sovereign-repo-governance — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited sovereign-repo-governance (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
(opencode - Skill) The March 2026 gold standard for autonomous repository management. This skill governs the entire lifecycle of a repository, divided into two primary pillars: Internal Governance (Zeus & Hermes Control Plane) for autonomous task orchestration, and External Outreach (CEO Bug-Hunter Protocol) for building global reputation by fixing upstream anomalies.
ABSOLUTE PFLICHT: Wenn /sovereign-repo-governance ausgeführt wird, MUSS der Agent AUTOMATISCH auch /visual-repo ausführen!
Begründung: Ein Repo mit Governance aber ohne visuelle Dokumentation ist wie ein Auto mit Motor aber ohne Karosserie - technisch perfekt, aber niemand versteht es auf den ersten Blick.
Reihenfolge:
1. sovereign-repo-governance → Struktur, Issues, Governance, Wiki
2. visual-repo → Mermaid-Diagramme, Infografiken, README-Optimierung, 3-Sekunden-HookTrigger-Erweiterung: Jedes Mal wenn sovereign-repo-governance aktiviert wird, lade zusätzlich den Skill visual-repo via skill(name="visual-repo").
MANDATORY USE: Keywords "zeus", "bootstrap project", "roadmap to issues", "hermes dispatch", "github issue", "opencode issue", "hunt bugs", "fix upstream", "sync fixes", "report bug", "visual repo", "diagramme", "readme verbessern".
The internal governance model converts high-level plans into highly structured, actionable GitHub Projects, Epics, and Sub-Issues, and then automatically dispatches them to the specialized A2A Coder Fleet.
When creating or updating any A2A-SIN repository inside the GitHub organization OpenSIN-AI, agents MUST set the GitHub metadata correctly:
opnsin-agentWebsite host rules:
https://a2a.delqhi.comhttps://opensin.ai/agents/<slug>Examples:
https://a2a.delqhi.com/agents/sin-google-appshttps://opensin.ai/agents/sin-google-appsFail-closed rule:
When an autonomous plan or roadmap is approved (e.g., via /plan), it MUST be persisted into a structured JSON roadmap (e.g., Docs/operations/endgame-plan.json).
node scripts/zeus/bootstrap-github-project.mjs --owner Delqhi --repo SIN-Solver/OpenSIN --title "Phase 5 Endgame" --plan-file Docs/operations/endgame-plan.jsonzeus/01-phase-5-...).Once issues are in the GitHub/Supabase pool, they must be assigned to the A2A Coder workforce.
sin_issues_pool and dynamically route open tasks to the correct specialized agent (A2A-SIN-Code-Database, A2A-SIN-Code-Integration, A2A-SIN-Code-AI, A2A-SIN-Frontend, A2A-SIN-Backend, etc.) based on keywords and labels.Room-13 FastAPI coordinator if executing in the legacy worker lane.Every governed repo must separate ingress from review feedback:
work_item contract onlyRequired repo artifacts:
governance/repo-governance.jsongovernance/pr-watcher.jsongovernance/coder-dispatch-matrix.json for coding/work reposplatforms/registry.jsonn8n-workflows/inbound-intake.jsondocs/03_ops/inbound-intake.mdscripts/watch-pr-feedback.shFail-closed rules:
Canonical shared references:
~/.config/opencode/INBOUND_WORK_ARCHITECTURE.md~/.config/opencode/templates/work-item.schema.json~/.config/opencode/templates/platform-registry.schema.json~/.config/opencode/templates/pr-watcher.schema.jsonThe external protocol dictates how the agent proactively hunts for bugs in upstream repositories, fixes them using SIN-Solver best practices, and publishes elite PRs/Issues.
scripts/bug_hunter.mjs to crawl upstreams like anomalyco/opencode and code-yeongyu/oh-my-openagent.repair-docs.md with status ✅ GEFIXT.scripts/submit_sovereign_issue.mjs to dual-file the fix.carbon-now-cli.scripts/capture_diff_screenshot.mjs to generate AIometrics-watermarked screenshots and upload them to the public auto-screenshots release.Internal (Zeus & Hermes):
External (Bug Hunter):
--error-file, --diff-file, --success-file).FLEET SYNC MANDATE: Any modifications to this skill or its scripts MUST be pushed to all runtimes via sin-sync.In enterprise and private environments, standard GitHub Wikis easily become disorganized dumping grounds. To maintain technical excellence, all A2A agents MUST autonomously initialize and structure the GitHub Wiki of a new or existing repository using strict best practices based on the repository's use case.
https://github.com/<org>/<repo>.wiki.git). Agents must interact with it via git clone, generate the structure locally, and git push._Sidebar.md to force a strict, hierarchical navigation menu. Do not rely on GitHub's default alphabetical sorting.Architecture/System-Design.md).assets/ folder inside the .wiki.git repository to host images. Never link to ephemeral external image hosts.Use the scripts/zeus/wiki-bootstrap.mjs script to automatically generate the correct structure based on the repo type:
Home.md (Project Overview, Setup)Architecture/State-Management.mdArchitecture/Component-Library.mdGuides/Styling-Conventions.mdHome.md (Project Overview, Setup)Architecture/System-Design.mdArchitecture/Database-Schema.mdAPI/Endpoints.mdOperations/Runbooks.mdHome.md (Overview, Installation)Usage/Quickstart.mdAPI/Reference.mdGuides/Contributing.mdHome.md (Ecosystem Overview, Setup)Architecture/Package-Boundaries.mdOperations/CI-CD-Pipelines.mdGuides/Tooling.mdWhenever a new repo is created or an agent is tasked with documentation:
node scripts/zeus/wiki-bootstrap.mjs --org OpenSIN-AI --repo my-new-service --type backendThis clones the wiki, scaffolds the correct .md files and the _Sidebar.md, and pushes it to the repository.
NACH Abschluss von Part 1-3 MUSS der Agent den `/visual-repo` Skill ausführen!
sovereign-repo-governance完成 → skill(name="visual-repo") → README + docs/architecture.md erstellen → Commit & PushFLEET SYNC MANDATE: Any modifications to this skill or its scripts MUST be pushed to all runtimes via sin-sync.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.