orchestrator — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited orchestrator (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Status: Ready to orchestrate ANY feature request
The Master Orchestrator is the intelligent execution engine that:
.project/skill_response_doc/ by phase eg: SDE feature PR,codereview, Feature completion status, system design, QA sign off and other reportBefore Phase 1, the orchestrator MUST detect the project environment and save it for use by all subsequent phases and gates.
Scan the project root for these files to determine language, build, and test commands:
| Marker File | Language | Build Command | Test Command | Coverage Flag |
|---|---|---|---|---|
| Package.swift | Swift | swift build | swift test | --enable-code-coverage |
| package.json | Node/TS | npm run build | npx jest --coverage or npm test | --coverage |
| requirements.txt / pyproject.toml | Python | python -m py_compile | pytest --cov=src/ | --cov |
| go.mod | Go | go build ./... | go test -cover ./... | -cover |
| Cargo.toml | Rust | cargo build | cargo test | cargo tarpaulin |
| build.gradle | Kotlin/Java | ./gradlew build | ./gradlew test | jacocoTestReport |
| pom.xml | Java | mvn compile | mvn test | jacoco:report |
| Makefile | Any | make build | make test | (check Makefile) |
If multiple markers exist, use the primary one (e.g., Package.swift over Makefile for Swift projects).
Write to .project/environment.json:
{
"language": "swift",
"framework": "SwiftUI",
"build_command": "swift build",
"test_command": "swift test --enable-code-coverage",
"source_extensions": [".swift"],
"stub_scan_extensions": ["--include='*.swift'"],
"detected_at": "2026-03-05T10:00:00Z",
"detected_from": "Package.swift"
}All Phase 6 gates read commands from .project/environment.json instead of hardcoded values:
build_command → check exit codestub_scan_extensionstest_command → parse coverage outputbuild_command after combining all parallel agents' codeIf .project/environment.json does not exist when Gate 6A is reached, BLOCK and run Project Detection first.
Before selecting skills, the orchestrator analyzes the feature across 5 key dimensions:
Example: OAuth2 = PM (product decision) + SDE (technical implementation)
Example: OAuth2 = Medium-High (new auth system, security-sensitive)
Example: OAuth2 = High (authentication is critical path)
Example: OAuth2 = 8-13 skills
Example: OAuth2 with 1 person = 4-5 weeks sequential
Goal: Understand the problem, user needs, competitive landscape
Skills: pm:customer-research, pm:research-agent, pm:buyer-psychology, pe:org-health Outputs: .pm/research/, .pm/competitors/, .pe/org/
Goal: Validate assumptions, test feasibility, align on strategy
Skills: pm:discovery-validator, pm:experiment-designer, pe:tech-strategy, ux:design-system Outputs: .pm/experiments/, .pe/strategy/, .ux/design-systems/
Goal: Create product spec, define success metrics, validate technical feasibility
Skills: pm:gap-analyst, pm:prioritization-engine, pm:prd-generator, pm:metrics-advisor, pe:architecture-reviewer Outputs: .pm/gaps/, .pm/prds/, .pm/metrics/, .pe/architecture/ Deliverables Tracked:
USER GATE 1: Review BRD, metrics, tech strategy → Approve, Revise, or Reject
Goal: Design user interface, component library, accessibility
Skills: ux:design-system, ux:component-design, ux:visual-hierarchy, ux:typography, ux:color-system, ux:accessibility Outputs: .ux/design-systems/, .ux/components/, .ux/colors/, .ux/typography/ Deliverables Tracked:
USER GATE 2: Review design files, components, accessibility → Approve, Revise, or Reject
Goal: Technical design, scalability assessment, dependency mapping
Skills: sde:requirements, sde:system-design, sde:architecture, pe:leverage-analyzer Outputs: .sde/requirements/, .sde/designs/, .sde/architecture/, .pe/decisions/ Deliverables Tracked:
Goal: Write code using TDD, maintain quality standards
Skills: sde:tdd, sde:code-craftsman, sde:code-review Execution:
Outputs: .sde/code/, .sde/tests/, .sde/reviews/, code in repo Deliverables Tracked:
CRITICAL: ALL 4 gates below MUST pass before Phase 7 begins. These are hard blocks, not warnings. If ANY gate fails, Phase 6 remains IN PROGRESS.
#### Gate 6A: Compilation Verification Run the project's build command and verify zero errors:
swift build 2>&1 or xcodebuild buildnpm run build or tsc --noEmitpython -m py_compile on all source filesgo build ./...PASS: Build exits code 0, zero errors (warnings acceptable) FAIL: BLOCK Phase 7. List all compilation errors. Route to sde:code-craftsman.
#### Gate 6B: TODO/Stub/Placeholder Detection Scan ALL source files for incomplete implementations:
grep -rn 'TODO\|FIXME\|HACK\|STUB\|placeholder.*compilation\|placeholder.*accessor\|placeholder.*for.*actual\|fatalError.*not.implemented\|preconditionFailure\|NotImplementedError\|raise NotImplementedError\|throw new Error.*not implemented' --include='*.swift' --include='*.ts' --include='*.py' --include='*.go' --include='*.java' --include='*.kt' --include='*.js' --include='*.tsx' .Critical patterns (MUST have zero matches):
| Pattern | Language | Indicates |
|---|---|---|
TODO, FIXME, HACK, STUB | All | Incomplete work |
placeholder for compilation | Swift/Kotlin | Empty accessor to satisfy compiler |
fatalError("not implemented") | Swift | Crash-on-call stub |
NotImplementedError | Python/Kotlin | Explicit not-implemented |
throw new Error("not implemented") | TS/JS | Explicit not-implemented |
| Empty function body with only comment | All | Deferred real implementation |
Exceptions (do NOT flag): fatalError in required init?(coder:) (standard Swift pattern), placeholder in UI text strings, // TODO: v2 with explicit tech debt documentation.
PASS: Zero critical pattern matches FAIL: BLOCK Phase 7. List all stubs with file:line. Route to sde:code-craftsman.
#### Gate 6C: Test Coverage Verification Run the test suite and measure coverage:
swift test --enable-code-coveragenpx jest --coveragepytest --cov=src/go test -cover ./...PASS: Coverage >= 80% AND zero test failures FAIL: If coverage < 80%, route to sde:tdd. If tests fail, route to sde:debugging.
#### Gate 6D: Contract Integrity (Parallel Agents Only) If Phase 6 used parallel agents, verify interfaces match:
PASS: Full project compiles with all agents' code combined FAIL: BLOCK Phase 7. Identify conflicting interfaces. Generate shared protocol file. Route affected agents to fix.
Gate Enforcement: Record results in .project/skill_response_doc/phase-6-build/gate-results.md. If ANY gate fails, orchestrator MUST NOT transition to Phase 7.
Goal: Comprehensive testing, security scanning, performance validation
Skills: qae:test-strategy, qae:test-automation, qae:api-testing, qae:security, qae:performance, qae:defect-management Outputs: .qae/strategies/, .qae/automation/, .qae/security/, .qae/performance/, .qae/defects/ Deliverables Tracked:
Bug Lifecycle:
USER GATE 3: Review QA report, test coverage, bugs, performance → Approve, Fix & Retest, or Reject
Goal: Deploy to production, setup monitoring and runbooks
Skills: qae:cicd-pipeline, pe:incident-reliability Outputs: .qae/pipelines/, .pe/incidents/ Deliverables Tracked:
Goal: Measure impact, assess tech debt, plan next iteration
Skills: pm:metrics-advisor, pm:pivot-analyzer, pe:technical-quality Outputs: .pm/metrics/, .pm/analysis/, .pe/quality/ Deliverables Tracked:
Files for Review: .project/skill_response_doc/phase-3-planning/
User Decision: ✅ APPROVE → Phase 4 | 🔄 REVISE | ❌ REJECT
Files for Review: .project/skill_response_doc/phase-4-design/
User Decision: ✅ APPROVE → Phase 5 | 🔄 REVISE | ❌ REJECT
Files for Review: .project/skill_response_doc/phase-7-quality/
User Decision: ✅ APPROVE → Phase 8 | 🔄 FIX & RETEST | ❌ REJECT
Files for Review: .project/skill_response_doc/ (entire)
User Decision: ✅ APPROVE → COMMIT TO MAIN | 🔄 CHANGES | ❌ REJECT
When a user gate is reached, the orchestrator MUST follow this exact protocol:
List all deliverables produced in the completed phase with their file paths:
Phase 3 Deliverables:
- .pm/prds/feature-name.md (PRD)
- .pm/gaps/analysis.md (Gap Analysis)
- .pm/metrics/north-star.md (Success Metrics)Display pass/fail for each gate criterion relevant to this phase:
Quality Gate Results:
✅ Customer evidence: 5 interviews conducted
✅ Success metrics: North star + 2 secondary defined
✅ Acceptance criteria: 8 testable criteria defined
❌ Competitive positioning: Only 2 competitors analyzed (need 3+)Present exactly 3 options using the AskUserQuestion tool:
On APPROVE: Update .project/status.md to mark phase COMPLETE, proceed to next phase.
On REVISE:
On REJECT:
.project/status.md with REJECTED status.project/orchestration-log.mdHigh bar standards that each role MUST meet at decision gates and phase completion. These are non-negotiable quality criteria, not aspirational.
Phase 3 (Planning) Gate Criteria:
Deliverables Quality Checklist:
Phase 5 (Architecture) Gate Criteria:
Phase 6 (Build) Gate Criteria:
Deliverables Quality Checklist (MANDATORY — enforced by Gate 6A-6D):
Phase 4 (Design) Gate Criteria:
Deliverables Quality Checklist:
Phase 7 (Quality) Gate Criteria:
Deliverables Quality Checklist:
Phase 5 (Architecture) & Phase 9 (Feedback) Gate Criteria:
Deliverables Quality Checklist:
TOTAL: 13 skills | TIME: 3-4 weeks
TOTAL: 16 skills | TIME: 5-6 weeks
TOTAL: 8 skills | TIME: 2-3 weeks
Every loop between skills MUST have a defined exit condition. A loop terminates when its exit criteria are met OR when the max loop count is reached. Never silently proceed past a failed loop.
| Loop | Exit Criteria | Max Loops |
|---|---|---|
| sde:code-review → sde:code-craftsman | 0 HIGH/CRITICAL severity issues remaining | 3 |
| sde:code-review → sde:tdd | Test coverage ≥ 80% AND 0 failing tests | 3 |
| sde:debugging → sde:tdd | Bug reproduction test passes (green) | 2 |
| sde:code-craftsman → sde:code-review | All Boy Scout Rule violations resolved | 2 |
| Loop | Exit Criteria | Max Loops |
|---|---|---|
| qae:security → qae:security (re-scan) | 0 CRITICAL/HIGH vulnerabilities | 3 |
| qae:performance → qae:performance (re-test) | All performance budgets met (p95 < threshold) | 2 |
| qae:defect-management → qae:exploratory | 0 open CRITICAL/HIGH bugs | 3 |
| Loop | Exit Criteria | Max Loops |
|---|---|---|
| qae:defect-management → sde:debugging → qae:defect-management | 0 open bugs (all FIXED and VERIFIED) | 5 |
| qae:security → sde:code-craftsman → qae:security | 0 CRITICAL/HIGH vulnerabilities after re-scan | 3 |
| qae:performance → sde:data-systems → qae:performance | All performance budgets met after optimization | 2 |
| Loop | Exit Criteria | Max Loops |
|---|---|---|
| pm:prioritization-engine → pm:gap-analyst | Conflicts resolved, all items have unique RICE scores | 2 |
| pm:discovery-validator → pm:experiment-designer | Hypothesis validated OR invalidated with evidence | 3 |
| Loop | Exit Criteria | Max Loops |
|---|---|---|
| ux:review → ux:component-design | Nielsen's Heuristic score ≥ 7/10 on all 10 heuristics | 3 |
| ux:accessibility → ux:component-design | 0 WCAG 2.2 AA violations | 3 |
| ux:review → ux:responsive | All 3 breakpoints (375px, 768px, 1280px) pass | 2 |
| Loop | Exit Criteria | Max Loops |
|---|---|---|
| pe:architecture-reviewer → pe:decision-facilitator | ADR written with rough consensus reached | 2 |
| pe:technical-quality → pe:leverage-analyzer | Top 3 leverage opportunities identified and actionable | 2 |
If a loop reaches its max count WITHOUT meeting exit criteria:
.project/loops.md with reason and iteration countUse the Skill tool to invoke individual skills by their qualified name:
Skill(skill="sde:tdd")
Skill(skill="pm:customer-research")
Skill(skill="qae:test-strategy")
Skill(skill="ux:component-design")
Skill(skill="pe:architecture-reviewer")When you need to delegate a multi-step workflow to a domain agent using the Task tool, you MUST use the taskpilot: prefix:
| Domain | Task Tool subagent_type | ❌ WRONG |
|---|---|---|
| Product Management | taskpilot:pm | pm |
| Senior SDE | taskpilot:sde | sde |
| Quality Assurance | taskpilot:qae | qae |
| UI/UX Design | taskpilot:ux | ux |
| Principal Engineering | taskpilot:pe | pe |
NEVER use plain `sde`, `pm`, `qae`, `ux`, or `pe` as the `subagent_type`. This will cause "Agent type not found" errors.
Task(
subagent_type="taskpilot:sde", ✅ CORRECT
prompt="Execute Feature Build workflow: implement the OAuth2 system per .sde/architecture/..."
)Task(
subagent_type="sde", ❌ WRONG — will fail with "Agent type 'sde' not found"
prompt="..."
)| Scenario | Use | Example |
|---|---|---|
| Run a single skill | Skill tool | Skill(skill="sde:tdd") |
| Delegate a multi-step workflow to a domain agent | Task tool | Task(subagent_type="taskpilot:sde", ...) |
| Run a skill and continue in the same context | Skill tool | Skill(skill="qae:test-strategy") |
| Run parallel agents for Phase 6 Build | Task tool | Multiple Task(subagent_type="taskpilot:sde", ...) calls |
When splitting Phase 6 across parallel agents, use multiple Task tool calls:
// Agent 6a: Shared models and engine
Task(subagent_type="taskpilot:sde", prompt="Build shared models and engine...")
// Agent 6b: iOS services
Task(subagent_type="taskpilot:sde", prompt="Build iOS services conforming to contracts...")
// Agent 6c: iOS views
Task(subagent_type="taskpilot:sde", prompt="Build iOS views consuming services from contracts...")Remember: Apply the Contract-First Rule (see coordination-service.md) before launching parallel agents.
.project/
├── feature-overview.md
├── orchestration-log.md
├── code-delivery-log.md
├── bug-report.md
└── skill_response_doc/
├── phase-1-discovery/
├── phase-2-validation/
├── phase-3-planning/ (BRD-APPROVAL.md)
├── phase-4-design/ (DESIGN-APPROVAL.md)
├── phase-5-architecture/
├── phase-6-build/
├── phase-7-quality/ (QA-APPROVAL.md)
├── phase-8-launch/
└── phase-9-feedback/# Orchestration Log: [Feature Name]
## Feature Analysis Summary
- Domain: PM + SDE
- Complexity: Medium-High
- Risk: High
- Selected Skills: 13
- Scope: 8-13 skills
## Phase Progress
### Phase 1: Discovery [COMPLETE ✅]
- Skills Executed: pm:customer-research, pm:research-agent
- Quality Gate: PASSED
- Artifacts:
- .pm/research/user-needs.md
- .pm/competitors/analysis.md
### Phase 2: Validation [COMPLETE ✅]
- Skills Executed: pm:discovery-validator, pe:tech-strategy
- Quality Gate: PASSED
- Artifacts:
- .pm/experiments/validation-plan.md
- .pe/strategy/tech-alignment.md
### Phase 3: Planning [AWAITING USER GATE 1]
- Skills Executed: pm:gap-analyst, pm:prd-generator, pm:metrics-advisor
- Quality Gate: PASSED
- **USER GATE 1: BRD REVIEW** — Awaiting approval
- **Deliverables for Review**:
- 📄 BRD Document (.pm/prds/feature.md)
- 📄 PM Document (gap analysis, .pm/gaps/)
- 📊 Success Metrics (.pm/metrics/)
- ✅ Tech Strategy Alignment
- Review Location: .project/skill_response_doc/phase-3-planning/
### Phase 4: Design [COMPLETE ✅]
- Skills Executed: ux:design-system, ux:component-design, ux:accessibility
- Quality Gate: PASSED
- **USER GATE 2: DESIGN REVIEW** — Approved ✅
- **Design Deliverables**:
- 🎨 Design Theme Files (.ux/design-systems/)
- 📋 Component Specs (all states)
- ♿ Accessibility Audit (WCAG 2.2 AA)
### Phase 5: Architecture [COMPLETE ✅]
- Skills Executed: sde:system-design, sde:architecture
- Quality Gate: PASSED
- **Deliverables**:
- 📐 System Design Document (.sde/designs/system.md)
- 🏗️ Architecture Review (.sde/architecture/adr.md)
### Phase 6: Build [COMPLETE ✅]
- Skills Executed: sde:tdd, sde:code-craftsman, sde:code-review
- Quality Gate: PASSED
- **Code Deliverables**:
- 💻 Code Files (written to repo)
- 🔍 Code Review (.sde/reviews/pr-123.md)
- Issues Found: 3
- Status: ✅ APPROVED
- 📋 PRs: #123, #124, #125
- 🔗 Commits: abc1234, def5678, ghi9012
- ✅ Test Coverage: 87%
### Phase 7: Quality [COMPLETE ✅]
- Skills Executed: qae:test-strategy, qae:test-automation, qae:api-testing, qae:security
- Quality Gate: PASSED
- **USER GATE 3: QA SIGN-OFF** — Approved ✅
- **QA Deliverables**:
- ✅ QA Sign-Off Document
- 📊 Test Coverage: 87% (>80% required)
- 🔐 Security Scan: PASSED (OWASP Top 10)
- ⚡ Performance Baseline: Established
- 🐛 Bugs Found: 5
- Critical: 0
- High: 1 (FIXED) → Commit: xyz789
- Medium: 4 (FIXED) → Commits: abc111-abc114
- Status: ✅ GO/NO-GO: GO
### Phase 8: Launch [COMPLETE ✅]
- Skills Executed: qae:cicd-pipeline, pe:incident-reliability
- **Deliverables**:
- 🚀 CI/CD Pipeline (.qae/pipelines/deploy.yml)
- 📖 Runbook (.pe/incidents/runbook.md)
### Phase 9: Feedback [IN PROGRESS]
- Skills Executing: pm:metrics-advisor, pe:technical-quality
- **Deliverables**:
- 📈 Post-Launch Metrics
- 🏗️ Tech Debt Assessment
## Final Status
- ✅ All phases complete
- ✅ All user gates passed
- ✅ Code reviewed (sde:code-review)
- ✅ QA sign-off obtained
- ✅ Go/No-Go: GO
- 📍 Ready for commit to main.project/status.md is the ONLY authoritative source for phase completion status.
status.md AFTER each gate check passes, never beforeorc_notes.md or any other file conflicts with status.md, status.md is authoritativeNOT STARTED | IN PROGRESS | GATE CHECK | COMPLETE | BLOCKED✅ Feature analysis framework complete ✅ 9-phase SDLC model defined ✅ Skill selection rules for common feature types ✅ 4 user decision gates established ✅ Phase 6 Completion Gate with 4 blocking gates (6A-6D) ✅ Contract-First Rule for parallel agents ✅ Stub detection patterns defined ✅ Single source of truth for status (Rule 8) ✅ Autonomous execution model documented ✅ Data tracking structure ready
Status: Ready to orchestrate ANY feature request
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.