CCBuddy: Skill for Codex

.agents/skills/architecture-governance/SKILL.md

architecture-governance is a skill for Codex from ccbud/CCBuddy. It costs 31 tokens per session (999 once invoked), scanned A, original, Apache-2.0.

A code-change planning and checking skill that applies a repository's architecture rules before implementation. Architecture rules describe which parts of a codebase may depend on one another and where behavior should live.

In plain words
What is it for?
Use it to create a focused design package, inspect related contracts and tests, update specifications, check changed files, and report violations against the existing baseline.
Why use it?
It helps prevent code from crossing module or layer boundaries unexpectedly and makes ownership, behavior, and migration decisions explicit before editing files.

Skill for Codex

Written for Codex: agents/openai.yaml present. Also seen: installed under .agents/ (shared by several agents); mentions AGENTS.md.

This is ccbud/CCBuddy's own configuration. It tells Codex how to work on CCBuddy itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything CCBuddy configures →

Reuse

Borrowing it

Nothing to install: this file belongs to ccbud/CCBuddy. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/ccbud/CCBuddy/main/.agents/skills/architecture-governance/SKILL.md
Clone the repo
git clone --depth 1 https://github.com/ccbud/CCBuddy

Made for: Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for architecture-governance

README.md
[![agentmods](https://agentmods.dev/badge/skills/ccbud/ccbuddy/architecture-governance/github.svg)](https://agentmods.dev/skills/ccbud/ccbuddy/architecture-governance)
Your own site
<a href="https://agentmods.dev/skills/ccbud/ccbuddy/architecture-governance"><img src="https://agentmods.dev/badge/skills/ccbud/ccbuddy/architecture-governance/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for architecture-governance

Your own site · 80×15
<a href="https://agentmods.dev/skills/ccbud/ccbuddy/architecture-governance"><img src="https://agentmods.dev/badge/skills/ccbud/ccbuddy/architecture-governance.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 31 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 999 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00031 $0.00999
Opus 5.5 $0.00012 $0.00400
Sonnet 5.5 $0.00006 $0.00200
Haiku 4.5 $0.00003 $0.00100

Measured 28d ago against content hash 23d55253b245, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

architecture-governance scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 28d ago.

The scan reads SKILL.md. This mod also ships 4 executable files (references/golden-module/contract.example.ts, references/golden-module/contract.ts, references/golden-module/module.ts, …), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.agents/skills/architecture-governance/SKILL.md · 49 lines

How it starts

The opening of the file, as written. The whole thing — 49 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Architecture governance

Use this skill before editing code in the CCbuddy repository. It is a design guide as well as a gate: the goal is to make the intended architecture obvious before code is generated, so the checker confirms a decision instead of discovering it for the first time.

Before writing code

  1. Identify intended files and modules from the task, contracts, and existing tests. Run pnpm architecture:check --changed for the current baseline; a clean diff does not identify files you have not edited yet.
  2. For cross-module changes, state ownership changes, or an unclear contract, run pnpm architecture:context <module-id> (or node .agents/skills/architecture-governance/scripts/context-package.mjs <module-id>). For a local change with a known contract, read only the relevant contract, spec, and affected tests; expand when a concrete dependency or evidence gap requires it.
  3. Apply the spec and regression-evidence rules in AGENTS.md. New behavior needs a spec before implementation; restoring already specified behavior needs regression evidence, not a duplicate feature document. Pure refactors update docs only when contracts change.
  4. For changes to mutable state, asynchronous behavior, or module boundaries, make the relevant design decisions before coding:
    • One owner: name the single component that owns each piece of mutable state. Other layers read through its contract and send commands; they do not keep a second accepted queue, cache, or derived truth.
    • One path: reuse an existing command, service, hook, adapter, or contract when it already expresses the behavior. Do not create a parallel helper for the same responsibility.
    • Explicit boundaries: choose the layer for every new file and the public contract for every cross-module edge. Keep ui → hooks/services → app → domain → adapters and keep IO out of domain.
    • Explicit time: for asynchronous or remote behavior, write the event order, owner/lease, idempotency key, stale-result rule, replay/resume boundary, and desktop versus Web/SSH delivery kind before implementation.
    • Bounded context: use the relevant contracts, specs, and tests. A generated reading package helps when dependencies are unclear; do not require a whole-module reading pass for every local edit.
  5. If the change alters a public contract, ownership, or allowed dependency, record that decision in the relevant spec/contract before implementation. Editing files in two modules alone does not require a new document. Use the root task boundary for when to consult the user; ordinary authorized implementation choices proceed autonomously.

Read the full file on GitHub · 49 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 28d ago Changed · -2 lines · -14 tokens per session 23d55253b245
  2. 1mo ago First seen · 51 lines · 45 tokens per session scan A f21e9ca87a26

Subscribe to this mod's changes

architecture-governance is a skill published in the GitHub repository ccbud/CCBuddy (8 stars, last pushed 2d ago), licensed Apache-2.0. It adds 31 tokens to every session and 999 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-25.

Related

architecture-governance compared with skills from other repositories

architecture-governance next to 6 skills from other repositories
ModTypeStarsLast pushLicenceScanTokensWorks with
architecture-governanceccbud/CCBuddySkill82d agoApache-2.0A31Codex
context-canvas-reflectionphenomenoner/Chatgpt-Codex-App-PlusSkill216d agoMITA99Codex
context-canvas-checkpointphenomenoner/Chatgpt-Codex-App-PlusSkill216d agoMITA88Claude Code, Codex
operate-a2a-superhubphenomenoner/Chatgpt-Codex-App-PlusSkill216d agoMITA132Codex
requesting-code-reviewNousResearch/hermes-agentSkill263ktodayMITA20Claude Code, Codex
gh-issuesspinabot/brigadeSkill11k2d agoMITA116Claude Code
pr-description-writermohitagw15856/pm-claude-skillsSkill1.5ktodayMITA80Claude Code, Codex