project-writing-go-modules-framework-v2 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited project-writing-go-modules-framework-v2 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use with project-writing-collectors. Keep this skill loaded for style; read source files for evidence.
src/go/plugin/framework/collectorapi/collector.gosrc/go/plugin/framework/docs/changing-framework-code.md
src/go/plugin/go.d/docs/how-to-write-a-collector.md
src/go/plugin/go.d/docs/helper-packages.md
src/go/plugin/go.d/docs/migrate-v1-to-v2.md
src/go/plugin/framework/chartengine/README.mdsrc/go/plugin/framework/charttpl/README.md.agents/sow/specs/go-v2-host-scope.mdsrc/go/plugin/go.d/collector/cato_networks/.Use focused pieces from it, not the whole collector shape.
for stale style before treating them as examples.
framework capability is missing and the problem is general, design the framework change instead of hiding the issue in collector-local glue.
src/go/plugin/framework/docs/changing-framework-code.md before writing code.
independent collector cleanup, framework fix, or integration-doc change, either defer it explicitly or land it separately before continuing.
collectorapi.CollectorV2 fromsrc/go/plugin/framework/collectorapi/collector.go and register via CreateV2.
New() SHOULD own defaults, metrix.NewCollectorStore(), typed metricinstruments, and test seams.
metrix.CollectorStore duringCollect() and provide chart template YAML through ChartTemplateYAML(); embedded charts.yaml is RECOMMENDED.
Collect(ctx) MUST return error and write metrics to metrix; it MUST NOTreturn a V1 map[string]int64.
implement optional collectorapi.CollectorV2Runner. Run(ctx) MUST return promptly after cancellation. Do not start operational polling from Init() or Check(), because DynCfg test and autodetection use those methods without starting the runtime job.
Cleanup(ctx) MUST be idempotent. The framework may call it morethan once, including after partial Init / Check setup.
collector.go, setuphelpers in init.go when needed, orchestration in collect.go, distinct upstream operations in collect_<operation>.go, metrics in metrix.go / write_metrics.go, focused tests.
or log-file plumbing, check src/go/plugin/go.d/docs/helper-packages.md and reuse an existing helper when it fits.
<name>func/ subpackage with a narrowDeps interface declared there. The Function package MUST NOT import the collector package or hold *Collector.
AgentWide module Methods, itsMethodHandler(job) receives the running canonical runtime job. Use job.Collector() to bind the Function handler to collector-owned state; do not add a __job parameter or introduce a package-global registry to bridge Function dispatch. During method execution, when the singleton job is not running, the framework returns an unavailable response before calling MethodHandler.
collectorapi.Creator.InstancePolicy defaults toInstancePolicyPerJob. Use InstancePolicySingle only for collectors that are intentionally one canonical job per agent. Single-instance configs MUST use name == module after defaults are applied. DynCfg exposes opted-in single-instance configs as single objects with the module-level collector config ID, no collector template, and no add/remove; updates target that single object.
InstancePolicySingle, decide howits initial single object appears in DynCfg. The framework exposes a single object only after a config exists; it does not publish a template placeholder, and plain stock enable failures can remove the stock object.
option MUST name the concrete operator decision it enables; "operators may want to tune it" is not enough. Internal tuning SHOULD use constants unless the operator has a real decision to make.
store.Write().SnapshotMeter("") for normal metrics.Vec(...) for labels, Gauge for current values,Counter.ObserveTotal() for source counters, and StateSet for fixed one-active-state values.
charts.yaml.charts.yaml: use version: v1, context_namespace, instances.by_labels,label_promotion, and an explicit algorithm on every chart: incremental for counters and absolute for gauges.
Counter.ObserveTotal() only records monotonic values in metrix; it doesNOT set the chart DIMENSION algorithm by itself. Every chart that presents a counter as a rate MUST explicitly set algorithm: incremental, including dynamically built charttpl.Chart values.
Netdata metrics. Suffix inference is only a fallback and MUST NOT be used as the correctness mechanism for V2 collector charts.
template, not ad hoc chart-emission code.
metrix registers a descriptor per metric NAME permanently (no unregister), sore-registering a name with a changed kind, summary quantile set, or histogram bounds PANICS. When a name's contract can drift across cycles, keep the per-name handle for the job lifetime and SKIP a drifted series instead of re-registering.
context_namespace (thefixed prefix, or prefix.<app> per job) so autogen rebuilds prefix.<metric> / prefix.<app>.<metric> without hand-built chart IDs.
chart waits for real data, matching how scalar NaN values are already skipped.
metrix's Vec handle cache isunbounded; cache per-series instruments yourself and evict handles unseen for N cycles to stay bounded. Prefer a framework fix if the need is general (Decision Discipline).
src/go/plugin/go.d/docs/migrate-v1-to-v2.md.
Vars is blocked until framework support, anapproved equivalent design, or explicit breaking-alert approval exists.
collecttest.AssertChartCoverage is not chart-identity parity; it cannotprove old chart IDs, family, priority, lifecycle, labels, or alert variables.
collection path or V1 map-to-metrix bridge remains reachable from normal execution.
finished collector MUST NOT keep a runtime V1 map-to-metrix bridge.
contexts, dimension IDs/names, labels, config keys, DynCfg schema keys, stock config, alerts, docs, and lifecycle behavior.
explicit breaking decision.
cardinality, cost, or user-visible identity could surprise existing users.
.agents/skills/integrations-lifecycle/consistency.md; do not preserve a partial local artifact checklist in V2 collector work.
credentials.
Warningf/Errorf every collection cycle for arecoverable partial failure. Use the built-in logger limiter: c.Limit("collector:stable-operation-key", 1, time.Hour).Warningf(...).
entity IDs, labels, URLs, raw errors, or user-controlled values.
Once() is reset by JobV2.runOnce(), so it is useful inside one cycle only;it is not cross-cycle spam protection.
retry path handles it. Limit only fail-soft warnings/errors where collection continues with partial or stale data.
on a generated vnode.
ScopeKey and GUID MUST be deterministic._vnode_type=<source>.create VM/disk/NIC/path/sensor scopes by default.
or promoted labels only.
At minimum, V2 work MUST include these tests, or the PR/SOW MUST justify why a specific item does not apply:
Init, Check, Collect, and Cleanup lifecycle coverage;BeginCycle, success commit, and aborton expected collection errors;
map[string]int64 collection path or V1 map-to-metrix bridge.
consistency artifacts and justify every artifact that did not need a matching change. SHOULD-level exceptions and escape hatches MUST be reviewer-visible.
records an explicit breaking decision.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.