Nw RigorSAFE
AI agents that guide you from idea to working code, with you in control at every step.
Overview
AI agents that guide you from idea to working code, with you in control at every step.
1a864ec81cdeOBSERVED · 2026-10-14What it tells the agent
The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.
--- name: nw-rigor description: "Selects a quality-vs-token-consumption profile (lean, standard, thorough, exhaustive, custom, inherit) and persists it globally (~/.nwave/global-config.json) or per-project (.nwave/des-config.json). Use when tuning how much rigor wave commands apply." user-invocable: false argument-hint: '[profile] - Optional: lean, standard, thorough, exhaustive, custom, inherit. Omit for interactive selection.' --- # NW-RIGOR: Quality Profile Selection **Wave**: CROSS_WAVE | **Agent**: Main Instance (self) | **Command**: `/nw-rigor [profile]` ## Overview Interactive command to select a quality-vs-token-consumption profile. Persists choice to either `~/.nwave/global-config.json` (global scope) or `.nwave/des-config.json` (project scope) under the `rigor` key. All wave commands read this config to adjust agent models, review policy, TDD phases, and mutation testing. You (the main Claude instance) run this directly. No subagent delegation. **Note on TDD phase canons (dual-canon, ADR-025, 2026-05-07)**: the canonical TDD cycle is **3-phase v5** (`RED, GREEN, COMMIT`) as described in `nw-tdd-methodology`. The **legacy 5-phase v4** (`PREPARE, RED_ACCEPTANCE, RED_UNIT, GREEN, COMMIT`) is preserved for backward-compat audit-log replay of pre-2026-05-07 commits. The `.nwave/des-config.json` `tdd_phases` field accepts BOTH canons: writers of new logs may emit v5; the validator + schema (`step-tdd-cycle-schema.json`) dispatch on `schema_version` (`"5.0"` → canonical, anything else → legacy). The profile table below shows both canons side-by-side: pick v5 for new features, keep v4 only when extending a feature whose audit log was started under the legacy canon. ## Profile Mappings (Single Source of Truth) | Setting | lean | standard [recommended] | thorough | exhaustive | inherit | |--------------------|---------------------------------------|------------------------------------------------------------------------------|------------------------------------------------------------------------------|------------------------------------------------------------------------------|------------------------------------------------------------------------------| | agent_model | haiku | sonnet | opus | opus | inherit | | reviewer_model | skip | haiku | sonnet | opus | haiku | | review_enabled | false | true | true | true | true | | double_review | false | false | true | true | false | | tdd_phases (v5 canonical, ADR-025) | [RED, GREEN] | [RED, GREEN, COMMIT] | [RED, GREEN, COMMIT] | [RED, GREEN, COMMIT] | [RED, GREEN, COMMIT] | | tdd_phases (v4 legacy, audit-replay) | [RED_UNIT, GREEN] | [PREPARE, RED_ACCEPTANCE, RED_UNIT, GREEN, COMMIT] | [PREPARE, RED_ACCEPTANCE, RED_UNIT, GREEN, COMMIT] | [PREPARE, RED_ACCEPTANCE, RED_UNIT, GREEN, COMMIT] | [PREPARE, RED_ACCEPTANCE, RED_UNIT, GREEN, COMMIT] | | refactor_pass | false | true | true | true | true | | mutation_enabled | false | false | false | true | false | ## Behavior Flow ### Mode Detection - No argument -> Mode 1 (Interactive Selection) - Argument is a preset name (lean, standard, thorough, exhaustive, inherit) -> Mode 2 (Quick Switch) - Argument is `custom` -> Mode 3 (Custom Builder) ### Mode 1: Interactive Selection (no argument) #### Step 1: Welcome Read `.nwave/des-config.json`. If missing or `.nwave/` directory absent -> error: "No nWave config directory foun
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | NA |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (0)
No findings outside the package's declared scope.
Gates applied: no_behavioural_pass.
1a864ec81cdefull audit observations/trust-audit/skill/nwave-ai__nw-rigor.json · Report an issue / request a re-scanAudit history
Every audit this skill has had.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-14 | 1a864ec81cde | SAFE | B | 89 | first audit |
Questions
What does the Nw Rigor skill do?
AI agents that guide you from idea to working code, with you in control at every step.
Is Nw Rigor safe to install?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean skill reads B.
What can Nw Rigor access on my machine?
The audit observed no filesystem, network or shell use at all in its source.
How current is this page?
The grade is for one exact copy of the source (1a864ec81cde), read on 2026-10-14. The repository is watched, and a new audit runs when it changes — this is the first audit.