feat: add YYLO to Agent Governance & Policy Enforcement

[InsightFactoryAPP]

Project

• Repository or specification: https://github.com/yylo-dev/yylo
• Proposed category: Agent Governance & Policy Enforcement

Why it belongs

YYLO is a command-line orchestrator for coding agents that functions as a governance and control layer over agent-authored repository changes. Every task runs behind typed task, validation, merge, and release-readiness boundaries; each task freezes the protected target SHA and creates a dedicated branch/worktree; and the merge queue owns risk-based review — low risk has no semantic reviewer, normal risk at most one, and high risk two sequential reviewers on one frozen candidate, stopping as REVIEW_FINDINGS_EXHAUSTED instead of starting an unbounded review loop. Workflow runs retain declared receipt hashes and terminal manifests, so the changes an agent produced stay receipt-backed and auditable. In section terms, this is policy enforcement plus approval gates applied to coding-agent output, alongside cordum and DashClaw rather than the identity/attestation categories.

Quality evidence

• Open source, MIT license (detected by the GitHub license API), public repository, pushed daily (activity gate comfortably met; created 2026-01-06).
• 57 GitHub stars (above the ≥5 advisory baseline), 8 months of continuous development.
• Distributed on npm as @yylo/cli (~780 downloads/month) — independently checkable adoption: https://api.npmjs.org/downloads/point/last-month/@yylo/cli
• Listed by third parties in their governance categories, e.g. agentrust-io/awesome-ai-governance PR #92 (## Governance Frameworks) and eltociear/awesome-AI-driven-development PR #120 (## Multi-Agent & Orchestration).
• No advisory signal is requested; no exception is needed.

Checklist

• This pull request adds or changes one project.
• I read CRITERIA.md and contributing.md.
• I checked the list for duplicates.
• The description uses - [Name](URL) - Description. format.
• The entry is alphabetized by displayed name within its category.
• The description states factual utility rather than copying marketing.
• The project is not a tutorial, sample, hackathon demo, workshop, or
  closed commercial product.
• I explained any new advisory signal or requested exception above.
• I did not edit the maintainer-owned advisory baseline or exception
  registry unless a maintainer requested it.
• npm ci, npm run lint, npm test, and
  python3 .github/scripts/validate-repos.py pass locally.

Local verification run for this exact tree: npm ci clean; npm run lint reports only the same single environmental awesome-github git-repository notice that pristine main reports in this sandbox (no new findings); npm test = 17/17 OK; check-markdown-links.py = PASS; validate-repos.py = 137 repositories checked, 0 hard failures, no new advisory for yylo-dev/yylo.

Disclosure

I am on the team that builds YYLO (yylo-dev); this is a disclosed self-submission of our own open-source project, and the PR was prepared with AI assistance and then checked against the live repository — every phrase in the entry description is quotable from the YYLO README (orchestrator/boundaries line, merge-queue risk-review rules, workflow-run retention line). Happy to adjust the category or description, or to withdraw if the governance framing reads as a stretch for this list.

[CodeSigils]

Thanks for the submission and clear disclosure. Approved for inclusion in Agent Governance & Policy Enforcement: YYLO's isolated task worktrees, validation evidence, and guarded Git integration fit the list's scope.

Please refresh the description before merge. The current YYLO documentation and merge CLI state that semantic reviews happen outside merge and that merge does not run tests, reviews, or models, so the claim about merge-owned risk-based review and two high-risk reviewers is outdated. Suggested wording:

• YYLO - Coding-agent orchestrator with isolated task worktrees, validation receipts, and guarded Git integration.

Review validation: all 17 regression tests and repository-relative Markdown links passed; YYLO generated no repository-validation flags. Full live validation currently fails on the unrelated existing archived entry neus/network, and the PR workflow is awaiting action. These checks still need resolution before merge.

[CodeSigils]

Merged — thank you for contributing YYLO and for the clear disclosure!

I refreshed the description to reflect the current isolated task worktrees, validation receipts, and guarded Git integration, and added contributor credit in the README. The unrelated archived repository entry was removed separately. Both required CI checks passed before merge, and your original commit is preserved in the merge history.