dev-traceability
Skill1 starsChanged 10 days agoApache-2.0View on GitHub
Guarantee a traceable path from requirement to merged change - requirement → issue → commit → PR → review → tests, traceability matrix (RTM), definition of done, compliance report aligned with ISO/IEC 27001:2022, ISO 9001, ISO/IEC/IEEE 12207, ITIL 4 and SOC 2. Use for any feature or fix, or to "prépare l'audit", "trace this change", "matrice de traçabilité". Deployment and change records belong to change-management. Not for an isolated code question with nothing to deliver.
In this repository10 other files it gives its agents.
- change-managementSkill
- incident-responseSkill
- issue-lifecycleSkill
- project-boardSkill
- project-trackingSkill
- repo-contextSkill
- repo-hardeningSkill
- secrets-hygieneSkill
- security-auditSkill
- skill-learningSkill
The file
We split this skill into the rules it gives an agent
1 rule. About 0 are common, 0 are distinctive, and 1 is very specific to this project.
≈0
Common · estimate
Many files like this have a rule of this kind.
≈0
Distinctive · estimate
This author's own choices. Worth a look.
1
Very specific
Tied to their project's names, files or tools. Probably skip.
- Common
- Distinctive
- Very specific
- Very specific: line 34
Before the PR: Run references/definition-of-done.md.
≈ “Common” is an estimate: at least 1 in 5 of the 350,495 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.
Files
Traceable development
Goal: every change can be explained and proven, from requirement to merge, without asking anyone. This skill produces evidence and applies controls mapped in references/standards-mapping.md. It certifies nothing: certification belongs to an accredited body; say so in any report meant for an auditor.
The project's own branch and PR flow (CLAUDE.md, CONTRIBUTING, repo-context notes) is authoritative. Never commit or push without the user's request.
Context
REPO=$(${CLAUDE_SKILL_DIR}/../repo-context/ctx.py repo) # --repo "$REPO" on every gh callAdapt controls to ctx.py resolve → kind: a solo personal account cannot satisfy "reviewer different from author" and needs a documented exception; a public repository gets stricter masking. Published text follows ctx.py lang (unset: stop and ask the user to confirm it, never default); commit messages follow ctx.py lang --commit (default English).
The chain (a missing link is a finding)
| # | Link | Expected evidence |
| 1 | Requirement | stable identifier (REQ-…, SEC-…) |
| 2 | Issue | purpose, acceptance criteria, risk, priority; in the Project and under an epic (project-tracking) |
| 3 | Branch and commits | Conventional Commits in English, Refs #<n> |
| 4 | Pull request | template filled: changes, risks, tests, rollback |
| 5 | Review | a reviewer different from the author; security review in sensitive areas |
| 6 | Tests | targeted results + CI run link; a test that failed before and passes after |
| 7 to 9 | Change, verification, closure | change-management and issue-lifecycle |
Flow
Start. Identify the requirement and the issue; none: propose issue-lifecycle. No change without an issue except an emergency fix (change-management). Check docs/traceability/ and the PR template exist, else offer references/project-init.md.
During. TDD or at least one targeted test per changed behaviour. Atomic commits with Refs #<n>; ${CLAUDE_SKILL_DIR}/check-refs.sh <base>..<head> lists commits without a reference. With the plugin installed, a hook denies git commit -m without Refs #<n> in repositories that adopted tracking; a documented exception is a No-Issue: <reason> line. No secret or personal data. Tell the user about any new dependency and record it in the PR.
Before the PR. Run references/definition-of-done.md; independent review with the reviewer agent (and /security-review in sensitive areas), each finding fixed or dismissed with the reason; update docs/traceability/RTM.md (requirement ↔ issue ↔ PR ↔ test).
Audit. Control table and indicators: references/compliance-report.md.
Platform controls (branch protection, secret scanning, CODEOWNERS, templates): repo-hardening.
Never
Skip links 2 to 6 outside emergencies; self-approve; fabricate or backdate evidence; present a "documented" control as "applied"; put sensitive data in evidence.
End of task
Log the run: ${CLAUDE_SKILL_DIR}/../skill-learning/learn.py log dev-traceability ok|partial|failed [--note …] [--correction …].
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.