Borrowing it
Nothing to install: this file belongs to ccbud/CCBuddy. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/ccbud/CCBuddy/main/.agents/skills/architecture-governance/SKILL.mdgit clone --depth 1 https://github.com/ccbud/CCBuddyWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ccbud/ccbuddy/architecture-governance)<a href="https://agentmods.dev/skills/ccbud/ccbuddy/architecture-governance"><img src="https://agentmods.dev/badge/skills/ccbud/ccbuddy/architecture-governance/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/ccbud/ccbuddy/architecture-governance"><img src="https://agentmods.dev/badge/skills/ccbud/ccbuddy/architecture-governance.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00045 | $0.01000 |
| Opus 5.5 | $0.00018 | $0.00400 |
| Sonnet 5 | $0.00009 | $0.00200 |
| Haiku 4.5 | $0.00005 | $0.00100 |
Grade A, and why
architecture-governance scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 51 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Architecture governance
Use this skill before editing code in the CCbuddy repository. It is a design guide as well as a gate: the goal is to make the intended architecture obvious before code is generated, so the checker confirms a decision instead of discovering it for the first time.
Before writing code
- Identify changed files and their modules with
pnpm architecture:check --changed. - Run
pnpm architecture:context <module-id>(or the reusable wrappernode .agents/skills/architecture-governance/scripts/context-package.mjs <module-id>). Read the target contract, directly referenced contracts, and any existing relevant spec and tests before opening broad implementation files. Do not assume a documentation or test path exists; verify it in the checkout. - Write or update the spec before implementation; create its directory when needed. State the behavior, ownership, invariants, failure semantics, and migration boundary in the spec.
- Make a short design decision before coding:
- One owner: name the single component that owns each piece of mutable state. Other layers read through its contract and send commands; they do not keep a second accepted queue, cache, or derived truth.
- One path: reuse an existing command, service, hook, adapter, or contract when it already expresses the behavior. Do not create a parallel helper for the same responsibility.
- Explicit boundaries: choose the layer for every new file and the public contract for every cross-module edge. Use the module's declared
layersandlayerOrder; a file may import only its own layer or lower ones through their public surface.domainis pure (no IO, noawaiton the world),appdecides side effects through ports,adaptersexecutes them,uidepends only on this module'scontract.ts. Quick test: needsawait? not domain. Knows it is sqlite / MessagePort / a timer? adapters. - Explicit time: for asynchronous or remote behavior, write the event order, owner/lease, idempotency key, stale-result rule, replay/resume boundary, and desktop versus mobile delivery kind before implementation.
- Bounded context: prefer the generated reading package over copying whole implementations into the prompt. Read more only when a contract or test proves it is necessary.
- If the change crosses modules or changes state ownership, include the decision in the spec and add or update the module contract before implementation.
What ships with it
11 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- agents/openai.yaml 321 B
- references/ai-guidance.md 2.6 KB
- references/golden-module/contract.example.ts 141 B runs code
- references/golden-module/CONTRACT.md 164 B
- references/golden-module/contract.ts 57 B runs code
- references/golden-module/module.ts 141 B runs code
- references/module-contract.md 471 B
- references/policy-schema.md 847 B
- references/rule-catalog.md 2.9 KB
- references/troubleshooting.md 1.1 KB
- scripts/context-package.mjs 718 B runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 51 lines · 45 tokens per session scan A f21e9ca87a26
architecture-governance is a skill published in the GitHub repository ccbud/CCBuddy (8 stars, last pushed yesterday), licensed Apache-2.0. It adds 45 tokens to every session and 1,000 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-25.
Other skills, from other repositories
context-canvas-reflection
Run one bounded trajectory reflection when repeated same-cause failures, contradicted assumptions, real-use failure after local green, material scope drift, a materially unresolved phase boundary, an unapproved authority-sensitive next effect, or user doubt suggests the current path may be wrong. Use Context Canvas…
context-canvas-checkpoint
Maintain an optional session task map and explicit retrievable references in Context Canvas Codex. Use when navigation or long-context offload would materially help with goals, decisions, progress, dependencies, blockers, next steps, exploration summaries, large textual tool results, or selective historical…
operate-a2a-superhub
Operate and diagnose the A2A Superhub product across its CLI, HTTP, and declared MCP/A2A surfaces. Use when the user explicitly asks to inspect a Superhub, create or read Superhub tasks or artifacts, work with Superhub memory/inbox/wakeup/handoffs, validate this product skill, diagnose auth/index/queue/capability…
requesting-code-review
Pre-commit review: security scan, quality gates, auto-fix.
gh-issues
Fetch GitHub issues, spawn sub-agents to implement fixes and open PRs, then monitor and address PR review comments. Usage: /gh-issues [owner/repo] [--label bug] [--limit 5] [--milestone v1.0] [--assignee @me] [--fork user/repo] [--watch] [--interval 5] [--reviews-only] [--cron] [--dry-run] [--model glm-5]…
example
Example fixture skill for scanner regression coverage.