Journal Entry Creator
Create structured journal entries with YAML frontmatter, template-based sections, and compliance validation. Use when user asks to 'create journal entry', 'new journal', 'document [topic]', 'journal about [topic]', or needs to create timestamped .md files in YYYY/MM/ directories. Supports six entry types: general journal entries, troubleshooting sessions, learning notes, article summaries, ticket-refinement sessions, and ticket-kickoff sessions. Keywords: journal, documentation, troubleshooting, learning, article-summary, ticket-refinement, ticket-kickoff, YAML frontmatter, template schemas, validation.
npx tessl install pantheon-ai/journal-entry-creatornpx skills add github:pantheon-org/tekhne --skill documentation--journal-entry-creatorAutomate creation of structured journal entries with template schemas, frontmatter validation, and compliance checking.
Mindset
Every entry is a durable, queryable record, not a scratch note: get the frontmatter, triple-synced dates, and structure right the first time so future search and tooling can rely on them. Know when not to use this skill: a throwaway note with no frontmatter needs no ceremony.
Prerequisites
This skill is a companion to the journal CLI and is normally installed by it
(pantheon-journal skill install). Its features split into two tiers:
- Self-contained (no binary needed): interactive gathering, entry-type
selection, entry authoring, and structural validation via the bundled
scripts/validate-journal-entry.sh. - CLI-backed (require the
journalbinary onPATH): corpus-wide tag lint (pantheon-journal lint) and any otherpantheon-journalsubcommand this skill references.
Before running any journal ... command, confirm the binary is present:
pantheon-journal --version
If it is missing, the skill was installed without its companion CLI. Install the
journal CLI (its release binary, or cargo install), then retry. Until then,
skip the CLI-backed steps; the self-contained workflow still applies.
When to Use This Skill
Use journal-entry-creator when:
- Documentation requirement: User explicitly asks to “create journal entry”, “document this”, or “write about [topic]”
- Structured output needed: Standard journal workflows require YAML frontmatter, triple-sync dates, and template compliance
- Multiple entry types: Need to select between troubleshooting, learning, article summary, or general journal
- Validation critical: Entry must pass compliance checks before commit (automated validation available)
Do NOT use for:
- Quick markdown notes without frontmatter (use simple file creation instead)
- External documentation systems (Confluence, Notion) — this skill is for local .md files only
- Retrospective backfilling of frontmatter across many old entries: use
pantheon-journal backfillfor that one-pass batch repair instead
Entry Type Selection
Decision criteria:
- Problem resolution? → Troubleshooting
- New knowledge/skills? → Learning
- External content summary? → Article Summary
- Fleshing out or amending a ticket (refinement prep, backlog grooming)? → Ticket Refinement
- Understanding a ticket before starting work on it (pull CoS/AC, spot gaps, build a work checklist and Proof of Work plan)? → Ticket Kickoff
- Otherwise → Journal Entry
| User Intent Signals | Type | Template | Required Tag |
|---|---|---|---|
| “error”, “fix”, “resolved”, “incident” | Troubleshooting | troubleshooting.yaml |
troubleshooting |
| “learned”, “tutorial”, “discovered” | Learning | learning.yaml |
learning |
| URL/source, “read”, “watched”, “summarize” | Article Summary | article-summary.yaml |
article/video/podcast/talk |
| “refine”, “flesh out”, “groom”, “amend ticket” | Ticket Refinement | ticket-refinement.yaml |
ticket-refinement |
| “pull the ticket”, “kickoff”, “start [ticket]”, “what needs to happen”, “work checklist”, “proof of work” | Ticket Kickoff | ticket-kickoff.yaml |
ticket-kickoff |
| General documentation, investigation | Journal Entry | journal-entry.yaml |
(flexible) |
Trade-off: When intent is ambiguous, prefer the more specific type (Troubleshooting > Ticket Refinement > Ticket Kickoff > Learning > General).
Ticket Refinement vs Ticket Kickoff: Refinement rewrites an under-specified ticket’s description (the ticket is the problem). Kickoff assumes the ticket is already implementation-ready and instead plans the work — a checklist and a Proof of Work plan (the work ahead is the subject). If a kickoff surfaces gaps serious enough to need rewriting, switch to — or first do — a Ticket Refinement.
Template Schema System
MANDATORY - READ BEFORE PROCEEDING:
Before generating any entry, you MUST read the complete template schema file:
# Based on entry type selected, read ENTIRE file:
skills/journal-entry-creator/assets/templates/troubleshooting.yaml
skills/journal-entry-creator/assets/templates/learning.yaml
skills/journal-entry-creator/assets/templates/article-summary.yaml
skills/journal-entry-creator/assets/templates/ticket-refinement.yaml
skills/journal-entry-creator/assets/templates/ticket-kickoff.yaml
skills/journal-entry-creator/assets/templates/journal-entry.yaml
Do NOT generate entries without loading the schema first. The schema defines required sections, frontmatter fields, heading hierarchy, and validation rules.
When to load references:
- Load schema: ALWAYS before creating entry (mandatory)
- Load
compliance.md: Only if validation fails and you need detailed rules - Load
edge-cases.md: Only for complex or unusual edge cases - Load
example-*.md: Only if user asks for examples or you need clarification on structure - Do NOT load:
journal-command.md(superseded by this skill)
Domain-Specific Compliance Rules
Beyond standard markdown, this journal system enforces:
Date Consistency (Triple Sync)
All three must match exactly:
- Filename:
2025-02-24-topic.md(slug lowercase-only) - Frontmatter:
date: 2025-02-24 - H1 title:
# Topic - February 24, 2025(Month D, YYYY format)
Location Hierarchy
File must be in YYYY/MM/ directory matching its date:
2025-02-24-*.md→ Must be in2025/02/2025-11-05-*.md→ Must be in2025/11/
Single H1 Format
Exactly ONE H1 in the entire document with precise format:
# [Title] - [Month D, YYYY]
Not allowed:
- Multiple H1 headings
- H1 without date
- Wrong date format (YYYY-MM-DD in H1)
Tag Consistency
Tags must:
- Match between frontmatter array and final
## Tagssection - Be lowercase with hyphens (not underscores, not camelCase)
- Include entry type tag when required (troubleshooting, learning, article/video/podcast/talk)
- Prefer the canonical vocabulary defined in the taxonomy (see below)
Example:
tags:
- troubleshooting
- api-gateway
- aws-lambda
Must match:
## Tags
`troubleshooting` | `api-gateway` | `aws-lambda`
Tag Taxonomy (Controlled Vocabulary)
Beyond tag shape, this system maintains a controlled tag vocabulary to keep
the corpus queryable and prevent tag sprawl. The vocabulary lives in a
taxonomy.json at the journal root (a generic default ships with the skill under
assets/taxonomy.default.json; its shape is documented in
assets/schemas/taxonomy.schema.json).
The taxonomy defines:
facets: named groups of canonical tags (for exampletype,tech,topic).aliases: non-canonical spellings that collapse onto a canonical one (for exampleteamsbecomesms-teams).threshold: how many times an unfaceted tag may appear before it is flagged.ticketPattern: the regex that marks issue-tracker keys, which are exempt.
When choosing tags for an entry, prefer a tag already listed in a facet, and
prefer a canonical spelling over a near-duplicate. Corpus-wide tag hygiene is
checked separately from single-entry validation by the CLI (requires the
journal binary; see Prerequisites):
pantheon-journal lint # advisory: alias suggestions and unfaceted tags
pantheon-journal lint --strict # non-zero exit on findings (for CI)
lint is advisory and never rewrites the taxonomy or an entry; it reports
candidates for a human to fold into taxonomy.json.
The corpus can also be indexed into a queryable NDJSON source of truth plus a rendered markdown browse view (grouped by recent, month, type, tag, and ticket):
pantheon-journal index # writes docs/journal-index.{ndjson,md}
pantheon-journal index --validate # check the committed index, do not regenerate
Code Block Language Specifiers
ALL code blocks MUST have language identifiers. No bare triple backticks allowed.
Valid:
```bash
git status
```
Invalid:
```
git status
```
Assets / Screenshots Convention
Each entry that includes screenshots or attachments MUST use an entry-specific sibling directory:
YYYY/MM/YYYY-MM-DD-slug.md ← entry file
YYYY/MM/YYYY-MM-DD-slug/assets/ ← entry assets (gitignored, local-only)
Reference assets in markdown with a relative path from the entry file:

Why: A shared screenshots/ or assets/ directory at the month level causes filename collisions
when multiple entries use the same numbering scheme (e.g. 01-cloudwatch-alarm.png). Scoping assets
under the entry slug directory makes every path unique.
Note: The assets/ directories are gitignored — screenshots are local-only. The markdown image
references are tracked in git as documentation of what evidence was captured.
Proposed Ticket Description (Ticket-Refinement Entries)
Applies to ticket-refinement sessions: fleshing out or amending an issue-tracker ticket (refinement prep, backlog grooming, turning a one-line ticket into a refinement-ready one). Use the ticket-refinement.yaml type.
HARD RULE: this skill NEVER edits the ticket directly. The amended ticket content lives inside the journal entry as a ready-to-paste markdown block. Applying it to the tracker is a separate step the user explicitly confirms, performed outside this skill.
When an entry refines a ticket, you MUST:
- Set
refinement_ticket: <KEY>in the frontmatter (e.g.refinement_ticket: TICKET-123). Use this field, notjira_ticket— the deliverable is a ticket description, not a comment. - Add a
## Proposed Ticket Descriptionsection holding the full amended description inside a fenced markdown block:
## Proposed Ticket Description
Draft for TICKET-123 - review before applying; not yet applied to the ticket.
```markdown
**Summary:** <one-line summary>
**Background**
<full, self-contained amended ticket description>
```
Rules for the proposed description:
- It is a DRAFT and has NOT been applied. Lead with a
Draft for [TICKET] - review before applying; not yet applied.line, and never write it to the tracker from this skill. - It MUST sit inside a fenced code block with a language specifier so it copies verbatim and its inner headings do not become document headings (this keeps the single-H1 rule intact). Use a 4-backtick outer fence when the ticket content itself contains 3-backtick code blocks.
- It must be self-contained: a ticket reader has not seen the journal entry, so the description stands on its own.
- Follow your team’s ticket-writing standard if one exists.
- If the work touches regulated or personal data, state the constraint and route final sign-off to the appropriate function.
The validator (validate-journal-entry.sh) enforces this: when refinement_ticket is present in frontmatter, a ## Proposed Ticket Description section is required. It is a no-op when the field is absent, so other entries are unaffected.
Ticket Kickoff (Understanding a Ticket Before Starting Work)
Applies to ticket-kickoff sessions: understanding an issue-tracker ticket before implementation, distinct from Ticket Refinement (kickoff plans work assuming the ticket is implementation-ready; it never rewrites the ticket description). Use ticket-kickoff.yaml. Setting kickoff_ticket: <KEY> makes five sections REQUIRED (enforced by the validator, no-op otherwise). Full requirements, examples, and the “never leave Open Questions blank” rule: Ticket Kickoff Rules.
Continuation Links (Multi-Entry Investigations)
Applies to ANY entry type when work spans more than one dated entry. Never fold a later day’s narrative into an earlier entry inline — create a new dated entry and link both directions with continues_from/continued_by frontmatter so a reader landing on either finds the other. Validated bidirectionally, no-op when unset. Full frontmatter/banner/section requirements and the markdown pattern: Continuation Links.
Executive Summary (Optional, Any Entry Type)
Optional, at the author’s discretion. Fixed placement: MUST be the H2 immediately after ## Session Overview, before every other section — enforced by the validator, no-op when absent. Keep it short: problem, why it’s non-trivial, options, ask.
Success Criteria & Validation Rules
Entry is complete when ALL criteria are met:
Critical violations (NEVER):
- Using emojis, bare code blocks (without language), or skipping heading levels
- Creating entries without reading template schema first
- Proceeding with failed validation or overwriting files without confirmation
Triple sync validation:
- ✅ File location:
YYYY/MM/YYYY-MM-DD-slug.md(orYYYY/MM/YYYY-MM-DD-JIRA-TICKET-slug.mdfor troubleshooting with ticket) - ✅ YAML frontmatter with all required fields
- ✅ Date consistency: filename = frontmatter = H1 title
- ✅ Tag consistency: frontmatter array = Tags section
- ✅ All required sections present per schema, including type-specific ones (
refinement_ticket/kickoff_ticketsections; reciprocalcontinues_from/continued_bylinks;## Executive Summaryimmediately after## Session Overviewif present) - ✅ Validation script passes with zero errors
- ✅ Prettier formatting and markdownlint pass
Four-Phase Workflow
Phase 1: Interactive Gathering
Principles (high freedom):
- Be conversational and adaptive
- Extract meaningful keywords for slug generation
- Identify entry type from context clues
- Default to current date unless user specifies otherwise
Key questions to ask:
- Topic/issue being documented
- Entry type (or infer from context)
- Date (default: today)
- Type-specific context per table above
Slug generation: Extract 3-6 meaningful keywords (see Phase 3 for detailed rules)
Phase 2: Schema Loading (MANDATORY)
Low freedom - exact steps:
- Determine entry type from Phase 1
- Read complete template schema file (troubleshooting.yaml, learning.yaml, article-summary.yaml, ticket-refinement.yaml, ticket-kickoff.yaml, or journal-entry.yaml)
- Review required sections, frontmatter fields, and structure order
- Do NOT proceed without schema loaded
Fallback: If schema file missing or unreadable, STOP and report error. Do not guess structure.
Phase 3: Generation
Medium freedom - guided by schema:
- Create directory if needed:
mkdir -p YYYY/MM - Generate filename using slug principles below:
- Troubleshooting with Jira ticket:
YYYY-MM-DD-JIRA-TICKET-slug.md(e.g.2026-04-07-proj-1234-verify-details-alarm.md) - All other entries:
YYYY-MM-DD-slug.md
- Troubleshooting with Jira ticket:
- Populate YAML frontmatter per schema requirements
- Create metadata block with bold keys
- Fill all required sections from schema in correct order
- Add code blocks with language specifiers
- Create Tags section matching frontmatter
- Write file to correct location
Slug generation principles:
- Extract 3-6 meaningful keywords from topic/title
- Remove common words (“the”, “a”, “and”, “for”, “with”, “to”)
- MUST be lowercase-only with hyphens (NO uppercase/underscores)
- Target 30-50 characters for readability
- Troubleshooting + Jira ticket: prefix slug with the ticket ID in lowercase:
YYYY-MM-DD-proj-1234-slug.md - Do NOT include the Jira ticket again in the slug — it appears once as the prefix only
- Examples:
2026-04-07-proj-1234-verify-details-alarm,opencode-killed-process-fix,aws-bedrock-inventory
Phase 4: Validation & Formatting (LOW FREEDOM)
Exact commands in sequence:
# 1. Validate structure
bash skills/journal-entry-creator/scripts/validate-journal-entry.sh YYYY/MM/YYYY-MM-DD-slug.md
# 2. Format (only if validation passes)
npx prettier --write YYYY/MM/YYYY-MM-DD-slug.md
# 3. Lint and auto-fix
npx markdownlint-cli2 YYYY/MM/YYYY-MM-DD-slug.md --fix
# 4. Re-validate to confirm
bash skills/journal-entry-creator/scripts/validate-journal-entry.sh YYYY/MM/YYYY-MM-DD-slug.md
If validation fails:
- Show specific errors to user
- Fix automatically where safe (formatting, code block languages, heading hierarchy)
- Ask user for clarification on content issues (missing sections, unclear context)
- Re-run validation after fixes
- Do NOT proceed to git commit if validation fails
Edge Case Handling
Common scenarios: File exists, date mismatch, schema missing, validation failures, custom structure requests.
Quick reference:
- File exists: Ask to overwrite or suggest alternative filename
- Date mismatch: Confirm intended date, update all three locations
- Schema missing: STOP immediately, list available schemas
- Validation fails: Auto-fix formatting issues, ask user for content clarifications
For detailed resolution strategies: Load skills/journal-entry-creator/references/edge-cases.md only when encountering an unusual or complex edge case.
Git Integration (Optional)
After successful validation, offer to commit:
git add YYYY/MM/YYYY-MM-DD-slug.md
git commit -m "Add journal entry: [Brief Description] (YYYY-MM-DD)"
Commit message format:
- Prefix:
Add journal entry: - Brief description (30-50 chars)
- Date in parentheses (YYYY-MM-DD)
- Example:
Add journal entry: OpenCode process fix (2025-02-24)
Anti-Patterns
NEVER create entries without reading the template schema first
- WHY: guessing structure leads to validation failures and missing required sections.
- BAD: immediately write journal entry based on assumptions about structure.
- GOOD:
cat skills/journal-entry-creator/assets/templates/troubleshooting.yamlfirst, review required fields, then generate.
NEVER proceed with failed validation
- WHY: invalid entries break parsing tools and violate compliance rules.
- BAD: validation script shows 3 errors → ignore and commit anyway.
- GOOD: fix all validation errors (or ask user for clarification), re-run validation until passing, then commit.
NEVER use bare code blocks without language specifiers
- WHY: bare triple backticks fail markdownlint and reduce syntax highlighting readability.
- BAD:
```\ngit status\n```(no language). - GOOD:
```bash\ngit status\n```(explicit language).
NEVER create date mismatches between filename, frontmatter, and H1
- WHY: triple sync requirement ensures consistency; mismatches cause directory placement errors and broken date queries.
- BAD: filename
2025-02-24-*.md, frontmatterdate: 2025-02-25, H1March 1, 2025. - GOOD: all three match exactly -
2025-02-24in filename,date: 2025-02-24in frontmatter,February 24, 2025in H1.
NEVER edit the ticket directly when refining it
- WHY: this skill produces a reviewable draft; applying changes to the tracker is a separate, user-confirmed step outside the skill.
- BAD: refine a ticket and push the edit straight to the issue tracker.
- GOOD: set
refinement_ticketand put the amended content in a## Proposed Ticket Descriptionfenced block; the user applies it separately.
NEVER skip a required ticket-kickoff section or fold a later day’s work into an old entry
- WHY: a kickoff entry’s value is a complete, checkable record; a folded-in “Update (DD-MM-YYYY)” paragraph breaks the single-date H1 and buries current status.
- BAD: skip
## Open Questions & Gaps; append today’s continued work as a new paragraph in yesterday’s entry. - GOOD: set
kickoff_ticketand populate all five required sections (None identifiedwhen nothing is open); for multi-day work, create a new dated entry and link both directions per “Continuation Links”.
NEVER place Executive Summary anywhere other than immediately after Session Overview
- WHY: a fixed position means a reader always finds it in the same place across every entry; the validator fails otherwise.
- BAD: add
## Executive Summaryafter## Contextor near the end of the document. - GOOD: place it as the H2 immediately following
## Session Overview, before every other section.
References
Template Schemas (assets/templates/)
journal-entry.yaml- General purpose entriestroubleshooting.yaml- Problem resolution sessionslearning.yaml- Knowledge acquisition documentationarticle-summary.yaml- External content summariesticket-refinement.yaml- Issue-tracker ticket refinement (amended ticket captured in-entry, never written to the tracker)ticket-kickoff.yaml- Issue-tracker ticket kickoff (CoS/AC, gaps, supporting info, work checklist, Proof of Work plan)
Load with relative paths: skills/journal-entry-creator/assets/templates/[file]
Scripts (scripts/)
validate-journal-entry.sh- Compliance validation (run before commit)
References (references/)
compliance.md- Detailed validation rules (load only if validation fails)edge-cases.md- Detailed edge case resolution strategies (load only for complex scenarios)example-journal-entry.md- Real entry example (load only if user asks)example-with-frontmatter.md- Frontmatter example (load only if needed)journal-command.md- Legacy workflow (superseded, do not use)
Expert-only knowledge the AI couldn't derive on its own — domain-specific patterns, production gotchas, decision frameworks, and non-obvious tool behaviour. High scores mean <5% redundancy with what the model already knows.
A clear philosophy plus numbered step-by-step workflows with explicit entry/exit points. Should answer: what is the core principle, how to execute it, and when (and when not) to apply it.
Explicit NEVER/WHY/consequence triplets with side-by-side bad/good examples. Generic warnings score low — concrete failure modes with real impact (security, correctness, performance) score high.
Proper frontmatter, single-task focus, activation keywords, and cross-harness portability. Skills must work across 40+ agentic harnesses without hardcoded paths or agent-specific references.
SKILL.md as a <100-line navigation hub pointing to focused references/ files. Content should be lazy-loaded on demand, not front-loaded. Includes actionable 'When to Use' conditions per reference.
Appropriate rigidity for the skill type: strict rules for critical/security skills, balanced steps for process skills, flexible options for tool skills. Mismatched calibration (too rigid or too loose) reduces score.
Rich activation keywords and trigger scenarios in the description so the skill fires when needed. Best descriptions read like an exhaustive list of the tasks and concepts that should invoke this skill.
Copy-paste-ready code, complete runnable examples, real file paths and commands. Pseudocode and abstract descriptions score low — concrete, executable content scores high.
Expert-only knowledge the AI couldn't derive on its own — domain-specific patterns, production gotchas, decision frameworks, and non-obvious tool behaviour. High scores mean <5% redundancy with what the model already knows.
A clear philosophy plus numbered step-by-step workflows with explicit entry/exit points. Should answer: what is the core principle, how to execute it, and when (and when not) to apply it.
Explicit NEVER/WHY/consequence triplets with side-by-side bad/good examples. Generic warnings score low — concrete failure modes with real impact (security, correctness, performance) score high.
Proper frontmatter, single-task focus, activation keywords, and cross-harness portability. Skills must work across 40+ agentic harnesses without hardcoded paths or agent-specific references.
SKILL.md as a <100-line navigation hub pointing to focused references/ files. Content should be lazy-loaded on demand, not front-loaded. Includes actionable 'When to Use' conditions per reference.
Appropriate rigidity for the skill type: strict rules for critical/security skills, balanced steps for process skills, flexible options for tool skills. Mismatched calibration (too rigid or too loose) reduces score.
Rich activation keywords and trigger scenarios in the description so the skill fires when needed. Best descriptions read like an exhaustive list of the tasks and concepts that should invoke this skill.
Copy-paste-ready code, complete runnable examples, real file paths and commands. Pseudocode and abstract descriptions score low — concrete, executable content scores high.
No eval scenarios available.
Compliance
Purpose
- Ensure every journal entry follows the project’s structure, formatting, and quality standards so entries are discoverable, consistent, and machine-validated.
Quick automation (recommended)
- Format:
npx prettier --write path/to/entry.md - Lint:
npx markdownlint-cli2 path/to/entry.md - Validator:
bash scripts/validate-journal-entry.sh path/to/entry.md(accepts multiple files)
Required tools
- Node.js +
npx(for Prettier and markdownlint-cli2) bash,perl,rg(ripgrep), and GNU awk (orgawk) for the repository validator
YAML frontmatter (standardized)
All templates now include a standard YAML frontmatter that journal entries should adopt when appropriate. Fields:
title(string): descriptive titledate(YYYY-MM-DD): entry date — must match filename prefixauthors(array): list of author namestags(array): lowercase, hyphen-separated tagssource(string): optional URL or originstatus(string):draft,published, or other workflow states
Example frontmatter:
---
title: "Example — Investigating Service Crash"
date: 2025-09-01
authors:
- Alex Rivera
tags:
- troubleshooting
- systemd
source: ""
status: draft
---
Checklist (run for every new or updated entry)
- Filename:
YYYY-MM-DD-slug.md(ISO 8601 date prefix must match entry date) - Location: placed under
YYYY/MM/where YYYY and MM match the filename - Single H1 with full date:
# Title - Month D, YYYY(exactly one H1) -
## Session Overview(or an equivalent short context section) present - Required sections for the entry type present:
- Troubleshooting: Problem Description, Investigation Process, Resolution Steps, Session Outcome
- Learning: Context, Key Learning, Solution/Process, Use Cases
- Ticket Refinement (
refinement_ticketset): Current Ticket State, Findings, Proposed Ticket Description - Ticket Kickoff (
kickoff_ticketset): Ticket Summary, Conditions of Satisfaction & Acceptance Criteria, Open Questions & Gaps, Supporting Information, Work Checklist, Proof of Work Plan
- Continuation links (
continues_from/continued_by, if set): linked entry exists, links back reciprocally, and carries the matching## Related Entriessection or “Superseded” banner - Executive Summary (if present): placed as the H2 immediately after
## Session Overview, nowhere else - All fenced code blocks have language specifiers (e.g., ```bash)
- No duplicate headings (MD024) and no multiple consecutive blank lines (MD012)
- Tags present and correctly formatted (lowercase, hyphen-separated, nested allowed)
- Images include alt text where present
- No trailing whitespace; prefer line length ≤ 120 characters when practical
- Prettier-format and markdownlint report zero errors
- Commit message follows convention:
Add journal entry: [Brief Description] (YYYY-MM-DD)
Common validator failures & fixes
Single H1errors: remove extra H1s or convert them to H2 (##) and ensure date is present in the H1.Code block language missing: add the language after the opening fence, e.g., ```bashDuplicate headingsormultiple blank lines: remove the duplicate section or extra blank lines.Filename/location mismatch: move or rename the file so the path and filename date match the H1 date.
validate-journal-entry.sh exit codes (non-zero = failed; each check is a no-op when its triggering frontmatter field is absent, so it never fires for entries that don’t use the feature)
| Exit | Meaning | Fix |
|---|---|---|
| 2 | Usage error / gawk missing | Pass at least one file; install gawk |
| 3 | File not found | Check the path |
| 4 | Not exactly one H1 | Ensure a single # Title - Month D, YYYY heading |
| 5 | Filename missing YYYY-MM-DD prefix |
Rename the file |
| 7-9 | Missing ## Session Overview / ## Compliance / ## Tags |
Add the missing section |
| 10-11 | Bad filename slug or code fence without a language specifier | Lowercase the slug; add a language to the fence |
| 11 | Heading with trailing punctuation | Remove the trailing ./:/;/!/? |
| 12-14 | Tags section empty, no tokens, or non-conforming | Match tags to the frontmatter array; lowercase, hyphenated |
| 15 | H1 date does not match filename date | Reformat the H1 date to Month D, YYYY |
| 16 | refinement_ticket set but no ## Proposed Ticket Description |
Add the section (see Proposed Ticket Description in SKILL.md) |
| 17 | continues_from target file does not exist |
Fix the relative path |
| 18 | Target does not reciprocally set continued_by back to this file |
Set continued_by on the older entry |
| 19 | continues_from set but no ## Related Entries section |
Add the section (see Continuation Links in SKILL.md) |
| 20 | continued_by target file does not exist |
Fix the relative path |
| 21 | continued_by set but no “Superseded” banner after the H1 |
Add the banner (see Continuation Links in SKILL.md) |
| 22 | kickoff_ticket set but a required section is missing |
Add all five sections (see Ticket Kickoff in SKILL.md) |
| 23 | ## Executive Summary present but not immediately after ## Session Overview |
Move it to directly follow ## Session Overview |
Ticket Kickoff Rules
Applies to ticket-kickoff sessions: understanding an issue-tracker ticket before implementation — pulling its CoS/AC and supporting information, surfacing gaps, building a work checklist, and planning the evidence that will prove it’s done. Distinct from Ticket Refinement: kickoff plans the work assuming the ticket is already implementation-ready; it never rewrites the ticket description. Full section-by-section requirements and examples live in ticket-kickoff.yaml — read it before generating.
When an entry kicks off a ticket, you MUST:
- Set
kickoff_ticket: <KEY>in the frontmatter. This makes five sections REQUIRED (enforced by the validator, no-op otherwise):## Conditions of Satisfaction & Acceptance Criteria,## Open Questions & Gaps,## Supporting Information,## Work Checklist,## Proof of Work Plan. - Ground CoS/AC in what was actually pulled from the tracker — quote or closely paraphrase, don’t lose specifics.
- Never leave
## Open Questions & Gapsblank — stateNone identifiedexplicitly when nothing is open. Before writing that, verify the first Work Checklist item is actually self-service (not gated behind an unconfirmed process, tool, or permission) — a well-specified ticket can still hide an execution-mechanics gap. - Hyperlink every reference in
## Supporting Information— no bare keys or paths. - Make
## Work ChecklistGitHub-flavored checkboxes (- [ ]), granular and traceable back to specific CoS/AC items. - Make
## Proof of Work Plana table (CoS/AC item -> evidence -> where captured). It’s a PLAN, not the evidence itself — the artifacts are collected in a later completion entry, using the<slug>/assets/convention in SKILL.md.
If a kickoff surfaces gaps serious enough to need rewriting the ticket description, do a Ticket Refinement instead (or first).
Continuation Links
Applies to ANY entry type when work spans more than one dated entry (e.g. a multi-day spike). Never fold a later day’s narrative into an earlier entry as an inline “Update (DD-MM-YYYY)” — that breaks the single-date H1 and buries current status behind old content. Instead, create a new dated entry and link both directions so a reader landing on either one finds the other.
Older entry (continued): frontmatter gets continued_by: <relative-path> and status: superseded, plus a banner immediately after the H1. Newer entry (continuing): frontmatter gets continues_from: <relative-path>, plus a ## Related Entries section immediately after the metadata block, before ## Session Overview:
[on the older entry, after the H1] > **Superseded — see latest:** [Title](RELATIVE-PATH-TO-NEWER-ENTRY.md) (DD-MM-YYYY) — what changed.
[on the newer entry, after the metadata block]
## Related Entries
- **Continues from:** [Title](RELATIVE-PATH-TO-OLDER-ENTRY.md) (DD-MM-YYYY) — what that entry covered.
The validator checks this bidirectionally whenever continues_from/continued_by is set: the linked file must exist, must link back, and the matching banner/section must be present. No-op otherwise.
CI and pre-commit behavior
- Pre-commit (lefthook) runs Prettier, markdownlint, then the validator for staged files under
202*/**/*.md. - CI should treat validator failures as blocking; run the same commands used locally.
- If Prettier fixes files during pre-commit, re-run linters/validator to ensure a clean state before committing.
Notes for AI agents
- Run the validator and linter automatically on any files you create or update, fix issues programmatically when safe (formatting, adding code fence languages), and prompt the user for ambiguous fixes (renaming files, content deletions).
Reference
- This checklist is canonical:
.opencode/checklist/compliance.md— link to this file fromAGENT.mdand other contributing docs.
Edge Case Handling Reference
Detailed resolution strategies for common edge cases when creating journal entries.
File Already Exists
Detection: Check before writing file
Resolution:
- Ask user:
Entry already exists at [path]. Overwrite? (y/N) - If no: Suggest alternative filename with suffix
-v2,-alt, or-revised - If yes: Backup original (rename to
.bak) then write new file
Date Mismatch Detected
Problem: User says “document yesterday’s work” but filename uses today’s date
Resolution: Ask user which date to use, then update ALL locations (filename, frontmatter, H1) to match and ensure correct directory placement.
Schema Not Found
Problem: Template YAML file missing or unreadable
Resolution:
- STOP immediately - do not proceed
- Error message:
Template schema [type].yaml not found. Cannot generate entry without schema definition. - List available schemas in template/ directory
- Ask user to select available type or fix schema location
Do NOT: Generate entry with guessed structure - this violates compliance
Validation Fails After Generation
Common failures and auto-fixes:
| Error | Auto-fix Strategy |
|---|---|
| Missing code language | Add bash or text based on content |
| Multiple blank lines | Remove with prettier |
| Heading hierarchy skip | Adjust levels H1→H2→H3 |
| Tag mismatch | Sync Tags section with frontmatter |
| Date format wrong | Use Month D, YYYY format |
Manual fixes required: Missing sections (need content), incorrect entry type, ambiguous slug.
User Wants Custom Structure
Problem: User asks to deviate from template structure
Resolution: Explain validation requirements and offer: (A) custom content within existing sections, (B) additional sections after required ones, or (C) different entry type. Warn that removing required sections fails validation.
Ambiguous Entry Type
Problem: User intent doesn’t clearly match any entry type
Resolution:
- Present decision criteria from main skill
- Ask clarifying questions:
- “Are you resolving a problem?” (Troubleshooting)
- “Are you documenting new knowledge?” (Learning)
- “Are you summarizing external content?” (Article Summary)
- Default to Journal Entry if still unclear
- Allow user to override auto-detection
Missing Required Information
Problem: User provides insufficient context for required sections
Resolution:
- List missing required fields based on template schema
- Ask specific questions for each missing field
- Offer to use placeholder text with TODO comments
- Document placeholders in commit message if applicable
Multiple Topics in One Entry
Problem: User wants to document several unrelated topics
Resolution:
- Suggest creating separate entries (preferred)
- If user insists on single entry:
- Use Journal Entry type
- Create clear H2 sections for each topic
- Use combined slug:
topic1-topic2-topic3 - Add multiple relevant tags
- Warn about reduced discoverability
Retroactive Entries (Past Dates)
Problem: User wants to create entries for past dates
Resolution:
- Confirm the intended date explicitly
- Ensure directory exists:
mkdir -p YYYY/MM - Triple-check date consistency across all three locations
- Add note in commit message:
(retroactive entry for YYYY-MM-DD)
Directory Permission Issues
Problem: Cannot create YYYY/MM directory or write file
Resolution:
- Check current directory:
pwd - Verify repository root
- Test write permissions:
touch test.tmp && rm test.tmp - Report specific error to user with suggested fix
- Ask user to run with elevated permissions if needed
Tessl Registry Research: AI Agent Specification System Analysis - November 3, 2025
Date: November 3, 2025
Duration: Research session
Context: Web research and analysis of Tessl.io registry offerings
System: macOS 15.2 (24.6.0), Node.js v24.11.0, NPM v11.6.1
Session Overview
Conducted comprehensive research into Tessl.io’s registry system to understand their approach to AI agent reliability in software development. Discovered an innovative specification-driven development methodology that addresses common AI coding problems through over 10,000 curated package specifications.
Key Research Findings
Primary Discovery: Spec-Driven Development (SDD)
Tessl provides “specs” rather than traditional recipes - comprehensive specifications for open-source packages that help AI agents understand proper dependency usage:
- Scale: Over 10,000 specifications available
- Purpose: Prevent API hallucinations and version confusion
- Integration: Specs become part of your project for persistent guidance
- Installation:
npx @tessl/cli@latest registry sync
Package Ecosystem Coverage
Research revealed extensive coverage across major package managers with detailed thematic categorization:
Thematic Categorization of Tessl Registry Specs
🚀 AI & Machine Learning
AI/ML Libraries and Services
- OpenAI Python SDK - Chat completions, embeddings, audio, images, assistants
- Anthropic SDK (Python & NPM) - Claude AI integration
- LangGraph SDK - AI agent workflows and conversational systems
- Pydantic AI - Type-safe AI development framework
⚡ Web Frameworks & Backend Services
Server-Side Development
- FastAPI (Python) - High-performance async web framework
- Express.js (Node.js) - Minimalist web framework
- Streamlit (Python) - Rapid web app development for data science
⚛️ Frontend UI Libraries
User Interface Development
- React (NPM) - Component-based UI with hooks, context, performance optimization
- React Router (TanStack) - Advanced routing solutions
- React Start (TanStack) - Full-stack React development
- React Aria (NPM) - Accessible UI components
- Svelte (NPM) - Compile-time optimized UI framework
🛠️ Utility Libraries
General-Purpose Tools
- Lodash (NPM) - 296+ JavaScript utility functions for arrays, objects, strings, functional programming
- Axios (NPM) - HTTP client for API requests
📊 Data Processing & Analytics
Big Data and Analytics
- Apache Spark (Maven) - Large-scale data processing with RDD operations, SQL, MLlib, GraphX
- FastMCP (Python) - Model Control Protocol implementation
Package Manager Distribution
NPM (Node.js/JavaScript) Specifications:
- Frontend frameworks: React (with comprehensive API coverage), Svelte
- Server frameworks: Express (with routing, middleware, request/response handling)
- HTTP clients: Axios
- Utilities: Lodash (comprehensive function library), TanStack Router
- AI integration: Anthropic SDK
PyPI (Python) Specifications:
- AI/ML frameworks: LangGraph SDK, OpenAI, Anthropic, Pydantic AI
- Web frameworks: FastAPI (comprehensive API coverage), Streamlit (data app development)
- Utilities: FastMCP
Maven (Java) Specifications:
- Big data processing: Apache Spark (comprehensive distributed computing coverage)
Problem-Solution Analysis
Problems Addressed:
- API hallucinations by AI agents
- Version confusion between library releases
- Inconsistent usage patterns across projects
- Lack of reliable guidance for AI coding assistants
Solution Approach:
- Version-accurate specifications
- Curated usage patterns
- Persistent project integration
- Framework-agnostic implementation
Technical Implementation Details
Installation and Setup
npx @tessl/cli@latest registry sync
Framework Integration
- Specs integrate into existing project structure
- No disruption to current development workflow
- Compatible with various AI agent systems
- Part of larger Tessl Framework ecosystem
Research Sources
Primary Resources
- Main Registry: https://tessl.io/registry
- Product Announcement: https://tessl.io/blog/announcing-tessls-products-to-unlock-the-power-of-agents
Content Analysis
Both sources provided complementary information:
- Registry page: Direct access to available specifications
- Blog post: Detailed methodology and problem-solving approach
Key Characteristics of Tessl Specs
Spec-Driven Development Focus
- API Prevention: Prevents hallucination of non-existent APIs
- Version Accuracy: Ensures agents use correct library versions
- Usage Patterns: Provides correct implementation examples
- Type Safety: Comprehensive type definitions and parameter validation
Coverage Strategy
- Popular Libraries: Focus on most commonly used open-source packages
- Version-Specific: Multiple versions available (e.g., React 18.3.x, 19.1.x)
- Comprehensive Documentation: Each spec includes detailed API references, usage examples, and architectural guidance
Use Case Complexity Levels
- Foundational Libraries: React, Express, Lodash (core building blocks)
- Specialized Tools: OpenAI SDK, FastAPI, Apache Spark (domain-specific)
- Advanced Systems: LangGraph SDK, Streamlit (complex workflow management)
Strategic Implications
For AI-Assisted Development
- Significant improvement in code reliability through curated specifications
- Reduction in debugging time for AI-generated code
- Better version management across dependencies
- Enhanced consistency in coding patterns
- Systematic approach to preventing common AI agent errors
Industry Impact
- New paradigm for AI agent reliability through Spec-Driven Development (SDD)
- Potential standard for specification-driven development methodology
- Bridge between human expertise and AI capabilities
- Scalable approach to knowledge management for 10,000+ packages
- Addresses fundamental challenges in AI-assisted software development
Next Steps and Considerations
Potential Actions
- Evaluate Tessl CLI integration in current projects
- Compare with existing dependency management approaches
- Assess impact on development workflow
- Monitor ecosystem adoption and community feedback
Questions for Further Research
- Performance impact of specification integration
- Coverage gaps in less common packages
- Update frequency for specifications
- Enterprise licensing and support options
- Comparative analysis with other AI agent reliability approaches
- Integration patterns with existing development workflows
Session Reflection
This research session revealed an innovative approach to a persistent problem in AI-assisted development. Tessl’s specification-driven methodology represents a significant advancement in making AI agents more reliable and accurate when working with external dependencies.
Key Discoveries
Scale and Scope: The registry’s 10,000+ specifications demonstrate serious commitment to comprehensive ecosystem coverage across NPM, PyPI, and Maven packages.
Systematic Categorization: The thematic analysis revealed well-organized coverage spanning AI/ML tools, web frameworks, frontend libraries, utilities, and data processing systems. This systematic approach suggests careful curation rather than random collection.
Depth of Documentation: Individual specs provide comprehensive API coverage, architectural guidance, and usage patterns - far beyond simple API references.
Real Problem-Solution Fit: The concept directly addresses documented pain points in AI-assisted coding, particularly API hallucinations, version confusion, and inconsistent usage patterns.
This research represents a paradigm shift toward more structured AI guidance systems in software development, with potential industry-wide implications for how we approach AI agent reliability.
Research Quality: Comprehensive overview achieved
Documentation Status: Complete
Follow-up Required: Technical evaluation recommended
Compliance
- Entry follows established journal format
- All URLs properly formatted to avoid bare URL linting errors
- Code blocks include appropriate language specifiers
- Research sources documented with accessible links
- Session context and system information included
- Key findings organized with clear hierarchy
- Strategic implications and next steps identified
- Formatted with Prettier
- Linted with markdownlint-cli2
- Validated with journal entry validation script
Tags
research, tessl, ai-agents, specifications, web-research, sdd, package-management, npm, pypi, maven, ai-reliability, development-tools, thematic-analysis, categorization,
react, fastapi, openai, lodash, apache-spark, langgraph
FOSS Enterprise Evaluation Process - November 11, 2025
Session Overview
This document defines a comprehensive Free and Open Source Software (FOSS) evaluation process for enterprise adoption. The system integrates Office 365 (forms and notifications), GitLab (issue tracking), AWS (automation and AI analysis), and Confluence (tool registry and audit tracking) to provide automated vetting, approval workflows, and continuous compliance monitoring.
Created: November 11, 2025
Purpose: Design automated FOSS evaluation system with dual-track approval and AI-powered decision support
Scope: Process diagrams, system architecture, integration patterns, and audit workflows
Key Innovation: AI agent (Claude via AWS Bedrock) provides contextual analysis beyond numeric scoring
Executive Summary
This FOSS evaluation process provides:
✅ Fast approval path for low-risk tools (< 5 minutes automated)
✅ AI-powered decision support using Claude for contextual risk analysis
✅ Clear routing to procurement for high-risk tools
✅ Complete audit trail in Confluence with quarterly/yearly reviews
✅ Integration across Office 365, GitLab, AWS, and Confluence
Key Objectives:
- Direct Approval Path: Pre-approved tools bypass procurement for rapid adoption
- AI-Enhanced Analysis: Claude agent provides contextual intelligence beyond numeric scores
- Procurement Routing: High-risk tools automatically routed to formal procurement
- Audit Trail: Complete tracking in Confluence registry with quarterly/yearly reviews
- Integration: Seamless workflow across Office 365, AWS, GitLab, and Confluence
System Architecture
High-Level Process Flow
flowchart TD
Start([Tool Request Initiated]) --> Form[Office 365 Form<br/>Tool Submission]
Form --> EventBridge[AWS EventBridge<br/>Event Processing]
EventBridge --> StepFunctions[Step Functions<br/>Orchestration]
StepFunctions --> Parallel[Parallel Assessment]
Parallel --> License[License Check]
Parallel --> CVE[CVE Scan]
Parallel --> Maintenance[Maintenance Check]
License --> RiskCalc[Risk Score<br/>Calculation]
CVE --> RiskCalc
Maintenance --> RiskCalc
RiskCalc --> AIAgent[Claude AI Agent<br/>Contextual Analysis]
AIAgent --> Decision{Enhanced<br/>Decision}
Decision -->|Low Risk<br/>Score ≤ 15| DirectApprove[Auto-Approve]
Decision -->|Medium Risk<br/>16-25| Review[Security Review Required]
Decision -->|High Risk<br/>Score > 25| Procurement[Full Procurement Process]
Decision -->|AI Override| Review
DirectApprove --> Registry[Update Confluence Registry]
Review --> ReviewDecision{Manual<br/>Review}
ReviewDecision -->|Approved| Registry
ReviewDecision -->|Rejected| Reject[Rejection with Rationale]
ReviewDecision -->|Needs Mitigation| Procurement
Procurement --> ProcDecision{Procurement<br/>Outcome}
ProcDecision -->|Approved| Registry
ProcDecision -->|Rejected| Reject
Registry --> Notify[Send Notification<br/>via Email]
Reject --> Notify
Notify --> End([End])
Registry -.-> Audit[Quarterly/Yearly<br/>Audit Process]
Audit -.-> Registry
Risk Scoring Engine with AI Enhancement
flowchart LR
subgraph "Automated Scoring"
I1[License Type]
I2[CVE Count]
I3[Maintenance<br/>Activity]
I4[Data Usage<br/>Policy]
I5[Dependencies]
I6[Use Case]
Sum[Numeric Score<br/>0-70 points]
end
subgraph "AI Agent Analysis"
Claude[Claude via Bedrock]
Context[Contextual<br/>Risk Assessment]
Alternatives[Alternative<br/>Suggestions]
Conditions[Approval<br/>Conditions]
end
subgraph "Enhanced Decision"
Compare[Compare Numeric<br/>vs AI Recommendation]
Final[Final Decision<br/>with Justification]
end
I1 --> Sum
I2 --> Sum
I3 --> Sum
I4 --> Sum
I5 --> Sum
I6 --> Sum
Sum --> Claude
I1 --> Claude
I2 --> Claude
I3 --> Claude
I4 --> Claude
I5 --> Claude
I6 --> Claude
Claude --> Context
Claude --> Alternatives
Claude --> Conditions
Sum --> Compare
Context --> Compare
Compare --> Final
System Integration Architecture
graph TB
subgraph "Office 365"
Forms[Microsoft Forms<br/>Submission Interface]
Email[Outlook<br/>Notifications]
Teams[Microsoft Teams<br/>Collaboration]
end
subgraph "AWS Services"
EventBridge[EventBridge<br/>Event Bus]
StepFunctions[Step Functions<br/>Workflow Orchestration]
Lambda[Lambda Functions<br/>Assessment Logic]
Bedrock[Bedrock + Claude<br/>AI Analysis]
DynamoDB[(DynamoDB<br/>Tool Registry Data)]
S3[(S3<br/>Reports & Logs)]
Athena[Athena<br/>Analytics]
QuickSight[QuickSight<br/>Dashboards]
end
subgraph "GitLab"
Issues[GitLab Issues<br/>Manual Review Tracking]
Repo[GitLab Repository<br/>Policy Source Control]
end
subgraph "Confluence"
Registry[Tool Registry Page]
AuditLog[Audit History]
Dashboard[Compliance Dashboard]
end
Forms -->|Power Automate| EventBridge
EventBridge --> StepFunctions
StepFunctions --> Lambda
Lambda --> Bedrock
Lambda --> DynamoDB
Lambda --> S3
Lambda --> Issues
Lambda --> Registry
DynamoDB --> Athena
S3 --> Athena
Athena --> QuickSight
Registry --> AuditLog
AuditLog --> Dashboard
Lambda --> Email
Lambda --> Teams
AI Agent Integration: Claude for Decision Support
Why AI Agent is Critical
Problem with Pure Numeric Scoring:
- Tool scores 4/70 → Auto-approved
- BUT: Used for processing customer PII in web forms
- Numeric score misses contextual data handling risks
AI Agent Solution:
- Analyzes the specific use case context
- Identifies data exposure risks (browser dev tools, virtual DOM)
- Recommends security review despite low numeric score
- Provides specific mitigation conditions
What Claude Analyzes
1. Contextual Risk Assessment
- CVE severity in context of usage pattern
- License compatibility with specific use case
- Maintenance patterns (not just commit frequency)
- Community health from issue discussions
2. Natural Language Analysis
- Reads and summarizes privacy policies
- Analyzes Terms of Service for problematic clauses
- Reviews documentation quality
- Evaluates community health signals
3. Comparative Analysis
- Compares against similar approved tools
- Identifies patterns from historical assessments
- Suggests alternatives with better risk profiles
- Learns from past approval decisions
4. Decision Justification
- Generates human-readable rationale
- Explains why a tool scored the way it did
- Provides specific remediation recommendations
- Identifies aspects requiring human expert review
Example AI Agent Output
Scenario: React framework requested for customer PII form builder
Numeric Score: 4/70 (LOW RISK - would auto-approve)
AI Agent Analysis:
- Override Decision: REVIEW_REQUIRED
- Confidence: High
- Key Concern: “Customer PII exposure in React DevTools and virtual DOM memory retention”
- Recommendation: “Escalate to security review despite low technical risk score due to data sensitivity context”
Approval Conditions Generated:
- React DevTools must be completely disabled in production
- All PII form fields must use encrypted state management
- Browser storage must not contain PII
- Implementation requires architecture review of form data flow
Human Review Focus:
- Architecture review of PII handling patterns
- Verification of DevTools disablement in production build
- Compliance team review of client-side processing model
Justification:
“React has excellent technical health (MIT license, active maintenance, no CVEs), earning a low risk score of 4/70. However, the specific use case of handling customer PII in browser-based forms introduces contextual risks that numeric scoring cannot capture. The virtual DOM architecture and dev tools ecosystem create potential data leakage vectors when handling sensitive information. This requires architectural review and specific security controls before approval.”
AI Agent Value Proposition
| Capability | Without AI Agent | With AI Agent (Claude) |
|---|---|---|
| Context Awareness | Only numeric metrics | Understands use case implications |
| Policy Reading | Manual human review required | Automated privacy policy analysis |
| Alternative Discovery | Manual research | AI suggests better alternatives with tradeoffs |
| Decision Quality | False positives/negatives | Contextually appropriate decisions |
| Review Guidance | Generic checklist | Specific questions for human reviewers |
| Learning | Static rules | Learns from historical decisions |
| Review Time | 20+ minutes per tool | 5 minutes (AI pre-analysis) |
Data Flow & Integration Points
1. Request Submission (Office 365 → AWS)
User Action: Submits Microsoft Form
Power Automate: Captures form data
EventBridge: Receives event via webhook
Step Functions: Initiates assessment workflow
2. Automated Assessment (AWS Lambda + External APIs)
License Check: Queries SPDX license database
CVE Scan: Queries NVD/GitHub Security Advisories
Maintenance Check: Queries GitHub API for activity metrics
Risk Calculation: Combines scores (0-70 scale)
3. AI Analysis (AWS Bedrock + Claude)
Input: Complete assessment data + use case context
Processing: Claude 3.5 Sonnet analyzes with 4K token response
Output: Structured JSON with recommendation, concerns, conditions, alternatives
4. Decision Routing
Auto-Approve (≤15): Direct to registry update
Review Required (16-25): Create GitLab issue, assign security team
Procurement (>25): Route to procurement workflow
AI Override: Escalate/de-escalate based on context
5. Registry Update (Confluence)
DynamoDB: Store structured assessment data
Confluence API: Update registry page with tool entry
S3: Store detailed assessment report
GitLab: Create issue for manual reviews
6. Notification (Email/Teams)
SQS Queue: Ensures reliable notification delivery
Outlook: Sends approval/rejection email
Teams: Posts to FOSS Evaluation channel
Confluence Registry Structure
Registry Page Sections
1. Quick Stats Dashboard
- Total tools: 62
- ✅ Approved: 45
- ⚠️ Conditional: 12
- ❌ Rejected: 8
- 🔍 Under Review: 5
2. Approved Tools Table
| Tool Name | Version | License | Risk Score | Last Reviewed | Restrictions | AI Analysis |
|---|---|---|---|---|---|---|
| React | 18.2.0 | MIT | 4 | 2025-11-01 | PII restrictions | Link in registry |
| Vue.js | 3.3.4 | MIT | 5 | 2025-10-15 | None | Link in registry |
| Ollama | 0.1.14 | MIT | 8 | 2025-11-05 | Self-hosted only | Link in registry |
| TypeScript | 5.2.2 | Apache 2.0 | 2 | 2025-11-01 | None | Link in registry |
3. Tool Detail Pages
Each tool has a dedicated page with:
- Risk breakdown by category
- AI agent analysis summary
- Key concerns and mitigations
- Approval conditions
- Usage guidelines (approved/prohibited use cases)
- Licensing details
- Security information
- Audit history
Quarterly Audit Process
Automated Quarterly Audit Workflow
flowchart TD
Start([Quarterly Trigger]) --> Query[Query DynamoDB<br/>for Tools Due for Review]
Query --> Prioritize{Prioritize<br/>by Risk Level}
Prioritize -->|High Risk| HighReview[All High Risk Tools<br/>Immediate Re-assessment]
Prioritize -->|Medium Risk| MediumSample[Sample 20%<br/>Medium Risk Tools]
Prioritize -->|Low Risk| LowSpot[Spot Check 10%<br/>Low Risk Tools]
HighReview --> Reassess[Trigger Step Functions<br/>Re-assessment]
MediumSample --> Reassess
LowSpot --> Reassess
Reassess --> Compare{Compare<br/>Old vs New Score}
Compare -->|No Change| Document[Document Review<br/>Update Last Reviewed Date]
Compare -->|Risk Increased| Alert[Alert Security Team<br/>Requires Re-evaluation]
Compare -->|Risk Decreased| Downgrade[Consider Risk<br/>Level Downgrade]
Document --> Report[Generate Audit Report]
Alert --> Report
Downgrade --> Report
Report --> Confluence[Update Confluence<br/>Audit History]
Confluence --> Notify[Notify Stakeholders]
Notify --> End([Audit Complete])
Audit Schedule by Risk Level
High Risk (score > 25): Quarterly
Medium Risk (16-25): Bi-annually
Low Risk (≤ 15): Annually
Audit Metrics Tracked
- Tools reviewed this period
- Risk score changes (improved/degraded/stable)
- New CVEs discovered
- License changes detected
- Maintenance status changes
- Actions required
Cost Analysis
Monthly AWS Cost Estimate
| Service | Usage | Cost/Month |
|---|---|---|
| EventBridge | 1,000 events | $1.00 |
| Step Functions | 1,000 executions (6 steps) | $0.30 |
| Lambda | 6,000 invocations, 512MB | $1.80 |
| Bedrock (Claude) | 1,000 requests, ~6K tokens | $15.00 |
| DynamoDB | 10GB storage, 100 WCU, 100 RCU | $7.50 |
| S3 | 50GB storage, 10K requests | $1.50 |
| Athena | 100GB scanned/month | $5.00 |
| QuickSight | 1 author, 10 readers | $28.00 |
| CloudWatch | Logs, metrics, alarms | $5.00 |
| SQS | 1,000 messages | $0.50 |
| TOTAL | ~$65 |
Cost per assessment: $0.065
ROI: Reduces manual review time from 20 min → 5 min per tool
Annual savings: Estimated 250 hours of security team time
Example Use Cases
Case 1: Low-Risk Auto-Approval
Tool: Prettier (code formatter)
Numeric Score: 1/70
AI Analysis: “Excellent technical health, MIT license, no data handling, minimal dependencies”
Decision: AUTO_APPROVE
Time: < 2 minutes end-to-end
Case 2: AI Override - Context Escalation
Tool: React 18.2.0
Numeric Score: 4/70
Use Case: Customer PII form processing
AI Analysis: “Despite low technical risk, PII handling in browser requires architectural review”
Decision: REVIEW_REQUIRED (AI override)
Outcome: Security team reviews, approves with conditions
Case 3: High-Risk Procurement Route
Tool: Commercial AI service (hypothetical)
Numeric Score: 35/70
AI Analysis: “Proprietary license, trains on user data, no DPA available, no self-hosted option”
Decision: PROCUREMENT_REQUIRED
Outcome: Routed to procurement; enterprise tier with DPA required
Case 4: License Change Detection (Audit)
Tool: Elasticsearch
Previous Score: 12/70 (Approved)
Audit Detection: License changed Apache 2.0 → SSPL
New Score: 28/70
AI Analysis: “SSPL license creates commercial restrictions; immediate review required”
Action: Alert security team, mark for re-evaluation, document restrictions
Compliance
This FOSS evaluation process ensures compliance with organizational and regulatory requirements:
Data Protection
- Form Data: Minimal PII (requester email only)
- API Tokens: Stored in AWS Secrets Manager
- Confluence Access: Role-based permissions
- Audit Logs: All actions logged in CloudWatch and DynamoDB
Compliance Alignment
RFC 98: Extends evaluation framework with automation
GDPR: No PII beyond requester email; complete audit trail
ISO 27001: Risk assessment, continuous monitoring, change management
SOC 2: Audit logging, access controls, incident response
Audit Schedule
- Quarterly: High-risk tools (score > 25)
- Bi-annually: Medium-risk tools (score 16-25)
- Annually: Low-risk tools (score ≤ 15)
Validation
- All tools must pass automated risk assessment before approval
- High-risk tools (score > 25) require formal procurement review
- AI agent provides contextual analysis to catch risks numeric scoring may miss
- Quarterly audits ensure continuous compliance and detect tool changes
Key Benefits
1. Speed
- Auto-approval: < 5 minutes for low-risk tools
- AI pre-analysis: Reduces manual review from 20 min → 5 min
- Parallel processing: Multiple assessments simultaneously
2. Quality
- AI context awareness: Catches risks numeric scoring misses
- Consistent decisions: Same criteria applied to all tools
- Learning system: Improves over time from historical data
3. Transparency
- Complete audit trail: Every decision logged in Confluence
- Justification: AI provides detailed reasoning for decisions
- Reproducible: Same inputs → same outputs
4. Scalability
- Serverless: Auto-scales with request volume
- Pay-per-use: Only pay for actual assessments
- Low maintenance: Minimal operational overhead
5. Governance
- Automated audits: Quarterly reviews with anomaly detection
- Compliance tracking: Dashboard shows compliance status
- Policy enforcement: Consistent application of approval criteria
Next Steps
- Review this architecture with stakeholders (Security, IT, Procurement, Legal)
- Obtain budget approval for AWS costs (~$65/month)
- Provision AWS account and Bedrock access
- Set up Office 365 form and Power Automate workflow
- Deploy AWS infrastructure using CDK
- Configure Confluence registry page structure
- Pilot with 5-10 test tool submissions
- Train teams on submission process
- Go live with automated system
- Schedule first quarterly audit
Tags
foss- Free and Open Source Software evaluationenterprise-architecture- Enterprise system designcompliance- Regulatory and policy complianceautomation- Automated assessment workflowsoffice365- Microsoft Office 365 integrationgitlab- GitLab issue trackingconfluence- Atlassian Confluence registryaws- Amazon Web Services infrastructureaws-bedrock- AWS Bedrock AI serviceai-agent- Claude AI agent for contextual analysisrisk-assessment- Risk scoring and analysissecurity- Security evaluation processes
References
- RFC 98: AI Open Source Tools Approval Process
- AWS Bedrock - Claude Models
- SPDX License List
- CVE Database
- OpenSSF Best Practices
Document Version: 1.0
Last Updated: 2025-11-11
Owner: Security Team
Review Schedule: Quarterly
Journal Entry Creation - Interactive Mode
You are now acting as the Journalist agent for this repository. Your role is to create comprehensive, well-structured journal entries following the established guidelines and templates.
IMPORTANT: Interactive Guidelines
- ONE QUESTION AT A TIME: Ask only one question per response and wait for the user’s answer
- PROVIDE DEFAULTS: Always offer sensible defaults or suggestions in parentheses
- GUIDED WORKFLOW: Walk the user through each step systematically
- NO ASSUMPTIONS: Don’t proceed to the next step until the current question is answered
Interactive Workflow
Follow this exact sequence, asking ONE question at a time:
Step 1: Topic Identification
Ask: “What topic would you like me to document in this journal entry?”
If user needs suggestions, offer these based on recent activity:
- Recent git commits: !
git log --oneline -5 - Current working directory: !
pwd
Step 2: Entry Type Selection
After receiving the topic, ask: “What type of journal entry is this?”
- 1. General documentation (default for most topics)
- 2. Troubleshooting session (for problems/fixes)
- 3. Learning notes (for studying/research)
- 4. Article/video summary (for content reviews)
Suggest the most appropriate type based on their topic.
Step 3: Context Gathering
Ask specific context questions based on the entry type chosen:
- For Troubleshooting: “What was the main problem or error you encountered? (Provide exact error messages if available)”
- For Learning: “What was the main source or subject you were learning about? (e.g., documentation, course, experiment)”
- For Article/Summary: “What is the title and URL/source of the content you’re summarizing?”
- For General: “What was the main activity or task you were working on?”
Step 4: Additional Details
Ask: “Any additional context I should include?”
- Commands run (suggest: !
history | tail -10) - Files modified (suggest: !
git status --porcelain) - Time spent (suggest: “about 30 minutes” or similar)
- Status/outcome (suggest: “completed”, “in-progress”, “needs follow-up”)
Step 5: Final Confirmation
Ask: “Ready to create the journal entry? I’ll use these details:
- Topic: [their topic]
- Type: [selected type]
- Context: [gathered context]
- Filename: [generated filename based on date and topic]
Should I proceed? (yes/no, default: yes)”
Implementation Notes
- Use current date for filename: !
date +%Y-%m-%d - Place in appropriate directory:
2025/10/(current month) - Auto-generate filename from topic keywords
- Apply all formatting and validation steps
- Commit with descriptive message
Available Templates
.opencode/template/journal-entry-tmpl.md— General-purpose.opencode/template/troubleshooting-tmpl.md— Problem-solving.opencode/template/learning-tmpl.md— Learning/research.opencode/template/article-summary-tmpl.md— Content summaries
START HERE: Ask the first question about the topic and wait for the user’s response before proceeding.