Bot and skill map
The bundles under bots/, then the skills they carry.
Bundles
| Bot | Persona | What it does | Version |
|---|---|---|---|
adr-cartograph | 🗺️ Adry | Observes the code-as-implemented and produces committable ADR markdown (Nygard format) in docs/adr/ — one capable agent over a… | 2.1.2 |
adr-rechallenge | ⚖️ ReArchi | Human-in-the-loop ADR re-challenge. | 0.1.3 |
app-dev | 🏗️ Appy | Autonomous end-to-end APPLICATION development from a prompt — greenfield. | 0.4.5 |
arbitrate | ⚖️ Themis | Judges the divergence cases a modernisation programme leaves blocked, by applying the target repository's own written arbitration doctrine… | 0.1.4 |
assessment | 🧭 Assessy | Assesses a repository at the START of a modernisation campaign and writes the contract the execution bot then carries out: the state of the… | 0.1.3 |
bmady | 🎭 Bmady | BMAD-METHOD-inspired agile delivery bot. | 0.1.4 |
branch-improve-loop | 🌿 Billy | Branch-scoped REVIEW-AND-IMPROVE campaign — one capable agent, its natural flow, minimal framing. | 1.9.9 |
campaign | 🧭 Campy | Supervises a WHOLE modernisation programme, lot after lot, by running the modernize bot as a subbot in a bounded loop — and holding the… | 0.1.3 |
copilot | 💬 Copi | Conversational iterion assistant. | 0.2.14 |
dep-update-guard | 💂 Vetty | Reactive security + alignment guard for automated dependency-update PRs (Dependabot / Renovate). | 2.11.3 |
devbox-setup | 🧰 Devy | Bootstraps a reproducible dev environment for a repository. | 0.1.4 |
docs-refresh | 📚 Doki | Documentation alignment bot — one capable agent + a mission + truth gates only. | 3.8.0 |
e2e-coverage | 🕸️ Endy | Autonomous end-to-end coverage completion — one capable agent, its natural flow, minimal framing. | 0.5.4 |
evolve | 🧬 Evoly | Strategic / architectural / visionary partner. | 0.1.5 |
feature-dev | 🛠️ Featurly | Autonomous end-to-end feature development — one capable agent, its natural flow, minimal framing. | 2.7.6 |
feature-gap-fill | 🧩 Fini | Gap-driven feature completer — one capable agent, its natural flow, minimal framing. | 2.4.4 |
feed-watch | 🔭 Vigie | Universal feed-watch + digest bot (Huginn-style veille pipeline as a single bot). | 1.6.5 |
gitops-warden | 🛡 Warden | GitOps merge gate. | 0.2.0 |
golden-master | 🪞 Goldy | Builds a behavioural non-regression net for an EXISTING application, and PROVES it is not blind. | 0.1.6 |
instrument | 📡 Obsy | Observability instrumentation campaign — one capable agent wires a repo for error tracking and standardized logs, one verified semantic… | 0.2.3 |
issue-triage | 🏷️ Triagy | Lightweight single-shot card triage. | 0.2.3 |
modernize | 🧱 Morphy | Carries a repository through a programme of modernisation LOTS — steps whose entry and exit are both deterministic gates — one… | 0.7.0 |
prod-watch | 👁️ Argus | Production watchdog for ONE deployed application (scheduled ticks, zero LLM in this slice — the compiled workflow contains no agent or… | 0.4.0 |
product-docs | 🧭 Prody | Functional documentation bot — one capable agent writes and maintains the BUSINESS-AUDIENCE documentation of a product ("what it does for… | 1.6.0 |
revi-converse | 💬 Revi (converse) | Conversational sibling of Revi (review-pr). | 0.1.6 |
review-env | 🌐 Envy | Deploys the CURRENT workspace's already-CI-published image to the operator-attached platform and hands back a LIVE https URL — a real… | 0.1.4 |
review-pr | 🔎 Revi | Read-only cross-family code reviewer. | 0.9.18 |
rgaa-audit | ♿ Acci | RGAA 4.1.2 / WCAG 2.2 AA accessibility audit (read-only) on the ultra11y engine. | 3.1.1 |
sec-audit-deps | 📦 Depsy | Universal supply-chain malware auditor. | 0.1.5 |
sec-audit-source | 🛡️ Seki | Universal source-code security auditor. | 0.1.11 |
secured-renovacy | ⬆️ Renovacy | Multi-stack agentic dependency upgrade pipeline. | 0.3.6 |
supply-shield | ⛓️ Shieldy | Global supply-chain MALWARE shield. | 0.1.6 |
supply-shield-cve | 🚨 Vulny | Global supply-chain CVE shield. | 0.1.6 |
test-coverage | 🧪 Testy | Autonomous test-coverage augmentation — one capable agent, its natural flow, minimal framing. | 2.4.4 |
vuln-watch | 🛡️ Senti | Inventory-scoped vulnerability sentinel (hourly watch, zero LLM). | 0.1.2 |
whats-next | 🧭 Nexie | Conversational co-CTO. | 0.3.11 |
whole-improve-loop | 🌍 Willy | Whole-codebase improvement CAMPAIGN on one axis — one capable agent, its natural flow, minimal framing. | 2.5.5 |
wiki-gen | 📖 Wikky | Wiki generator — one capable agent builds and incrementally maintains a navigable, Open-Knowledge-Format wiki for whatever repository it… | 1.0.7 |
Skills
The pair a model sees before it decides to open the file.
| Bot | Skill | Description |
|---|---|---|
adr-cartograph | adr-format | Exact Nygard ADR format used in docs/adr/ — filename convention, markdown bullet-list front-matter, required sections,… |
adr-cartograph | adr-scope-detection | Heuristics for locating where ADRs live in an arbitrary target repo. |
adr-cartograph | adry | Operating playbook for the adr-cartograph bot (Adry) — observe code, write ADRs, audit completeness, never edit code, file… |
adr-cartograph | completeness-taxonomy | The 8 enum-locked kinds of feature gap Adry recognises in the completeness audit. |
adr-cartograph | decision-vs-mechanic | The dam against ADR-spam. |
adr-cartograph | verify-build | Detect and run a repository's OWN build + test so a deterministic gate can confirm the tree actually compiles and passes before… |
adr-rechallenge | argument-framing | ReArchi's contract for honest re-challenge arguments. |
adr-rechallenge | rearchi | Operating playbook for ReArchi — the human-in-the-loop ADR re-challenger. |
app-dev | code-review-invariants | The cross-cutting invariants an adversarial self-review must check on a code diff before it ships — the defect classes that… |
app-dev | forge-mr-create | How to push the current run's branch and open ONE pull request (merge request on GitLab) on GitHub (gh), GitLab (glab) or… |
app-dev | greenfield-bootstrap | Stack-agnostic scaffold and walking-skeleton discipline for creating a NEW application in a bare workspace — stack detection,… |
app-dev | interview-playbook | Adaptive interview method for converging a decision-quality application spec (SPEC.md) with the operator before development… |
app-dev | rgaa-dsfr | Exploiter le Système de Design de l'État (DSFR) comme baseline d'accessibilité RGAA via les outils MCP DSFR. |
app-dev | verify-build | Detect and run a repository's OWN build + test so a deterministic gate can confirm the tree actually compiles and passes before… |
assessment | assessment-brief | The .modernize/brief.yaml declared entry — what a repository cannot state about its own modernisation, the fields that carry… |
assessment | assessment-report | How the assessment documents are written — factual assertions inserted by fact identifier and substituted by the renderer,… |
assessment | assessment-survey | What a survey declaration is, the kinds it may take, the evidence each kind owes the lint, and the machine-readable extractor… |
assessment | measurement-profile | The default measurement profile — metrics, canonical exclusions, domain of applicability, synthetic anchor and size thresholds,… |
assessment | plan-contract | The .modernize/plan.yaml contract — its fields, why the programme is a committed file rather than something re-derived from git… |
assessment | stack-go | Go extractors for the assessment — the declared toolchain version, the deployable commands, and the HTTP entrypoints, each… |
assessment | stack-java | Java extractors for the assessment — the declared JVM and framework versions, the modules the build ships on their own, and the… |
assessment | stack-node | Node.js extractors for the assessment — the declared runtime and package-manager versions, the runnable packages, and the HTTP… |
assessment | upgrade-archetypes | The behaviour-drift classes every MAJOR crossing ships — a stack-agnostic sweep grammar. |
bmady | bmady-analyst | Mary, the Bmady Analyst — turns a raw request into a crisp, testable problem analysis (problem statement, stakeholders, open… |
bmady | bmady-architect | Winston, the Bmady Architect — turns an approved PRD into a pragmatic architecture (components, ADR-worthy decisions, risks)… |
bmady | bmady-dev | James, the Bmady Developer — implements ONLY the operator-selected stories against the approved architecture, runs the repo's… |
bmady | bmady-pm | John, the Bmady Product Manager — turns an approved analysis into a PRD (epics + small, id'd user stories with acceptance… |
bmady | bmady-qa | Quinn, the Bmady QA architect — judges the UNCOMMITTED work (git diff HEAD, never HEAD^) against the selected stories'… |
bmady | bmady | Operating playbook for the Bmady bot — the BMAD-inspired Analyst→PM→Architect→Dev→QA pipeline, the five human gates,… |
branch-improve-loop | code-review-invariants | The cross-cutting invariants an adversarial self-review must check on a code diff before it ships — the defect classes that… |
branch-improve-loop | forge-mr-create | How to push the current run's branch and open ONE pull request (merge request on GitLab) on GitHub (gh), GitLab (glab) or… |
branch-improve-loop | verify-build | Detect and run a repository's OWN build + test so a deterministic gate can confirm the tree actually compiles and passes before… |
copilot | copi-conversation | Copi's conversational playbook — opening and resuming a session, maintaining a compact continuity brief, presenting drafts and… |
copilot | iterion-bot-architecture | Complete embedded victor/iterion-bot-authoring/v1 standard for designing .bot graphs — responsibilities, contracts,… |
copilot | iterion-concepts | The iterion mental model — what a bot, a run, a bundle, a skill and the catalog are; how the compilation pipeline and the… |
copilot | iterion-dsl-authoring | Writing and fixing a .bot workflow — node types, edge syntax, references, budget, and the syntax traps that compile clean but… |
copilot | iterion-run-debug | Diagnosing an iterion run — the status ladder, what each pause and failure means, how to read events and the checkpoint,… |
dep-update-guard | dependency-pr-guard | Operating playbook for Vetty — guarding an automated dependency-update PR (Dependabot/Renovate). |
dep-update-guard | package-managers | Reference for package-manager operations across common ecosystems — discovery (what's outdated), upgrade (bump one or many),… |
dep-update-guard | verify-build | Detect and run a repository's OWN build + test so a deterministic gate can confirm the tree actually compiles and passes before… |
devbox-setup | devbox-setup | Playbook for authoring a pinned devbox.json that reproduces a repo's build/test/e2e toolchain, for use by Devy (devbox-setup) and… |
docs-refresh | anti-facade-fix-rules | Evidence and editing discipline for Doki's single documentation-alignment campaign. |
docs-refresh | context-sources | Reading the run's optional product-context material (reference repos, tracker snapshot) — what it grounds, how to read it per… |
docs-refresh | doc-enrichment | Discipline for the code→docs half of a Doki campaign — what deserves documentation, where to put it, how to write it, when to… |
docs-refresh | doc-mismatch-taxonomy | Working taxonomy and evidence conventions for adjudicating Doki doc-drift issues (advisory hints and self-found). |
docs-refresh | doc-scope-enumeration | Contract for Doki's deterministic documentation footprint, incremental base detection, advisory hints, and writeable set. |
docs-refresh | doc-verification-checklist | Per-pass verification checklist for Doki v3's adaptive campaign and deterministic truth gates. |
docs-refresh | docs-refresh | Operating playbook for Doki v3 — one adaptive documentation-alignment campaign guided by an advisory scan and gated only by… |
docs-refresh | forge-mr-create | How to push the current run's branch and open ONE pull request (merge request on GitLab) on GitHub (gh), GitLab (glab) or… |
e2e-coverage | coverage-matrix | THE CONTRACT of the feature×coverage matrix file — exact table format, allowed statuses, which statuses require test… |
e2e-coverage | e2e-coverage | Endy's operating playbook for driving an application's FEATURE-level e2e coverage to complete in ANY repo. |
e2e-coverage | feature-inventory | How to enumerate an application's FEATURES from the outside (docs, CLI surface, API routes, configuration, grammar/DSL, UI… |
e2e-coverage | verify-build | Detect and run a repository's OWN build + test so a deterministic gate can confirm the tree actually compiles and passes before… |
e2e-coverage | verify-tests | Detect and run a repository's OWN test suite so a deterministic gate can confirm the new tests actually pass before the campaign… |
evolve | architectural-axes | A vocabulary of evolution axes Evoly draws from when synthesising a vision — reliability, performance, DX, modularity, and more. |
evolve | backlog-handoff | How Evoly hands proposed evolutions to Nexie and the operator — one deep artifact per evolution in the shared findings/ memory… |
evolve | elicitation-discipline | How Evoly interrogates the operator mid-investigation with ask_user — when to ask, when not to, one-shot question shape, and… |
evolve | evolve-memory-layout | The contract for Evoly's two memory scopes — the PER-BOT vision tree (private across sessions) and the SHARED findings inbox… |
evolve | evolve-playbook | Operating playbook for Evoly — survey a mature repo, investigate with ask_user, accumulate a long-horizon vision in per-bot… |
evolve | iterion-board | How to write to the iterion native kanban board from inside a .bot workflow. |
evolve | repo-maturity-assessment | Heuristic for deciding whether a repository is mature/stable enough to warrant a long-horizon vision. |
evolve | session-continuity | How to use the iterion workspace memory tools (memory_read, memory_write, memory_list) to keep a compact, frontmatter-tagged… |
feature-dev | code-review-invariants | The cross-cutting invariants an adversarial self-review must check on a code diff before it ships — the defect classes that… |
feature-dev | forge-mr-create | How to push the current run's branch and open ONE pull request (merge request on GitLab) on GitHub (gh), GitLab (glab) or… |
feature-dev | verify-build | Detect and run a repository's OWN build + test so a deterministic gate can confirm the tree actually compiles and passes before… |
feature-gap-fill | fini | Operating playbook for Fini's adaptive gap-closing campaign. |
feature-gap-fill | gap-vs-feature | When to use Fini (feature-gap-fill) vs Featurly (feature_dev), and the schema of a valid gap spec. |
feature-gap-fill | verify-build | Detect and run a repository's OWN build + test so a deterministic gate can confirm the tree actually compiles and passes before… |
feed-watch | feed-config | feed-watch (Vigie) workspace configuration — the config file format (categories, feeds, editorial, sinks), the state layout,… |
feed-watch | notify-webhooks | feed-watch delivery mechanics — Mattermost/Slack incoming-webhook payloads, the webhooks secret map, dry-run, partial-failure… |
feed-watch | synthesis-scoring | Editorial rubric for the feed-watch digest agent — how to group, rank, semantically dedup and write a chat digest that respects… |
gitops-warden | ci-and-argocd | The gitops CD layout: apps/<app>-<env>/ wrappers, main/rendered branches, CI components and ArgoCD definitions — the structural… |
gitops-warden | context-and-access | Platform context: what product teams are given self-service, the vocabulary (PIC, ESO, CNPG, XRD), and a known-good gitops shape… |
gitops-warden | gitops-repo-standard | The gitops repo standard: branch/merge policy, the validate job, OPS-vs-MR modes, the three-repo chart boundary — what an MR on… |
gitops-warden | helm-pitfalls | Verified Helm traps for a merge verdict: renamed values keys dropping config silently, subchart aliases and conditions,… |
gitops-warden | platform-conformance | Atlas v2 platform facts for a merge verdict: managed resources (OvhValkey, OvhPostgresqlCluster, OvhBucket), LimitRange bounds… |
gitops-warden | policy-template | Starter review-policy.md (the policy_path var pins the real path) for a gitops repo: what may widen or tighten the… |
gitops-warden | review-policy | The warden's policy contract — default classes, the override file, the verdict vocabulary, and the invariants the judge may not… |
gitops-warden | secrets-and-datastores | Secrets and datastore rules: no Secret material in charts, ExternalSecret via the local store, reloader conventions, and the… |
golden-master | binary-lane | Capture generated documents (PDF, spreadsheets, CSV) without building a blind judge — the triple assertion, the volatile fields… |
golden-master | canonicalization | Neutralise what is volatile in a captured response without erasing what is business signal — the line between the two, and the… |
golden-master | deterministic-fixture | Freeze the application's world so captures are reproducible AND the surface is actually exercised — seeded data, credentials,… |
golden-master | golden-master | Build a behavioural non-regression net for an existing application — the five surface lanes, what counts as an oracle, and what… |
golden-master | oracle-mutation | Write mutants that prove the oracle is not blind — required archetypes, the apply/revert contract, and the sealed held-out set. |
golden-master | surface-discovery | Enumerate an application's observable surface and choose a corpus with real width — how to find routes, which personas to open,… |
instrument | code-review-invariants | The cross-cutting invariants an adversarial self-review must check on a code diff before it ships — the defect classes that… |
instrument | forge-mr-create | How to push the current run's branch and open ONE pull request (merge request on GitLab) on GitHub (gh), GitLab (glab) or… |
instrument | instrumentation | The observability-instrumentation playbook — how to survey a repo, what "done" means for the errors / logs / tracing families,… |
instrument | lang-go | Go reference for the instrument campaign — sentry-go for error tracking (init, recover, flush, mock transport tests), log/slog… |
instrument | lang-js | Node.js / TypeScript reference for the instrument campaign — @sentry/node for error tracking (init order, process handlers,… |
instrument | lang-python | Python reference for the instrument campaign — sentry-sdk for error tracking (init, LoggingIntegration for the… |
instrument | metrics | The metrics family — what "done" means for a /metrics surface (HTTP request count and latency by route and status, process… |
instrument | tracing | Opt-in tracing family for the instrument campaign — Sentry-first transactions/spans, env-tunable sampling with a conservative… |
instrument | verify-build | Detect and run a repository's OWN build + test so a deterministic gate can confirm the tree actually compiles and passes before… |
issue-triage | issue-triage | Triagy's single-shot routing procedure — read one board card, stamp the handler bot + labels, comment the rationale, never move… |
issue-triage | iterion-bot-catalog | Catalog of iterion bots — walk the decision tree to pick which bot handles a board card, then stamp it with set_bot. |
issue-triage | iterion-label-vocabulary | Canonical label namespaces for the iterion native kanban board. |
modernize | modernize-lots | What a modernisation lot is, why the unit is the lot and not the package, the ordering constraints that make or break a… |
modernize | plan-contract | The .modernize/plan.yaml contract — its fields, why the programme is a committed file rather than something re-derived from git… |
modernize | upgrade-archetypes | The behaviour-drift classes every MAJOR crossing ships — a stack-agnostic sweep grammar. |
prod-watch | argus-config | prod-watch (Argus) workspace configuration — the prod-watch.json format (app, release, grafana, loki, prometheus, probes,… |
prod-watch | signals-and-queries | prod-watch (Argus) signal lanes — the Loki window and cursor contract, the Sentry lists and what posts when, what the redaction… |
product-docs | blocs-gitbook | Default GitBook block vocabulary for published functional pages — which blocks are allowed, what each one means to the reader,… |
product-docs | forge-mr-create | How to push the current run's branch and open ONE pull request (merge request on GitLab) on GitHub (gh), GitLab (glab) or… |
product-docs | glossaire-produit | How to build and maintain the per-product glossary page — which terms earn an entry, how each entry is written and grounded in… |
product-docs | modele-documentaire | Default documentary model for functional product pages — structure by user roles and journeys, one hub page per role/journey… |
product-docs | product-docs | Operating playbook for Prody — writing functional, business-audience product documentation in a dedicated docs repository from… |
product-docs | publish-static-site | Build the product documentation into a static site (GitBook blocks → MkDocs Material) and package it as a non-root nginx… |
product-docs | ton-et-style | Default tone and style rules for published functional pages — person, tense, sentence shape, the sourced-or-[à confirmer]… |
revi-converse | forge-reply | How to POST a reply note in an EXISTING pull-request (merge-request on GitLab) discussion thread on GitHub, GitLab, or… |
review-pr | ticket-context | How to obtain the ticket(s) a PR claims to deliver — from an external tracker (Jira Cloud/DC) or, with no configuration, from… |
rgaa-audit | adjudication-protocol | How to rule on one batch of criteria the engine could not decide: reading a brief and an evidence file, the four verdicts and… |
rgaa-audit | iterion-board | How to write to the iterion native kanban board from inside a .bot workflow. |
rgaa-audit | refutation-protocol | The second reader's protocol: a draft report's claims — every stated non-conformity and every conformity an agent landed —… |
rgaa-audit | rgaa-audit | The playbook of the rgaa-audit bot (Acci): who finds the non-conformities (the ultra11y engine), who judges the criteria a static… |
rgaa-audit | ultra11y-engine | The ultra11y engine as this bot uses it: what it decided before you were started, what it hands you (evidence files, normative… |
sec-audit-deps | iterion-board | How to write to the iterion native kanban board from inside a .bot workflow. |
sec-audit-deps | lang-generic | Language-agnostic supply-chain heuristics for sec-audit-deps. |
sec-audit-deps | lang-go | Go modules heuristic reference for sec-audit-deps. |
sec-audit-deps | lang-js | npm / yarn / pnpm heuristic reference for sec-audit-deps. |
sec-audit-deps | lang-py | pip / poetry / uv heuristic reference for sec-audit-deps. |
sec-audit-deps | malware-signals | Canonical catalogue of supply-chain malware signal ids emitted by the heuristic_scan tool nodes. |
sec-audit-deps | package-cache | Package analysis cache at {{vars.cache_path}} (default: the engine's out-of-tree run scratch dir). |
sec-audit-deps | sec-audit-deps | Operating playbook for the sec-audit-deps bot. |
sec-audit-source | harness-attribution | Provenance notice for Seki's threat-model, vuln-scan, triage, and patch skills — records that they are adapted from Anthropic's… |
sec-audit-source | crypto-handling | Hard-stop policy for crypto findings. |
sec-audit-source | disprove-voting | Fixed-pool 3-voter adversarial verification protocol used by Seki's revalidate phase. |
sec-audit-source | external-security-tools | When and how to invoke external security tools from Seki: vercel-labs/deepsec (heavy-duty matchers, per-file FileRecord cache)… |
sec-audit-source | file-records | Per-file append-only analysis records — .sec-audit/files/. |
sec-audit-source | finding-taxonomy | Canonical enum of finding types for sec-audit-source. |
sec-audit-source | fp-memory | How to read and write .sec-audit/fp-known.yaml — the cross-run false-positive memory for sec-audit-source. |
sec-audit-source | iterion-board | How to write to the iterion native kanban board from inside a .bot workflow. |
sec-audit-source | lang-generic | Language-agnostic scanner reference for sec-audit-source. |
sec-audit-source | lang-go | Go scanner reference for sec-audit-source. |
sec-audit-source | lang-js | JS/TS scanner reference for sec-audit-source. |
sec-audit-source | lang-python | Python scanner reference for sec-audit-source. |
sec-audit-source | patch | Generate candidate fixes for verified findings, then climb a five-rung verification ladder (build, reproduce, regress, re-attack,… |
sec-audit-source | programmatic-matchers | How to ship custom programmatic matchers in this bundle. |
sec-audit-source | project-context | Project security context — .sec-audit/context.md. |
sec-audit-source | reattack-oracles | Per-scanner re-attack recipes used by Seki's verification ladder (D5a propose-mode). |
sec-audit-source | reproducer-go | How to write a focused Go regression test per finding_type — one that FAILS on unpatched code and PASSES after the fix. |
sec-audit-source | reproducer-ts | How to write a focused TS/JS regression test per finding_type — one that FAILS on unpatched code and PASSES after the fix. |
sec-audit-source | reviewer-isolation | The reviewer-isolation contract enforced by Seki's verification ladder. |
sec-audit-source | scanner-deepsec | Field mapping and triage contract for the optional deepsec 2.3.9 scanner backend (Enhancement 4). |
sec-audit-source | sec-audit-source | Operating playbook for the sec-audit-source bot. |
sec-audit-source | threat-model | Build (or refresh) the project threat model that Seki consumes before triage and ranking. |
sec-audit-source | triage | Adversarial triage of raw scanner output: N-vote majority verification, two-pass dedup (deterministic + semantic), exclusion… |
sec-audit-source | vuln-matchers-guide | How sec-audit-source uses external scanners as matchers, and how to add custom matchers for project-specific vulnerability shapes. |
sec-audit-source | vuln-scan | Static parallel review of a source tree by focus area. |
secured-renovacy | package-managers | Reference for package-manager operations across common ecosystems — discovery (what's outdated), upgrade (bump one or many),… |
secured-renovacy | verify-build | Detect and run a repository's OWN build + test so a deterministic gate can confirm the tree actually compiles and passes before… |
supply-shield | diff-scope | How supply-shield scopes a run to the dependency versions a PR / push ADDED or UPGRADED. |
supply-shield | forge-report | How supply-shield reports findings back onto a PR (merge request on GitLab) via the native forge API — GitHub, GitLab,… |
supply-shield | iterion-board | How to write to the iterion native kanban board from inside a .bot workflow. |
supply-shield | js-xray | js-x-ray AST malware analysis for npm/ts/js packages — the @nodesecure analyzer the no-package-malware project relied on. |
supply-shield | lang-generic | Language-agnostic supply-chain heuristics for sec-audit-deps. |
supply-shield | lang-go | Go modules heuristic reference for sec-audit-deps. |
supply-shield | lang-js | npm / yarn / pnpm heuristic reference for sec-audit-deps. |
supply-shield | lang-py | pip / poetry / uv heuristic reference for sec-audit-deps. |
supply-shield | malware-signals | Canonical catalogue of supply-chain malware signal ids emitted by the heuristic_scan tool nodes. |
supply-shield | package-cache | Cross-run host-wide package analysis cache, located at ~/.iterion/security-cache/packages.jsonl. |
supply-shield | supply-shield | Operating playbook for the supply-shield bot (Shieldy). |
supply-shield-cve | cve-scanning | The CVE floor for supply-shield-cve — trivy fs + osv-scanner over lockfiles (cross-ecosystem, no install) — and how the… |
supply-shield-cve | diff-scope | How supply-shield scopes a run to the dependency versions a PR / push ADDED or UPGRADED. |
supply-shield-cve | forge-report | How supply-shield reports findings back onto a PR (merge request on GitLab) via the native forge API — GitHub, GitLab,… |
supply-shield-cve | iterion-board | How to write to the iterion native kanban board from inside a .bot workflow. |
supply-shield-cve | lang-generic | Language-agnostic supply-chain heuristics for sec-audit-deps. |
supply-shield-cve | lang-go | Go modules heuristic reference for sec-audit-deps. |
supply-shield-cve | lang-js | npm / yarn / pnpm heuristic reference for sec-audit-deps. |
supply-shield-cve | lang-py | pip / poetry / uv heuristic reference for sec-audit-deps. |
supply-shield-cve | malware-signals | Canonical catalogue of supply-chain malware signal ids emitted by the heuristic_scan tool nodes. |
supply-shield-cve | package-cache | Cross-run host-wide package analysis cache, located at ~/.iterion/security-cache/packages.jsonl. |
supply-shield-cve | supply-shield-cve | Operating playbook for the supply-shield-cve bot (Vulny). |
test-coverage | test-coverage | Testy's operating playbook for adding/augmenting test coverage in ANY repo. |
test-coverage | test-types | What each test type means (unit / integration / e2e / property / contract / snapshot / smoke / performance) and how to write +… |
test-coverage | verify-build | Detect and run a repository's OWN build + test so a deterministic gate can confirm the tree actually compiles and passes before… |
test-coverage | verify-tests | Detect and run a repository's OWN test suite (and coverage tool, if any) so a deterministic gate can confirm the new tests… |
vuln-watch | senti-config | vuln-watch (Senti) workspace configuration — the config file format (sources, alert policy, sinks, labels), the technology… |
whats-next | dogfood-cycle | The operator's proven ritual for validating a bot by running it for real — launch on a real task, monitor actively, fix BOTH… |
whats-next | factory-ops | Iterion factory operating rules for Nexie — what breaks around a live dispatcher (store-locking, serialization, cost caps,… |
whats-next | iterion-board | How to write to the iterion native kanban board from inside a .bot workflow. |
whats-next | iterion-bot-catalog | Catalog of iterion bots — pick a bot name for each roadmap_item.assignee. |
whats-next | iterion-dsl-quickref | Iterion DSL cheatsheet — load this only when whats-next.bot's next_action recommends writing or modifying a .bot / .botz… |
whats-next | iterion-label-vocabulary | Canonical label namespaces for the iterion native kanban board. |
whats-next | operator-arbitrage | How Nexie unlocks operator decisions — grouped decision blocks with sharp options and a named recommendation in the turn-end… |
whats-next | repo-survey | Read-only survey method for Nexie — a tight single-pass survey for scoped questions, and a 3-audit parallel fan-out (docs/ADRs,… |
whats-next | roadmap-synthesis | Compose a roadmap study's synthesis — 6-9 named chantiers tiered now/next/later, quick-wins, an argued top-3, explicit blind… |
whats-next | session-continuity | Why this bundle keeps nothing of its own across sessions, where its durable record lives instead, and how to read the cross-bot… |
whats-next | whats-next | Operating playbook for Nexie, the conversational co-CTO — recommendation-first board intelligence, ticket curation against code… |
whole-improve-loop | forge-mr-create | How to push the current run's branch and open ONE pull request (merge request on GitLab) on GitHub (gh), GitLab (glab) or… |
whole-improve-loop | lang-js-fallow | Static analysis for JavaScript/TypeScript repos using fallow (dead code, duplication, complexity). |
whole-improve-loop | verify-build | Detect and run a repository's OWN build + test so a deterministic gate can confirm the tree actually compiles and passes before… |
wiki-gen | okf-format | The Open Knowledge Format (OKF v0.1) contract for wiki pages — required YAML frontmatter, Markdown-links-as-concept-edges,… |
wiki-gen | wiki-authoring | Operating playbook for building and incrementally maintaining a navigable, grounded, Open-Knowledge-Format wiki for any… |