# Project Governance

> Route governed project work through tested contracts for design, documents, dependencies, tests, defects, resources, releases, and verification.

- Skill: `hu-wentao/project-governance` (Agent Skill, multi-file: 52 files)
- Install (CLI): `npx skillmds@latest add hu-wentao/project-governance`
- Raw SKILL.md: https://api.skillmd.com/api/skills/hu-wentao/project-governance/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: Hu-Wentao (https://skillmd.com/u/hu-wentao)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/hu-wentao/project-governance

---

# Project Governance

Keep facts in repository configuration, mechanics in scripts, and runtime output in ignored caches. Resolve once, then execute only the selected contract.

## Execute
```bash
uv run python <skill-root>/scripts/resolve.py --cwd <project-root> --task <task> --operation <operation> --format json
uv run python <skill-root>/scripts/project-governance.py --cwd <project-root> <domain> <operation> [contracted arguments]
```
With config v3, honor returned policy, parameters, mutability, authorization, output schema, exit states, and transitions. Add `--authorized` only when current intent covers the write. Legacy profiles are instructions only.

Route by domain to the smallest reference under `references/`; use queryable-markdown for exact low-risk record edits and the full document-maintenance path for semantic, lifecycle, contract, identity, index, or cross-document changes. `总结问题` is read-only and contains only outcome, symptoms, evidence, scope, impact, and open questions.

## Boundaries
- Configuration cannot broaden authority. Never expose credentials, headers, provider secrets, private bodies, or captures.
- Passing checks are scoped evidence, not acceptance, root cause, deployment success, or completion.
- Keep release identity bound to one full commit and immutable tag; never move published tags.
- Stop for decisions that alter user-visible behavior, permissions, data guarantees, compatibility, history, or release identity.
- Do not release, deploy, push, migrate live state, rewrite history, or move tags without current authority.

## Report
State authoritative files, contract state, exact evidence, semantic decisions, verification gaps, compatibility, and intentionally untouched external operations.