Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/sistema2d/framecode-vibework/governance-validatornpx skills add Sistema2D/FrameCode-VibeWork --skill governance-validatorgit clone --depth 1 https://github.com/Sistema2D/FrameCode-VibeWorkWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sistema2d/framecode-vibework/governance-validator)<a href="https://agentmods.dev/skills/sistema2d/framecode-vibework/governance-validator"><img src="https://agentmods.dev/badge/skills/sistema2d/framecode-vibework/governance-validator.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00021 | $0.00567 |
| Opus 5 | $0.00010 | $0.00283 |
| Sonnet 5 | $0.00004 | $0.00113 |
| Haiku 4.5 | $0.00002 | $0.00057 |
Grade A, and why
governance-validator scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 85 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Governance validator
Purpose
Evaluate the human-readable FCVW invariants. The optional script automates deterministic checks; this skill owns interpretation and remediation decisions.
Profiles
clean-template: project-profile placeholders are allowed; application histories and contamination are forbidden.instantiated: required project profiles must be complete.incremental: new violations fail; exact legacy baseline findings are reported but do not block.strict: all applicable findings block.
Inputs
SCHEMAS.md,OWNERSHIP.md,FRAMEWORK_LOCK.md;- physical filesystem;
- active plan and target release;
- optional legacy baseline.
Checks
- Canonical files and ownership metadata.
- Plan status/directory coherence and unique IDs.
- Skill metadata, catalog coverage, and provider-neutral core instructions.
- Framework/application version namespace separation.
- Markdown links and fence balance.
- Wiki IDs, schema, index, freshness, and archive rules.
- Placeholder policy by profile.
- Clean-template contamination.
- Framework lock, release record, and migration coherence.
FILESYSTEM.mdcanonical path/glob coverage.- Operational-index and reading-route coverage for every root framework policy, project profile, and declared skill session type.
Optional execution
Installed release:
python FCVW/tools/validate_fcvw.py --root . --profile <profile>
Framework source checkout:
python tools/validate_fcvw.py --root . --profile <profile>
For controlled legacy debt:
Use the matching installed/source tool prefix with --profile incremental --baseline path/to/legacy-baseline.md.
Scripts do not auto-correct historical evidence. Review every proposed remediation and keep the report attached to the active plan or release.
Non-responsibilities
- application runtime tests;
- legal approval;
- destructive cleanup without a plan;
- hiding legacy findings.
Required output
List command/profile, passed checks, new failures, reading-route gaps, baseline findings, corrections, and residual risk.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 85 lines · 21 tokens per session scan A ca28e6dec2c2
governance-validator is a skill published in the GitHub repository Sistema2D/FrameCode-VibeWork (23 stars, last pushed 4d ago), licensed Apache-2.0. It adds 21 tokens to every session and 567 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
evaluate-pattern-adoption
Run or plan this repository's pattern-adoption evidence evaluation locally with signed-in Codex agents. Use when asked to refresh stale evidence, assess stable or exploratory patterns, evaluate one or all catalog patterns, discover possible new patterns, or prepare a reviewable evidence PR without model-backed GitHub…
Compliance Checker
Check regulatory compliance across finance, tax, employment, data privacy, and industry-specific requirements.
traceability-gate
Enforces parent-link lineage across requirement layers.
wendao
Internal guardian skill for creating and editing Wendao DocOS documentation.
Advisory Board Builder
Recruit, structure, and manage advisory boards for strategic guidance.
Board Meeting Prep
Prepare board meeting decks, updates, and materials for effective governance.