Refactor Y.). Symbol-only fragments out: ⊥ skip flag → No skip flag.is/are elided only when the fragment intent is unambiguous. Drop the copula in X — Y form only when Y reads as predicate not apposition (apposition ambiguity slows the reader).system, having validated the token after refreshing the session, returns ...) prevents first-clause readability.Verb-headed fragments fine. Lists > paragraphs. One idea per line in lists. Break long sentences before cutting words.
Safe for GitHub readers:
→ leads to / becomes / produces
≥ at least
≤ at most
& and
| or (in lists, not prose)
§ spec citation (e.g. `§V.<n>`, `§T.<n>`) — only for refs into SPEC.mdAvoid — write the word instead; mirrors the glyph skill retired set:
⊥ ¬ ≠ ∈ ∉ ≡ ∴ ∀ ∃ ∧ ∨not compress:
src/auth/mw.go.#123 issue/PR refs.Resolves #N / Fixes #N / Closes #N trailers — exact form.Bullet > paragraph when listing > 2 items.
Definition list for term/explanation pairs:
- `--dry-run` — print actions, do not execute.
- `--force` — skip confirmation prompts.Table for comparing options on same axes:
| flag | scope | reversible |
|-------------|----------|------------|
| --soft | local | yes |
| --hard | working | no |Headers + fragments > full sentences in issue/PR bodies:
## Summary
JWT replaces session cookies. Tokens expire 1h. Refresh via `/auth/refresh`.
## Changes
- Add JWT generation & validation
- New `/auth/refresh` endpoint
- Middleware validates `Authorization: Bearer <jwt>`
## Breaking
- Session cookies dropped. Clients must send `Authorization` header.Three pairs. every pair: Good passes SKIM TEST (first sentence or bullet states the fact); Anti fails on a named shape rule.
Issue body
Anti (44 words — fails rule 1: lead-first):
When a user tries to log in with an email address that contains uppercase letters, the system fails to find their account because the lookup is being done in a case-sensitive manner, which is not the expected behavior for email addresses.
Skim failure: opening clause When a user tries to log in... not name the fact. The reader scans 14 words before reaching fails to find their account.
Good (15 words):
Login fails when email has uppercase letters. Lookup is case-sensitive — should be case-insensitive for emails.
Skim pass: first sentence states the fact (login fails, under what condition). Second sentence states cause + fix direction.
PR body
Anti (fails SKIM TEST — filler precedes the fact):
This pull request basically just adds some additional logging to the auth middleware so that we can debug issues more easily in production environments. It also includes a small refactor of the token validation logic.
Skim failure: 8 words of filler (This pull request basically just adds some additional) precede the fact. The takeaway sits past mid-sentence.
Good:
## Summary
>
Add auth middleware logging for prod debugging. Refactor token validation.
>
## Changes
>
- LoguserId,path,latencyon every authed request - ExtractvalidateToken()from middleware intoauth/token.go
Skim pass: first-sentence fragment states both items (logging + refactor). Each bullet opens with a verb (Log, Extract).
Release commit body
Anti (fails rule 4: nested participials; passive obscures the fact):
## Summary
>
This change implements a new authentication system using JWT tokens which replaces the previous session-based authentication that was being used. Users will now be able to log in and receive a token that they can use to make authenticated requests, and these tokens will expire after a period of 24 hours.
Skim failure: 47 words before the fact tokens expire after a period of 24 hours. The two key facts (replacement, expiry) sit in tail clauses; nested relative clauses (which replaces ... that was being used) prevent first-clause readability.
Good:
## Summary
>
JWT auth replaces sessions. Tokens expire 24h.
>
## Changes
>
- JWT generation & validation -/auth/refreshendpoint - Middleware readsAuthorization: Bearer <jwt>
>
## Breaking
>
- Session cookies dropped — clients must send Authorization header.Skim pass: first sentence is 4 words and states the replacement; second sentence is 3 words and states the constraint.
Steno register is literal phrasing w/ readable symbols (per SCOPE). Reviewers parse facts fast — idiom adds parsing cost and ambiguity. Within scope:
Exclusions (preserved verbatim):
backprop, glyph-encode, socratic, steno).drift, bottleneck, leak) — allowed when it is the standard term in context.Fact missing from the first sentence → rewrite the first clause to state it directly; not cut further words. Reviewer would slow down on a symbol → use the word. Compression preserves fact.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.