Table of Contents generated with DocToc

Labels and capabilities

This page is the canonical reference for the label taxonomy used on issues and pull requests in this framework repository (apache/airflow-steward). It also defines the capability model that classifies what each skill or tool in the framework actually does, independent of which subject area it sits under.

Every issue and pull request opened against this repository should carry at least one area:* label and at least one capability:* label. New tools and new skills must declare their capability up front (see The rule).

Scope caveat. This taxonomy applies to this framework repository. Skills that create issues or PRs on an adopter’s tracker (e.g. security-issue-import, security-issue-fix, issue-fix-workflow) use the adopter’s own label scheme — adopters are free to mirror this taxonomy in their own repo but are not required to.


Label dimensions

The repository’s labels fall into four orthogonal dimensions. An issue or PR typically carries one label from each dimension that applies.

1. area:* — subject

What part of the framework does this touch?

LabelCovers
area:pr-managementpr-management-* skills
area:securitysecurity-* skills, security-tracker-stats-dashboard
area:setupsetup-* skills, framework adoption, agent-sandbox setup
area:issueissue-* skills (issue-triage, issue-fix-workflow, issue-reassess, issue-reassess-stats, issue-reproducer)
area:toolsSubstrate tools under tools/* (CLI bridges, agent-runtime adapters, mail-source backends)
area:ci.github/ workflows, prek, validators
area:docsdocs/, MISSION.md, READMEs

2. capability:* — what the tool does

Nine buckets. A tool or skill carries one or more capability:* labels. Most map cleanly to a single bucket; dual-capability cases are real and explicitly enumerated below. Issues and PRs follow the same rule — apply every capability the change is implementing.

When a skill or tool spans multiple capabilities, list all of them in its frontmatter / README. Do not pick a single “primary” to be neat; that loses information the label system exists to surface.

LabelDefinition
capability:triageSweep a queue, classify candidates, propose dispositions for human confirmation.
capability:reviewDeep per-item code review of a PR or local diff; also contributor mentoring (single-item teaching intervention).
capability:fixImplement a code change against an upstream repo to resolve a triaged issue.
capability:intakeImport external signal (mailing list, scan report, public PR) into a tracker entry, or keep an existing entry reconciled with one of those sources.
capability:reconciliationCompare tracker state against an external inventory (e.g. ASF security dashboard, organization-wide issue registry); surface drift; propose corrections. Does not write to either source.
capability:resolveClose-out actions: invalidate, dedupe, CVE-allocate, post-announcement housekeeping.
capability:reassessRe-run resolved or end-of-life issues against current code to verify still-fixed / still-broken.
capability:statsRead-only dashboards, metrics, governance evidence, contributor nomination briefs.
capability:setupFramework / agent / substrate infrastructure: install, verify, update, doctor, override-upstream, write-skill, plus new tools under tools/*.

The capability:* dimension is orthogonal to area:*. A single query can answer “how is our triage stack doing across PR + issue + security?” by filtering on capability:triage alone, without enumerating per-area queries.

3. kind:* — change type (pre-existing)

LabelCovers
kind:dxMaintainer dev-loop / CLI UX
kind:policyRule changes (eligibility, thresholds, behaviour switches)
kind:perfToken / latency / API-call budget
kind:adopter-configPer-adopter knob

4. mode:* — handling mode (pre-existing)

LabelCovers
mode:AMode A — triage
mode:BMode B — mentoring
mode:CMode C — agent-authored fix with human review
mode:DMode D — narrowly-scoped auto-merge (off until A/B/C run 2 quarters)
mode:cross-cuttingSpans multiple modes
mode:platformSubstrate / infra — not a mode (sandbox, CI, validators)

Standalone labels

marketing (branding artefacts), dependencies (dependency-update PRs), python:uv (Python uv-managed code), plus the default GitHub labels (bug, enhancement, documentation, good first issue, etc.).


Capability to skill map

Capabilities for every skill currently in .claude/skills/. Skills with two values (separated by +) carry both labels.

SkillCapability / capabilities
pr-management-triagecapability:triage
issue-triagecapability:triage
security-issue-triagecapability:triage
pr-management-code-reviewcapability:review
pairing-self-reviewcapability:review
pr-management-mentorcapability:review
issue-fix-workflowcapability:fix
security-issue-fixcapability:fix + capability:resolve (opens the PR that closes the tracker — both phases)
security-issue-importcapability:intake
security-issue-import-from-mdcapability:intake
security-issue-import-from-prcapability:intake
security-issue-synccapability:intake (+ capability:reconciliation once #337 lands the ASF-dashboard step)
setup-shared-config-synccapability:intake + capability:setup (reconciles user-scope config to a sync repo; the act is intake, the subject is setup)
security-cve-allocatecapability:resolve
security-issue-invalidatecapability:resolve
security-issue-deduplicatecapability:resolve
issue-reassesscapability:reassess
issue-reproducercapability:reassess
pr-management-statscapability:stats
issue-reassess-statscapability:stats
security-tracker-stats-dashboardcapability:stats
contributor-nominationcapability:stats
list-steward-skillscapability:stats
setup-stewardcapability:setup
setup-isolated-setup-installcapability:setup
setup-isolated-setup-verifycapability:setup
setup-isolated-setup-updatecapability:setup
setup-isolated-setup-doctorcapability:setup + capability:reassess (re-checks an installed sandbox against current spec — the phase is reassess on subject setup)
setup-override-upstreamcapability:setup
write-skillcapability:setup

Capability to tool map

Tools under tools/. Tools with two values (separated by +) carry both labels — the dual role is explained in each row.

ToolCapability / capabilitiesRole
tools/agent-isolationcapability:setupSecure-agent sandbox helpers
tools/cve-orgcapability:resolve + capability:intakePublishes to CVE.org (resolve) and records the resulting CVE state back into the tracker (intake)
tools/dashboard-generatorcapability:statsSelf-contained HTML dashboard generator
tools/devcapability:setupFramework dev-loop helpers
tools/githubcapability:setupGitHub REST / GraphQL substrate (called by every lifecycle phase — pure substrate, no single phase)
tools/gmailcapability:setupGmail API substrate
tools/jiracapability:setupJIRA REST substrate (read-only today; write subcommands tracked in #301)
tools/mail-sourcecapability:setup + capability:intakeMail-source backend abstraction (mbox / IMAP / Mailman 3); the abstraction is setup, every concrete read is part of the intake pipeline
tools/ponymailcapability:setup + capability:intakePonyMail archive substrate; same dual role as mail-source — substrate plus an intake-pipeline component
tools/pr-management-statscapability:statsPR-backlog analytics engine
tools/privacy-llmcapability:setupPrivacy-LLM PII-scrubbing gate
tools/probe-templatescapability:setupSandbox-doctor probe templates
tools/sandbox-lintcapability:setupSandbox settings linter
tools/security-tracker-stats-dashboardcapability:statsSecurity-tracker analytics engine
tools/spec-loopcapability:setupSpec-driven build loop runner (Ralph-style) for framework development
tools/skill-evalscapability:setup + capability:statsEval harness for skills; the harness is setup infrastructure, the run output is governance evidence
tools/skill-and-tool-validatorcapability:setupSkill-frontmatter and convention validator
tools/spec-status-indexcapability:setup + capability:statsIndex of spec / RFC implementation status — substrate that also doubles as a governance/stats view
tools/spec-validatorcapability:setupSpec-frontmatter and body-section validator — counterpart to skill-and-tool-validator for tools/spec-loop/specs/
tools/vulnogramcapability:resolveASF Vulnogram CVE-allocation client

A tool’s capabilities are determined by its use-case lifecycle phases, not by which skills happen to consume it. tools/github is called by every triage / intake / fix / resolve skill but is tagged only capability:setup because it doesn’t encode any one lifecycle phase — it is pure substrate. tools/cve-org, by contrast, exists specifically to do CVE publication and to record that result; both the resolve action and the intake of state into the tracker are first-class jobs of the tool, so it carries both labels.

When a tool grows to serve a new lifecycle phase as a first-class feature (rather than as generic substrate that other skills happen to compose), add the new capability:* label to its README and to the table above.


The rule

When you create any of the following on this repository, declare the capability:

A GitHub issue

Apply at least one area:* AND one capability:* label. If the issue genuinely spans capabilities, apply both — for example, #337 carries both capability:reconciliation and capability:setup because it covers a new substrate tool and a new sync-flow integration.

A pull request

Same: area:* AND capability:*. Match the capability the change is implementing, not the file paths it happens to touch. A PR that adjusts the validator config to support a new triage rule is capability:triage (the change’s purpose), not capability:setup (the file it edited).

A new tool under tools/

Declare the tool’s capability in the first paragraph of its README using the line:

**Capability:** capability:NAME

If the tool serves more than one capability, list both. Substrate bridges (tools/github, tools/gmail, …) default to capability:setup unless they encode a specific lifecycle capability.

A new skill under .claude/skills/

Declare the capability in the skill’s frontmatter:

---
name: my-new-skill
description: |
  ...
capability: capability:NAME
---

The write-skill skill prompts for this on every new-skill scaffold.

A new doc under docs/

Capability-specific docs (e.g. a guide for a single skill family) should link to this page and name the capability in their first paragraph. Cross-cutting docs (MISSION.md, top-level READMEs) need no capability marker.


Why this exists

The original area:* labels split issues by subject — useful for “what part of the codebase is this?” but unable to answer “what kind of thing is this?”. The capability:* dimension fills that gap and is orthogonal: a triage-rule change in PR management (area:pr-management + capability:triage) and a triage-rule change in security (area:security + capability:triage) become trivially findable as a cohort even though they live in different families.

Capability is also a forcing function for skill design: if a new skill doesn’t fit any of the nine buckets cleanly, that’s a signal worth inspecting before the skill ships.