Renma

Renma is a Git-native Context Repository and deterministic governance CLI for agent-facing knowledge and its static repository declarations. It keeps Skills, Context Assets, Context Lenses, ownership, lifecycle, provenance, security policy, declared relationships, and review evidence maintainable in Git. Renma analyzes and reports repository state; it is not the runtime that consumes these assets.

Why A Context Repository?

Agent-facing guidance is often copied across Skills, prompts, and repository instructions until its authority, owner, and lifecycle are unclear. A Context Repository gives reusable knowledge stable identity and explicit, Git-reviewed governance. A Context Asset is the governance entry point for independently maintained knowledge and its authoritative sources. The content may live in the Context Repository or in an external governed system; Renma does not require copying the complete external source into contexts/.

A reviewed reference does not prove that the source was consulted or its contents validated, and it does not grant permission to access the source.

What Renma Checks

Renma reviews discovered agent-facing repository assets and produces deterministic evidence for humans, CI, and coding agents. renma scan is the normal starting point; focused commands expose the related inventory, graph, ownership, readiness, and change evidence.

Area	Examples
Skills and layout	Canonical entrypoints, metadata, historical paths, and support-directory boundaries.
Governance	Identity, ownership, lifecycle, freshness, required metadata, and security profiles.
Relationships and support	Missing, inactive, conflicting, or cyclic dependencies; broken references; unreachable support.
Authoring quality	Selection boundaries, inputs, verification guidance, scaffold residue, local paths, token budgets, and mixed responsibilities.
Security	Policy violations, sensitive-data exposure, risky commands and dependencies, untrusted instructions, and hidden Unicode.
Review coverage	Inspected files, blocked paths, analysis layers, and unsupported or ambiguous formats.

Security checks apply to documented, supported forms in agent-facing instructions and metadata. They do not perform general code SAST, CVE lookup, dependency-content validation, complete secret scanning of executable code, or runtime permission enforcement. See the Security Policy Guide for the effective-policy and instruction-analysis boundary, and the Diagnostics Reference for current finding identifiers and remediation guidance.

Product Boundary

Renma discovers, validates, compares, and reports repository assets. It does not call an LLM for core analysis; select, retrieve, or load live context; assemble prompts or inject Context; execute agents or Skills; collect runtime telemetry; or replace runtime security and language-specific analysis tools.

The review boundary is:

LLM proposes. Renma verifies. Human approves.

Quick Start

npx renma scan . --fail-on high
npx renma catalog . --format markdown
npx renma graph . --format markdown
npx renma readiness . --format markdown

Read Next

• Documentation Index maps each question to its authoritative document.
• User Manual contains the authoritative operational metadata reference and covers current CLI workflows and commands.
• Machine-Readable JSON Compatibility defines the top-level schema identifiers and 1.x compatibility rules for JSON commands.
• Authoring Guide defines Skill and Context authoring workflows.
• Changelog records release history and compatibility notes.
• Agent Skills Compatibility and Migration defines canonical and migration-only Skill forms.
• Diagnostics Reference and Security Policy Guide explain findings and policy.