Guide AAS maintainers through pull request review, batch merging, generated-file synchronization, and scripted releases. Follow protected-branch procedures and check evidence tied to the exact revision before accepting changes.
Run protected AAS maintainer sweeps, PR merge batches, resumable review, immutable distribution, Core checks, and scripted releases. Use for repository maintenance, main alignment, CLI/MCP/Workbench changes, or release work; not ordinary contribution tasks.
Review the instructions the agent will receive before you install.
Use for AAS maintainer sweeps, PR repairs and merge batches, runtime/catalog releases, installed maintainer-skill alignment, and public deployment verification. Ordinary contributors do not need maintainer privileges.
.github/MAINTENANCE.md, package.json, and maintenance contract. Mandatory tools must exist on that base; never import retired procedures from another checkout.npm run maintenance:cycle -- start on clean current main before content analysis/review, and follow the complete cycle. The runner measures source maintenance without a release; finish it before release preparation. For a release-only task or a sweep with no PRs, record the overall start separately; do not invent a PR or start a source cycle that cannot finish. Triage the full authorized scope. Repair source PRs, run the component plan, review the entire tracked skills/<skill-id>/** subtree, and inspect relevant advisories. Do not substitute a heuristic score for semantic review.maintenance:cycle merge, which delegates to merge:batch, or invoke npm run merge:batch directly when no source cycle applies. These share the sole merge authority; do not run both for the same merge. Keep strict protected main and admin enforcement. Safe analysis may precede review; merge still requires current checks and either real Tessl review or exact-head maintainer attestation. Private signed receipts may reuse unchanged content/context review. Preserve owner-only sensitive-change and protected-base fork-ledger restrictions.--state-dir. Record each blocker once; after two equivalent unproductive checks, continue independent work. Re-fetch PR state and protection every time. Continue independent PRs after a blocked PR; report failures. Follow the cycle reference’s deterministic failure codes and bounded read retries. Never repeat a write with an unknown outcome, steal an active state lock, or reuse stale CI evidence. Do not rewrite PR metadata, automatically retry base drift, or use GitHub auto-merge.release:prepare and release:publish. Prepare already validates; do not duplicate its suite with diagnostic preflight. Merge the prepared release PR through protection. The immutable candidate is built once, checked on supported platforms, and consumed unchanged by npm/Pages. Main may advance while the released commit remains protected ancestry.maintenance:cycle verify on exact main CI/CodeQL after all other source-cycle actions. Without publication, stop there: public distribution snapshots intentionally remain at the last release. For releases, complete the full-release-alignment gate in the contract, including actual public bytes and live surfaces. Report personal MCP configuration and session reload separately. Update installed maintainer skills from the adopted canonical source, preserving unrelated installations.Prepare safe analyses without merging:
npm run merge:batch -- --prs 123,124 --prepare-only
After actual semantic review, persist the evidence and merge:
npm run merge:batch -- --prs 123,124 --state-dir /absolute/private/state --reviewed-head FULL_40_CHARACTER_SHA --reviewer maintainer --review-evidence 'Complete bundle, provenance, safety and limitations reviewed'
Use real IDs, paths and a full immutable SHA. The state directory must already exist, be privately owned and mode 0700, and be outside source checkouts.
Read component validation and the maintenance contract for exact checks, release proof, catalog compatibility and timing methodology. Required checks remain pr-policy, pr-evidence, source-validation, artifact-preview. Unknown/shared/policy changes receive full validation.
This skill grants no additional publication or messaging authority. Tessl unavailable means manual-review-required, not a passing review. Jev, SkillSpector and timing reports are advisory. Never use direct main push, admin bypass, mutable artifact identity, PR-controlled review receipts, or invented native-client reload proof. Local timings do not establish whole-cycle improvement.
Consult scanner interpretation when triaging SkillSpector and Core preview acceptance for runtime changes.
Follow public surface verification for catalog, Pages and legacy redirect changes.
For CSV security intake, distinguish historical/generated duplicates from current canonical defects. Never execute skill Markdown or external setup as a triage shortcut. Dossiers must include containing nested skill trees; use reviewed test fixtures and inert source comparisons for executable documentation examples. Record each finding disposition and its evidence before release.
Before creating a release tag, inventory and audit every canonical npm lockfile, including bundled applications and templates; a clean root/web audit does not cover nested dependencies. Recheck live security alerts after source merges and immediately before tagging. Treat newly created alerts as new work before publication.
No reviews yet. Tell others what you thought.
No login needed. Share how it worked for you, ask a question, or note where it did not run.
No comments yet. Be the first to write one.
Assess a new or existing AI project by examining its code, goals, and constraints. Recommend skills confirmed to exist in the available registry, then outline tasks and implementation phases with dependencies, completion criteria, and checks.
Review code and infrastructure for security risks, map potential threats, and plan stronger defenses. The skill covers OWASP checks, attack and defense exercises, and incident response, with validation required for each environment.
Turn a repeatable task into an Andru.ia skill with clear inputs, outputs, examples, and limits. Draft SKILL.md, check the folder structure and required validations, and prepare a pull request describing the changes for review.
Prepare an industry briefing once a project's sector is defined. It covers sector context, potentially applicable regulations, familiar interface patterns, technology choices, and risks, while separating verified evidence from hypotheses and questions requiring further review.
Create presentation drafts from text, outlines, or documents through the 2slides API. Match a reference image's style, choose themes, add AI voice narration, and export slide images or audio for review and use.
Plan a 360-degree or peer feedback process and create empty response templates from confirmed requirements. Produces consistent CSV, SQL, JSON Schema, or Notion property mappings while keeping visibility choices and scoring configuration separate.