What problem does it solve?
When a child thread is asked to review, triage, or advise on an external GitHub PR or issue, it is easy to act on unverified assumptions: trusting the thread title for PR identity, misjudging who should fix what, or writing review verdicts without maintainer authority. This Skill enforces a fail-closed workflow that grounds every judgment in provider-verified facts before any action is taken.
Core Features & Use Cases
- Provider-neutral grounding: Uses the deployment's provider adapter (e.g.,
gh for GitHub) to resolve the external object into verified fields such as providerSubject, headSha, verifiedAuthorIdentity, and authenticatedRole before any judgment.
- Custody and identity matrix: Compares verified author identity against the authenticated contributor identity and role to decide who reviews, who fixes, and who merges, with fail-closed handling for bots, ambiguous authors, and missing authentication.
- Maintainer five-question adoption framework: Structures adopt/reject/advisory-only decisions around problem fit, vision alignment, adoption path, and custody boundaries, all citing grounded fields.
- Reverse provenance verification: Separates external object verification from internal thread provenance, grading evidence as
origin, related, or unknown and recording verified PR/issue metadata via cat_cafe_set_thread_metadata.
- Use Case: A maintainer receives a community PR on their repository. The child thread loads this Skill, runs
gh to verify the PR and author, determines the authenticated identity is a maintainer, answers the five adoption questions, registers tracking only if genuinely blocked, and routes the fix back to the external author.
Quick Start
Load the opensource-ops skill in the child thread and ground the external PR or issue with the provider adapter before making any review or custody decision.
