It will say the work is done. It will say the tests pass. It will mean it. Ten skills that make the scaffolding auditable, the compliance evidence automatic and the team's own rules executable — and one hook that will not let it finish until it has proof.
This is the path that installs the verification gate along with the skills, the two slash commands and the two subagents. Requires Claude Code.
claude plugin marketplace add https://github.com/Oltrematica/oltrematica-skills.git
claude plugin install oltrematica-skills@oltrematica
Then, in any repository: say "audit our harness", or run /compliance-status, and read what comes back. Updating is marketplace update then plugin update, in that order — skipping the first updates nothing — and then restart Claude Code, because skills and hooks are read at session start.
And, for the mandate gates, thirteen migration tools — Laravel, Rails, Django, Alembic, Ecto, EF Core, Knex, TypeORM, Doctrine, golang-migrate, Liquibase, and the two that have no rollback at all, which are reported as not applicable rather than as a gap.
A CLAUDE.md grows until the agent quietly stops obeying half of it. A skill's description drifts until it fires on everything, or on nothing. There is no error and no alert. The agent just gets worse — and the team concludes the model got worse.
Harness assurance →Not ignorance — tedium. The work is always less urgent than the feature, until it is suddenly a deadline. CRA vulnerability-reporting obligations begin 11 September 2026 for anyone shipping software into the EU.
The regulatory clock →Every endpoint has a Policy. Migrations are reversible. Every fix ships with a test. Checked, when at all, by whoever reviews the PR and happens to remember. They do not fail loudly; they erode.
The gates →Each track carries one thesis and its own set of non-goals. A skill that needs a thesis widened to fit it belongs somewhere else — which is how a track stays a track instead of becoming a folder.
Everything else warns. This is a concession to how these tools actually die: a gate that blocks on a heuristic gets switched off within a week, and it takes the checks that did work with it. Two of the three gates could have been written to look far more powerful than they are.
| Gate | The mandate | Severity | Why |
|---|---|---|---|
| tests-with-change | Every change ships with a testEvery stack. Deleting a test never counts as shipping with one. | block | It is a fact about the diff, not an inference. |
| reversible-migrations | Migrations roll backA down() that exists but is empty blocks too — it reads as reversible to a reviewer and rolls back nothing. | block warn n/a | Exact where the tool has an explicit reverse; a heuristic where the tool infers it; meaningless where the tool has no rollback at all. |
| authz-coverage | Authenticated endpoints authorizeFinds handlers where nothing at all references authorization. Eight frameworks; elsewhere it says so. | warn | Whether a route is authenticated is a runtime property of a middleware stack. A gate that guessed it would be disabled within a week. |
Flyway Community and Prisma have no rollback step. Reporting their migrations as irreversibility gaps would be a false finding — so the gate says the question does not apply here, and says why. A report that never says "not applicable" is a report that has started inventing findings to look useful.
And a lowering is printed as a lowering. A team that switched a gate off must not be able to produce output that looks like a team that passed it. An advisory gate also stays advisory even if the config asks for block — otherwise a documented heuristic becomes a merge blocker, and then the tool gets the blame.
A skill's description: is the entire router surface — Claude sees it, and nothing else, when deciding whether to invoke a skill. So we test it the way the router meets it: three independent judges per prompt, each a fresh session started with --allowedTools "" — unable to call a tool rather than instructed not to — holding exactly one prompt, on one pinned model. 891 blind judgements so far, 120 of them in the round below.
It reached nothing. All three judges quoted the same clause back at us — the description said a severe incident "affects one", meaning a shipped product:
A compromise of the build, signing or update path is the textbook CRA severe incident. The skill's body covered it in full. The router never sees the body. The fix was a few words of description — and the second finding of the round was stranger still: a 2-of-3 split on a phrase the description quotes verbatim, because an exclusion clause written to keep a neighbouring skill out was also excluding this skill's own second job.
Triggering is probabilistic. One judge returns a single sample and calls it evidence — and on the row that was broken, a single judge would have returned a clean pass. A 2-of-3 split is recorded as FLAKY and never rounded up: the disagreement is the finding.
"how long do we keep this?" and "what is our reporting deadline?" split because the prompt has no antecedent, not because a clause reads two ways. Forcing 3-of-3 would mean claiming territory on the strength of a pronoun, and the cost would land on the neighbouring skills.
Nobody doubts an SBOM matters. Nobody regenerates one mid-sprint either, because nothing forces the moment — until something does.
GDPR has no start date left to wait for. gdpr-evidence exists because the rule that a legal basis is decided before the column exists is unenforceable while nothing records what personal data a repository holds — so it records it, and then fails a build when a new personal-data column arrives without one.
This is the section a skeptical reader should check hardest, because it is also the one we are least entitled to get away with asserting. Every figure on this page is derived from its source and verified in CI — a script re-computes each one and fails the build when a published copy disagrees. It exists because we shipped three stale numbers in a single week.
That sentence blocked three regulations we are exposed to — the AI Act, the PLD and a promoted EAA — and it was derived from nothing, in a repo whose CI fails when a published number drifts from its source. So we built the instrument and ran it: 600 selection judgements across 200 row-instances, four arms. Each judge sees the whole catalogue and picks one skill, or none, because a ceiling is not a property of any description — it is interference between them.
One row lost its owner: a draft description quoted a phrase in its own trigger list and ceded it to a neighbour two sentences later. The router reads the trigger list and never adjudicates the carve-out, so it won the prompt. Fixed by an edit, and the whole arm re-run — a description edit voids every earlier result for that skill.
A→C holds our catalogue fixed and adds only the neighbours. Both regressions are ordinary engineering work captured by a skill — "fix the invoice rounding bug" went to a debugging skill. Not a defect in any description: a boundary disagreement about who owns ordinary work. The usable conclusion is that a catalogue's interference is mostly not from its own growth, so measuring your skills in isolation measures the wrong arm.
tests/harness/fixtures/bad-harness/ is a repository built to fail every surface the audit checks, on purpose, with five seeded defects. Its own README says outright: do not fix these — they are the test.
Every trigger-validation round is recorded, including the discarded ones and the rounds that found a real gap. The clean final state is the least informative part of that file, so it is not the only part we keep.
Small N, and the ledger says so itself. Ten prompts per skill judged three ways is a smoke test for gross triggering failures, not a benchmark. It found two real defects in descriptions their author had read carefully several times, which is the entire argument for running it at all.
No artifact — ADR, SBOM, gap report, harness audit, regulatory filing — is ever marked Accepted, Compliant or Validated by Claude on its own initiative. Everything ships Proposed or Draft until a named person says otherwise.
Every report states one of exactly three outcomes per item — present, gap, or not applicable — each with a pointer or a rationale. "Looks good" is not an output this plugin produces; where it appears, it is a bug.
Nothing here transmits to an authority, files, emails or posts to a reporting platform. It writes the text and computes the clock. Submission is an organizational act performed by a named human, and every draft says so on its first line.