orchestrator: Skill for Claude Code

.claude/skills/qa-doc-governance/SKILL.md

qa-doc-governance is a skill for Claude Code, Codex from c9r-io/orchestrator. It costs 66 tokens per session (835 once invoked), scanned A, original, MIT.

A process for checking and maintaining the quality of quality-assurance documentation, which describes how software is tested.

In plain words
What is it for?
It helps audit QA documents, classify problems by urgency, fix test-flow and documentation issues, and update related indexes and governance records.
Why use it?
It finds broken test instructions, outdated indexes, excessive scenario lists, and inconsistencies after code or documentation changes.

Skill for Claude CodeCodex

Written for Claude Code and Codex: installed under .claude/, but also agents/openai.yaml present.

This is c9r-io/orchestrator's own configuration. It tells Claude Code and Codex how to work on orchestrator itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything orchestrator configures →

Reuse

Borrowing it

Nothing to install: this file belongs to c9r-io/orchestrator. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/c9r-io/orchestrator/main/.claude/skills/qa-doc-governance/SKILL.md
Clone the repo
git clone --depth 1 https://github.com/c9r-io/orchestrator

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for qa-doc-governance

README.md
[![agentmods](https://agentmods.dev/badge/skills/c9r-io/orchestrator/qa-doc-governance/github.svg)](https://agentmods.dev/skills/c9r-io/orchestrator/qa-doc-governance)
Your own site
<a href="https://agentmods.dev/skills/c9r-io/orchestrator/qa-doc-governance"><img src="https://agentmods.dev/badge/skills/c9r-io/orchestrator/qa-doc-governance/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for qa-doc-governance

Your own site · 80×15
<a href="https://agentmods.dev/skills/c9r-io/orchestrator/qa-doc-governance"><img src="https://agentmods.dev/badge/skills/c9r-io/orchestrator/qa-doc-governance.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 66 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 835 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00066 $0.00835
Opus 5 $0.00033 $0.00417
Sonnet 5 $0.00013 $0.00167
Haiku 4.5 $0.00007 $0.00084

Measured 10d ago against content hash db1c6399c73a, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-10, from the pricing page.

Security

Grade A, and why

qa-doc-governance scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.

The scan reads SKILL.md. This mod also ships 1 executable file (scripts/run-audit.sh), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/skills/qa-doc-governance/SKILL.md · 78 lines

How it starts

The opening of the file, as written. The whole thing — 78 lines — stays where its author put it; the contents beside it link to each section on GitHub.

QA Doc Governance

Run a repeatable governance loop for QA documentation quality, consistency, and discoverability.

Workflow

  1. Baseline audit.
  2. Classify findings by severity and scope.
  3. Apply targeted remediation.
  4. Sync index and governance artifacts.
  5. Validate and publish audit result.

Step 1: Baseline Audit

  1. Run scripts/qa-doc-lint.sh.
  2. Run ./.claude/skills/qa-doc-governance/scripts/run-audit.sh for expanded metrics.
  3. If needed, read references/policy-checklist.md for rule definitions.

Step 2: Classify Findings

Use this priority order:

  1. P0: Broken navigability or unusable test flow. : Examples: missing checklist, impossible auth/session steps, README index drift.
  2. P1: Governance drift. : Examples: too many scenarios in one file, missing UI entry visibility in UI-facing docs.
  3. P2: Style consistency improvements. : Examples: naming alignment, wording normalization.

Step 3: Remediate

Apply these rules in order:

  1. Fix executable correctness first. : Replace non-executable auth/session checks with explicit methods (incognito/private window, clear session cookie, explicit sign-out).
  2. Enforce mock-fixture-only for orchestrator workflows. : QA docs must reference fixtures/manifests/bundles/* mock fixtures (echo agents), never docs/workflow/* (real AI agents). Every doc must include explicit apply -f fixtures/... in preconditions. Standalone scenario stubs must inline precondition commands or cross-reference parent doc. Severity: P0.
  3. Enforce visibility-first UI flows. : UI scenarios start from visible entry points (sidebar, tab, button, quick links), not direct URL.
  4. Enforce scenario cap. : Keep each file <=5 numbered scenarios. Split long files into base/advanced or topic-specific docs.
  5. Keep checklists mandatory. : Every QA doc includes ## Checklist / ## Regression Checklist (or localized equivalent).

Step 4: Sync Governance Artifacts

  1. Update docs/qa/README.md so index matches current docs.
  2. If this repo uses docs/qa/_manifest.yaml, regenerate it with scenario counts and governance flags.
  3. If QA behavior changes affect security/UIUX expectations, add alignment notes to: : docs/security/README.md, docs/uiux/README.md.
  4. Check CHANGELOG.md consistency. : Entries under [Unreleased] have not shipped, so a stale one will publish as a false statement. Verify no unreleased entry describes a mechanism the repo has since removed or replaced, that removals appear under ### Removed, and that user-visible incompatibilities are recorded with the exact diagnostic users will hit. Released sections are historical and stay as written.

Read the full file on GitHub · 78 lines

Files

What ships with it

3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 10d ago First seen · 78 lines · 66 tokens per session scan A db1c6399c73a

Subscribe to this mod's changes

qa-doc-governance is a skill published in the GitHub repository c9r-io/orchestrator (21 stars, last pushed 9d ago), licensed MIT. It adds 66 tokens to every session and 835 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.