workflow-hub

Six graphs worth copying. You own the file after it lands.

One workflow per shape worth learning, each implementing a build card from the reference architecture. No runtime dependency, no version to keep in sync, no update command — editing the file is the point.

alpha
6 workflows
all lint clean
20 tests passing
MIT

npx workflow-hub list GitHub

Real output. All six workflows lint clean as shipped.

Install one

One command, one file, yours

$ npx workflow-hub add auth-audit

  ✓ .claude/workflows/auth-audit.js

  phases    Scope → Scan → Verify → Report
  cost      ~$1 for 40 routes with 3 lenses

  next:
    npx graphlint check .claude/workflows/auth-audit.js   # lints clean as shipped
    read it before you run it — you own it now

The registry

One per shape worth learning

Workflow	Shape	Card	Teaches
`ecosystem-digest`	diamond, barrier	6	Start here. No writes, no repo risk, obvious ground truth, one legitimate barrier.
`auth-audit`	diamond + verify	1	The zero-token prefilter, three genuinely distinct lenses, asymmetric thresholds.
`screening-funnel`	funnel	7	Why 300 cheap calls plus 5 deep ones beats 60 deep ones. The `killer` flag.
`cited-report`	diamond + adversarial	5	Decomposition is the ceiling. Three skeptics with three different attacks.
`test-gen`	pipeline + oracle gate	2	The cleanest oracle there is. Worktree isolation. The vacuous-test check.
`cve-sweep`	nested fan-out	9	A second fan-out sized by the first. The human gate — output is a plan, never a PR.

$ workflow-hub show screening-funnel

  screening-funnel  funnel · build card 7

  Cheap rubric pass over a backlog, then a deep dive on the shortlist

  when      You have a backlog and no defensible way to rank it.
  teaches   Why funnel shape beats uniform effort: 300 cheap schema-bounded calls
            plus 5 deep ones beats 60 deep calls on cost and quality.
  cost      ~$2 for 60 items x 4 criteria

  phases    Score → Rank → Deep

  args
    items          the backlog — 50+ is fine
    shortlistSize  how many survive to the deep pass

Why

A registry, not a framework

Every workflow here is a single file with no imports from this package. add copies it and gets out of the way.

That is the whole design. A registry that keeps ownership of the code it hands you is a framework, and a framework is the wrong shape for this: the interesting part of a graph is the part you change — your lenses, your tiers, your fan-out width. There is deliberately no update command, because editing the file is the point.

The registry itself is derived from the workflow files. Each file's own meta.name, meta.description and meta.phases are the source of truth, so an entry cannot drift from what it describes. The tests also check that every documented arg is actually read, and every read arg is documented.

Verified

They follow their own advice

Every workflow passes graphlint with zero findings, and CI fails if one stops. A registry of examples that trip your own org's linter would be worse than no registry — it would be six files teaching the mistakes.

meta declared with phases and a budget.
Every model call tiered explicitly — cheap for mechanical passes, deep for the one or two nodes whose judgment reaches the user.
A schema on every result that crosses an edge.
pipeline by default; parallel only where a barrier is justified, with the reason written down.
Nulls filtered before a fan-in, so one failed node degrades the answer instead of killing the run.
No clock, no random number — nondeterminism invalidates the resume cache and turns a crash into a full re-spend.
A log() whenever a work list is truncated, because a silent cap reads as full coverage.

The test suite asserts those properties directly against the files, not only through the linter.

Limits

What this does not do

It does not run anything. It copies files.

The cost figures are hints. They orient you; they are not measurements of your workload. Run preflight on the copied file for a real estimate.

Read the file before running it. Each one spawns agents and spends money, and cve-sweep and test-gen touch your filesystem.