repos

Repos

Command-driven GitHub repository management. Parse the first token as a command when it matches the table; otherwise map clear intent.

Default secrets path is [Pulumi ESC](https://www.pulumi.com/docs/esc/) (OIDC + pulumi/esc-action) — not long-lived secrets.* in GitHub unless the user explicitly wants classic repo secrets.

Operating contract

Shared by every DecisionNerd/dev-skills skill. Canonical copy: handbook/concepts/14-operating-contract.md.

• Define done first. Before using tools, write the finish line in one or two lines: acceptance criteria (existing issue AC, BDD scenarios, tests, or contract; otherwise propose them and where they should live) and the evidence that will prove them. Re-check it before reporting done. Never report done on unverified work.
• Requested scope sets the finish line. A question ("is it ready?", "why is it broken?", "what next?") ends with the answer and a Next: line naming the exact next invoke. An outcome request ("fix", "finish", "land", "#42") continues through the chain (diagnose → fix → test → check-readiness → merge-it) until the outcome or a real blocker. Do not end a turn with "Do you want me to…?" for in-scope, in-repo work.
• Stop only for real blockers. Stop and ask only when you cannot continue without the user, or before: deleting data or unmerged work, force-push or history rewrite, changing anything outside this repository (GitHub objects, deployments, live data, production or paid resources, external services), or leaving the requested scope, unless the user's request already named that exact action. Keep the harness's permission prompts for risky commands. Otherwise keep going and put status notes in the same message as the next action.
• Ask well, once. For a genuine question use the harness's structured question tool when it has one (Claude Code: AskUserQuestion; Codex: request_user_input when the current mode supports it; T3 Code: the question tool) with concrete options; otherwise plain text with numbered options. Treat the answer as settled; do not re-open earlier verdicts, plans, or answers unless asked.
• Fan out when work is parallel. Use subagents for independent reads (repo survey, evidence gathering, per-option research, per-area audits) and independent verification (a reviewer that did not write the change). Writes stay single-owner per path set and sequential. Brief every child with goal, done-when, constraints, must-not, and return shape; verify each result before consolidating. Use Claude Code's Workflow tool only when orchestrating many subagents truly needs it; it is expensive. T3 Code: its delegated subagents — with optional worktree isolation for independent verification — cover this without the Workflow tool.
• Pick the model tier per child; defer to routing config. If the harness or user config already routes subagents, follow it and do not pass a model. Otherwise pick a tier per child: mechanical search or inventory → fast/cheap; implementation and evidence gathering → mid; planning, review, adversarial verification → top. Tier names differ per harness (Claude Code: haiku / sonnet / opus or fable; T3 Code: inherit by default or pick from its live provider/model catalog). Set the choice with the harness's spawn model param or agent frontmatter model: (per-harness details: skills/agents/references/sub.md). Where the harness cannot choose, children inherit or the harness picks; say which in the status note.
• Keep a checklist on long runs. For more than about five steps or work that crosses skills, keep TASKS.md at the repo root and tick items as they finish. Do not commit it unless the repo already tracks one.
• Close every run with three headings. Blocked on me (the one genuine question or blocker, else "none"); Changed (files, commits, GitHub objects, deploys, else "nothing"); Found (evidence, verdict, and Next: <exact invoke>).

Commands

Aliases: carve → split; join → combine; esc → secrets; workflows → ci.

Target: owner/repo, URL, local path, or “current repo.”

Routing

1. No argument: status for the current git remote.
2. First word is a command: run it; remainder is target/context.
3. `ci harden` / `ci simplify`: CI subcommands (below).
4. Clear intent (“split packages/api into its own repo”, “move secrets to ESC”): map and proceed.

Mutating GitHub (create, settings, transfer, archive, secret writes), Pulumi ESC, or history rewrites requires explicit approval. Prefer plans + DAG before execution. For complexity judgment on CI/architecture, pair with kiss.

CI subcommands

Details: references/ci.md.

secrets (Pulumi ESC default)

Default method: Pulumi ESC + GitHub OIDC (id-token: write, pulumi/auth-actions, pulumi/esc-action) so CI does not store long-lived cloud keys in GitHub Secrets.

Follow references/secrets-esc.md. Never print secret values.

split / combine / monorepo

• split: map boundaries → history strategy (git filter-repo preferred) → new remote → CI/secrets/access → update consumers. See references/split.md.
• combine: path prefix plan → history import strategy → unified CI → CODEOWNERS → redirect/archive sources. See references/combine.md.
• monorepo: package layout (apps/packages), task runner, affected CI, ownership, release units. See references/monorepo.md.

Always produce a DAG of migration steps with right-sized tasks (Goldilocks — see kiss).

Done when: the DAG is fully executed, consumer repos and import paths are updated, and CI is green on the new layout. Fan out per-repo inventories to parallel read-only subagents (fast tier) during the survey phase; keep TASKS.md across the migration for any chain longer than five steps.

architecture

Repo-level architecture review (not app feature design):

• Deployable units vs packages vs shared libs
• Boundary rules (who may import whom)
• CI/CD and env topology (dev/staging/prod)
• Recommendation: keep / reshape / split / combine — with risks/benefits

Hand off product/UI feeling to ProductFeeling / Impeccable; docs tree to DocSlime; code structure inside a package to refactor-it.

Standard hygiene (status checklist)

• Default branch, visibility, homepage/topics
• Branch protection / rulesets vs actual required checks
• Workflows present, permissions blocks, action pinning posture
• Secrets: GitHub vs ESC; long-lived credentials remaining
• Dependabot/Renovate, CODEOWNERS, SECURITY.md, license
• Autodelete head branches, squash/rebase policy
• Forks, templates, archive state

For large orgs (many repos), split the audit by repo across parallel read-only subagents (fast tier); verify each before consolidating.

Output

Blocked on me

none

Changed

nothing

Found

Next: <exact skill> (from the recommend above)

Related skills

• Complexity of CI/arch/plan → kiss
• Issues/PRs/milestones → issues / pulls / milestones
• Ship staging/prod → merge-it (Stage/Ship phases per repo policy)
• Agent thrash during migration → agents slap
• Local clutter after history ops → tidy-up
• Lost on whether to split → idk-now then repos architecture

Grounding

This skill’s TTPs are grounded in current engineering baselines (DORA, GitHub Docs, Fowler/Beck, Google SRE & SWE book, OpenTelemetry, OWASP LLM / NIST AI RMF, Diátaxis — see handbook sources.md).

DORA CI + loosely coupled topology; GitHub OIDC / pinned Actions / least privilege for supply-chain baseline; Pulumi ESC is this house’s default over long-lived cloud keys.

Handbook card: handbook/practices/repos.md.