Working methods for AI agents — installed by the agent that needs them.
Sylphx Skills is the public, MIT-licensed library of how Sylphx agents design, build, verify, deliver, operate, and grow software. It supports Codex, Claude Code, and Grok Build.
Give this to your agent:
Install this: https://github.com/SylphxAI/skills
That is the complete user procedure. The agent reads INSTALL.md,
detects its environment, installs the exact Skill catalog and compact runtime
constitution, enables managed AutoSync, enrolls the canonical Sylphx Enact
SaaS endpoint through native OAuth, preserves unrelated configuration,
and verifies the result in a fresh context. The repository never asks the user
to translate that outcome into shell commands.
The root SKILL.md is a discovery bootstrap for clients that
pre-route repository installation through a generic Skill installer. It sends
the agent to INSTALL.md before any leaf-package operation. Folder copying
alone omits the managed source manifest, compact constitution, idempotent
reconciliation, and fresh-context proof; changing other runtimes without an
explicit request exceeds the installation scope.
Updates also converge installations that still point at the retired Doctrine runtime. Only the exact per-user Sylphx legacy projection is eligible: the adapter preserves local notes, installs a regular digest-bound constitution, and does not alter the retired target. It also validates POSIX ownership and permissions where those metadata are authoritative. Unknown links and imports remain fail-closed.
Codex also discovers the shared ~/.agents/skills root, and current public
source labels $CODEX_HOME/skills as deprecated user storage. Grok discovers
the shared root too, so moving a Codex-targeted install there can also change
Grok's effective catalog. The current adapter therefore keeps its existing
runtime-scoped compatibility target while removing only one exactly proven
historical duplicate from shared discovery. This is a bounded transition, not
a claim that the shared root is obsolete. A shared-catalog cutover must first
define cross-runtime scope and prove a lossless migration. Unknown, modified,
or lookalike projections remain fail-closed.
Agents already load skills. Most collections are either thin stubs or private playbooks. This repository is different:
| Public on purpose | Our real operating methods, not marketing vapor |
| Agent-native packages | Each skill has a clear job, load trigger, and bounded method |
| Multi-runtime | Codex · Claude Code · Grok Build from one source |
| Converging sync | New skills appear; removed skills leave; third-party skills stay |
| Agent-owned adoption | Install, update, integration enrollment, and readback are outcomes owned by the receiving agent |
| OS auto-update | Standard launchd / systemd / Task Scheduler enrollment — no daemon we host |
Commercial Sylphx value is continuous maintenance, private customer packages, Platform integrations, and support — not pretending public Markdown is secret.
Installation is intentionally prompt-native:
Install this: https://github.com/SylphxAI/skills
For a later exact-source update:
Update my Sylphx Skills from https://github.com/SylphxAI/skills and verify them in a fresh context.
To repair or re-enable managed updates explicitly:
Keep my Sylphx Skills current from https://github.com/SylphxAI/skills.
For readback without mutation:
Verify my Sylphx Skills installation and report any drift without changing it.
The agent uses the repository-owned adapter internally. Humans do not need to select a runtime, locate a home directory, invoke a package manager, or repair permissions. If the environment cannot safely persist a required surface, the agent reports a typed partial or blocked result instead of delegating repair to the user.
The command uses the operating system's built-in per-user scheduler: launchd on macOS, a systemd user timer on Linux, and Task Scheduler on Windows. Each tick verifies the installed catalog, profile metadata, source commit, and package bytes and checks the public remote head. Either a changed commit or local drift triggers an exact-source resync. There are no agent hooks, runtime approvals, resident daemons, webhook relays, tokens, or Enact dependencies. When offline, a verified last-known-good generation remains active and retries back off.
AutoSync readback verifies scheduler liveness, the current public remote head, the clean managed checkout, the applied state, adapter bytes, and installed targets rather than trusting its config alone. A Linux container with no working user-systemd manager is therefore reported as configured but inactive instead of green. Its hosting runtime must supply a supervised native scheduler; file presence and detached processes are not durable scheduling evidence.
Each successful reconciliation converges the complete Sylphx-managed set as one verified target generation: new packages, changed package bytes, removals, and the ownership manifest commit together through an ownership-proven recoverable journal under a fenced per-target writer lock. One managed-generation pointer switches every package and the manifest together, so a crash recovers to one complete old or new generation rather than mixed packages. The target root stays stable: unrelated third-party or hand-authored Skills never enter the managed journal and are never copied, moved, or deleted by the switch.
An already-running agent may not reload a changed Skill until that runtime's next normal reload boundary. The files themselves converge within the selected interval.
The deterministic adapter exposes install, status, clear, and scheduled-sync operations to agents and automation. Those operations are implementation mechanisms, not a user installation interface.
Static Skills and live coordination remain separate authorities. Every
installation validates and registers the stable Sylphx SaaS MCP resource
https://enact.sylphx.com/api/mcp through Codex, Claude Code, or Grok Build's
native MCP configuration. The hostname is public product identity, not a
credential or tenant grant. Codex and Claude use their native OAuth login
command; Grok starts its native browser flow when the server connects. OAuth
account, tenant, scopes, expiry, and revocation determine access. A runtime
without safe OAuth support is partial rather than receiving a copied bearer
token. See INSTALL.md and
ADR-20260720.
109 packages in four families (see catalog.json for the
machine index and skills/ for sources):
How we run engineering across projects — delivery, CI admission, incidents, agent-first development, enterprise control planes, profiles, and more.
Examples: engineering-standard · delivery-standard · agent-first-development-standard · work-coordination-standard · technology-stack-profile
Independent methods with precise native-injection triggers and concrete artifacts: critical analysis, design-space exploration, structured deliberation, evidence synthesis, requirements, user research, decision quality and optimization, probabilistic forecasting, causal inference, system dynamics, agent planning/context, semantic taxonomy, threat modeling, objective review, provenance, reference originality, frontend performance remediation, and finite review closure.
Examples: critical-analysis · structured-deliberation · reference-originality-review · frontend-performance-remediation · security-threat-modeling
Bounded design/audit jobs with a concrete artifact: payments, privacy, growth loops, marketplace trust, support ops, launch readiness, game economy, …
Examples: payment-platform-readiness · privacy-data-lifecycle-review · saas-subscription-pricing · launch-readiness-review
Whole-product and craft surfaces: app/game/SaaS blueprints, interface craft, prompt architecture, architecture convergence, skill authoring.
Examples: app-design-blueprint · saas-web-platform-blueprint · interface-craft · prompt-architecture · sylphx-platform-first
Open any package: skills/<id>/SKILL.md is the contract; deeper material lives
in references/.
skills/<id>/
SKILL.md # name + description (when to load) + procedure body
references/ # durable depth (optional)
scripts/ # deterministic helpers only (optional)
agents/ # runtime display metadata (optional; not a second SSOT)
- One semantic owner per package — no dual authoring roots.
- Description front-loads the concrete job, artifact, nearby contexts, and exclusions. Current Codex and Grok expose metadata to the model, so implicit matching is model-mediated rather than a deterministic keyword or embedding verdict. Trigger phrases are selection evidence, not exact activation rules.
- Native discovery starts from compact metadata. Current Codex gives the
model
name + description + locator; current Grok gives it identity through the locator plusdescription + when-to-use. A valid, enabled, unambiguous explicit$skillor/skillinvocation is host-resolved; ambiguous bare names fail or require qualification. Implicit use depends on the model choosing and loading the body. Listing budgets may shorten descriptions or omit entries, so an installed package is not proof that it was visible or selected for a task. Material routes need fresh evidence from each supported native runtime. - There is no repository meta-router or dependency graph. Provider-specific listing, visibility gates, explicit invocation, or shadow rankers remain runtime behavior rather than a second semantic authority. Several relevant packages may compose, but each requested artifact still has one semantic owner.
- Compound tasks may load several useful Skills. One owner produces each requested artifact while standards constrain it without duplicate reports.
- Runtime tools (browse, execute, MCP, credentials) stay with the agent; skills teach method and expected artifacts.
Authority notes: docs/adr/ADR-0001-public-agent-instruction-source.md · docs/adr/ADR-0002-consumption-boundary-skill-reconciliation.md · docs/adr/ADR-0009-native-skill-discovery-and-package-boundaries.md · docs/adr/ADR-0010-observability-audience-boundaries.md · docs/adr/ADR-0011-source-verified-native-skill-discovery.md
| Path | Role |
|---|---|
skills/<id>/ |
Only writable semantic source for packages |
catalog.json |
Deterministic index from frontmatter |
runtime/ |
Agent-facing install / sync / auto-sync / verified MCP enrollment adapters and compact constitution |
INSTALL.md |
Environment-neutral installation contract for the receiving agent |
scripts/ · tests/ |
Integrity gates only |
docs/adr/ |
Repository-level decisions |
Not in this repo: live work or organization-wide adoption state, customer data, benchmark laboratories, admission services, or model-provider evidence runs.
- Questions & ideas → GitHub Discussions
- Bugs in the installer or package shape → Issues
- Contributing a skill → CONTRIBUTING.md
- Security → SECURITY.md
We care about packages that encode a real, recurring job with an independent artifact — not skill-count inflation. Contributors can give the repository and their intended change to an agent; the repository instructions require that agent to run the complete integrity suite before delivery.
MIT. Inspect, fork, embed, and reuse freely.
Sylphx may offer managed updates, enterprise/private packages, Platform integrations, verification, and support. Public text is intentionally not exclusive; quality and continuity are the product.