adr-index — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited adr-index (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Persists every ADR under */docs/adr/ or */docs/adrs/ to the adr-patterns namespace and every relationship (supersedes / amends / related / depends-on) to adr-edges. Handles both ADR formats found in the Ruflo monorepo:
# ADR-097: Title heading + **Status**: Proposed lineid: ADR-NNNN, status: Proposed)Implementation is in scripts/import.mjs (one Bash call) rather than dozens of per-ADR MCP tool calls — same effective behavior, materially faster, dual-format-aware, and false-positive-resistant for issue numbers.
node plugins/ruflo-adr/scripts/import.mjsOptional env:
IMPORT_FORMAT=json — emit JSON instead of markdownIMPORT_DRY_RUN=1 — parse + summarize, skip persistenceADR_ROOT=/path — scan a different root (default: cwd)adr-verify skill, which runs scripts/verify.mjs and exits 1 on cycles.mcp__claude-flow__memory_search against the populated namespace: memory_search --query "federation budget" --namespace adr-patternsadr-patterns namespace, key <ADR-id>::<basename>, value (text):
<title> — <first paragraph of Context>
file: <relative path>
status: <Proposed|Accepted|Superseded|...>
date: <ISO date>
tags: <comma-separated>adr-edges namespace, key <relation>:<FROM>-><TO>:<timestamp-rand>, value:
{ "from": "ADR-097", "to": "ADR-086", "relation": "related", "capturedAt": "<ISO>" }#1697 / commit abc123 / PR 1234 references inside ADR bodies are stripped before regex extraction so they don't get misread as ADR-1697 etc. See extractAdrRefs() in scripts/import.mjs.
adr-create — produces the ADR files this skill consumesadr-review — runs over adr-patterns for compliance checksadr-verify (sibling skill) — runs scripts/verify.mjs for graph-integrity gating~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.