jposluns
UserA documentation library for governance, risk, compliance, cybersecurity, privacy, resilience, AI assurance, and operational control practices + a Claude Code rules-and-skills pack distilled from maintaining it.
Categories
Indexed Skills (13)
adopt
Run-once onboarding for a fork that adopts this governance-corpus-plus-pack project. A maintainer's clone carries accumulated operational working-state (audit-trail registers, session handoff, a next-actions queue, per-document review anchors) that is meaningless to a fresh adopter; this skill resets that machinery-core working-state to clean adopter baselines, settles how the adopter will handle the absent sibling repositories (their own, or self-contained with in-repo stubs `/adopt` creates or functional in-repo siblings), strips maintainer-only operational residue, and records the adopter's choices in a committed adopt-config so the resume step proceeds in adopter-mode without re-asking. It runs ONLY on an adopter clone (a fork origin), never on the maintainer's own repo or a maintainer's fresh-machine clone, and only once (an existing adopt-config short-circuits it).
artefact-discipline-check
Routes a change through the correct workflow when the change touches a generated artefact or a protected branch. Use before hand-editing a file that is produced by a generator (build outputs, schema dumps, taxonomies, doc portals, scorecards, lockfiles). Use before pushing directly to, force-pushing, or `reset --hard`ing a protected branch (the default branch, release branches, long-lived integration branches). Use when CI flags generated-artefact drift or a protected-branch operation. The workflow redirects to "edit source, run the generator, commit both halves" or "open a PR through the documented merge mechanism", never to "hand-edit the artefact" or "force-push past the check".
change-tracking-write-entry
Composes a CHANGELOG entry (substantive or terse form) for a PR. Use when about to commit, open a PR, or finalize a change. Every PR carries an entry, even if terse; there is no skip path. The entry's required parts (date-and-version header, structured Keep a Changelog sections for substantive entries, file references as markdown links, the "why" not just the "what", verification evidence, phase context) are walked step by step so an entry that would fail the link-coverage gate, the version-monotonicity audit, or the PR-time delta gate is caught at the draft stage rather than at CI.
clarify-before-acting
Surfaces ambiguity in one sentence and asks before acting, rather than silently picking. Use when a request supports more than one reasonable interpretation, when an external value the request does not pin down is required, when a project-specific convention must be chosen, or when an unexpected state of the world is encountered.
high-assurance-verification
Run the heavier pre-apply verification harness for a SENSITIVE change, one that is gate-blind on correctness (a fit or semantic property no existence gate can check), delicate at scale (a wide reshape or bulk mapping where a hand-edit is itself a defect risk), and costly to get wrong (a cited or downstream-relied-on artefact). Use before applying such a change, when the maintainer directs absolute-integrity rechecking, or when resuming a sensitive item left open in the register. It composes research fan-out, a mechanical signal pass over the negatives, two independent adversarial verifiers (false-negative and false-positive lenses, blind to each other and to the research), a programmatic invariant floor, and a deterministic scripted apply plus re-parse, so apply-correctness does not rest on the orchestrator's in-context precision. It catches the plausible-but-wrong value that survives every existence gate because the gate confirms the value is well-formed, not that it is right.
library-fitness-review
Trigger a comprehensive whole-corpus library-fitness review with a project-defined catalogue of persona reviewers when a governance/security documentation library undergoes a major change (new domain dir, new document type, multiple governance rule additions, major restructure) or quarterly minimum. Each invocation dispatches a fan-out of independent persona subagents (for example an executive reader, a security practitioner, an auditor, a newcomer) who review every page from a fresh-reader perspective without inheriting maintainer mental models. Catches comprehensibility, usability, logical-structure, standardization, governance/security quality, auditability, maintainability, and reader-experience gaps that per-PR validation sweeps and mechanical audit gates do not detect. Surfaces prioritized recommendations and a discrete remediation backlog the maintainer drives through subsequent PRs.
pr-retrospective
Post-merge retrospective on each successful PR. Surfaces what went well, what caused friction, recurring patterns, and proposed improvements. Output is one entry per PR in the improvement-log register; recurring patterns become candidates for pack-rule updates, worker-brief template additions, or new audit gates. Invoke after `/validate-pr` returns and before the next-PR planning step.
surface-instruction-concern
Runs the stop-consider-confirm protocol when executing a clear instruction as given would be counterproductive. Use when an instruction would destroy or discard committed work, reduce quality or efficiency with no offsetting benefit, contradict a goal the requestor stated, or rest on an apparently stale belief about current state; and when a brief instruction has both a harmful literal reading and a sensible charitable one. Walks the trigger test, the charitable-interpretation and stale-state checks, and the one-round named-options confirmation, calibrated so routine instructions proceed untouched and only material-impact concerns are surfaced, once, concisely.
validate-inference
Validates an inferred premise with a concrete observation before an action depends on it. Use when a draft or plan contains "since / because / given X, do Y" where X is a state claim not observed this turn, when about to skip a step because a prior run covered it, when declaring a fix complete because the named occurrence is fixed, or when acting on remembered rather than re-read state. Walks the discipline (name the inference, cost the validation, validate with a tool call, act on the observation) plus its recording step, so a wrong premise is caught by one cheap read instead of cascading into every downstream action built on it.
validation-sweep
Corpus-wide regression sweep run as a follow-up after any issue is identified and corrected, to confirm no sibling issue remains anywhere in the repository. Invoke after fixes that touch multi-surface artefacts, gate inventories, prose claims about repo state, AI-inferred citations, or generated artefacts. Combines the mechanical audit suite with a structured semantic fan-out, and loops until clean.
action-before-explanation-of-inaction
Grounds explanations of why an external action cannot or will not proceed in a real tool result, not in inference. Use before writing any clause of the form "X is blocked / waiting on / requires / needs / would fail" attached to an external action you have not attempted this turn. Use when about to explain why a PR cannot merge, why CI is waiting, why a deploy is held, why a permission is missing, or why any external system step is not proceeding. The safe action is attempted before the explanation is written; destructive actions are named and asked, not guessed at.
evidence-grounded-completion
Verifies completion claims with evidence before declaring done. Use before stating "done", "complete", "fixed", "shipped", "ready", or any synonym. Use when wrapping up a unit of work and about to summarize to the user. Use when about to acknowledge a user-reported issue with "good catch". Use also before asserting a factual property of an artefact you have not read (a state assertion in research, assessment, planning, or review), not only at completion.
gate-discipline-diagnose
Diagnoses a failing CI gate, lint, or audit and fixes the artefact rather than weakening the gate. Use when a gate fails. Use when tempted to bypass a check with --no-verify, blanket suppression, severity-threshold lowering, or exemption-list addition. Use when a pre-commit hook blocks a commit. Use when a required status check on a PR shows red.
Bio shown is the top-scored skill's repo description as a fallback — real GitHub bios land in a future update.