ai-governance
$
npx mdskill add arcasilesgroup/ai-engineering/ai-governance``` /ai-governance # compliance mode (default) /ai-governance all # all four modes /ai-governance risk accept # accept a new risk (TTL by severity) /ai-governance integrity # framework consistency check /ai-governance --report # formal report (score + verdict) ```
SKILL.md
.github/skills/ai-governanceView on GitHub ↗
--- name: ai-governance description: Validates framework compliance, ownership boundaries, risk acceptance lifecycle, and manifest integrity for regulated environments. Trigger for 'are quality gates enforced', 'who owns this file', 'formally accept a known risk', 'pre-release compliance check', 'governance report for auditors'. Not for code quality; use /ai-verify instead. Not for security scanning; use /ai-security instead — this validates governance process, not code content. effort: high argument-hint: "all|compliance|ownership|risk|integrity|--report" mode: agent tags: [governance, compliance, ownership, risk, integrity, enterprise] model_tier: opus mirror_family: copilot-skills generated_by: ai-eng sync canonical_source: .claude/skills/ai-governance/SKILL.md edit_policy: generated-do-not-edit --- # Governance ## Quick start ``` /ai-governance # compliance mode (default) /ai-governance all # all four modes /ai-governance risk accept # accept a new risk (TTL by severity) /ai-governance integrity # framework consistency check /ai-governance --report # formal report (score + verdict) ``` ## Workflow Compliance validation for regulated industries. Default mode is `compliance`. Pick a mode, run the checks, surface findings; with `--report`, generate a scored audit document. 1. **compliance** — verify quality-gate enforcement (hooks, CI workflows, non-negotiables, security contract). 2. **ownership** — map files to ownership zones (framework / team / project / system); verify modification history. 3. **risk** — record / resolve / renew risk acceptances in `decision-store.json` with severity-based TTL. 4. **integrity** — manifest counters vs disk reality; agent-skill cross-refs; state-file schemas. > Detail: see [the four modes (compliance/ownership/risk/integrity)](references/modes.md), [OPA policy-engine integration](references/policy-engine.md), [`--report` format and scoring](references/formal-report.md). ## When to Use - Governance audit, pre-release check, post-install verification. - NOT for code quality — use `/ai-verify quality`. - NOT for security scanning — use `/ai-security`. Step 0 (load contexts): read `.ai-engineering/manifest.yml` `providers.stacks`; load `.ai-engineering/overrides/<stack>/conventions.md` for each stack and `.ai-engineering/overrides/_shared/conventions.md`; load `.ai-engineering/team/*.md` for team conventions. ## Common Mistakes - Running governance mid-implementation — best between phases or before releases. - Accepting risk without `follow_up_action` — mandatory field. - Exceeding 2 renewals — remediation becomes mandatory. ## Examples ### Example 1 — pre-release compliance report User: "generate a formal compliance report I can hand to auditors" ``` /ai-governance --report ``` Walks the compliance checks, scores against the rubric, emits a Markdown report with findings table, gate status, and verdict (PASS / WARN / FAIL). ### Example 2 — accept a known risk User: "we've reviewed the gitleaks finding and want to accept it for 30 days" ``` /ai-governance risk accept ``` Records a risk-acceptance entry in `decision-store.json` with severity-based TTL, mandatory `follow_up_action`, and an audit trail consumed by pre-push. ## Integration - **Called by**: `/ai-verify` (governance mode delegation). - CLI layer: `ai-eng validate --category <mode>`, `ai-eng doctor`, `ai-eng maintenance risk-status`. The LLM performs checks directly by reading files and running tools; `ai-eng validate` and `ai-eng doctor` are CLI equivalents for non-interactive use. - Risk acceptances block pre-push when expired. - Release gate (`/ai-verify --release`) checks governance status. - **Boundary**: `/ai-pipeline` generates workflow files; `/ai-governance` validates that governance gates are enforced in them. ## Key Files - `.ai-engineering/manifest.yml` — governance non-negotiables and quality thresholds. - `state/decision-store.json` — risk acceptance records (decision records). - `.ai-engineering/reference/risk-acceptance-flow.md` — DEC lineage and risk-acceptance lifecycle. $ARGUMENTS
More from arcasilesgroup/ai-engineering
- ai-adviseProactive governance advisor — checks standards, decisions, and quality trends during development. Always advisory, NEVER blocks. Three modes: `advise` (post-edit), `gate` (pre-dispatch), `drift` (on-demand decision audit). Trigger for 'governance check', 'advise on this change', 'check for drift', 'is this aligned with active decisions', 'shift-left advisory'. Not for blocking gates — use /ai-verify. Not for narrative code review — use /ai-review.
- ai-analyze-permissionsUse when Claude Code keeps asking to approve commands you have already approved, when settings.local.json has grown large, or when you want to consolidate permission grants into wildcard patterns. Trigger for 'too many permission prompts', 'clean up permissions', 'audit my settings', 'consolidate allow rules'. Claude Code only — not available in GitHub Copilot, Antigravity, or Codex.
- ai-animationDesigns motion, transitions, and micro-interactions for UI components: spring animations, gestures, easing, staggers — taste-driven detail compounding. Trigger for 'animate this', 'add transitions', 'micro-interactions for', 'gesture design', 'swipe to dismiss', 'easing for this', 'stagger the'. Not for design systems; use /ai-design instead. Not for visual art; use /ai-visual instead. Not for testing animation code; use /ai-test instead.
- ai-autopilotDelivers large multi-concern specs and backlog runs autonomously: decomposes specs into sub-specs (or normalizes work items into a backlog DAG), deep-plans with parallel agents, builds a dependency DAG, implements in waves, runs a single final quality loop with one bounded quality-remediation pass (verify+guard+review on full changeset), delivers via PR. Trigger for 'implement spec-NNN end to end', 'autopilot this', 'autonomous delivery', 'decompose and ship', 'run the backlog', 'execute these GitHub issues', 'process the sprint backlog'. Invocation is the approval gate. Not for small or single-concern tasks; use /ai-build instead. Not for ambiguous requirements; use /ai-brainstorm first.
- ai-boardOperates the project board (GitHub Projects v2 or Azure DevOps): discovers configuration after install (fields, state mappings, process templates) and syncs work-item state at lifecycle transitions. Trigger for 'set up the board', 'configure our ADO board', 'discover board fields', 'move this issue to in-review', 'update the board', 'mark as in progress', 'sync the work item state'. Two subcommands: `discover` (post-install configuration write) and `sync` (lifecycle state transitions). Auto-invoked via `sync` by /ai-brainstorm, /ai-build, and /ai-pr; fail-open. Not for backlog execution; use /ai-autopilot --backlog instead.
- ai-brainstormForces rigorous design interrogation BEFORE any code: explores approaches, surfaces ambiguity, gathers evidence, produces an approved spec that becomes the contract for /ai-plan. Trigger for 'lets add X', 'how should we handle Y', 'whats the best approach', 'I am thinking about', 'what should we build for'. Not for existing approved specs; use /ai-plan instead. Not for execution; use /ai-build instead.
- ai-branch-cleanupCleans branches safely: switches to the default branch, prunes merged and squash-merged branches, syncs to remote, sweeps stale specs, rotates `.ai-engineering/runtime/` per retention policy. Trigger for 'tidy up', 'tidy branches', 'sync to main', 'delete old branches', 'start fresh', 'rotate runtime'. Auto-invoked by /ai-pr after merge. Not for committing changes; use /ai-commit instead. Not for code-level dead-code removal; use /ai-simplify instead.
- ai-buildCanonical implementation gateway: reads approved plan.md, resolves stack from manifest, deterministic-routes each task to its adapter, dispatches the build agent in an isolated worktree, runs TDD self-validation per task, then a single final quality loop with one bounded quality-remediation pass on the full changeset before /ai-pr. Trigger for 'go', 'start building', 'execute the plan', 'implement it', 'lets do this', 'build the plan', 'resume', 'continue'. Not without an approved plan; run /ai-plan first. Not for multi-concern specs needing decomposition; use /ai-autopilot instead. Not for a single function or subcomponent; use /ai-code.
- ai-codeWrites production code that satisfies stack-context standards on the first pass: interface-first design, backward-compatibility checks, lightweight self-review. Trigger for 'implement this', 'write the code for', 'add X to Y', 'build this function', 'make this work'. Not for tests; use /ai-test instead. Not for debugging; use /ai-debug instead. Not for refactoring; use /ai-simplify instead. Not for executing an approved plan end-to-end; use /ai-build (the gateway).
- ai-commitRuns the governed commit pipeline: auto-branches from protected, stages selectively, formats and lints, scans for secrets, gates docs, composes a conventional message, pushes. Trigger for 'commit my changes', 'save my work', 'push this to remote', 'stage these files', 'ship it'. Not for opening a PR; use /ai-pr instead. Not for branch hygiene; use /ai-branch-cleanup instead.