agent-skill-doctor 0.1.0 → 0.3.0

package/CHANGELOG.md

@@ -5,6 +5,17 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.3.0] - 2026-07-07
+
+### Added
+- Added `governance` registry readiness diagnostics for owner, version, lifecycle status, release label, and trusted source metadata.
+- Added `agent-skill-doctor governance --json` for focused governance findings.
+- Added governance findings to diagnose summaries, Markdown reports, JSON reports, and HTML dashboard cards.
+- Added targeted `fix --type governance` guide text in English and Chinese.
+
+### Documentation
+- Documented governance checks and CLI examples in English and Chinese READMEs.
+
 ## [0.1.0] - 2026-06-08
 
 ### Added

package/README.en.md

@@ -23,6 +23,7 @@ Agent Skill Doctor diagnoses local AI Agent Skills: duplicate installs, version
 - `conflict`: contradictory instructions, such as `npm install` vs `pnpm install`.
 - `duplicate`: exact, same-source, or same-name duplicate skills.
 - `version_drift`: the same skill installed with different refs or content.
+- `governance`: registry / team-sharing readiness, such as missing owner, version, lifecycle status, stable/dev label, or trusted source.
 - `zombie`: low-activity or possibly abandoned skills.
 - `description_quality`: missing trigger, input/output, risk notes, or too-short descriptions.
 - `scan_warning`: missing `SKILL.md` or malformed frontmatter.
@@ -67,7 +68,7 @@ Use agent-skill-doctor to diagnose my local Agent Skills:
 2. Generate an HTML report: npx agent-skill-doctor report --format html --lang en
 3. Review conflicts, duplicates, version drift, zombie skills, and risks.
 4. Do not delete files yet. First produce a repair plan and explain which skills would change.
-5. Give recommendations for risk, duplicate, version_drift, zombie, and description_quality findings.
+5. Give recommendations for risk, duplicate, version_drift, governance, zombie, and description_quality findings.
 ```
 
 The agent can use `fix` to generate targeted repair prompts:
@@ -174,6 +175,7 @@ agent-skill-doctor diagnose --json
 agent-skill-doctor risks --json
 agent-skill-doctor conflicts --json
 agent-skill-doctor duplicates --json
+agent-skill-doctor governance --json
 agent-skill-doctor zombies --json
 
 # Generate reports
@@ -185,6 +187,7 @@ agent-skill-doctor report --format html --lang en
 agent-skill-doctor fix --lang en
 agent-skill-doctor fix --type duplicate --lang en
 agent-skill-doctor fix --type version_drift --lang en
+agent-skill-doctor fix --type governance --lang en
 
 # Fail CI by severity
 agent-skill-doctor diagnose --ci --fail-on high

package/README.md

@@ -23,6 +23,7 @@ Agent Skill Doctor 用来帮你检查本地 AI Agent Skills 是否健康：有
 - `conflict`：Skill 之间的指令冲突，例如一个要求 `npm install`，另一个要求 `pnpm install`。
 - `duplicate`：重复 Skill，包含完全重复、同源重复、同名不同内容。
 - `version_drift`：同一个 Skill 在多个位置存在不同版本、不同 ref 或不同内容。
+- `governance`：Registry / 团队共享就绪度，例如缺少 owner、version、生命周期状态、stable/dev 标签或可信来源。
 - `zombie`：疑似长期不用或无人维护的 Skill。
 - `description_quality`：缺少触发条件、输入输出、风险说明，或者描述过短。
 - `scan_warning`：目录结构问题，例如缺少 `SKILL.md` 或 frontmatter 格式异常。
@@ -174,6 +175,7 @@ agent-skill-doctor diagnose --json
 agent-skill-doctor risks --json
 agent-skill-doctor conflicts --json
 agent-skill-doctor duplicates --json
+agent-skill-doctor governance --json
 agent-skill-doctor zombies --json
 
 # 生成报告
@@ -185,6 +187,7 @@ agent-skill-doctor report --format html --lang zh
 agent-skill-doctor fix --lang zh
 agent-skill-doctor fix --type duplicate --lang zh
 agent-skill-doctor fix --type version_drift --lang zh
+agent-skill-doctor fix --type governance --lang zh
 
 # CI 中按严重程度失败
 agent-skill-doctor diagnose --ci --fail-on high

package/bin/agent-skill-doctor.js

@@ -11,9 +11,21 @@ const { detectConflicts } = require('../src/doctor/conflict');
 const { detectZombies } = require('../src/doctor/zombie');
 const { DEFAULT_CONFLICT_RULES } = require('../src/doctor/rules');
 const phase2 = require('../src/doctor/phase2');
+const { detectGovernanceFindings } = require('../src/doctor/governance');
 const { t, dictionaries } = require('../src/doctor/i18n');
 
-const SKIP_DIRS = new Set(['.git', 'node_modules', 'target', 'dist', 'build', '.cache', '.tmp', '.DS_Store']);
+const SKIP_DIRS = new Set([
+  '.git', 'node_modules', 'target', 'dist', 'build', '.tmp', '.DS_Store',
+  // Agent-specific non-skill directories
+  'sessions', 'backups', 'shell-snapshots', 'session-env',
+  'debug', 'file-history', 'paste-cache', 'plans',
+  'daemon', 'ide', 'hooks', 'logs', 'log', 'errors',
+  'archived_sessions', 'worktrees', 'sqlite',
+  'accounts', 'memories', 'rules', 'docs', 'vendor_imports',
+  'process_manager', 'node_repl', 'ambient-suggestions',
+  'automations', 'codexmate', 'computer-use', 'computer-use-turn-ended',
+  'browser', 'pets',
+]);
 
 function sha256(input) {
   return crypto.createHash('sha256').update(input).digest('hex');
@@ -34,6 +46,10 @@ function normalizePath(p) {
   return path.resolve(expandHome(p)).replace(/\\/g, '/');
 }
 
+function isDir(p) {
+  try { return fs.existsSync(p) && fs.statSync(p).isDirectory(); } catch { return false; }
+}
+
 function ensureDir(dir) {
   fs.mkdirSync(dir, { recursive: true });
 }
@@ -106,34 +122,76 @@ function loadConfig() {
   const home = doctorHome();
   ensureDir(home);
   ensureDir(path.join(home, 'reports'));
-  const candidates = [
-    // Central library
-    '~/.skills-manager/skills',
+
+  // Agent root directories (global)
+  const agentRoots = [
     '~/.skills-manager',
-    // Agent global skill directories requested by users.
-    '~/.agent/skills',
-    '~/.agents/skills',
-    '~/.agents/skills-core',
-    '~/.codex/skills',
-    '~/.claude/skills',
-    '~/.cursor/skills',
-    '~/.opencode/skills',
-    // Project-local skill directories
-    path.join(process.cwd(), '.agent/skills'),
-    path.join(process.cwd(), '.agents/skills'),
-    path.join(process.cwd(), '.codex/skills'),
-    path.join(process.cwd(), '.claude/skills'),
-    path.join(process.cwd(), '.cursor/skills'),
-    path.join(process.cwd(), '.opencode/skills'),
-  ].map(expandHome).filter(p => {
-    try { return fs.existsSync(p) && fs.statSync(p).isDirectory(); } catch { return false; }
-  });
+    '~/.agent',
+    '~/.agents',
+    '~/.codex',
+    '~/.claude',
+    '~/.cursor',
+    '~/.opencode',
+    '~/.windsurf',
+    '~/.aider',
+    '~/.continue',
+    '~/.cody',
+    '~/.copilot',
+  ];
+
+  // Project-local agent directories
+  const projectAgents = [
+    '.agent',
+    '.agents',
+    '.codex',
+    '.claude',
+    '.cursor',
+    '.opencode',
+    '.windsurf',
+    '.aider',
+    '.continue',
+    '.cody',
+    '.copilot',
+  ];
+
+  const candidates = [];
+
+  // For each agent root, discover skill directories automatically
+  for (const root of agentRoots) {
+    const expanded = expandHome(root);
+    if (!isDir(expanded)) continue;
+
+    // Add the root itself (for ~/.skills-manager pattern)
+    candidates.push(expanded);
+
+    // Add skills/ subdirectory if exists
+    const skillsDir = path.join(expanded, 'skills');
+    if (isDir(skillsDir)) candidates.push(skillsDir);
+
+    // Add skills-core/ subdirectory if exists (for ~/.agents/skills-core)
+    const skillsCoreDir = path.join(expanded, 'skills-core');
+    if (isDir(skillsCoreDir)) candidates.push(skillsCoreDir);
+
+    // Add plugins/ subdirectory if exists (for plugin cache/marketplace)
+    const pluginsDir = path.join(expanded, 'plugins');
+    if (isDir(pluginsDir)) candidates.push(pluginsDir);
+  }
+
+  // For project-local directories
+  for (const agent of projectAgents) {
+    const expanded = path.join(process.cwd(), agent);
+    if (!isDir(expanded)) continue;
+
+    const skillsDir = path.join(expanded, 'skills');
+    if (isDir(skillsDir)) candidates.push(skillsDir);
+  }
+
   return {
     home,
     dbPath: path.join(home, 'doctor.db'),
     reportsDir: path.join(home, 'reports'),
     scan: { maxDepth: 6 },
-    roots: candidates,
+    roots: [...new Set(candidates)], // deduplicate
   };
 }
 
@@ -691,6 +749,12 @@ function runPhase2Analysis(db, skills) {
   return { groups, drifts };
 }
 
+function runGovernanceAnalysis(db, skills) {
+  const findings = detectGovernanceFindings(skills);
+  for (const finding of findings) upsertFinding(db, finding, finding.links || []);
+  return findings;
+}
+
 function recordRun(db, run) {
   db.prepare('INSERT INTO doctor_runs (id, started_at, finished_at, status, skill_count, finding_count, duplicate_group_count, high_count, critical_count, config_json, summary_json) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)').run(run.id, run.startedAt, run.finishedAt, run.status, run.skillCount, run.findingCount, 0, run.highCount, run.criticalCount, JSON.stringify(run.config || {}), JSON.stringify(run.summary || {}));
 }
@@ -727,6 +791,7 @@ function buildReportData(db, includeIgnored) {
     riskFindings: findings.filter(f => f.type === 'risk').length,
     conflictFindings: findings.filter(f => f.type === 'conflict').length,
     zombieCandidates: findings.filter(f => f.type === 'zombie').length,
+    governanceFindings: findings.filter(f => f.type === 'governance').length,
     descriptionQualityFindings: findings.filter(f => f.type === 'description_quality').length,
     duplicateFindings: findings.filter(f => f.type === 'duplicate').length,
     ignoredFindings: rows.filter(row => row.ignored).length,
@@ -749,6 +814,7 @@ function renderMarkdown(data, lang) {
     `- ${L('report.versionDriftFindings')}: ${data.summary.versionDriftFindings}`,
     `- ${L('report.conflictFindings')}: ${data.summary.conflictFindings}`,
     `- ${L('report.riskFindings')}: ${data.summary.riskFindings}`,
+    `- ${L('report.governanceFindings')}: ${data.summary.governanceFindings}`,
     `- ${L('report.zombieCandidates')}: ${data.summary.zombieCandidates}`,
     `- ${L('report.ignoredFindings')}: ${data.summary.ignoredFindings}`,
     `- ${L('report.bySeverity')}: ${JSON.stringify(data.summary.bySeverity)}`,
@@ -908,6 +974,7 @@ function renderHtml(data, lang, reportPath) {
     { key: 'report.totalFindings', descKey: 'dashboard.totalFindings.desc', value: data.summary.totalFindings, color: '#8b5cf6', tooltipTitle: null, tooltipText: null, filterFn: null },
     // Actionable — high priority (red)
     { key: 'report.conflictFindings', descKey: 'dashboard.conflictFindings.desc', value: data.summary.conflictFindings, color: '#ef4444', tooltipTitle: 'tooltip.conflict.title', tooltipText: 'tooltip.conflict.text', filterFn: f => f.type === 'conflict' },
+    { key: 'report.governanceFindings', descKey: 'dashboard.governanceFindings.desc', value: data.summary.governanceFindings, color: '#0f766e', tooltipTitle: 'tooltip.governance.title', tooltipText: 'tooltip.governance.text', filterFn: f => f.type === 'governance' },
     // Actionable — medium priority (orange)
     { key: 'report.zombieCandidates', descKey: 'dashboard.zombieCandidates.desc', value: data.summary.zombieCandidates, color: '#f59e0b', tooltipTitle: 'tooltip.zombie.title', tooltipText: 'tooltip.zombie.text', filterFn: f => f.type === 'zombie' },
     // Actionable — lower priority (yellow)
@@ -1367,6 +1434,7 @@ Commands:
   risks [--json] [--ci] [--fail-on high|critical|medium]
   conflicts [--json] [--ci] [--fail-on high|critical|medium]
   zombies [--json] [--ci] [--fail-on high|critical|medium]
+  governance [--json] [--ci] [--fail-on high|critical|medium]
   plan [--safe|--normal|--aggressive] [--json] [--output <path>]
   apply <plan.json> --dry-run [--json]
   ignore <finding-id> [--reason <text>]
@@ -1374,7 +1442,7 @@ Commands:
   ignored list
   help
 
-Fix types: risk, zombie, duplicate, conflict, version_drift, description_quality, scan_warning
+Fix types: risk, zombie, duplicate, conflict, version_drift, governance, description_quality, scan_warning
 Fix severity: critical, high, medium, low, info
 `);
 }
@@ -1473,6 +1541,9 @@ function runDiagnose(args) {
   const zombieFindings = detectZombies(skills);
   for (const f of zombieFindings) upsertFinding(db, f, f.links || []);
 
+  // Governance readiness detection
+  const governanceFindings = runGovernanceAnalysis(db, skills);
+
   // Duplicate and version drift detection
   const phase2Result = runPhase2Analysis(db, skills);
 
@@ -1482,6 +1553,7 @@ function runDiagnose(args) {
     riskFindings: riskFindings.length,
     conflictFindings: conflictFindings.length,
     zombieCandidates: zombieFindings.length,
+    governanceFindings: governanceFindings.length,
     duplicateGroups: phase2Result.groups.length,
     versionDriftFindings: phase2Result.drifts.length,
   };
@@ -1494,6 +1566,7 @@ function runDiagnose(args) {
     console.log(t('cli.riskFindings', lang, summary.riskFindings));
     console.log(t('cli.conflictFindings', lang, summary.conflictFindings));
     console.log(t('cli.zombieCandidates', lang, summary.zombieCandidates));
+    console.log(t('cli.governanceFindings', lang, summary.governanceFindings));
   }
 
   if (args.ci) {
@@ -1684,7 +1757,7 @@ function runIgnored(args) {
 
 function runGuide(args) {
   const lang = args.lang || 'en';
-  const types = ['risk', 'zombie', 'duplicate', 'conflict', 'version_drift', 'description_quality', 'scan_warning'];
+  const types = ['risk', 'zombie', 'duplicate', 'conflict', 'version_drift', 'governance', 'description_quality', 'scan_warning'];
   const lines = [];
   for (const type of types) {
     lines.push(`=== ${t(`guide.${type}.title`, lang)} ===`);
@@ -1721,7 +1794,7 @@ function runFix(args) {
   }
 
   // Validate type
-  const validTypes = ['risk', 'zombie', 'duplicate', 'conflict', 'version_drift', 'description_quality', 'scan_warning'];
+  const validTypes = ['risk', 'zombie', 'duplicate', 'conflict', 'version_drift', 'governance', 'description_quality', 'scan_warning'];
   if (typeFilter && !validTypes.includes(typeFilter)) {
     console.error(`${lang === 'zh' ? '无效的问题类型' : 'Invalid type'}: ${typeFilter}. ${lang === 'zh' ? '可选值' : 'Valid values'}: ${validTypes.join(', ')}`);
     process.exit(3);
@@ -1819,6 +1892,7 @@ function main() {
     if (command === 'risks') return runFindingsByType(args, 'risk');
     if (command === 'conflicts') return runFindingsByType(args, 'conflict');
     if (command === 'zombies') return runFindingsByType(args, 'zombie');
+    if (command === 'governance') return runFindingsByType(args, 'governance');
     if (command === 'plan') return runPlan(args);
     if (command === 'apply') return runApply(args);
     if (command === 'ignore') return runIgnore(args, true);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-skill-doctor",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "Diagnostic and governance CLI for AI agent skills",
   "type": "commonjs",
   "main": "./src/doctor/index.js",
@@ -10,6 +10,7 @@
     "./conflict": "./src/doctor/conflict.js",
     "./zombie": "./src/doctor/zombie.js",
     "./risk": "./src/doctor/risk-lite.js",
+    "./governance": "./src/doctor/governance.js",
     "./rules": "./src/doctor/rules.js",
     "./i18n": "./src/doctor/i18n.js"
   },

package/src/doctor/governance.js

@@ -0,0 +1,136 @@
+'use strict';
+
+const crypto = require('node:crypto');
+const { buildParticipantIdentityKey } = require('./phase2');
+
+function sha256(input) {
+  return crypto.createHash('sha256').update(String(input)).digest('hex');
+}
+
+function normalizeList(value) {
+  if (Array.isArray(value)) return value.map(String).map(s => s.trim().toLowerCase()).filter(Boolean);
+  return String(value || '').split(',').map(s => s.trim().toLowerCase()).filter(Boolean);
+}
+
+function frontmatterValue(skill, keys) {
+  const frontmatter = skill.frontmatter || {};
+  for (const key of keys) {
+    const value = frontmatter[key];
+    if (value != null && String(value).trim()) return String(value).trim();
+  }
+  return '';
+}
+
+function hasTrustedSource(skill) {
+  const source = skill.source || {};
+  if (['builtin', 'marketplace'].includes(source.type)) return true;
+  if (['git', 'plugin'].includes(source.type) && source.url) return true;
+  return Boolean(skill.upstreamSkillId || skill.upstream_skill_id);
+}
+
+function lifecycleStatus(skill) {
+  return frontmatterValue(skill, ['lifecycle', 'status', 'release_status', 'registry_status', 'governance_status']);
+}
+
+function hasGovernanceLabel(skill) {
+  const tags = normalizeList(skill.tags || []);
+  const labels = normalizeList(frontmatterValue(skill, ['label', 'labels']));
+  return [...tags, ...labels].some(label => ['stable', 'dev', 'latest'].includes(label));
+}
+
+function makeFinding(skill, ruleId, severity, title, description, recommendation) {
+  const participantKey = buildParticipantIdentityKey([skill]);
+  const evidenceText = `${skill.slug || skill.name}: ${ruleId}`;
+  const signature = sha256(`${ruleId}:${skill.id || skill.slug || skill.name}`);
+  const id = sha256(`${participantKey}:governance:governance-detector:${ruleId}:${signature}`);
+  return {
+    id,
+    type: 'governance',
+    severity,
+    detectorId: 'governance-detector',
+    ruleId,
+    title,
+    description,
+    signature,
+    evidence: [{
+      file: skill.location?.path || skill.local_path || '',
+      text: evidenceText,
+      anchor: evidenceText.toLowerCase(),
+    }],
+    recommendation,
+    skills: [skill],
+    links: [{ skillId: skill.id, role: 'primary' }],
+  };
+}
+
+function detectGovernanceFindings(skills) {
+  const findings = [];
+
+  for (const skill of skills) {
+    const owner = frontmatterValue(skill, ['owner', 'owners', 'maintainer', 'maintainers']);
+    if (!owner) {
+      findings.push(makeFinding(
+        skill,
+        'missing-owner',
+        'medium',
+        'Missing owner',
+        'The skill has no owner or maintainer metadata, so registry review and rollback ownership are unclear.',
+        'Add owner or maintainer metadata before sharing this skill through a registry.'
+      ));
+    }
+
+    const version = skill.version || frontmatterValue(skill, ['version']);
+    if (!version) {
+      findings.push(makeFinding(
+        skill,
+        'missing-version',
+        'medium',
+        'Missing version',
+        'The skill has no version metadata, which makes stable release and rollback decisions harder.',
+        'Add a version field or lock the skill to an upstream ref before publishing.'
+      ));
+    }
+
+    if (!lifecycleStatus(skill)) {
+      findings.push(makeFinding(
+        skill,
+        'missing-lifecycle-status',
+        'medium',
+        'Missing lifecycle status',
+        'The skill has no governance lifecycle status such as draft, review, or online.',
+        'Add lifecycle metadata such as draft, review, online, deprecated, or archived.'
+      ));
+    }
+
+    if (!hasGovernanceLabel(skill)) {
+      findings.push(makeFinding(
+        skill,
+        'missing-governance-label',
+        'low',
+        'Missing governance label',
+        'The skill has no stable, dev, or latest label to control adoption scope.',
+        'Add a stable, dev, or latest label to make release targeting explicit.'
+      ));
+    }
+
+    if (!hasTrustedSource(skill)) {
+      findings.push(makeFinding(
+        skill,
+        'missing-source',
+        'high',
+        'Missing trusted source',
+        'The skill has no upstream or registry source, so users cannot tell which copy is authoritative.',
+        'Add source metadata or import this skill into a central library or registry before team-wide use.'
+      ));
+    }
+  }
+
+  return findings;
+}
+
+module.exports = {
+  detectGovernanceFindings,
+  hasGovernanceLabel,
+  hasTrustedSource,
+  lifecycleStatus,
+};

package/src/doctor/i18n.js

@@ -8,6 +8,7 @@ const en = {
   'cli.riskFindings': 'Risk findings: %s',
   'cli.conflictFindings': 'Conflict findings: %s',
   'cli.zombieCandidates': 'Zombie candidates: %s',
+  'cli.governanceFindings': 'Governance findings: %s',
   'cli.reportWritten': 'Report written: %s',
   'cli.noFindings': 'No %s findings.',
   'cli.noDuplicateGroups': 'No duplicate groups. Run: agent-skill-doctor diagnose',
@@ -32,6 +33,7 @@ const en = {
   'report.riskFindings': 'Risk findings',
   'report.conflictFindings': 'Conflict findings',
   'report.zombieCandidates': 'Zombie candidates',
+  'report.governanceFindings': 'Governance readiness',
   'report.descriptionQualityFindings': 'Description issues',
   'report.duplicateFindings': 'Duplicate findings',
   'report.ignoredFindings': 'Ignored',
@@ -118,6 +120,8 @@ const en = {
   'tooltip.zombie.formulaText': 'Score = presetCount==0 (0.25) + noAgents (0.20) + noProjects (0.20) + noModification (0.15) + noActivityLog (0.15) + lowDescriptionQuality (0.05). Then: official (*0), plugin (*0.5), thirdParty (*0.75). Max = 1.0.',
   'tooltip.conflict.title': 'Conflict Detection Criteria',
   'tooltip.conflict.text': 'Checks if 2+ skills match different alternatives within the same conflict rule. Built-in rules: package manager conflict (npm vs pnpm vs yarn), output format conflict (JSON vs Markdown). Binary detection: conflict exists or not.',
+  'tooltip.governance.title': 'Governance Readiness Criteria',
+  'tooltip.governance.text': 'Checks whether a skill is ready for team or registry use: owner, version, lifecycle status, release label, and trusted source metadata.',
   'tooltip.descriptionQuality.title': 'Description Quality (Informational)',
   'tooltip.descriptionQuality.text': 'Evaluates skill descriptions on 4 dimensions: length, risk mention, usage guidance, and structure. Low scores indicate poor documentation, but this does not affect skill functionality. Can be improved by Agent at low priority.',
   'tooltip.versionDrift.title': 'Version Drift Detection',
@@ -144,6 +148,7 @@ const en = {
   'type.zombie': 'Zombie',
   'type.duplicate': 'Duplicate',
   'type.version_drift': 'Version Drift',
+  'type.governance': 'Governance',
   'type.description_quality': 'Description Quality',
   'type.scan_warning': 'Scan Warning',
 
@@ -193,6 +198,15 @@ const en = {
   'guide.version_drift.prompt': 'Please update all installations of skill "%s" to the latest version and consolidate to a single install location if possible.',
   'guide.version_drift.agentExample': 'Agent interaction example:\nUser: Please help me unify skill versions\nAgent: I\'ll check all installation locations and find the latest version...',
 
+  'guide.governance.title': 'Governance Readiness',
+  'guide.governance.definition': 'Governance findings indicate that a skill is missing metadata needed for team sharing, registry review, release labels, or rollback.',
+  'guide.governance.cause': 'Common causes:\n• Skill was created locally without owner metadata\n• Skill has no version or lifecycle status\n• Skill has no stable/dev/latest label\n• Skill has no trusted source or upstream registry record',
+  'guide.governance.severity': 'Severity explanation:\n• High: Missing trusted source\n• Medium: Missing owner, version, or lifecycle status\n• Low: Missing release label',
+  'guide.governance.meaning': 'The skill may work locally, but it is not yet ready to be treated as a governed team asset.',
+  'guide.governance.steps': 'Fix steps:\n1. Add owner or maintainer metadata\n2. Add version metadata\n3. Add lifecycle status such as draft, review, or online\n4. Add stable/dev/latest label\n5. Add source metadata or import into a central registry',
+  'guide.governance.prompt': 'Please improve governance metadata for the skill at "%s". Add owner, version, lifecycle, label, and trusted source fields where missing.',
+  'guide.governance.agentExample': 'Agent interaction example:\nUser: Please prepare this skill for registry sharing\nAgent: I\'ll inspect the skill metadata, add missing owner/version/lifecycle fields, and keep content changes minimal...',
+
   'guide.description_quality.title': 'Description Quality',
   'guide.description_quality.definition': 'Description quality issues indicate that the skill\'s SKILL.md file is missing necessary information or has unclear descriptions.',
   'guide.description_quality.cause': 'Common causes:\n• Skill author didn\'t provide complete description\n• Description is too brief, missing key information\n• No trigger conditions specified\n• No input/output documented\n• Known risks not recorded',
@@ -235,6 +249,7 @@ const en = {
   'dashboard.riskFindings.desc': 'Inherent permissions, not actionable',
   'dashboard.zombieCandidates.desc': 'Unused or abandoned skills (score >= 0.4)',
   'dashboard.conflictFindings.desc': 'Skills with contradictory instructions',
+  'dashboard.governanceFindings.desc': 'Skills missing registry readiness metadata',
   'dashboard.descriptionQualityFindings.desc': 'Documentation quality, low priority',
   'dashboard.duplicateFindings.desc': 'Findings related to duplicate skill content',
   'dashboard.versionDriftFindings.desc': 'Skills with outdated versions compared to source',
@@ -281,6 +296,7 @@ const zh = {
   'cli.riskFindings': '风险发现: %s',
   'cli.conflictFindings': '冲突发现: %s',
   'cli.zombieCandidates': '僵尸技能: %s',
+  'cli.governanceFindings': '治理发现: %s',
   'cli.reportWritten': '报告已写入: %s',
   'cli.noFindings': '没有 %s 类型的发现。',
   'cli.noDuplicateGroups': '没有重复组。运行: agent-skill-doctor diagnose',
@@ -304,6 +320,7 @@ const zh = {
   'report.riskFindings': '风险发现',
   'report.conflictFindings': '冲突发现',
   'report.zombieCandidates': '僵尸技能',
+  'report.governanceFindings': '治理就绪',
   'report.descriptionQualityFindings': '描述问题',
   'report.duplicateFindings': '重复发现',
   'report.ignoredFindings': '已忽略',
@@ -389,6 +406,8 @@ const zh = {
   'tooltip.zombie.formulaText': '分数 = 未被预设引用(0.25) + 未安装到Agent(0.20) + 未安装到项目(0.20) + 无近期修改(0.15) + 无活动日志(0.15) + 描述质量低(0.05)。然后：官方(*0)、插件(*0.5)、第三方(*0.75)。最大值 = 1.0。',
   'tooltip.conflict.title': '冲突检测标准',
   'tooltip.conflict.text': '检查 2+ 个技能是否在同一冲突规则中匹配了不同的备选项。内置规则：包管理器冲突（npm vs pnpm vs yarn）、输出格式冲突（JSON vs Markdown）。二元检测：存在或不存在。',
+  'tooltip.governance.title': '治理就绪检测标准',
+  'tooltip.governance.text': '检查技能是否具备团队共享或 Registry 使用所需的元数据：owner、version、生命周期状态、发布标签和可信来源。',
   'tooltip.descriptionQuality.title': '描述质量（仅供参考）',
   'tooltip.descriptionQuality.text': '从 4 个维度评估技能描述：长度、风险提示、使用指导、结构化。低分说明文档质量差，但不影响技能功能。可由 Agent 低优先级补充完善。',
   'tooltip.versionDrift.title': '版本漂移检测标准',
@@ -413,6 +432,7 @@ const zh = {
   'type.zombie': '僵尸',
   'type.duplicate': '重复',
   'type.version_drift': '版本漂移',
+  'type.governance': '治理',
   'type.description_quality': '描述质量',
   'type.scan_warning': '扫描警告',
 
@@ -461,6 +481,15 @@ const zh = {
   'guide.version_drift.prompt': '请将技能 "%s" 的所有安装更新到最新版本，如可能请合并到单一安装位置。',
   'guide.version_drift.agentExample': 'Agent 交互示例：\n用户：请帮我统一技能版本\nAgent：我来检查所有安装位置，找出最新版本...',
 
+  'guide.governance.title': '治理就绪',
+  'guide.governance.definition': '治理发现表示技能缺少团队共享、Registry 审核、发布标签或回滚所需的元数据。',
+  'guide.governance.cause': '常见成因：\n• 技能只在本地创建，未写 owner\n• 技能没有 version 或生命周期状态\n• 技能没有 stable/dev/latest 标签\n• 技能没有可信来源或上游 Registry 记录',
+  'guide.governance.severity': '严重程度说明：\n• High（高）：缺少可信来源\n• Medium（中）：缺少 owner、version 或生命周期状态\n• Low（低）：缺少发布标签',
+  'guide.governance.meaning': '该技能可能本地可用，但还不能被当作可治理的团队资产。',
+  'guide.governance.steps': '修复步骤：\n1. 添加 owner 或 maintainer 元数据\n2. 添加 version 元数据\n3. 添加 draft、review 或 online 等生命周期状态\n4. 添加 stable/dev/latest 标签\n5. 添加 source 元数据，或导入中心库/Registry',
+  'guide.governance.prompt': '请完善技能 "%s" 的治理元数据。补齐缺失的 owner、version、lifecycle、label 和 trusted source 字段。',
+  'guide.governance.agentExample': 'Agent 交互示例：\n用户：请把这个技能整理到可以团队共享\nAgent：我会检查技能元数据，补齐缺失的 owner/version/lifecycle 字段，并尽量保持内容改动最小...',
+
   'guide.description_quality.title': '描述质量',
   'guide.description_quality.definition': '描述质量问题是指标技能的 SKILL.md 文件缺少必要信息或描述不清晰。',
   'guide.description_quality.cause': '常见成因：\n• 技能作者未提供完整描述\n• 描述过于简短，缺少关键信息\n• 未说明触发条件\n• 未说明输入输出\n• 未记录已知风险',
@@ -503,6 +532,7 @@ const zh = {
   'dashboard.riskFindings.desc': '固有权限，无需修复',
   'dashboard.zombieCandidates.desc': '疑似废弃的技能数（分数 >= 0.4）',
   'dashboard.conflictFindings.desc': '指令相互矛盾的技能数',
+  'dashboard.governanceFindings.desc': '缺少治理元数据的技能数',
   'dashboard.descriptionQualityFindings.desc': '文档质量问题，低优先级',
   'dashboard.duplicateFindings.desc': '与重复内容相关的发现数',
   'dashboard.versionDriftFindings.desc': '与源版本不一致的技能数',

package/src/doctor/index.js

@@ -6,6 +6,7 @@ const zombie = require('./zombie');
 const riskLite = require('./risk-lite');
 const rules = require('./rules');
 const i18n = require('./i18n');
+const governance = require('./governance');
 
 module.exports = {
   // Phase 2 - Duplicate and drift detection
@@ -35,6 +36,12 @@ module.exports = {
   loadJsonRules: riskLite.loadJsonRules,
   scanSkillForRisks: riskLite.scanSkillForRisks,
 
+  // Governance readiness
+  detectGovernanceFindings: governance.detectGovernanceFindings,
+  hasGovernanceLabel: governance.hasGovernanceLabel,
+  hasTrustedSource: governance.hasTrustedSource,
+  lifecycleStatus: governance.lifecycleStatus,
+
   // Rules and utilities
   DEFAULT_RISK_RULES: rules.DEFAULT_RISK_RULES,
   DEFAULT_CONFLICT_RULES: rules.DEFAULT_CONFLICT_RULES,