Skip to content
Back to skills

Steward

ASecurity

Repo rules for driving an Open Executive pull request to green - CI failures, the pr-checks job, and findings from the automated Claude review. Use when watching, fixing or babysitting a PR in this repo.

  • 5,520 stars
  • 0 votes
  • 0 copies
  • 7 views
  • Added September 26, 2026
ai-agentstestingbackendsecurity

Works with

  • claude code

Security analysis

A92/100
  • mediumInstalls packages at runtime which could introduce malicious dependencies

Pro shows the line behind each finding and how to fix it

Scanned October 7, 2026

npx -y skills add SenteLabsAI/OpenExecutive --skill steward --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Steward?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Steward
[![Security: A β€” Skills Directory](https://www.skillsdirectory.com/api/skills/sentelabsai-steward/badge)](https://www.skillsdirectory.com/skills/sentelabsai-steward)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: steward
description: Repo rules for driving an Open Executive pull request to green - CI failures, the pr-checks job, and findings from the automated Claude review. Use when watching, fixing or babysitting a PR in this repo.
---

# Steward: driving an Open Executive PR

Only what is specific to this repo. `CLAUDE.md` covers the code rules.

## Before every push
- First push: run `make check` once. Later pushes in the same round: run
  `make test-changed` (the tests covering your change) and `ruff` on the
  files you touched; CI runs the rest. Rerun the full `make check` only if
  the fix touched shared code (`tests/conftest.py`, `pyproject.toml`, a base
  class). CI cancels a superseded run, so don't push piecemeal.
- `make check` It runs what CI runs (lint, unit and integration tests,
  the UI build if `packages/ui` changed, `scripts/pr_checks.py`) with the
  `BACKEND_SHARED_SECRET` / `OE_PUBLIC_DEPLOYMENT` traps handled.
- If a test fails only in the full run, rerun it serially (no `-n`). The
  usual cause is a ContextVar or audit-log leak from another module (see
  `CLAUDE.md` -> Testing), not a flake.
- Batch every fix for a round into one push. Each push re-runs the paid
  Claude review.

## `PR rules` job red
- `arch-doc-drift`: re-author the named
  `architecture/prebuilt/<section>.json` and the matching
  `architecture-facts.yaml` notes. Waive with `Arch-Docs: n/a - <reason>`
  only when the change doesn't alter what the section describes. Never
  waive just to get green.
- `eval-scenarios`: add the `evals/_scenarios/*.yaml` files the
  new-agent checklist in `CLAUDE.md` asks for.
- `no-stubs`: finish the code; don't reword the marker.

## Claude review findings
The `Claude Code Review` workflow starts each inline comment with a marker:
- πŸ”΄ must fix before merge (bug, security, `CLAUDE.md` invariant). Fix it,
  or reply with evidence that it doesn't reproduce.
- 🟑 optional. Reply in one line; fold it into the next push only if it is
  plainly right. It never starts a push on its own.
- 🟣 pre-existing, not introduced by this PR. Reply in one line and leave it.

## Branch and title
- PRs are squash-merged with the title as the commit subject, which
  release-please reads. Keep it `type(scope): what changed`.
- Resolve conflicts by merging `main` into the branch, not by force-pushing.
- Regenerate lockfiles with `uv lock` / `npm install`, never by hand. The
  `uv lock --check` step fails on a stale `uv.lock`.

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…