Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/seekers2001/docs-governance/module-regressionnpx skills add Seekers2001/docs-governance --skill module-regressiongit clone --depth 1 https://github.com/Seekers2001/docs-governanceWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00147 | $0.01812 |
| Opus 5 | $0.00073 | $0.00906 |
| Sonnet 5 | $0.00029 | $0.00362 |
| Haiku 4.5 | $0.00015 | $0.00181 |
Grade A, and why
module-regression scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 79 lines — stays where its author put it; the contents beside it link to each section on GitHub.
模块回归台账(module-regression)
治什么病
大项目里模块互相引用。改模块 A 时,AI 和人都只盯着 A 本身对不对,下游的 B、C 被悄悄改坏了没人知道——直到几天后 B 的产出数字对不上才发现。这是 AI 协作大项目里最高发、最晚爆雷的事故。
解法:一份回归台账(REGRESSION.md)+ 一个照单审计动作——改完任何模块,按台账把受牵连的下游全部验一遍,全绿才算改完。
台账三要素(每个模块一段,缺一不可)
## 模块 03-店铺数据清洗
下游(谁依赖我):05-汇总、07-成品导出 <!-- 脚本从 import 生成,勿手改 -->
回归验收命令:pytest tests/test_03.py && python scripts/对账.py --module 03
联动规则:改我的对外行为 → 必须跑 05、07 的验收命令;只改内部实现且本模块验收绿 → 可豁免下游
- 下游消费者——脚本从 import/调用关系生成,禁止手写。手写的依赖清单必然腐烂(变动最频繁、没人记得同步),生成的永远反映真实代码。
- 回归验收命令——台账的核心资产:每个模块一条"怎么证明我没坏"的可执行命令(pytest / 对账脚本 / golden sample diff)。没有这行,审计退化成"AI 看一眼说没问题"(把裁判权交给被告);有这行,判决就是退出码。
- 联动规则——改我 → 谁必须被验证;什么情况可豁免。
与 TESTS.md 的连接
REGRESSION.md 不再维护业务规则和测试缺口。它只引用 TESTS.md 中稳定的 TEST-ID:
关联测试点:TEST-ORDER-001、TEST-REFUND-003
- 哪些规则必须被保护、测试处于什么状态、证据在哪:由
test-collaborationskill 和TESTS.md管理。 - 改了某模块后要重跑哪些模块、执行哪条命令:由本 skill 和
REGRESSION.md管理。 /regression-audit只按回归台账执行命令和报告退出码,不重复审查测试必要性。
台账纪律
- 验收命令优先"对账型"而非"断言型":锚外部事实(golden sample / 上游合计 / 财务勾稽),"测试全过"能被钻(改松断言、注水 mock),"和基准差异 < 0.01"钻不了。
- 下游列表只由重扫刷新:加了新 import → 重跑生成脚本,不许手补一行了事。
- 台账放项目根或
docs/,从CLAUDE.md挂指路牌(否则成孤儿文档没人读必烂)。
审计流程(每次改完照做)
Claude Code 可通过 /regression-audit 调用 regression-auditor;Codex / ChatGPT 直接调用 $module-regression,由当前 agent 承担同一“只跑、只报、不修”职责。宿主不同不改变退出码终审和红着不交付的边界。
- 列改动:
git status -s/git diff --name-only,对照台账定位改的是哪个(些)模块。 - 查联动:台账告诉你下游是谁。
- 跑回归:本模块验收命令 + 所有下游模块的验收命令,逐个跑,记录每条的退出码。
- 退出码终审:全绿 = 没牵连,可交付;任何一条红 = 改动波及下游,修完从第 3 步重跑,不许带红交付。
- 红了怎么归因(控制变量,不靠猜):基线全绿 + 本次只改了 A + B 红 → 错误必然由 A 引入,顺着 B 验收命令的输出(对账差异行 / assert 信息)反查 A 碰到的交接字段。若 B 在改动前就红 = B 的旧债,不赖本次改动,标台账缺口另行处理。改动批次越小归因越准——一次改 5 个模块再跑,红了就说不清谁干的。台账应记「上次全绿的 commit」,保证归因有干净基线。
- 出审计摘要:改了哪个模块 / 跑了谁的回归 / 各自结果(命令 + 关键输出行)/ 豁免了谁及理由。
铁律(四条,违反任何一条审计无效)
- 判决 = 退出码,不是"看着没问题"。没有可执行验收命令的模块 = 台账缺口,先补命令再审计。
- 审计员只报不修:跑回归、报红绿;红了怎么修是改动者(主会话/人)的事——裁判不能下场踢球。
- 红着不准交付:下游红 = 本次改动没完成,没有"下游的问题以后再说"。
- 坑必下沉:每修一个 bug,必须在
TESTS.md新增或关联 TEST-ID,写清回归测试 / lint / schema 校验落在哪;确实只能人工验收时写明理由、步骤和证据。只改代码不登记保护证据 = 没修完。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 79 lines · 147 tokens per session scan A af4afdfcde04
module-regression is a skill published in the GitHub repository Seekers2001/docs-governance (11 stars, last pushed 20d ago), licensed MIT. It adds 147 tokens to every session and 1,812 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
brainstorming
You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation.
chat-pet-sprite-creation
Use when creating or changing VS Code chat pet sprite art, sprite sheets, state animations, eye treatments, Stable/Insiders variants, or pet transitions under src/vs/workbench/contrib/chat/browser/widget/media/chatPet.
cpu-profile-analysis
Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…
agent-host-chat-contributions
Build and review cross-cutting agent-host chat behavior through lifecycle contributions. Use when adding turn lifecycle side effects, prompt or context injection, restored-history transformation, protocol-action observation, or when reviewing changes that add code to AgentSideEffects or AgentService.
auto-perf-optimize
Run agent-driven VS Code performance or memory investigations. Use when asked to launch Code OSS, automate a VS Code scenario, run the Chat memory smoke runner, capture renderer heap snapshots, take workflow screenshots, compare run summaries, or drive a repeatable scenario before heap-snapshot analysis.