What you clone
A public-safe template, not someone else’s operations.
The repository ships with example configs, prompts, schemas, scripts, a static landing page, and opinionated docs. Real portfolio data stays local.
How it runs
Scheduled task. CLI scan. Reconciliation. Report.
No public ingest endpoint, no webhook signing, no mandatory database. Start with a repeatable task loop and add complexity only when latency becomes a real problem.
01
Source registry
Map repos, Projects, owners and exception rules through local JSON config.
02
Reconcile with `gh`
Collect repo events, commits, issues, PRs and Project items using GitHub CLI and GraphQL.
03
Append-only journal
Persist only new normalized events. Re-run safely with event IDs and dedupe keys.
04
Exception queue
Flag unregistered work with evidence, severity and a next step.
Public capability catalog
Approved capabilities rendered from a sanitized registry.
Why this shape
Governance without platform drag.
- Open source by default
- Low infrastructure overhead
- Local-first data handling
- Human review before automation expansion
Current limits
Intentional constraints in v0.
- No automatic write-back into source repos
- No external alerting loop yet
- No webhook ingestion in the first phase
- Heuristics need calibration per portfolio