Self Improving Business

Secret Leak Detector

Scans your codebase for accidentally committed secrets: API keys, tokens, passwords, and private keys.

Usage

python scripts/detect_secrets.py --path ./src

Supports detection of: AWS keys (AKIA...), GitHub PATs (ghp_...), OpenAI keys (sk-...), Slack tokens (xoxb-...), and generic high-entropy strings assigned to credential-like variable names.

Self-Improving Business Skill

Log business administration learnings, operational issues, and governance improvements to markdown files for continuous improvement. This skill focuses on business administration operations, cross-functional coordination, process governance, KPI tracking, execution risk, policy consistency, stakeholder communication, and operational decision quality.

CRITICAL: Safety Posture (Reminder-Only)

This skill is documentation and reminder only.

It does not execute or authorize:

• spending approvals
• vendor commitments
• payroll actions
• legal actions
• procurement commitments
• policy sign-offs
• executive approvals

Use this skill to capture structured findings and recommendations. Human owners remain responsible for all high-impact business decisions.

Always require explicit human approval for high-impact decisions, including:

• budget reallocations
• vendor selection or termination
• policy exceptions
• operating model changes
• governance escalations
• staffing or compensation effects

First-Use Initialisation

Before logging anything, ensure the .learnings/ directory and files exist in the project or workspace root. If any are missing, create them:

mkdir -p .learnings
[ -f .learnings/LEARNINGS.md ] || printf "# Business Learnings\n\nBusiness administration learnings across process, governance, KPI tracking, and decision quality.\n\n**Categories**: process_breakdown | policy_gap | kpi_misalignment | decision_latency | handoff_failure | stakeholder_misalignment | documentation_drift | compliance_oversight\n**Areas**: planning | execution | governance | reporting | operations | budgeting | procurement | vendor_management | risk_management | communication\n\n---\n" > .learnings/LEARNINGS.md
[ -f .learnings/BUSINESS_ISSUES.md ] || printf "# Business Issues Log\n\nOperational execution issues, policy inconsistencies, KPI risks, and governance concerns.\n\n---\n" > .learnings/BUSINESS_ISSUES.md
[ -f .learnings/FEATURE_REQUESTS.md ] || printf "# Business Operations Feature Requests\n\nBusiness administration automation and process-improvement requests.\n\n---\n" > .learnings/FEATURE_REQUESTS.md

Never overwrite existing files. This is a no-op if .learnings/ is already initialised.

Do not treat this skill as an approval engine. It is a structured learning and reminder system only.

If you want automatic reminders, use the opt-in workflow in Hook Integration.

Quick Reference

OpenClaw Setup (Recommended)

OpenClaw is the primary platform for this skill. It uses workspace-based prompt injection with automatic skill loading.

Installation

Via ClawdHub (recommended):

clawdhub install self-improving-business

Manual:

git clone https://github.com/jose-compu/self-improving-business.git ~/.openclaw/skills/self-improving-business

Create Learning Files

mkdir -p ~/.openclaw/workspace/.learnings

Then create the log files (or copy from assets/):

• LEARNINGS.md - reusable business learnings and governance improvements
• BUSINESS_ISSUES.md - execution problems, policy misses, and risk items
• FEATURE_REQUESTS.md - requested capabilities for administration workflows

Promotion Targets

When business patterns are broadly applicable, promote them:

Optional: Enable Hook

For automatic reminders at session start:

cp -r hooks/openclaw ~/.openclaw/hooks/self-improving-business
openclaw hooks enable self-improving-business

See references/openclaw-integration.md for complete details.

Generic Setup (Other Agents)

For Claude Code, Codex, Copilot, or other agents, create .learnings/ in the project or workspace root:

mkdir -p .learnings

Create the files inline using the headers shown above.

Agent file reminder

Add a short note in AGENTS.md or CLAUDE.md to log LRN/BUS/FEAT entries and keep this workflow reminder-only with human approval for high-impact decisions.

Logging Format

Learning Entry [LRN-YYYYMMDD-XXX]

Append to .learnings/LEARNINGS.md:

## [LRN-YYYYMMDD-XXX] category

**Logged**: ISO-8601 timestamp
**Priority**: low | medium | high | critical
**Status**: pending
**Area**: planning | execution | governance | reporting | operations | budgeting | procurement | vendor_management | risk_management | communication

### Summary
One-line description of the business learning

### Details
Context of the finding: what happened, which teams were involved, where the process,
policy, KPI definition, or communication failed, and what improved outcome is expected.

### Recommended Action
Specific process correction, governance control, KPI definition update, or cadence change.
Reminder-only: this does not execute approvals.

### Metadata
- Source: meeting_review | retrospective | dashboard_audit | vendor_sync | finance_review | incident_postmortem
- Stakeholders: operations | finance | procurement | legal | hr | product | sales
- Related Files: path/to/process.md, path/to/report.csv
- Tags: tag1, tag2
- See Also: LRN-20260413-001
- Pattern-Key: ops.handoff_failure | kpi.definition_mismatch (optional)
- Recurrence-Count: 1 (optional)
- First-Seen: 2026-04-13 (optional)
- Last-Seen: 2026-04-13 (optional)

---

Categories for learnings:

Business Issue Entry [BUS-YYYYMMDD-XXX]

Append to .learnings/BUSINESS_ISSUES.md:

## [BUS-YYYYMMDD-XXX] issue_type

**Logged**: ISO-8601 timestamp
**Priority**: critical | high | medium | low
**Status**: pending
**Area**: planning | execution | governance | reporting | operations | budgeting | procurement | vendor_management | risk_management | communication
**Severity**: critical | high | medium | low

### Summary
Brief description of the business issue

### Issue Details
What happened, why it matters, where dependencies broke, and what operational risk emerged.
Keep this as a documented finding and recommendation; this skill does not execute decisions.

### Impact Assessment
- Affected functions and owners
- KPI or SLA impact estimate
- Cost or budget impact range
- Governance or compliance implication

### Recommended Action
- Immediate containment steps
- Owner + escalation path
- Long-term process hardening
- Human approval required for any high-impact decisions

### Timeline
- **Identified**: ISO-8601
- **Escalated**: ISO-8601 (if applicable)
- **Resolved**: ISO-8601 (if applicable)

### Metadata
- Trigger: sla_miss | approval_delay | raci_conflict | kpi_variance | budget_alert | handoff_block | policy_missing | audit_finding | dependency_blocked
- Stakeholders: operations | finance | procurement | vendor_management | compliance | leadership
- Related Files: path/to/doc
- See Also: BUS-20260413-001

---

Feature Request Entry [FEAT-YYYYMMDD-XXX]

Append to .learnings/FEATURE_REQUESTS.md:

## [FEAT-YYYYMMDD-XXX] capability_name

**Logged**: ISO-8601 timestamp
**Priority**: medium
**Status**: pending
**Area**: planning | execution | governance | reporting | operations | budgeting | procurement | vendor_management | risk_management | communication

### Requested Capability
What business administration capability is needed

### Business Justification
Why it improves speed, quality, policy consistency, or risk reduction

### Complexity Estimate
simple | medium | complex

### Suggested Implementation
How this could be built: workflow automation, dashboard guardrails, dependency tracker,
handoff checklist, policy linting, governance workflow reminders.

### Metadata
- Frequency: first_time | recurring
- Related Features: existing_tool_or_feature
- Benefit: cycle_time | decision_quality | risk_reduction | policy_consistency

---

ID Generation

Format: TYPE-YYYYMMDD-XXX

• TYPE: LRN (learning), BUS (business issue), FEAT (feature request)
• YYYYMMDD: Current date
• XXX: Sequential number or random 3 chars (for example 001, A7B)

Examples: LRN-20260413-001, BUS-20260413-A3F, FEAT-20260413-002

Resolving Entries

When an issue is resolved, update the entry:

1. Change **Status**: pending to **Status**: resolved
2. Add a resolution block after Metadata:

### Resolution
- **Resolved**: 2026-04-13T09:00:00Z
- **Action Taken**: Brief description of process or governance fix
- **Artifact Updated**: Playbook/checklist/KPI registry/RACI/cadence reference
- **Verified By**: operations review | finance review | governance committee | internal audit

Other status values:

• in_progress - actively being remediated
• wont_fix - risk accepted with documented rationale and human approver
• promoted - elevated to permanent business operating artifacts
• promoted_to_skill - extracted as reusable skill

Detection Triggers

Automatically log when you encounter:

Execution Signals (learning or business issue):

• missed SLA on committed deliverable
• overdue approval at decision gate
• repeated dependency blocked status
• handoff without complete acceptance criteria

Governance Signals (learning or business issue):

• policy exists but team follows outdated practice
• control owner unknown or contested
• RACI accountability conflict between teams
• governance board receives contradictory status reports

KPI Signals (learning):

• KPI definition mismatch across dashboards
• variance unexplained beyond tolerance band
• lagging metrics reported as leading indicators

Budget and Procurement Signals (business issue):

• budget overrun warning without mitigation owner
• purchase request bypasses policy threshold
• vendor onboarding stalled at approval handoff

Compliance and Documentation Signals (learning):

• audit issue reveals missing process evidence
• runbook differs from actual operational behavior
• required approval record missing for material decision

Priority Guidelines

Area Tags

Use these areas to classify learnings:

Promoting to Permanent Business Standards

When a learning is broadly applicable, promote it to business administration standards.

When to Promote

• the same process breakdown recurs across teams
• policy gap repeatedly creates execution risk
• KPI definition issue causes repeated reporting conflicts
• decision latency appears in multiple planning or governance cycles
• handoff failures recur with shared root causes

Promotion Targets

How to Promote

1. Distill the finding into concise and reusable operational guidance
2. Add it to the correct target artifact
3. Update original entry:
   • set **Status**: promoted
   • add **Promoted**: process_playbook (or other target)
4. confirm human owner for adoption and enforcement

Promotion Examples

Learning to governance checklist:

Overdue approvals repeatedly blocked procurement. Added checklist rule: "Any approval older than 48h triggers escalation to backup approver."

Learning to KPI registry:

Revenue-at-risk definition mismatched between sales and finance. Registered canonical formula and source system for both teams.

Recurring Pattern Detection

If logging something similar to an existing entry:

1. Search first: rg "keyword" .learnings/
2. Link entries with **See Also**
3. Increment recurrence fields
4. Raise priority if impact is increasing
5. Trigger systemic fix proposal when recurrence exceeds threshold

Recurring business patterns usually indicate one or more root causes:

• missing process control
• weak policy communication
• unclear ownership model
• inconsistent KPI definition
• brittle cross-team handoff protocol
• insufficient governance cadence

Simplify/Harden Feed

Keep incoming signals easy to process, and harden the learning feed against noise.

Simplify Rules

• prefer one clear issue statement per entry
• include only evidence needed for a decision
• use standard categories and area tags
• avoid duplicating the same incident in multiple files
• route uncertain items to pending with explicit open questions

Harden Rules

• require source attribution in metadata
• require owner and next action for high and critical
• require explicit approval note for wont_fix
• require recurrence tracking for repeated issues
• require status updates before review meetings

Periodic Review

Review .learnings/ at operational checkpoints.

When to Review

• before weekly operating review
• before monthly business review
• before quarterly planning cycle
• before budget review forums
• after major incident retrospectives
• before governance committee decisions

Quick Status Check

rg "Status\\*\\*: pending" .learnings/*.md | wc -l
rg "Priority\\*\\*: critical|Priority\\*\\*: high" .learnings/*.md
rg "Area\\*\\*: budgeting|Area\\*\\*: procurement" .learnings/*.md
rg "Category\\*\\*:|\\] process_breakdown|\\] decision_latency" .learnings/*.md

Review Actions

• close resolved entries and capture verification evidence
• merge duplicates and strengthen canonical entries
• promote proven patterns to permanent artifacts
• add or adjust operating cadence for recurring issues

Hook Integration

Enable automatic reminders through hooks. This is opt-in.

Quick Setup (Claude Code / Codex)

Create .claude/settings.json:

{
  "hooks": {
    "UserPromptSubmit": [{
      "matcher": "",
      "hooks": [{
        "type": "command",
        "command": "./skills/self-improving-business/scripts/activator.sh"
      }]
    }]
  }
}

This injects a business-administration reminder after each prompt.

Advanced Setup (With Pattern Detection)

{
  "hooks": {
    "UserPromptSubmit": [{
      "matcher": "",
      "hooks": [{
        "type": "command",
        "command": "./skills/self-improving-business/scripts/activator.sh"
      }]
    }],
    "PostToolUse": [{
      "matcher": "Bash",
      "hooks": [{
        "type": "command",
        "command": "./skills/self-improving-business/scripts/error-detector.sh"
      }]
    }]
  }
}

Enable PostToolUse only if you want command output pattern reminders.

Available Hook Scripts

See references/hooks-setup.md for details.

Automatic Skill Extraction

When a learning becomes stable and reusable, extract it into a dedicated skill.

Skill Extraction Criteria

Extraction Workflow

1. identify candidate entry
2. run helper:

   ./skills/self-improving-business/scripts/extract-skill.sh skill-name --dry-run
   ./skills/self-improving-business/scripts/extract-skill.sh skill-name
   

3. customize generated SKILL.md
4. update source entry status to promoted_to_skill
5. verify no transactional instructions were embedded

Multi-Agent Support

Regardless of agent, apply this workflow when you:

1. coordinate cross-functional delivery with dependencies
2. track KPI quality and reporting consistency
3. manage policy-governed approvals and exceptions
4. monitor budget, procurement, and vendor execution
5. document risk controls and escalation outcomes
6. resolve stakeholder alignment and communication gaps

Business Administration Best Practices

1. keep ownership explicit and visible in each entry
2. separate signal from symptom using root-cause notes
3. normalize KPI definitions before target discussions
4. document decision deadlines and escalation rules
5. review RACI regularly for contested responsibilities
6. harden handoffs with acceptance criteria and evidence
7. tie governance controls to actual operating cadences
8. use consistent tags for reporting and searchability
9. require human approval for high-impact decisions
10. avoid turning reminders into hidden execution commands

Gitignore Options

Keep learnings local when entries include sensitive business context:

.learnings/

Hybrid option (track structure, ignore contents):

.learnings/*.md
!.learnings/.gitkeep

Track learnings in-repo only when content is sanitized and approved for sharing.

Final Reminder

This skill is a structured memory and improvement mechanism. It does not approve, execute, sign, spend, commit, or authorize business actions. Use it to improve clarity and decision quality, and require human approval for high-impact outcomes.

Stackability Contract (Standalone + Multi-Skill)

This skill is standalone-compatible and stackable with other self-improving skills.

Namespaced Logging (recommended for 2+ skills)

• Namespace for this skill: .learnings/business/
• Keep current standalone behavior if you prefer flat files.
• Optional shared index for all skills: .learnings/INDEX.md

Required Metadata

Every new entry must include:

**Skill**: business

Hook Arbitration (when 2+ skills are enabled)

• Use one dispatcher hook as the single entrypoint.
• Dispatcher responsibilities: route by matcher, dedupe repeated events, and rate-limit reminders.
• Suggested defaults: dedupe key = event + matcher + file + 5m_window; max 1 reminder per skill every 5 minutes.

Narrow Matcher Scope (business)

Only trigger this skill automatically for business signals such as:

• kpi|revenue|margin|strategy|roadmap
• pricing|forecast|market shift|business case
• explicit business intent in user prompt

Cross-Skill Precedence

When guidance conflicts, apply:

1. security
2. engineering
3. coding
4. ai
5. user-explicit domain skill
6. meta as tie-breaker

Ownership Rules

• This skill writes only to .learnings/business/ in stackable mode.
• It may read other skill folders for cross-linking, but should not rewrite their entries.