Control Adoption¶
ContributorsMyles Henaghan
When to use: Deliberately invoke in Agent mode against an in-scope consumer repository to see which library deterministic controls it already has, and what it does better or newer that should be pulled back into the library. Re-run periodically (e.g. quarterly) to keep provenance honest.
Purpose¶
A dual-direction diagnose skill:
| Direction | Question |
|---|---|
| Adoption (library → repo) | Which library controls does this repo already have? |
| Backport (repo → library) | What does the repo do better or newer that should land in the library? |
Instructions¶
- Read references/control-adoption-prompt.md and references/control-catalogue.md.
- Run the scope gate (target repo + archetype, control set, results path) before scanning. Read-only on the target repo; write only into the portfolio path that owns the matrix.
- On first use in a portfolio, seed
control-matrix.ymlandreviews/from assets/ if those files do not exist yet. - For each control: evidence-led status (present / partial / absent / N/A), direction (adoption / backport / parity), and concrete paths/flags.
- Update state (
control-matrix.yml) and run log (reviews/YYYY-MM.yml) every run. Write the optional narrative only when asked. - Report the net diff (or
baseline), updated counts, and new backport candidates. Flag effort/provenance implications — do not silently rewrite effort plans.
What this scan covers¶
| Artefact | Job |
|---|---|
| Control matrix | Current per-repo control status, since dates, provenance |
| Run log | When each repo was scanned + per-run changes net diff |
| Narrative (optional) | Human-readable evidence write-up with At-a-glance |
References¶
Troubleshooting¶
| Symptom | Likely cause | Fix |
|---|---|---|
| Distorted present/absent mix | Control marked ⬜ when N/A for archetype | Re-scope by archetype; use — for N/A |
| Vague "present" claims | No file/flag cited | Require path + tool/flag before ✅ |
| Zero adoption but strong controls | Independent implementation | Treat as backport source; list extraction targets |
| Silent effort drift | Matrix updated without reporting implications | Report provenance/effort deltas; wait for user to apply |
| Matrix missing on first run | Portfolio never seeded | Copy assets/control-matrix.example.yml into the confirmed results path |