passioncodeSAFE

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

npx @passioncode-ai/passioncode@latest update

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: working-in-passioncode
description: >-
  Use when working in any passioncode-ai repository — "work on a PassionCode repo", "open a PR
  in passioncode-ai", "release", "tag a version", "which repo owns this", "bump the contract
  pin", "publish this to the public repo", "what license do we use", «работаю в репозитории
  PassionCode», «как тут принято», «где записать решение», «как выпустить релиз». Covers the org
  map, landing (protected and unprotected main, fast-forward, never force-push shared work,
  never touch another session's work), nightly CI and why a blocked run is not green,
  handoffs, decisions, ids and leases, secrets, licensing (AGPL-3.0 or commercial, CLA), the
  repository standard, the privacy gate, and releases, versions and pins; the knowledge base
  stays the source of truth. NOT for product UX, visual design or copy (super-ux,
  sheleg-design, copywriting), building Fabric agents or services (the fabric-agent-adapter
  skills), or repositories outside passioncode-ai.
license: AGPL-3.0-only OR LicenseRef-PassionCode-Commercial
compatibility: Any agent that can read files and run git. The gh CLI and a clone of passioncode-ai/org-index make the checks exact; without them follow the fallbacks in the body.
metadata:
  author: PassionCode.ai
---

# Working in PassionCode repositories

What belongs to no single repository — the vision, the principles, how to work, the rules, the
repository standard, the products and the licence — lives in one place: the organization's
**knowledge base**, `fabric-workspace/knowledge/` in a clone (org-index
`scripts/clone_all.sh` makes it), published at https://wiki.passioncode.ai/knowledge (sign-in
required; Fabric ADR-0093). [org-index](https://github.com/passioncode-ai/org-index) (private;
every member can read it) keeps the map (`repositories.json`), `ONBOARDING.md` and the checks
(`check_index.py`, `check_names.py`, `check_format.py`). This skill is the checklist that makes
those rules reach you while you work. It summarises; it does not replace. Where it and the
knowledge base disagree, **the knowledge base wins**; where a repository's own `AGENTS.md` is
stricter, **that file wins**.

## 0. The protocol — before and after every piece of work

**Before the first edit**, read the knowledge base (at least its `README.md`, `vision.md`,
`principles.md` and `how-to-work.md`), then the repository's `AGENTS.md`. The session-start hook
of this plugin prints that line in every passioncode-ai repository.

**After the work**, in the same run: update the repository's own docs in the change that changes
the behaviour; if a fact that crosses repositories changed — a product, a version, a plan row, a
principle, a rule — update the knowledge base page that owns it (`products.md`, `plans.md`, ...);
land both; then publish (`node scripts/workspace.mjs sync` from a Fabric checkout) or leave it to
the scheduled sync. A page there is read as true: every claim carries its receipt.

## 1. Before the first edit

1. Read the knowledge base, then the repository's `AGENTS.md` (its `CLAUDE.md` imports
   it). `AGENTS.md` names the role, the test command and any local rule.
2. Find who owns what you are about to change: the table in org-index `README.md`,
   generated from `repositories.json`. Do not guess an owner from a directory name.
3. `git fetch origin`, then work in a worktree from `origin/main` on your own branch
   (`<who>/<topic>`, e.g. `agent/engine-update`):
   `git worktree add ../<repo>-<topic> -b <who>/<topic> origin/main`.
   Checkouts are shared by several sessions; never switch, reset, stash or check out
   over one.
4. An unmerged branch or a dirty tree you did not create is someone's work in
   progress. Leave it; ask before touching it.

No clone: `gh repo clone passioncode-ai/org-index`, then its `scripts/clone_all.sh` for the
knowledge base. No access at all: say so, follow the repository's `AGENTS.md`, and name that you
worked from it alone.

Also, before the first edit:

- **Read the organization's [CONTRIBUTING.md](https://github.com/passioncode-ai/.github/blob/main/CONTRIBUTING.md)**
  — the repository's `AGENTS.md` sends you there in its *Read first* block.
- **Names** (Fabric ADR-0090): PassionCode.ai is the organization; **Fabric** is the product,
  the CEO AI agent; Fabric's tools carry its full name before any short form (Fabric Inbox,
  Fabric Dashboards, Fabric Switchboard); the Fabric Agent Contract and Adapter make any agent
  Fabric-compatible; Project Observatory keeps its own name. Never "PassionCode app".
- **Code region markers**: fence a feature, module or special condition with
  `#region <slug> — docs: <path>#<anchor>` ... `#endregion <slug>` in the file's comment syntax;
  the reference must resolve. Repositories that ship `check-regions` fail a broken one.

## 2. Landing on main

| `main` is | Land by |
|---|---|
| protected (today only `project-observatory-dashboard`) | a PR; the required checks green (three OS/Python combinations); linear history |
| unprotected (every other repository) | a PR, or a fast-forward push after the repository's local gate passes |

- Private repositories are on GitHub's free plan, which cannot protect a branch. The
  rules hold there **on your word**.
- A fast-forward means `git push origin HEAD:main` succeeds without `--force`. If
  `main` moved, rebase your own branch, re-run the gate, then push.
- Never force-push `main`, and never force-push a branch someone else has built on.
- Never put a merge commit on top of someone else's unpushed work.
- Release tags `vX.Y.Z` and contract tags `rev-N` never move. A mistake gets a new
  version.
- Commit subjects: imperative, at most 72 characters. An agent's commit ends with a
  `Co-Authored-By:` trailer naming the model.

## 3. Tests and CI

- **The local gate is the gate.** Run the repository's test command (its `AGENTS.md`,
  and the `test` field in `repositories.json`) before you push, and report each
  command with its exit code.

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

What the source does

Filesystem

declared (5 observation(s))

Network

none-observed

Shell

declared (4 observation(s))

Dependencies

pinned

Secrets in source

none-found

Findings (3)

.check-private-allow

registry = `http://127.0.0.1:${server.address().port}`;

| hook.spawn-failed | [passioncode] could not start the background update; check that npx is on PATH and retry next session. | plugin/passioncode/hooks/session-start.js:64 | SCN-006 | proposed | copy

Gates applied: no_behavioural_pass.