Skip to content
Back to skills

signum

ASecurity

Use when the user wants contract-first development — define correctness before coding, implement against a contract, audit with multiple models, and package proof artifacts.

  • 18 stars
  • 0 votes
  • 0 copies
  • 1 view
  • Added May 27, 2026
data-aici/cd

Security analysis

A100/100

Pro scans all 20 files and shows the line behind each finding

Scanned May 27, 2026

npx -y skills add heurema/signum --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of signum?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for signum
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/heurema-signum/badge)](https://www.skillsdirectory.com/skills/heurema-signum)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: signum
description: Use when the user wants contract-first development — define correctness before coding, implement against a contract, audit with multiple models, and package proof artifacts.
---

# Signum — Evidence-Driven Development Pipeline

Run a CONTRACT → EXECUTE → AUDIT → PACK pipeline for any implementation task.

## When to Use

- User asks to "implement X" and you want verifiable correctness
- Task requires multi-model code review
- Changes need proof artifacts for CI/CD gates
- Risk is medium-high and ad hoc coding is insufficient

## Pipeline

1. **CONTRACT** — Turn the request into a verifiable contract with acceptance criteria
2. **EXECUTE** — Implement against the contract, not a vague prompt
3. **AUDIT** — Deterministic checks (lint, test, scope) + optional multi-model review
4. **PACK** — Package into a proofpack artifact with verdict (AUTO_OK / HUMAN_REVIEW / AUTO_BLOCK)

## Core Rules

- Do not start implementation before a contract exists
- If the contract is vague, stop and improve it
- Check against deterministic criteria, not just model opinion
- Keep active run/pipeline artifacts under `.signum/contracts/<contractId>/`
- Treat root `.signum/` as the registry/state/archive/compatibility namespace, not the canonical per-run artifact root
- If reduced audit coverage on medium/high-risk task → HUMAN_REVIEW, not AUTO_OK

Files in this skill

  • .claude-plugin/marketplace.json255 B
  • .claude-plugin/plugin.json416 B
  • .codex-plugin/plugin.json1.2 KB
  • .pre-commit-config.yaml286 B
  • AGENTS.md5.3 KB
  • ARCHITECTURE.md4.8 KB
  • CHANGELOG.md36.4 KB
  • CODE_OF_CONDUCT.md4.9 KB
  • CONTRIBUTING.md5.6 KB
  • DCO.md1.3 KB
  • QUICKSTART.md6.5 KB
  • SECURITY.md1.5 KB
  • SKILL.md1.4 KB
  • SUPPORT.md823 B
  • TRADEMARKS.md1.5 KB
  • agents/contractor.md19.2 KB
  • agents/engineer.md12.7 KB
  • agents/init-synthesizer.md6.7 KB
  • agents/reviewer-claude.md4 KB
  • agents/synthesizer.md13.9 KB

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.