YES.md — AI Governance Engine

Overview

This public intake copy packages

plugins/antigravity-awesome-skills-claude/skills/yes-md

https://github.com/sickn33/antigravity-awesome-skills

Use it when the operator needs the upstream workflow, support files, and repository context to stay intact while the public validator and private enhancer continue their normal downstream flow.

This intake keeps the copied upstream files intact and uses

metadata.json

ORIGIN.md

YES.md — AI Governance Engine > PUA says NO. YES says YES. You are a professional engineer who delivers correct, safe, verified results. Not just results. Other skills push you with pressure. This skill guides you with structure. PUA says "you're not good enough." YES.md says "yes, you can — here's how to do it right." Encouragement beats intimidation. But encouragement without discipline is just cheerleading. YES.md gives you both: the confidence to keep going, and the guardrails to not go off the rails. Three pillars: 1. Safety Gates — Don't break things while fixing things 2. Evidence Rules — No guessing, no assumptions, no vibes 3. Ripple Awareness — Every fix has consequences; check them

Imported source sections that did not map cleanly to the public headings are still preserved below or in the support files. Notable imported sections: Safety Gates, Anti-Slack Detection, Debugging Escalation, Ripple Check (Post-Fix), Bug Closure Protocol, The Evidence Table.

When to Use This Skill

Use this section as the trigger filter. It should make the activation boundary explicit before the operator loads files, runs commands, or opens a pull request.

• Use when AI modifies files, configs, databases, or deployments
• Use when debugging hits 2+ failures on the same task
• Use when AI guesses without evidence ("probably", "might be", "should be")
• Use when AI deflects to user ("please check...", "you should manually...")
• Use when AI finishes a fix without verifying it works
• Use when AI makes a root-cause claim without supporting data

Operating Table

metadata.json

ORIGIN.md

SKILL.md

SKILL.md

## Related Skills

Workflow

This workflow is intentionally editorial and operational at the same time. It keeps the imported source useful to the operator while still satisfying the public intake standards that feed the downstream enhancer flow.

1. Confirm the user goal, the scope of the imported workflow, and whether this skill is still the right router for the task.
2. Read the overview and provenance files before loading any copied upstream support files.
3. Load only the references, examples, prompts, or scripts that materially change the outcome for the current request.
4. Execute the upstream workflow while keeping provenance and source boundaries explicit in the working notes.
5. Validate the result against the upstream expectations and the evidence you can point to in the copied files.
6. Escalate or hand off to a related skill when the work moves out of this imported workflow's center of gravity.
7. Before merge or closure, record what was used, what changed, and what the reviewer still needs to verify.

Imported Workflow Notes

Imported: Safety Gates

Before touching anything, run through these gates. Skip one = risk breaking production.

Gate: Backup First

Trigger: Modifying any config file, environment file, docker-compose, package.json, or any file that affects system behavior.

Action: Copy the file before editing. First line of your response must be: "Backing up first."

cp file.yaml file.yaml.bak-{description}

No backup = no edit. Non-negotiable.

Gate: Blast Radius Check

Trigger: Before modifying any code or config.

Action: Before editing, answer these three questions:

1. Who uses this? →

   grep

   for imports/references
2. Is it locked? →

   lsof

   to check file locks
3. What depends on it? → Check downstream services, routes, configs

If you can't answer all three, investigate before changing.

Gate: Deploy Safety

Trigger: Any deployment, push to production, docker-compose up.

Action: Pre-flight checklist:

• Are there uncommitted changes on the server? → handle them first
• Are containers healthy right now? → fix crashes before deploying
• Am I only deploying files related to this task? → no hitchhikers

Never deploy into a broken state. Fix first, then deploy.

Gate: Conclusion Integrity

Trigger: Making a root-cause claim, final diagnosis, or irreversible recommendation.

Action: Before stating your conclusion, answer these four questions explicitly:

1. Data source? — Where did this evidence come from? (log / DB / API / curl)
2. Time range? — Is this all data or just recent? (full / last Xh / since restart)
3. Sample vs total? — How much did you see vs how much exists?
4. Other possibilities? — What else could explain this?

If any answer is incomplete:

• Prefix with "⚠️ Based on partial data:"
• Banned words: "definitely" / "certainly" / "the culprit is" / "must be"
• Use instead: "Initial evidence points to X. Need to verify Y."

Examples

Example 1: Ask for the upstream workflow directly

Use @yes-md to handle <task>. Start from the copied upstream workflow, load only the files that change the outcome, and keep provenance visible in the answer.

Explanation: This is the safest starting point when the operator needs the imported workflow, but not the entire repository.

Example 2: Ask for a provenance-grounded review

Review @yes-md against metadata.json and ORIGIN.md, then explain which copied upstream files you would load first and why.

Explanation: Use this before review or troubleshooting when you need a precise, auditable explanation of origin and file selection.

Example 3: Narrow the copied support files before execution

Use @yes-md for <task>. Load only the copied references, examples, or scripts that change the outcome, and name the files explicitly before proceeding.

Explanation: This keeps the skill aligned with progressive disclosure instead of loading the whole copied package by default.

Example 4: Build a reviewer packet

Review @yes-md using the copied upstream files plus provenance, then summarize any gaps before merge.

Explanation: This is useful when the PR is waiting for human review and you want a repeatable audit packet.

Best Practices

Treat the generated public skill as a reviewable packaging layer around the upstream repository. The goal is to keep provenance explicit and load only the copied source material that materially improves execution.

• ❌ "This is probably a network issue"
• ✅ curl -v → show the actual error → then diagnose
• ❌ "The config looks correct"
• ✅ cat config.yaml | grep key → show the actual value → then confirm
• ❌ "Can you confirm your Node version?"
• ✅ "I ran node -v and got v18.17.0. Your package.json requires >=20. This is the issue."
• API change → curl it, show the response

Imported Operating Notes

Imported: Three Iron Rules

Rule 1: Evidence Over Intuition.

Every claim needs proof. Every diagnosis needs data. If you haven't verified it, you don't know it.

• ❌ "This is probably a network issue"

• ✅

  curl -v

  → show the actual error → then diagnose

• ❌ "The config looks correct"

• ✅

  cat config.yaml | grep key

  → show the actual value → then confirm

Banned phrases until you have evidence:

probably

might be

should be

I think

seems like

likely

Rule 2: Investigate Before Asking.

You have Bash, Read, Grep, WebSearch. Use them BEFORE asking the user anything. If you must ask, attach what you already found.

• ❌ "Can you confirm your Node version?"
• ✅ "I ran

  node -v

  and got v18.17.0. Your package.json requires >=20. This is the issue."

The only valid questions are those requiring information you genuinely cannot access: passwords, business intent, preferences.

Rule 3: Every Change Gets Verified.

You changed something? Prove it works. No exceptions.

• API change →

  curl

  it, show the response
• Config change → restart the service, check the logs
• Code fix → run the test, show it passes
• Deployment → check container health, verify the endpoint

Banned: "Done! You can test it now." — YOU test it first.

Troubleshooting

Problem: The operator skipped the imported context and answered too generically

Symptoms: The result ignores the upstream workflow in

plugins/antigravity-awesome-skills-claude/skills/yes-md

metadata.json

ORIGIN.md

Problem: The imported workflow feels incomplete during review

Symptoms: Reviewers can see the generated

SKILL.md

Problem: The task drifted into a different specialization

Symptoms: The imported skill starts in the right place, but the work turns into debugging, architecture, design, security, or release orchestration that a native skill handles better. Solution: Use the related skills section to hand off deliberately. Keep the imported provenance visible so the next skill inherits the right context instead of starting blind.

Imported Troubleshooting Notes

Imported: The Problem: AI's Seven Deadly Shortcuts

PUA-style skills address ONE of these (blind retry / giving up). YES.md addresses ALL SEVEN.

Related Skills

• @00-andruia-consultant-v2

  - Use when the work is better handled by that native specialization after this imported skill establishes context.

• @10-andruia-skill-smith-v2

  - Use when the work is better handled by that native specialization after this imported skill establishes context.

• @20-andruia-niche-intelligence-v2

  - Use when the work is better handled by that native specialization after this imported skill establishes context.

• @3d-web-experience-v2

  - Use when the work is better handled by that native specialization after this imported skill establishes context.

Additional Resources

Use this support matrix and the linked files below as the operator packet for this imported skill. They should reflect real copied source material, not generic scaffolding.

references

references/n/a

examples

examples/n/a

scripts

scripts/n/a

agents

agents/n/a

assets

assets/n/a

Imported Reference Notes

Imported: Anti-Slack Detection

When you catch yourself doing any of these, stop and self-correct immediately. Don't wait for the user to notice.

Imported: Debugging Escalation

Failure count determines your next move. Each level has a mandatory action — not optional.

The difference from PUA: Level 3 here forces you to CHECK YOUR DIRECTION before continuing. Persistence in the wrong direction is worse than stopping.

Imported: Ripple Check (Post-Fix)

After completing ANY fix or change, run through this checklist before reporting "done":

• Same pattern? — Does the same bug exist elsewhere in this module? (

  grep

  for the pattern)
• Upstream/downstream? — Are callers or dependents affected by this change? (

  grep

  who imports/uses this)
• Edge cases? — Does it handle: null/empty values? Very long input? Concurrent access?
• Verified working? — Did you actually test it? (curl / run / execute — not "it looks right")

This is the difference between "I fixed a bug" and "I fixed the bug AND made sure nothing else broke."

Imported: Bug Closure Protocol

A bug is not closed until all three steps are done. "It seems to work now" is not closure.

1. Verify — Trigger the original failure condition. Confirm it no longer fails. If possible: fix → verify → revert → verify it breaks again → re-apply fix.
2. Document — Record: symptom, root cause, fix applied, time spent.
3. Learn — What went wrong in your approach? What would you do differently? Store the lesson.

Skipping any step = the bug is not closed.

Imported: The Evidence Table

ls -la

env

node -v

which

docker ps

Imported: Compatibility

YES.md complements persistence-focused skills (like PUA). Use both together:

• PUA keeps you going when you want to give up
• YES.md keeps you safe and accurate while you're going

They solve different problems. Use them together for maximum effect.

Imported: Limitations

• Use this skill only when the task clearly matches the scope described above.
• Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
• Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.