Reliability Evidence Pack (REP)

A comprehensive runtime system for documenting and verifying agent operational reliability through structured artifact recording, validation, and compliance reporting.

What's Included

Core Scripts (/scripts)

• rep.mjs - Main CLI for initialization, validation, and bundle management
• rep-validate.mjs - Schema validation engine for REP artifacts
• rep-heartbeat-cron.mjs - Records agent heartbeats on a schedule
• rep-near-miss-cron.mjs - Tracks near-miss reliability events
• rep-performance-baseline.mjs - Captures performance metrics
• rep-generate-bundle.mjs - Generates REP bundles from artifacts

CLI Package (/cli)

• Installable npm package for convenient command-line access
• See cli/README.md for installation and usage

GitHub Action (/github-action)

• CI/CD integration for automated validation
• See github-action/README.md for setup

Schemas (/schemas)

• JSON Schema definitions for all REP artifact types:
• decision_rejection_log.json
• handoff_acceptance_packet.json
• memory_reconstruction_audit.json
• near_miss_reliability_trailer.json
• signed_divergence_violation_record.json

Examples (/examples)

• Sample artifacts and workflows
• Integration patterns for different use cases

Required Binaries

• Node.js (v16 or higher - required for runtime scripts)
• npm (for CLI package installation)

No other system binaries required.

Installation

Option 1: Direct Scripts

# Clone or copy this bundle to your project
cp -r rep-bundle-v2 /path/to/your/project/rep
cd rep

# Make scripts executable
chmod +x scripts/*.mjs

# Test
node scripts/rep.mjs --help

Option 2: CLI Package

cd cli
npm install -g
rep --help

Option 3: GitHub Action

- uses: ./github-action
  with:
    bundle-path: ./rep

Configuration

Set environment variables to configure behavior:

# Path to artifacts directory (default: ./artifacts)
REP_ARTIFACTS_PATH=./artifacts

# Path to schemas directory (default: ./schemas)  
REP_SCHEMAS_PATH=./schemas

# Log file path (optional)
REP_LOG_FILE=/var/log/rep.log

Usage

Initialize a new REP

node scripts/rep.mjs init --name "my-agent"

Validate artifacts

node scripts/rep-validate.mjs ./artifacts --strict

Run heartbeat recording (cron)

REP_ARTIFACTS_PATH=./artifacts node scripts/rep-heartbeat-cron.mjs

Set up cron (example for crontab)

# Add to crontab - run heartbeat every 5 minutes
*/5 * * * * cd /path/to/rep && REP_ARTIFACTS_PATH=./artifacts node scripts/rep-heartbeat-cron.mjs >> /var/log/rep-heartbeat.log 2>&1

Artifact Types

Security Considerations

• Credentials: This skill does not require or handle credentials
• File Access: Writes to configured artifacts directory only
• Cron: Does not modify system crontab - operator must configure
• Logs: Optional logging to configurable path

License

MIT

Support

• Documentation: SPEC.md, QUICKSTART.md, INTEGRATION.md
• Examples: examples/
• Validation: node scripts/rep-validate.mjs --help

Security Considerations

Sensitive Data

REP captures context snapshots, decision logs, and memory-like artifacts that may contain sensitive information. - Set REP_ARTIFACTS_PATH to an isolated, access-controlled directory - Review or redact artifacts before sharing externally - Consider running in a container or unprivileged account

Signing Keys

The SPEC includes signature fields for artifact integrity, but key management is operator-defined: - Do NOT place private keys in the artifacts directory - Use external KMS or secure vault for production signing - For testing, generate keys externally and pass via environment (future feature)

CI Usage

The GitHub Action is local to your repository: - Review github-action/entrypoint.sh before use in public CI - Ensure no artifacts leak to external endpoints - Use isolated artifact paths in CI environments

Network Behavior

All scripts operate locally: - No telemetry or external API calls - No automatic updates - All file I/O is to configured artifact paths only

Best Practices

1. Keep artifacts directory separate from source code
2. Add artifact paths to .gitignore
3. Rotate logs regularly

   小葱技能7w4.net有更新，你可以访问看下。

4. Audit artifacts before external sharing

这个 Skill 整体质量较好，文档详细、集成方式多样、场景示例丰富，能满足可靠性证据收集需求。但存在一些小问题：部分文档描述不一致、有个别文件缺失、合规状态为部分通过（非完全）。对于需要完整可靠性的生产环境，建议先确认这些小问题得到修复。日常使用体验应该是不错的。