pr-lifecycle — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited pr-lifecycle (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Reference document for the PR creation and pre-merge policy. The executable bash lives in plugins/flow/commands/pr.md (full creation flow) and plugins/flow/commands/merge.md (finding-ledger check). This skill describes what those commands enforce and why, so reviewers can audit the policy without reading shell.
NO PR WITHOUT VERIFICATION. Every PR must have proof that quality checks pass. "I think it works" is not a PR description.
If you can't show test results, lint output, or verification evidence in the PR body, the PR is not ready.
Before any PR is created, four conditions are verified:
| # | Condition | Failure handling |
|---|---|---|
| 1 | Not on the default branch | Hard error — PRs are made from feature branches, never from main |
| 2 | At least one commit ahead of the default branch | Hard error — empty PRs are noise |
| 3 | No uncommitted changes | Warning — offer to commit first via /flow:commit |
| 4 | No existing open PR for this branch | Hard error — update the existing PR instead of creating a duplicate |
The runnable checks are in plugins/flow/commands/pr.md Phase 1 (EXPLORE). The command is the single source of truth.
Before the PR is created, every one of the following must hold. If any fail, stop:
code-quality-principles checklistThis gate is mandatory. Skipping it to "get the PR up quickly" creates reviewer burden and shifts the verification cost to whoever reads the PR.
For the canonical map of all eight quality gates flow enforces — Spec Validation, Stranger Test, Per-Task Verification, Runtime Verification, Evidence Completeness, Missing-Criterion Scan, Holdout Validation, and Finding-Ledger Merge — see gate-configuration.md.
The PR body is generated from a fixed template plus review findings plus the decision journal. Sections, in order:
Why this shape: reviewers should be able to skim Summary → Requirements Adherence → Verification in under thirty seconds and decide whether to do a deep read. A PR body that buries the acceptance-criterion mapping or omits verification evidence forces every reviewer to reconstruct context the author already had.
Reviewer selection follows this priority cascade:
The PR command surfaces the top 2-3 candidates with a one-line rationale per candidate. The author makes the final call.
Both git push -u origin <branch> and gh pr create are Tier 2 (journal-and-proceed): the agent executes them and logs the action, but does not require explicit human confirmation each time. This tier classification is recorded in plugins/flow/commands/pr.md.
After creation, the command verifies the PR exists via gh pr view --json number,url,state,title and surfaces the PR URL plus a suggested next step (/flow:review {number}).
Before a PR can be merged via /flow:merge, the finding ledger is checked to ensure all review findings have been resolved. The runnable parser lives in plugins/flow/commands/merge.md Phase 1 (Finding-Ledger Check).
PR comments carry two markers:
/flow:addressThe latest comment of each kind is parsed and compared.
ESCALATED:[F3] means at least one finding was escalated but not resolved. The merge gate blocks until every escalated item is resolved or the array is empty.FLOW_REVIEW_CYCLE:FINDINGS that has no corresponding entry in FLOW_RESOLUTION_CYCLE:RESOLVED is considered unresolved. The merge gate blocks until every finding has a matching RESOLVED entry./flow:address {pr_number} to address remaining findingsRESOLVED arrayESCALATED array is empty in the latest resolution comment/flow:merge {pr_number}This gate enforces the "no incomplete shipments" hard boundary from organizational governance. Merging with unresolved findings is a violation, not a judgment call.
The PR pipeline blocks these recurring excuses by structure, not by exhortation:
| Excuse | Response |
|---|---|
| "I'll fix it after the PR is up" | Fix it now. Draft PRs accumulate, they don't improve. |
| "The reviewer will catch any issues" | You are the first reviewer. Don't outsource your job. |
| "It's a small change, no need for full pre-flight" | Small changes, same process. The cost of pre-flight is small; the cost of a malformed PR is reviewer time. |
| "CI will validate it" | CI validates what it tests. Pre-flight validates what CI doesn't. |
This skill is reference-only. The runnable implementations are:
plugins/flow/commands/pr.md Phase 1 (EXPLORE)plugins/flow/commands/pr.md Phase 4 (VERIFY)plugins/flow/commands/pr.md Phase 4 step 11plugins/flow/commands/merge.md Phase 1When the policy needs to change — a new pre-flight check, a new PR body section, a new ledger marker — update the command and update this reference together. Keeping the bash and the rationale in lockstep prevents the silent drift that motivated this consolidation.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.