This is an automated email from the ASF dual-hosted git repository.
potiuk pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/airflow-steward.git
The following commit(s) were added to refs/heads/main by this push:
new b21be7a4 docs(spec-loop): sync specs with contributed functionality
(#539)
b21be7a4 is described below
commit b21be7a4e4bbb92e0a2f402d6011e0231e0f9804
Author: Justin Mclean <[email protected]>
AuthorDate: Sat Jun 27 12:42:55 2026 +1000
docs(spec-loop): sync specs with contributed functionality (#539)
* docs(spec-loop): sync specs with contributed functionality
- triage-mode: add issue-stale-sweep (now shipped), security-issue-triage,
security-issue-import-from-scan, security-issue-import-via-forwarder,
contributor-activity-sweep, committer-onboarding to Where it lives;
update Known gaps to remove resolved stale-issue gap and fix
contributor-growth cross-reference
- mentoring-mode: add mentoring-welcome (3rd Mentoring skill) to Where
it lives and Validation; update acceptance criteria and Known gaps to
reflect it shipped; remove first-contact welcome from unbuilt list
- release-management-lifecycle: reflect release-announce-draft shipped
(experimental, Step 11); update Known gaps and Validation accordingly
- overview: update Mentoring to "3 skills"; add release-announce-draft
to Drafting experimental row
- meta-and-quality-tooling: update skill-and-tool-validator description
to include eval-coverage soft check and Python license-header check;
update spec-validator description to include SPDX header, Known gaps,
Validation code block, and path-existence checks
Generated-by: Claude (Opus 4.7)
* docs(spec-loop): sync specs with skills shipped since the last sync point
Fold-on to #539's sync: main shipped 7 skills after this branch's sync
point (296b72f), so several specs misstated reality. Refresh them and
advance .last-sync to the current main tip.
- repo-health-family.md: family is now three skills deep —
workflow-security-audit
and dependency-audit shipped alongside ci-runner-audit.
- triage-mode.md: add issue-deduplicate + issue-backlog-stats to the
inventory;
retire the "no general-issue dedup / backlog dashboard" gap and the
"repo-health one-off" gap.
- release-management-lifecycle.md: 4 of 10 skills shipped
(release-announce-draft,
release-verify-rc, release-vote-tally, release-promote); status proposed
-> experimental.
- overview.md: release-management line now experimental (4/10 shipped).
- .last-sync: 296b72f -> current main.
Generated-by: Claude Code (Opus 4.8)
---------
Co-authored-by: Jarek Potiuk <[email protected]>
---
tools/spec-loop/.last-sync | 2 +-
tools/spec-loop/specs/mentoring-mode.md | 42 ++++++++-----
tools/spec-loop/specs/meta-and-quality-tooling.md | 10 +++-
tools/spec-loop/specs/overview.md | 6 +-
.../specs/release-management-lifecycle.md | 55 ++++++++++-------
tools/spec-loop/specs/repo-health-family.md | 33 ++++++-----
tools/spec-loop/specs/triage-mode.md | 68 +++++++++++++---------
7 files changed, 131 insertions(+), 85 deletions(-)
diff --git a/tools/spec-loop/.last-sync b/tools/spec-loop/.last-sync
index a65a14fc..eed91d31 100644
--- a/tools/spec-loop/.last-sync
+++ b/tools/spec-loop/.last-sync
@@ -1 +1 @@
-e4f79fc8d2470f2120ee5b6df1215d0f8159874f
+764cdb89fda0bcd62b039bbb96543aab017ba704
diff --git a/tools/spec-loop/specs/mentoring-mode.md
b/tools/spec-loop/specs/mentoring-mode.md
index 98e768d4..282b7b0f 100644
--- a/tools/spec-loop/specs/mentoring-mode.md
+++ b/tools/spec-loop/specs/mentoring-mode.md
@@ -9,7 +9,7 @@ mode: Mentoring
source: >
MISSION.md § Technical scope (Mentoring) — "the highest-value
project-side mode and the one off-the-shelf agent tooling skips".
- docs/modes.md § Mentoring (experimental, 1 skill). Spec exists at
+ docs/modes.md § Mentoring (experimental, 3 skills). Spec exists at
docs/mentoring/spec.md ahead of any skill code. MISSION.md names
onboarding latency as one of the two loudest ecosystem complaints;
authoring newcomer-ready good first issues targets it directly.
@@ -22,6 +22,9 @@ acceptance:
- The good-first-issue authoring skill drafts net-new, newcomer-ready
issues (scope, code pointers, contributing-doc links, effort estimate)
and never files them without maintainer confirmation.
+ - The first-contact welcome skill greets first-time contributors with
+ project-convention pointers, never posts without confirmation, and
+ skips repeat contributors.
---
# Mentoring mode
@@ -60,6 +63,14 @@ a project can offer a first-time contributor.
confirmation before any issue is filed via `gh`. Ships `mode: Mentoring`
+ `experimental`, with an eval suite under
`tools/skill-evals/evals/good-first-issue-author/`.
+- Skill: `mentoring-welcome` — drafts a first-contact orientation comment
+ for a first-time contributor on a newly opened issue or PR. Detects
+ first-time authorship via the GitHub `author_association` field and
+ drafts a welcome with contributing-guide link, community-norm pointers,
+ and expected next steps. Does not post for repeat contributors; waits
+ for explicit maintainer confirmation before posting. Ships `mode:
+ Mentoring` + `experimental`, with an eval suite under
+ `tools/skill-evals/evals/mentoring-welcome/`.
## Behaviour & contract
@@ -101,28 +112,29 @@ a project can offer a first-time contributor.
```bash
test -f docs/mentoring/spec.md
test -f .claude/skills/magpie-good-first-issue-author/SKILL.md
+test -f .claude/skills/magpie-mentoring-welcome/SKILL.md
uv run --project tools/skill-and-tool-validator --group dev
skill-and-tool-validate
uv run --project tools/skill-evals skill-eval
tools/skill-evals/evals/good-first-issue-author/
+uv run --project tools/skill-evals skill-eval
tools/skill-evals/evals/mentoring-welcome/
```
## Known gaps
-- **`experimental` — no adopter pilot has run.** The first skill
- (`pr-management-mentor`) shipped; shape may change as adopter pilots
- and contributor-sentiment evaluations land.
+- **`experimental` — no adopter pilot has run.** All three shipped skills
+ (`pr-management-mentor`, `good-first-issue-author`, `mentoring-welcome`)
+ may change shape as adopter pilots and contributor-sentiment evaluations
+ land.
- **`good-first-issue-author` shipped `experimental`; no adopter pilot
has authored a live good first issue through it yet.** The suitability
and readiness thresholds may shift once real backlog candidates run
through it. The curation counterpart (relabeling the *existing* backlog
as good-first-issue candidates) is still unspecced.
-- **The family is one shipped skill deep against a core MISSION stream.**
- Mentoring is named as one of the four day-to-day work streams, but only
- `pr-management-mentor` ships (plus the Mentoring-flagged
- `good-first-issue-author`). Two newcomer-facing capabilities are
- designed nowhere yet: a *first-contribution welcome / orientation* skill
- that greets a contributor's first issue or PR with project-convention
- pointers and a clean hand-off, and a *contributor-to-committer path*
- tracker that reads the nomination-evidence signals
- `contributor-nomination` already gathers and surfaces when a contributor
- is approaching readiness. Both are candidate work items for the plan
- pass.
+- **`mentoring-welcome` shipped `experimental`; no adopter pilot run.**
+ The welcome tone, detecting first-timer vs. repeat contributor, and
+ the content of the orientation template may shift once live threads run
+ through it.
+- **One newcomer-facing capability is still unbuilt.** A
+ *contributor-to-committer path* tracker that reads the
+ nomination-evidence signals `contributor-nomination` already gathers
+ and surfaces when a contributor is approaching readiness remains a
+ candidate work item for the plan pass.
diff --git a/tools/spec-loop/specs/meta-and-quality-tooling.md
b/tools/spec-loop/specs/meta-and-quality-tooling.md
index fd15bd79..5d1fb604 100644
--- a/tools/spec-loop/specs/meta-and-quality-tooling.md
+++ b/tools/spec-loop/specs/meta-and-quality-tooling.md
@@ -32,8 +32,9 @@ trustworthy as it grows.
## Where it lives
- `tools/skill-and-tool-validator/` — validates `SKILL.md` frontmatter
(required
- `name`, `description`, `license`) and tool definitions, internal link
integrity, and
- placeholder conventions. CLI: `skill-and-tool-validate`.
+ `name`, `description`, `license`) and tool definitions, internal link
integrity,
+ placeholder conventions, license headers on tool Python files, and
eval-coverage
+ (soft check: warns when a skill has no eval suite). CLI:
`skill-and-tool-validate`.
- `tools/skill-evals/` — harness for measuring skill behaviour.
- `tools/sandbox-lint/` — lints the sandbox/permissions configuration.
- `tools/dashboard-generator/` — read-only HTML dashboards over campaign
@@ -44,7 +45,10 @@ trustworthy as it grows.
build iterations to mechanically select the next work item.
- `tools/spec-validator/` — validates spec-loop spec frontmatter
(required keys, valid `status`/`kind`/`mode` values, body-section
- presence); the spec-side counterpart to `skill-and-tool-validator`.
+ presence, `Known gaps` section required in functional specs,
+ SPDX-License-Identifier header, Validation code block present,
+ filesystem paths in Validation blocks must exist under repo root);
+ the spec-side counterpart to `skill-and-tool-validator`.
- Skills: `write-skill` (author/update a skill), `optimize-skill`
(restructure an existing skill or sweep a set: split oversized
`SKILL.md`, lift project-specific values into placeholders, harden
diff --git a/tools/spec-loop/specs/overview.md
b/tools/spec-loop/specs/overview.md
index aebc581f..9f875ca5 100644
--- a/tools/spec-loop/specs/overview.md
+++ b/tools/spec-loop/specs/overview.md
@@ -31,8 +31,8 @@ Each mode is an independently toggleable set of skills.
Maturity mirrors
| Mode | Spec | Maturity |
|---|---|---|
| Triage | [triage-mode.md](triage-mode.md) | stable (security) / experimental
(PR, issue, contributor-nomination) |
-| Mentoring | [mentoring-mode.md](mentoring-mode.md) | experimental (2 skills)
|
-| Drafting | [drafting-mode.md](drafting-mode.md) | stable (security) /
experimental (issue, audit-finding-fix) |
+| Mentoring | [mentoring-mode.md](mentoring-mode.md) | experimental (3 skills)
|
+| Drafting | [drafting-mode.md](drafting-mode.md) | stable (security) /
experimental (issue, audit-finding-fix, release-announce-draft) |
| Pairing | [pairing-mode.md](pairing-mode.md) | experimental (2 skills) |
> **Auto-merge** is the fifth MISSION mode but is deliberately **off** by
@@ -45,7 +45,7 @@ Each mode is an independently toggleable set of skills.
Maturity mirrors
| Area | Spec |
|---|---|
| Security-issue lifecycle (the load-bearing use case) |
[security-issue-lifecycle.md](security-issue-lifecycle.md) |
-| Release-management lifecycle (proposed, spec-first) |
[release-management-lifecycle.md](release-management-lifecycle.md) |
+| Release-management lifecycle (experimental — 4 of 10 skills shipped) |
[release-management-lifecycle.md](release-management-lifecycle.md) |
| Privacy-LLM gate + PII redaction |
[privacy-llm-gate.md](privacy-llm-gate.md) |
| Agent isolation / layered sandbox |
[agent-isolation-sandbox.md](agent-isolation-sandbox.md) |
| CVE tooling | [cve-tooling.md](cve-tooling.md) |
diff --git a/tools/spec-loop/specs/release-management-lifecycle.md
b/tools/spec-loop/specs/release-management-lifecycle.md
index 0edbb84b..85f696ae 100644
--- a/tools/spec-loop/specs/release-management-lifecycle.md
+++ b/tools/spec-loop/specs/release-management-lifecycle.md
@@ -3,7 +3,7 @@
---
title: Release-management lifecycle (end-to-end)
-status: proposed
+status: experimental
kind: feature
mode: Drafting
source: >
@@ -11,8 +11,9 @@ source: >
standard process within 3 months of resolution adoption"). README.md
§ Skill families (release-management, proposed). Designed spec-first in
docs/release-management/ (README.md, process.md, spec.md) plus the
- adopter scaffold projects/_template/release-management-config.md. No
- release-* skill code exists yet.
+ adopter scaffold projects/_template/release-management-config.md.
+ Four of the ten skills have since shipped (release-announce-draft,
+ release-verify-rc, release-vote-tally, release-promote).
acceptance:
- The family's design (14-step process, per-skill state-change
boundaries, adopter contract) is reviewable independently of any
@@ -55,11 +56,20 @@ code lands.
`projects/_template/release-build.md`, `projects/_template/pmc-roster.md`,
`projects/_template/site-repo.md`, and the shared
`projects/_template/release-trains.md`.
-- Skills (all `proposed`, none implemented yet): `release-prepare`,
- `release-keys-sync`, `release-rc-cut`, `release-verify-rc`,
- `release-vote-draft`, `release-vote-tally`, `release-promote`,
- `release-announce-draft`, `release-archive-sweep`,
- `release-audit-report`.
+- Skills (four shipped, all `experimental`): `release-announce-draft`
+ (`mode: Drafting`) drafts the `[ANNOUNCE]` body and proposes the
+ site-bump PR for a promoted release (Step 11), enforcing the one-hour
+ promote-wait gate, `@apache.org` address reminder, Download Page link
+ constraint, and no-send / no-auto-merge boundaries; `release-verify-rc`
+ (`mode: Triage`) runs read-only RC pre-flight (signatures, checksums,
+ RAT headers, NOTICE/LICENSE, prohibited binaries, version consistency,
+ Step 6); `release-vote-tally` (`mode: Triage`) classifies +1/0/-1
+ binding vs non-binding once the window closes and drafts the `[RESULT]`
+ (Step 9); `release-promote` (`mode: Drafting`) emits the backend-shaped
+ staging→release promotion command set for a vote-passed release
+ (Step 10). The remaining six skills (`release-prepare`,
+ `release-keys-sync`, `release-rc-cut`, `release-vote-draft`,
+ `release-archive-sweep`, `release-audit-report`) are still `proposed`.
- Adapters it will read/draft through: `tools/github`, `tools/ponymail`
(vote threads), `tools/gmail` (announce/vote drafts), plus the project's
`svn` dist tree as a distribution backend.
@@ -117,23 +127,24 @@ code lands.
test -f docs/release-management/spec.md
test -f docs/release-management/process.md
test -f projects/_template/release-management-config.md
+test -f .claude/skills/magpie-release-announce-draft/SKILL.md
+test -f .claude/skills/magpie-release-verify-rc/SKILL.md
+test -f .claude/skills/magpie-release-vote-tally/SKILL.md
+test -f .claude/skills/magpie-release-promote/SKILL.md
uv run --project tools/skill-and-tool-validator --group dev
skill-and-tool-validate
+uv run --project tools/skill-evals skill-eval
tools/skill-evals/evals/release-announce-draft/
```
## Known gaps
-- **`release-verify-rc` shipped** — read-only RC pre-flight skill
- (Step 6) landed with eval suite (13 cases across 6 steps); status
- updated to `experimental`.
-- **Nine `release-*` skills remain unimplemented** (`release-prepare`,
- `release-keys-sync`, `release-rc-cut`, `release-vote-draft`,
- `release-vote-tally`, `release-promote`, `release-announce-draft`,
- `release-archive-sweep`, `release-audit-report`; `release-announce-draft`
- landed earlier, `release-vote-draft` and `release-vote-tally` are
- in-flight on local branches). The plan pass turns each
- un-implemented skill in the `docs/release-management/` table into a
- work item.
+- **Four of ten skills have shipped** (`release-announce-draft`,
+ `release-verify-rc`, `release-vote-tally`, `release-promote`), all
+ `experimental` with eval suites. **Six remain `proposed`**
+ (`release-prepare`, `release-keys-sync`, `release-rc-cut`,
+ `release-vote-draft`, `release-archive-sweep`, `release-audit-report`).
+ The plan pass turns each un-implemented skill in the
+ `docs/release-management/` table into a work item.
- **Health-evidence promotion criteria are unmeasured.** No adopter has
- cut a release through the family yet, so the RM/binding-voter evidence
- window that would justify default-on or a state-changing lane has no
- data behind it.
+ cut a full release through the family yet, so the RM/binding-voter
+ evidence window that would justify default-on or a state-changing lane
+ has no data behind it.
diff --git a/tools/spec-loop/specs/repo-health-family.md
b/tools/spec-loop/specs/repo-health-family.md
index da8c9046..b23eb29d 100644
--- a/tools/spec-loop/specs/repo-health-family.md
+++ b/tools/spec-loop/specs/repo-health-family.md
@@ -38,14 +38,17 @@ grouped, prioritised report → wait for confirmation before
any write.
## Where it lives
-- Skill: `ci-runner-audit` — first shipped member. Reads GitHub Actions
- workflow files across one repo, an explicit set, one Apache project's
- repos, or the full Apache GitHub org and surfaces obsolete
- GitHub-hosted runner labels and macOS architecture mismatches. Read-only;
- no workflow files are modified. Ships `mode: Triage` + `experimental`.
-- Design docs: `docs/repo-health/README.md` — family overview, candidate
- skills (workflow-security-audit, dependency-audit, license-compliance-audit,
- flaky-test-triage), and the planned adopter-config scaffold.
+- Skills (three shipped): `ci-runner-audit` (obsolete GitHub-hosted runner
+ labels and macOS architecture mismatches), `workflow-security-audit`
+ (zizmor-backed Actions security findings — injection, excessive
+ permissions, unpinned external actions, fork-secret leaks), and
+ `dependency-audit` (known-vulnerable / outdated dependencies). Each reads
+ across one repo, an explicit set, one Apache project's repos, or the full
+ Apache GitHub org, is read-only (no workflow file, manifest, or lock file
+ is modified), and ships `mode: Triage` + `experimental` with an eval suite.
+- Design docs: `docs/repo-health/README.md` — family overview, remaining
+ candidate skills (license-compliance-audit, flaky-test-triage), and the
+ planned adopter-config scaffold.
- Planned adopter config: `projects/_template/repo-health-config.md` —
per-skill switches (deprecated-runner families, zizmor rule classes,
dependency-manager selection, SPDX expression, flaky-test window).
@@ -97,17 +100,19 @@ grouped, prioritised report → wait for confirmation before
any write.
```bash
test -f .claude/skills/magpie-ci-runner-audit/SKILL.md
+test -f .claude/skills/magpie-workflow-security-audit/SKILL.md
+test -f .claude/skills/magpie-dependency-audit/SKILL.md
uv run --project tools/skill-and-tool-validator --group dev
skill-and-tool-validate
```
## Known gaps
-- **Family is one skill deep.** `ci-runner-audit` is the sole shipped
- member. Four candidates are designed in `docs/repo-health/README.md`:
- `workflow-security-audit` (zizmor-backed, highest priority — the tool
- is already in pre-commit), `dependency-audit`, `license-compliance-audit`,
- and `flaky-test-triage`. Each is a separate build item, sequenced after
- `ci-runner-audit`'s pilot evaluation confirms the family shape.
+- **Family is three skills deep.** `ci-runner-audit`,
+ `workflow-security-audit`, and `dependency-audit` have shipped (read-only,
+ `experimental`, each with an eval suite). Two candidates remain designed
+ in `docs/repo-health/README.md`: `license-compliance-audit` and
+ `flaky-test-triage`. Each is a separate build item, sequenced after the
+ shipped members' pilot evaluation confirms the family shape.
- **No adopter-config scaffold yet.**
`projects/_template/repo-health-config.md`
is planned alongside the first candidate skill; the keys are sketched in
`docs/repo-health/README.md § Adopter contract`.
diff --git a/tools/spec-loop/specs/triage-mode.md
b/tools/spec-loop/specs/triage-mode.md
index 41f1027a..cbc0e64e 100644
--- a/tools/spec-loop/specs/triage-mode.md
+++ b/tools/spec-loop/specs/triage-mode.md
@@ -34,14 +34,30 @@ suggestion the human signs off on.
`pr-management-quick-merge` (read-only express-lane surfacing of
trivial, low-risk PRs a maintainer can review in seconds).
Reference implementation: `tools/pr-management-stats/`.
-- General issues: `issue-triage`, `issue-reassess`, `issue-reproducer`.
- Companion reporting skill: `issue-reassess-stats` (read-only dashboard
- over `verdict.json` files produced by `issue-reassess` campaigns).
+- General issues: `issue-triage`, `issue-reassess`, `issue-reproducer`,
+ `issue-stale-sweep` (configurable inactivity sweep: nudge or
+ propose-close after a warning window; waits for confirmation before
+ posting), `issue-deduplicate` (merge two open issues describing the same
+ root cause — proposes a close + cross-reference, waits for confirmation).
+ Companion reporting skills: `issue-reassess-stats` (read-only dashboard
+ over `verdict.json` files produced by `issue-reassess` campaigns) and
+ `issue-backlog-stats` (read-only maintainer dashboard over the open
+ general-issue backlog — health rating, age/staleness, area pressure,
+ triage funnel).
- Contributor readiness: `contributor-nomination` (read-only brief for a
named contributor — activity breadth, consistency, and nomination-
- evidence prose for a committer or PMC thread).
+ evidence prose for a committer or PMC thread);
+ `contributor-activity-sweep` (read-only GitHub activity card for a
+ named contributor over a configurable window);
+ `committer-onboarding` (post-vote ICLA/account/permissions/welcome
+ checklist for committer and PMC promotions).
- Security inbound: `security-issue-import`, `-import-from-pr`,
- `-import-from-md`, `security-issue-deduplicate`,
+ `-import-from-md`, `-import-from-scan` (triage-first scanner-output
+ import via pluggable scan-format adapters),
+ `-import-via-forwarder` (relay-broker variant: reports relayed by an
+ upstream broker such as the ASF security team),
+ `security-issue-triage` (batch-triage open tracker issues carrying
+ `needs triage`), `security-issue-deduplicate`,
`security-issue-invalidate`, `security-issue-sync`,
`security-cve-allocate`.
- Adapters it reads through: `tools/github`, `tools/jira`,
@@ -80,25 +96,23 @@ uv run --project tools/skill-and-tool-validator --group dev
skill-and-tool-valid
- PR and general-issue triage are `experimental` — no adopter-pilot eval
has run; behaviour may change.
-- **General-issue triage lacks the dedupe, stale-handling, and
- backlog-dashboard coverage the security side already has.** There is
- no general-issue deduplication skill (only `security-issue-deduplicate`
- exists), no stale-issue management (nudge, then propose-close after a
- warning window), and no general open-issue backlog dashboard
- (`pr-management-stats` covers PRs; `issue-reassess-stats` only covers
- reassess-campaign `verdict.json` output). Each is a candidate work item.
-- **The contributor-growth skills are not yet a formalised family.**
- `contributor-nomination`, `contributor-activity-sweep`,
- `committer-onboarding`, and `good-first-issue-author` (Mentoring) span
- the contributor-to-committer path but are catalogued ad hoc;
- `contributor-activity-sweep` and `committer-onboarding` are not yet
- referenced by any spec. Missing members of that path: PMC-member
- nomination (distinct from committer), emeritus / inactive-committer
- handling, and contributor offboarding. Worth deciding whether this
- becomes a named family.
-- **Repo-health audits are a one-off with no family around them.**
- `ci-runner-audit` is a standalone read-only audit (obsolete runner
- labels, macOS arch mismatches) with no sibling skills. A repo-health
- family is a candidate: GitHub Actions workflow security audit (the repo
- already runs `zizmor` in pre-commit), dependency-update triage,
- license / NOTICE compliance, and flaky-test detection.
+- **General-issue triage gained its deduplication skill and backlog
+ dashboard.** `issue-deduplicate` (general-issue dedup, parallel to
+ `security-issue-deduplicate`) and `issue-backlog-stats` (open-issue
+ backlog dashboard, parallel to `pr-management-stats`) have now shipped
+ (`experimental`); `issue-stale-sweep` provides stale-handling /
+ close-proposal. No adopter-pilot eval has run on the general-issue
+ family yet, so behaviour may change.
+- **The contributor-growth skills span the path but are not yet a named
+ family.** `contributor-nomination`, `contributor-activity-sweep`,
+ `committer-onboarding`, and `good-first-issue-author` (Mentoring) are
+ now all catalogued in the specs. Missing members of the
+ contributor-to-committer path: PMC-member nomination (distinct from
+ committer), emeritus / inactive-committer handling, and contributor
+ offboarding. Worth deciding whether this becomes a named family with
+ its own spec.
+- **Repo-health audits are now a three-skill family.** `ci-runner-audit`,
+ `workflow-security-audit` (zizmor-backed), and `dependency-audit` have
+ shipped (read-only, `experimental`); see
+ [repo-health-family.md](repo-health-family.md). Remaining candidates:
+ license / NOTICE compliance and flaky-test detection.
