A general-purpose coordination protocol for multiple AI coding agents working on one repository with worktree isolation, structured handoffs, review, testing, and merge readiness
SaferSkills independently audited agent-collab (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use Agent Collab to run multiple AI agents on one repository without shared working-directory edits, hidden state, duplicated work, or unreviewed merges. The repository is the coordination surface: task files, branches, worktrees, handoffs, reviews, test reports, ADRs, and status files must capture everything future agents need.
main, master, production, staging, or release branches directly..agent/; do not rely on private chat context..agent/risks/..agent/ does not exist: agent-collab init agent-collab new-task --id TASK-001 --title "API Client Refactor"Use this repository structure:
.agent/
README.md
status.json
tasks/
handoffs/
decisions/
reviews/
test-reports/
risks/
protocols/
scratch/Run commands from the target repository root after installing the package. When coordinating another repository from elsewhere, pass --root <repo-root> to the command.
Create durable artifacts with:
agent-collab handoff --task TASK-001-api-client-refactor --role implementer --branch agent/impl/TASK-001-api-client-refactor --worktree ../repo-implementer
agent-collab review --task TASK-001-api-client-refactor --branch agent/impl/TASK-001-api-client-refactor
agent-collab test-report --task TASK-001-api-client-refactor --branch agent/impl/TASK-001-api-client-refactor
agent-collab adr --number 1 --title "Use Server-Side API Wrapper"
agent-collab conflict --task TASK-001-api-client-refactor --title "API Client and Auth Changes"
agent-collab file-ownership --task TASK-001-api-client-refactor
agent-collab human-decision --task TASK-001-api-client-refactor --title "Choose Auth Boundary"
agent-collab merge-recommendation --task TASK-001-api-client-refactorRead references/artifacts-and-templates.md for file names, required fields, source-of-truth priority, and complete template guidance.
Create sibling worktrees from the base branch:
git fetch origin
git worktree add ../repo-implementer -b agent/impl/TASK-001-api-client-refactor origin/main
git worktree add ../repo-reviewer -b agent/review/TASK-001-api-client-refactor origin/main
git worktree add ../repo-tester -b agent/test/TASK-001-api-client-refactor origin/main
git worktree listBranch naming:
agent/<role>/<task-id>-<short-description>
agent/impl-frontend/<task-id>-<short-description>
agent/impl-backend/<task-id>-<short-description>Before editing, every agent must run:
git status
git branch --show-current
git log --oneline -5Read references/worktree-and-branch-protocol.md before creating, sharing, rebasing, integrating, or removing worktrees.
Use the smallest role set that makes the task safe:
| Role | Use for |
|---|---|
| Coordinator | Scoping, task flow, worktree assignment, handoff routing, merge recommendation |
| Architect | Solution design, boundaries, ADRs, split strategy, testing strategy |
| Implementer | Scoped code changes, tests, commits, implementation handoff |
| Reviewer | Diff review for correctness, architecture, security, reliability, maintainability, tests |
| Tester | Running checks, reproducing flows, smoke testing, test report |
| Documentation | README/docs/examples/migration notes aligned with implemented behavior |
| Integration | Conflict resolution, branch freshness, final checks, merge readiness |
Read references/role-playbooks.md for responsibilities, forbidden actions, workflows, and role prompts.
Implementation is not ready for merge until:
Read references/quality-review-testing-merge.md for coding, review, testing, commit, PR, and merge rules.
Treat auth, authorization, identity, sessions, cookies, CSRF, CORS, billing, payments, webhooks, admin panels, database migrations, file uploads, multi-tenant data access, PII, logging of user data, deployment secrets, and infrastructure as high-risk.
If a secret is committed, stop and escalate. Do not merely delete it in a later commit and continue.
Read references/security-and-escalation.md for high-risk areas, human approval triggers, database/API/runtime rules, failure handling, and escalation templates.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.