spec-governance SKILL.md skillA
spec-governance from devcodex-labs/devcodex is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add devcodex-labs/devcodex/spec-governance@git:20260908.6caf1bfPins git:20260908.6caf1bf in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- devcodex-labs/devcodex
- Path
content/skills/spec-governance/SKILL.md- Versions recorded
- 3
- Latest version
- git:20260908.6caf1bf, committed Sep 8, 2026
- First version recorded
- Jul 30, 2026
- Size
- 37,134 bytes
- Repository stars
- 432
- License
- AGPL-3.0
规范治理生命周期 — 意图驱动记录、RecordRouter 分流、SCV 规范变更验证；规范吸纳执行细节由 spec-absorption 承接.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Spec Governance Skill ## 定位 本 Skill 是规范治理生命周期的集中规则源，负责把“记录规范问题”和“规范变更验证”收口为统一链路；规范吸纳的候选扫描、通用性证明、消费者证明和实施执行由 `spec-absorption` 承接： ```text 发现 -> Intent Detection -> Ambiguity Guard -> RecordRouter -> Ledger Write -> Upgrade Check -> Verification ``` 原则： - AI 负责语义判断、上下文归因、多意图拆分和模糊表达澄清。 - 规则负责安全底线、CP 状态、台账格式、路径落点和 SCV 阶段要求。 - 工具负责文件存在、测试结果、部署同步、active-root 泄漏和 validate 探针。 ## 记录意图识别 `PostAssessmentGovernanceIntakeGate`：每条非空用户消息都先登记一个**中性的待评估候选**，但候选不等于治理命中。AI 必须在完成合理性评估、项目现实扩展和上下文归因后，才判断是否存在治理记录意图；关键词、固定短语或正则只能帮助定位证据，不能作为候选分类、写台账或跳过评估的权威依据。普通问答也必须形成 `record.none` 的受控评估结果，而不是靠“未命中关键词”静默绕过。 | 规范化意图 | 触发含义 | 默认目标 | |------------|----------|----------| | `record.violation` | 已有明确规则，但 AI 未执行或执行错 | `data/violations.md` | | `record.spec-defect` | 规范缺失、冲突、过窄、外部假设失效或拦截滞后 | `data/pending-fixes.md` | | `record.process-improvement` | 用户提出更优执行策略，AI 验证后可泛化 | `data/process-improvements.md`（优化清单，PI） | | `record.pending-issue` | 已确认但不阻断当前任务，适合后续批次治理 | `data/pending-issues.md` | | `record.audit-gap` | 审计/validate/Hook 未发现本该发现的问题 | `data/gap-registry.md` | | `record.none` | 普通解释、需求整理、报告整理，不是治理记录 | 不写台账 | | `record.ambiguous` | 指代不清或可能误写台账 | 先澄清 | ## 置信度规则 | 置信度 | 条件 | 处理 | …
Read the whole file at its exact version.
How to install
mdr add devcodex-labs/devcodex/spec-governance@sha256:5cdb3e0892f17f6aThe line at the top of this page pins the label git:20260908.6caf1bf, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_wu6r7tcjwg47f2sh)
4 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 3 versions of this file, between Jul 30, 2026 and Sep 8, 2026, about one every 20 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20260908.6caf1bf latest | 2026-09-08 | 6caf1bf | 37,134 B | A | view · diff |
| git:20260829.ef3a006 | 2026-08-29 | ef3a006 | 36,678 B | A | view · diff |
| git:20260730.6ee304a | 2026-07-30 | 6ee304a | 35,305 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (37134 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
devcodex-labs/devcodex · 432 stars · license AGPL-3.0 · pushed 2026-10-27 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_wu6r7tcjwg47f2sh GET https://markdownregistry.com/api/v1/resolve?ref=devcodex-labs/devcodex/spec-governance GET https://markdownregistry.com/api/v1/blob/5cdb3e0892f17f6af01bcc4c5b7946e9819192c92c39f216e78fe1104716e2ec
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.