Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Xwen0857/agent-orchestrator --skill governance-configgit clone --depth 1 https://github.com/Xwen0857/agent-orchestratorWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/xwen0857/agent-orchestrator/governance-config)<a href="https://agentmods.dev/skills/xwen0857/agent-orchestrator/governance-config"><img src="https://agentmods.dev/badge/skills/xwen0857/agent-orchestrator/governance-config/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/xwen0857/agent-orchestrator/governance-config"><img src="https://agentmods.dev/badge/skills/xwen0857/agent-orchestrator/governance-config.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00028 | $0.01914 |
| Opus 5 | $0.00014 | $0.00957 |
| Sonnet 5 | $0.00006 | $0.00383 |
| Haiku 4.5 | $0.00003 | $0.00191 |
Grade A, and why
governance-config scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 109 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Governance Config
规则
- 未经审批人（默认 master）批准，不得修改 planner 关键配置。
- 每次配置变更必须执行“变更前快照 + 变更后快照”，并使用时间戳命名。
- 维护
current与history：变更成功后更新current指针，并将快照写入历史列表。 - 支持按版本号或时间戳回滚；回滚也必须走审批、审计和通知流程。
- 所有变更必须记录操作人、变更内容、审批结果和执行结果。
- 提供当前配置与历史版本查询能力。
- 支持权限管理，仅授权人员可发起变更、审批、回滚。
- 支持自动化测试/验证，验证失败不得发布为当前版本。
- 检测到未经批准的高危变更时，触发告警并回滚到最近稳定版本。
- 生成配置变更报告（每六小时一次），用于审阅和追踪。
- 运行态
primary.md在STARTED后进入核心字段冻结状态，未经审批不得修改核心字段。 - 运行态
primary.md的冻结变更视为高风险操作，必须关联审批单与审计记录。
高危操作
- 任何未经审批的配置变更。
- 任何未经审批的版本回滚。
- 任何未经审批的越权（break-glass）操作。
- 任何未按规定流程执行的配置变更或回滚。
- 任何未记录审批和审计信息的配置变更或回滚。
- 任何直接导致系统发生安全风险提示的配置变更或回滚。
- 任何未及时通知相关人员的配置变更或回滚。
- 任何未保留完整证据链的配置变更或回滚。
- 任何未与 audit-guard 协同实现审批和回滚的配置变更或回滚。
- 运行态
primary.md在STARTED状态下被直接修改核心字段且无审批记录。
何时使用
- planner 约定或 properties 需要变更。
- 需要保留变更历史和审批记录。
- 需要快速回滚到稳定版本。
- 需要审计变更过程和责任人。
- 需要支持越权（break-glass）操作并保留完整证据。
- 需要与 audit-guard 协同实现高危操作的审批和回滚。
- 需要与 agent-orchestrator 协同实现 planner-worker-tester-audit 流程中的配置管理和版本控制。
- 需要支持多环境（如测试、预生产、生产）的配置管理和版本控制。
- 需要向其他系统提供当前配置和历史版本查询能力。
路径描述
- 入口需求运行文件路径：
$AGENT_ORCHESTRATOR_STATE_DIR/planner/primary.md（默认~/.openclaw-state/agent-orchestrator/planner/primary.md）；示例模板：templates/coordination/planner/primary.example.md。 - 当前配置文件路径：
templates/coordination/planner/config/current.md。 - 历史快照目录路径：
templates/coordination/planner/config/history。 - 配置变更报告目录路径：
templates/coordination/audit/reports。 - 审批单目录路径：
templates/coordination/audit/approvals。
命名示例
- 快照命名格式：
planner-config-YYYYMMDD-HHMMSS.md。 - 快照示例：
planner-config-20240601-120000.md。 - 回滚后新快照示例：
planner-config-20240601-123000.md。 - 报告命名示例：
YYYYMMDD-HH.md。
版本回滚示例
- 当前版本：见“命名示例”中的快照示例。
- 发现问题，回滚到上一个稳定版本（同命名规则）。
- 生成回滚审批单，记录回滚原因和审批人。
- 审批通过后执行回滚，并生成新的快照（同命名规则）。
- 记录回滚操作和结果到审计日志。
配置变更审批示例
- 提交配置变更请求，描述变更内容和理由。
- 生成审批单，通知审批人。
- 审批人审核变更请求，批准或拒绝。
- 根据审批结果执行变更或拒绝变更，并记录审批结果到审计日志。
- 生成新的配置快照，并通知操作人员。
配置变更报告示例
- 每六小时生成一次配置变更报告，包含变更内容、变更人、审批结果、执行结果等信息。
- 报告格式为HTML便于审阅和追踪。
- 报告存储路径见“路径描述”，并提供只读查询和下载功能。
- 报告内容应清晰、详细，便于审阅人员理解变更的背景、过程和结果。
- 报告应包含变更的影响评估和后续跟踪建议，以便审阅人员能够全面评估变更的合理性和潜在风险。
- 报告应与审计日志打通，提供变更的完整证据链，以支持后续的审计和追踪。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 109 lines · 28 tokens per session scan A 210aaf0c5678
governance-config is a skill published in the GitHub repository Xwen0857/agent-orchestrator (2 stars, last pushed 5mo ago), licensed MIT. It adds 28 tokens to every session and 1,914 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
clawteam
Multi-agent swarm coordination via the ClawTeam CLI. Use when the user wants to create agent teams, spawn multiple agents to work in parallel, coordinate tasks with dependencies, broadcast messages between agents, monitor progress via kanban board, or launch pre-built team templates (hedge-fund, code-review…
ClawTeam
This skill should be used when the user asks to "create a team", "spawn agents", "assign tasks", "coordinate multiple agents", "check team status", "view kanban board", "send messages between agents", "manage team tasks", "monitor team progress", or mentions "clawteam", legacy "oh", "multi-agent coordination", "team…
status
A workflow skill that summarizes project status and progress from workflow.json and milestones.json files.
sdd-tasks
Break an SDD change into implementation tasks. Trigger: orchestrator launches task planning for a change.
mission-control
Interact with Mission Control — AI agent orchestration dashboard. Use when registering agents, managing tasks, syncing skills, or querying agent/task status via MC APIs.
task-management
Use before any Worker taskflow call or assigned-task workflow, including reading task state, acknowledging a task, executing a task, tracking progress, handling blockers/questions, submitting structured results, or reporting completion. Always use this skill when the message mentions assigned task, task ID…