forge-repo-intelligence

id	repo-intelligence
name	FORGE-repo-intelligence
version	1.0.0
description	Controller skill for repository intelligence across the arifOS Federation. Exposes 9 modes (inventory, map, delta, pr_review, ci_diagnose, issue_triage, security, cross_repo_impact, release_audit) and orchestrates existing GitHub micro-skills rather than duplicating their logic. Every mode outputs a minimum evidence envelope with repo, ref, commit_sha, working_tree, tag_delta, changed_files, critical_paths, tests, ci, security, contract_impacts, runtime_probe, risk_tier, proposed_action, rollback, evidence_class, and unknowns.
owner	AAA
risk_tier	medium
knowledge_basis	{"language":true,"math":false,"physics":false}
host_compatibility	["claude-code","codex","opencode","kimi","kimi-code","copilot-cli"]
dependencies	{"skills":["FORGE-pr-review","FORGE-pr-governance","FORGE-ci-diagnose","FORGE-issue-triage","FORGE-github-ops","aaa-agent-invariants","code-wiki","parallel-authority-detection","secret-safety-scan"],"servers":["a-forge","github-official"],"tools":["forge_worktree","forge_git_status","forge_git_diff","forge_git_log","forge_filesystem_read","forge_filesystem_grep","forge_github_search","forge_github_get_file"]}
examples	["Audit all 7 federation repos for tag-vs-main drift","Cross-repo impact analysis for a contract change",{"Full release audit":"tag, commit, CI, artifact, runtime parity"},{"PR review with efficient diff pattern":"metadata → filenames → critical files → patches"}]
tests	["inventory mode returns all 7 repos with branch, tag, commit, dirty state","release_audit mode detects tag-vs-main divergence","pr_review mode uses efficient diff pattern (filenames first, then critical patches)","cross_repo_impact mode detects contract changes across organ boundaries","security mode scans workflows for unpinned actions and missing permissions"]
version_lock	{"schema_version":"1","artifact_hash":"pending"}
orthogonal_tags	{"trinitarian":["Ω","Ψ"],"functional":["Meta","Ops","Audit"],"layer":"CODING/FI","autonomy_tier":"T1"}
floor_scope	["F1","F2","F11"]

FORGE-repo-intelligence — Controller Skill

One controller. Nine modes. No duplicate logic. This skill orchestrates existing GitHub micro-skills; it does not re-implement them. Every mode produces the minimum evidence envelope defined below.

Operating Loop

OBSERVE → MAP → DIFF → VERIFY → REVIEW → (JUDGE) → (ACT) → RE-PROBE → RECEIPT

Parenthesized stages (JUDGE, ACT) require mutation authority and are gated.

Minimum Evidence Envelope

Every mode output must include:

repo:
ref:
commit_sha:
working_tree:
tag_delta:
changed_files:
critical_paths:
tests:
ci:
security:
contract_impacts:
runtime_probe:
risk_tier:
proposed_action:
rollback:
evidence_class:
unknowns:

Use UNMEASURED for any field where the probe failed — never substitute 0, clean, or healthy.

---

Modes

inventory — Repository census

Orchestrates: FORGE-github-ops

scope: all 7 federation repos
output:
  - repo name, remote, default branch
  - current branch, HEAD SHA, tag list
  - working tree dirty/clean
  - ahead/behind origin
  - collaborator permissions

Tool path: forge_worktree per repo → forge_git_status → forge_git_log → GitHub API for permissions.

map — Architecture and critical paths

Orchestrates: code-wiki, aaa-agent-invariants

output:
  - entry points, build commands, test runners
  - contract files (schemas, registries, manifests)
  - ownership (CODEOWNERS, organ responsibility)
  - generated vs hand-maintained files
  - critical paths that gate deployment

delta — Ref comparison

Orchestrates: FORGE-github-ops

input: base_ref, head_ref (branches, tags, or commits)
output:
  - commit diff (count, authors, files changed)
  - tag-vs-main drift detection
  - deployed-vs-source comparison
  - surface/manifest parity (tools/list vs tool_registry.json)

Never equate "clean" with "correct." A clean tree proves only no local changes.

pr_review — Efficient diff review

Orchestrates: FORGE-pr-review, FORGE-pr-governance, secret-safety-scan

Efficient pattern (DO NOT load 20,000-line diffs first):

1. PR metadata (title, author, base/head, labels)
2. Changed filenames only → list_pr_changed_filenames
3. Identify critical files (contracts, schemas, registries, workflows, constitution)
4. Fetch only critical file patches → fetch_pr_file_patch
5. Inspect review threads → list_pull_request_review_threads
6. Inspect CI status → fetch_commit_workflow_runs
7. Produce risk verdict

Risk classification:

• LOW: docs, comments, non-critical config
• MEDIUM: source changes in single organ, no contract impact
• HIGH: contract/schema/registry changes, cross-repo impact
• CRITICAL: constitutional, deployment, or secret-adjacent

ci_diagnose — Workflow analysis

Orchestrates: FORGE-ci-diagnose

input: repo, commit SHA or PR number
output:
  - workflow runs for commit
  - job-level pass/fail breakdown
  - step-level failure extraction
  - log analysis for root cause
  - classification: flake | dependency | regression | config | security

Truth gate: Never label a diagnostic-survival job as "passed." If lint fails but continue-on-error keeps the workflow green, report the truth.

issue_triage — Issue intelligence

Orchestrates: FORGE-issue-triage

input: repo, query filters
output:
  - deduplicated issue list
  - severity classification
  - routing (which organ, which agent)
  - linked PRs and cross-references

security — Supply-chain and secret audit

Orchestrates: secret-safety-scan, parallel-authority-detection

checks:
  - unpinned actions (movable tags → require SHA pinning)
  - least-privilege permissions (permissions: {} declared)
  - concurrency cancellation
  - OIDC vs long-lived credentials
  - artifact attestations
  - CODEOWNERS coverage for constitutional/registry/schema/deployment files
  - secret patterns in source

cross_repo_impact — Federation boundary detection

Orchestrates: code-wiki, FORGE-pr-review

input: changed files or PR
output:
  - which organs are affected
  - contract/schema/registry changes
  - breaking vs additive changes
  - required witness count per blast radius
  - organ attestation impacts

release_audit — Tag, commit, CI, artifact, runtime parity

Orchestrates: federation-release-attestation

output (per repo):
  - tag → commit SHA
  - commit → CI run status
  - CI → artifact hash
  - artifact → deployed commit
  - deployed → runtime health probe
  - tools/list match against registry

federation manifest:
  release: "vYYYY.MM.DD-AAA"
  repos:
    arifOS:    { commit, ci, artifact, runtime }
    A-FORGE:   { commit, ci, artifact, runtime }
    AAA:       { commit, ci, artifact, runtime }
    GEOX:      { commit, ci, artifact, runtime }
    WEALTH:    { commit, ci, artifact, runtime }
    WELL:      { commit, ci, artifact, runtime }
    arif-sites:{ commit, ci, artifact, runtime }

Tag discipline: Never silently move a published federation tag. Treat tags as immutable receipts. If a tag is behind main, issue a new corrected tag rather than overwriting.

---

Tool Routing

Intelligence Task	GitHub Tools	A-FORGE Tools
Repository inventory	search_repositories, get_file_contents	forge_worktree, forge_git_status
Code discovery	search_code, get_file_contents	forge_filesystem_read, forge_filesystem_grep
History comparison	get_commit, list_commits	forge_git_log, forge_git_diff
PR discovery	search_pull_requests, pull_request_read	forge_github_search
Efficient diff	pull_request_read(method=get_files) → patch	—
CI diagnosis	list_commits → workflow runs	forge_log_tail
Issue intelligence	search_issues, issue_read	—
Build evidence	get_commit → status/check runs	—

Mutation lane (requires change control): create_branch, create_or_update_file, create_pull_request, create_issue, pull_request_review_write, merge_pull_request, tag creation.

Default mutation pattern:

worktree → bounded branch → path-specific staging → tests → commit
→ draft PR → independent review → required checks
→ human/kernel authority → merge → post-merge verification

No agent should author, approve, and merge the same consequential change.

---

Registry Repair Note

This skill replaces several overlapping GitHub micro-skills. The registry must:

1. Generate from active skill directories only — never resolve a retired path as active.
2. github-runbook (in _retired/ARCHIVE-github-runbook/) must be removed from active registry.
3. FORGE-pr-governance dependency on github-runbook must be updated to FORGE-repo-intelligence.
4. Version drift (ci-diagnose 1.0.0→1.1.0, issue-triage 1.0.0→1.1.0, pr-review 1.0.0→1.1.0) must be resolved in registry.

---

DITEMPA BUKAN DIBERI — Forged, Not Given.