I wrote down 61 rules, then failed my own repos

Nobody starts a library because they wanted to write a SECURITY.md.

You start it because there is a thing you want to exist. Then you publish it, and a second job arrives that nobody signed up for: issue templates, a code of conduct, pinned action SHAs, a changelog that survives contact with a release, a publish job that does not leave a long-lived token lying around, and a README that still tells the truth eighteen months later.

That is the boring half. It is mostly mechanical, and it decides whether a stranger with a good patch can figure out how to send it to you.

So I wrote it down. oss-kit is 61 rules about that half of the job and nine agent skills that fix them. Then I pointed it at two repositories of my own. The first failed 27 rules. The second I had already put through the fixing loop, so it is the one that shows what is left at the other end.

What the boring half contains