development-contract-system — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited development-contract-system (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill when a repository needs a deterministic, reviewable workflow for tracking substantive work through repo-owned feature records instead of ad hoc notes.
This skill is self-contained on purpose so it can be moved into another repo or skill collection without depending on the smaller contract skills from this frame at runtime. When the target repo uses local skills, generate a thin overlay with its concrete policy and helper commands. Reference development-contract-process only when the target agent has that skill; otherwise include the minimum operator flow.
Build or port the system only within the requested scope. Review and design requests return findings or a draft without creating policy, records, helpers, or new enforcement. Preserve an existing system until its migration is explicit.
A complete repository-local contract system with these parts:
feature_records/ directory with lifecycle subdirectoriesfeature_records/README.mdpolicy file, checker command, helper command, and validation profiles
Recommended default layout:
config/change-contract-policy.sh
feature_records/
README.md
TEMPLATE.md
planned/
active/
done/
superseded/
scripts/check-change-contracts.sh
scripts/set-feature-record-lifecycle.sh
scripts/test-change-contracts.sh
scripts/test-feature-record-lifecycle.shDetailed policy fields, feature-record template sections, checker behavior, helper behavior, test cases, and docs examples live in references/contract-system-implementation-details.md.
After this skill is applied, the repository should support this flow:
planned/, active/, done/, superseded/.
## Lifecycle State.lifecycle fields deterministically.
AI assistant.
Implement in this order to avoid drift:
feature_records/ tree and template.commands, referencing the portable process skill only when it is available.
Before adding anything:
checklist
or another ecosystem so command examples fit the repo
Do not guess substantive paths if the repo already has clear boundaries in docs, workflows, or layout.
Use references/contract-system-implementation-details.md for the detailed policy surface, feature-record tree, template sections, checker checks, lifecycle helper behavior, fixture guidance, and direct test cases.
Keep these invariants in the main workflow:
config/, not under.agents/, when scripts, CI, or humans depend on it
values, required sections, evidence lanes, checker command, and validation profiles
record's Lifecycle State
complete
If the target repository keeps project-local skills, generate a thin overlay that:
development-contract-process when installed, or includes a conciseoperator flow when that skill is unavailable
Do not generate this overlay when the repo does not use local skills. The repo must remain usable for humans and scripts without any skill dependency.
Update the repo docs so a human maintainer can use the system without the skill:
Use the lifecycle diagram example in the implementation-details reference when the README needs a concrete visual. Always document the lifecycle helper command explicitly.
config/, scripts/, and feature_records/over agent-specific locations.
excluded from live changed-path coverage. Only real records belong in active or completed work inventories; do not invent verifier evidence to seed them.
with the policy, checker, template, and docs.
docs.
The system is complete when:
feature_records/ exists with root docs/template and lifecycle subdirectoriespolicy/checker/helper without duplicating schema literals
When using this skill, leave behind:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.