Source-backed rules for public AI workflow registries that need to keep directory entries, source links, version claims, examples, install guidance, compatibility notes, and last-reviewed metadata fresh enough to trust.
Stale install commands, API examples, permissions, and compatibility notes can lead users to run unsafe, unsupported, or wrong commands., Do not infer current safety behavior from old screenshots, generated summaries, marketing copy, or cached search snippets., Escalate stale claims about security, privacy, pricing, licenses, support status, or production readiness before merge.
Privacy notes
Freshness review can expose private package names, internal docs, customer examples, local paths, account IDs, or vendor plan details if copied into public notes., Use public source URLs and synthetic examples when documenting freshness; do not paste private changelogs or internal support replies., Record uncertainty plainly rather than guessing retention, telemetry, hosted-service, or data-sharing behavior.
Author
MkDev11
Submitted by
MkDev11
Claim status
unclaimed
Last verified
2026-06-04
Decision playbook
Review trust signals before you adopt
Signals are present but mixed. Use the checklist below to confirm the source and operational safety for your environment.
Compare context
Selected
0
Current score
78
Baseline
—
Delta
No baseline selected
No major trust-signal divergence detected in the current selection.
Source and provenance checks
Complete
Confirm ownership and provenance before trusting install instructions.
Source link availableRequired
Open the canonical repository and verify ownership.
Done
Source provenance statusRequired
Marked as source-backed.
Done
Metadata reviewed
Registry metadata indicates a reviewed listing.
Done
Safety and privacy checks
Complete
Validate risk disclosures before installation or API wiring.
Safety notes presentRequired
Review the listed safety guidance before running commands.
Done
Privacy notes presentRequired
Review data handling notes before connecting accounts or secrets.
Done
Trust level risk gateRequired
Trust level does not block evaluation.
Done
Package and install checks
Needs review
Check package metadata and artifact integrity signals.
Install payload available
Install or copy payload is available for review.
Done
Package verification flag
No package verification flag provided.
Pending
Checksum metadata
No checksum provided for downloaded artifact.
Pending
Compare-driven decision checks
Needs review
Use compare context to validate trade-offs before adoption.
Compare tray has multiple entries
Add at least one more entry to compare trust differences.
3 safety and 3 privacy notes across 4 risk areas. Review closely: permissions & scopes, third-party handling.
4 areas
SafetyPermissions & scopesStale install commands, API examples, permissions, and compatibility notes can lead users to run unsafe, unsupported, or wrong commands.
SafetyData retentionDo not infer current safety behavior from old screenshots, generated summaries, marketing copy, or cached search snippets.
SafetyGeneralEscalate stale claims about security, privacy, pricing, licenses, support status, or production readiness before merge.
PrivacyThird-party handlingFreshness review can expose private package names, internal docs, customer examples, local paths, account IDs, or vendor plan details if copied into public notes.
PrivacyData retentionUse public source URLs and synthetic examples when documenting freshness; do not paste private changelogs or internal support replies.
PrivacyData retentionRecord uncertainty plainly rather than guessing retention, telemetry, hosted-service, or data-sharing behavior.
Safety notes
Stale install commands, API examples, permissions, and compatibility notes can lead users to run unsafe, unsupported, or wrong commands.
Do not infer current safety behavior from old screenshots, generated summaries, marketing copy, or cached search snippets.
Escalate stale claims about security, privacy, pricing, licenses, support status, or production readiness before merge.
Privacy notes
Freshness review can expose private package names, internal docs, customer examples, local paths, account IDs, or vendor plan details if copied into public notes.
Use public source URLs and synthetic examples when documenting freshness; do not paste private changelogs or internal support replies.
Record uncertainty plainly rather than guessing retention, telemetry, hosted-service, or data-sharing behavior.
Prerequisites
A public registry entry, submission, or refresh PR with source URLs that users can inspect.
Permission to request source updates, remove stale claims, or block merge when current behavior cannot be verified.
Access to canonical docs, repository releases, package pages, changelogs, or standards pages for the listed workflow.
A place to record last-reviewed date, reviewed version, known unknowns, and update triggers.
You are reviewing documentation freshness for a public AI workflow registry.
Rules:
1. Record when the entry was reviewed and which source version or docs page it
reflects.
2. Prefer stable canonical URLs over release notes, redirects, short links, or
campaign URLs.
3. Treat install commands, compatibility claims, pricing, hosted-service
behavior, and safety notes as stale until source-backed.
4. Do not merge entries with broken source links or unverifiable current-state
claims.
5. Update examples when source docs, package versions, API behavior, or
platform requirements change.
6. Keep generated registry artifacts out of contributor PRs unless the
repository explicitly asks for them.
About this resource
Purpose
Use these rules when reviewing or refreshing documentation for a public AI
workflow registry. The goal is to stop stale docs, stale examples, broken source
links, and old compatibility claims from looking current just because they still
render.
Freshness is not only about dates. A source can be old but stable, or new but
unverified. Review whether the registry entry still matches the source of truth
users will rely on today.
Freshness Metadata
Every public registry entry should make current-state claims reviewable.
Reviewed date. Record when the entry or source claim was last checked.
Reviewed version. Record package, app, API, spec, framework, model, or
docs version when the source provides one.
Canonical source URL. Prefer stable docs, repo, package, release, or
standard URLs over blog posts, announcement pages, short links, and redirects.
Update trigger. Say what should cause a refresh: new major version,
package deprecation, API change, pricing change, policy update, broken link,
or safety/privacy change.
Known unknowns. If current behavior cannot be verified, say so instead of
presenting the entry as current.
Review Rules
Verify every source URL still resolves to the expected canonical page.
Remove tracking parameters, campaign fragments, and stale redirect targets.
Re-check install commands against the current package manager, runtime, and
platform requirements.
Re-check examples when APIs, auth flows, command flags, environment variables,
model names, hosted plans, or file paths change.
Treat pricing, plan names, privacy behavior, telemetry, support level, license,
and production readiness as volatile claims.
Keep old release notes as history, not as evidence of current behavior.
Do not edit generated registry artifacts unless the repository explicitly asks
contributors to do so.
Stable Source Rules
Stable URLs make future review easier.
Prefer documentation pages that remain valid across versions.
Use versioned pages when the entry depends on version-specific behavior.
Prefer canonical repository, package, or standard pages over search result
pages, CDN mirrors, screenshots, social posts, and copied snippets.
Keep one source of truth for each claim; do not cite multiple weak pages when
one canonical source is available.
If a URL redirects, verify the destination still supports the claim.
If a source page is removed, archive status can explain history, but a current
registry entry needs a current source or a clear stale/deprecated label.
Stale Claim Rules
Request edits or block merge when an entry:
says "latest," "current," "new," "official," "production-ready," "secure,"
"free," "open source," or "supported" without current source evidence;
names an old package version but describes current behavior;
copies install commands from a README that changed runtime or permission
requirements;
links to examples that no longer match source docs;
describes hosted retention, telemetry, pricing, or account behavior from an
old plan page;
keeps a safety or privacy note after the underlying tool changed execution
surface, permissions, or data movement.
Reviewer Checklist
{"task": "Sources resolve", "description": "All source URLs resolve to expected canonical pages without unwanted redirects or tracking parameters"}
{"task": "Reviewed date", "description": "The entry records when the source-backed claims were last checked"}
{"task": "Version known", "description": "Package, API, framework, spec, model, or docs version is recorded when relevant"}
{"task": "Volatile claims checked", "description": "Install, pricing, support, privacy, safety, compatibility, and production-readiness claims have current evidence"}
{"task": "Examples match", "description": "Commands, config snippets, screenshots, and examples still match current source behavior"}
{"task": "Update trigger noted", "description": "Future reviewers can tell what event should cause the entry to be refreshed"}
Do Not Merge When
source URLs are broken, redirect to unrelated pages, or only work through a
private account;
freshness depends on screenshots, copied terminal output, AI summaries, or old
announcement posts instead of canonical source pages;
volatile claims are written as timeless facts;
examples use deprecated commands, old package names, removed APIs, or
unsupported runtime versions;
privacy, safety, license, pricing, or support claims are stale or unsourced;
the PR refreshes generated registry artifacts instead of the raw source entry.
Troubleshooting
A source URL works but redirects: update the entry to the canonical
destination if it still supports the claim.
The docs have no visible date: record the date you reviewed the page and
the version or release context you could verify.
The package changed but docs did not: mark the claim as uncertain and ask
for maintainer evidence or a safer wording.
The current docs conflict with an old entry: trust the current canonical
docs, then preserve history only when it matters to migration.
The entry needs generated output: update the raw source file and leave
generated artifacts to the maintainer workflow.
Duplicate Check
Checked existing rules, guides, collections, hooks, skills, MCP entries,
statuslines, registry quality code, submission validation code, and recent PRs
for documentation freshness rules, stale source review, source freshness,
last-reviewed metadata, registry freshness, versioned docs, and public registry
update policy.
Adjacent content includes a documentation coverage hook and registry quality
code that tracks source freshness. This rules entry is distinct because it gives
portable do/don't behavior for contributors and reviewers deciding whether a
public registry entry's documentation and source claims are fresh enough to
merge.
Source Mapping
Each freshness rule below traces to an established documentation-maintenance
practice. Use this table to ground a review decision in a public source rather
than personal preference.
Freshness rule in this entry
Grounding practice
Source
Treat install commands, version claims, and behavior as stale until re-checked against source
"Current": consider incorrect documentation worse than missing documentation; keep docs up to date as the software changes
Show that Documentation Freshness Rules is listed on HeyClaude. Paste this Markdown into your README — it renders the badge and links back to this page.
[](https://heyclau.de/entry/rules/documentation-freshness-rules)
How it compares
Documentation Freshness Rules side by side with 2 alternatives on trust, install, platform support, and disclosed safety notes — all from reviewed registry metadata.
Source-backed rules for public AI workflow registries that need to keep directory entries, source links, version claims, examples, install guidance, compatibility notes, and last-reviewed metadata fresh enough to trust.
Source-backed rules for registry repositories that must keep contributor PRs focused on source files while generated indexes, feeds, downloads, search data, README output, and previews are rebuilt by trusted automation.
Source-backed rules for AI workflow directories that need consistent privacy metadata before accepting entries that touch prompts, files, local tools, hosted services, telemetry, generated artifacts, or personal data.
✓Stale install commands, API examples, permissions, and compatibility notes can lead users to run unsafe, unsupported, or wrong commands.
Do not infer current safety behavior from old screenshots, generated summaries, marketing copy, or cached search snippets.
Escalate stale claims about security, privacy, pricing, licenses, support status, or production readiness before merge.
✓Generated artifacts can hide unrelated rewrites, stale data, broken provenance, checksum drift, or accidental inclusion of private metadata.
Do not trust a generated diff unless the reviewed source input, generator version, and command or workflow are known.
Block PRs that mix raw content changes with broad generated output churn unless repository policy explicitly requires contributor-generated artifacts.
✓Privacy metadata is a reviewer aid, not proof that a workflow is safe or compliant for every jurisdiction or organization.
Escalate entries that touch regulated data, customer records, credentials, browser state, production systems, or private repositories.
Do not let generated descriptions replace source-backed privacy notes; require the submitter to identify actual data paths.
Privacy notes
✓Freshness review can expose private package names, internal docs, customer examples, local paths, account IDs, or vendor plan details if copied into public notes.
Use public source URLs and synthetic examples when documenting freshness; do not paste private changelogs or internal support replies.
Record uncertainty plainly rather than guessing retention, telemetry, hosted-service, or data-sharing behavior.
✓Generated registry artifacts can copy private source paths, timestamps, account names, API responses, prompt excerpts, logs, screenshots, package metadata, or reviewer notes into public files.
Review generated output for accidental disclosure before publishing downloads, search indexes, README sections, feeds, or previews.
Prefer synthetic examples and public metadata in source entries so downstream generated files do not amplify private context.
✓The review itself can expose private repo names, tool config, prompt examples, customer-like fixtures, logs, screenshots, or vendor account details.
Avoid copying secrets, private prompts, personal data, or proprietary datasets into public metadata examples.
Record unknowns honestly instead of filling gaps with guessed retention, sharing, or telemetry behavior.
Prerequisites
A public registry entry, submission, or refresh PR with source URLs that users can inspect.
Permission to request source updates, remove stale claims, or block merge when current behavior cannot be verified.
Access to canonical docs, repository releases, package pages, changelogs, or standards pages for the listed workflow.
A place to record last-reviewed date, reviewed version, known unknowns, and update triggers.
A registry repository with raw source entries and derived artifacts such as feeds, indexes, README sections, previews, search data, downloads, or public JSON.
A documented generation command, build job, or maintainer workflow that can reproduce generated outputs from source.
A file-classification convention such as `.gitattributes`, comments, path naming, or review labels for generated files.
Permission to request a source-only resubmission when generated artifact churn hides the actual content change.
A directory entry or submission that describes an AI workflow, tool, MCP server, hook, skill, command, collection, guide, or hosted service.
Permission to request edits when privacy notes, source links, data categories, or execution surfaces are missing.
Access to source documentation for the tool or workflow, including where it runs and what data it reads or transmits.
A review place for recording privacy-relevant assumptions, unknowns, and last-checked dates.