execute-work-package — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited execute-work-package (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill standardizes execution/implementation once planning is gated.
It is a small, repeatable protocol:
1) BLUEPRINT: Subagent returns an Execution Blueprint (step list) 2) GATE: Primary approves (primary-internal) 3) EXECUTE: Fresh subagent implements and verifies 4) DIGEST: Subagent returns a compact digest (no raw logs/diffs)
This skill deliberately does not create new persistent artifacts in docs/ or plans/.
Use this skill when:
If your phase implementation plan is still vague or unverified against the repo, run author-and-verify-implementation-plan first.
Do not use this skill to:
generate-docs, create-plan, update-plan, update-docs.update-plan as needed.plans/** or docs/** artifacts.plans/** (typically via update-plan).docs/ and plans/ matter hereplans/ provides the gated intent/DoD and references for what to implement.docs/ (if present) provides curated inventories (modules/features/symbols) so the subagent does not rediscover everything.This skill supports three transport mechanisms. If l4l-oci MCP tools are available (check: do you have create_handle, generate_blueprint, submit_gate, execute_handle, get_digest tools?), always use Option A. Only fall back to B/C if MCP is not configured.
#### Pre-flight: Ensure l4l-oci server is running
Before using Option A, run the bundled helper:
skills/execute-work-package/scripts/start-l4l-oci.shBehavior:
L4L_OCI_ROOT (default: $HOME/git/l4l-oci)python -m l4l_oci in background if neededhealth to return okL4L_OCI_DEFAULT_MODEL=qwen-openrouter for startup unless already setPrerequisites:
OPENROUTER_API_KEY (or QWEN_API_KEY) must be available in the environment#### Option A: MCP via l4l-oci (Default)
Use the l4l-oci MCP server. The primary calls MCP tools directly — no Agent spawning needed:
create_handle(project_root) → returns handle_idgenerate_blueprint(handle_id, prompt) → async; poll with get_status(handle_id) until completeget_blueprint(handle_id, format="markdown") → review the Execution Blueprintsubmit_gate(handle_id, decision="accept"|"reject", notes=...) → explicit gateexecute_handle(handle_id) → async; poll with get_status(handle_id) until completeget_digest(handle_id, format="markdown") → returns Execution Digestcleanup_handle(handle_id) → optional cleanupBenefits: state persistence across restarts, model decoupling (cheap Sub-LLM), scope enforcement, iterative blueprint refinement.
Additional tools: health() (service health check), list_handles() (list all active handles).
#### Option B: Stateful Subagent (OpenCode)
Original design using resumeSessionId to maintain subagent state between BLUEPRINT and EXECUTE:
resumeSessionId)This is the native OpenCode pattern.
#### Option C: Fresh Agent (Claude Code / Cursor / Copilot)
BLUEPRINT and EXECUTE use separate Agent invocations (not SendMessage to resume):
mode: auto, returns the step list, then terminates.The EXECUTE prompt must include the full approved step list and all references — the agent has no memory of the BLUEPRINT agent's context.
#### Platform Decision Table
| Platform | Recommended | Fallback |
|---|---|---|
| Claude Code | Option A (MCP) | Option C (Fresh Agent) |
| Cursor | Option A (MCP) | Option C (Fresh Agent) |
| Copilot | Option A (MCP) | Option C (Fresh Agent) |
| Codex | Option C (Fresh Agent) | — |
| Windsurf | Option A (MCP) | Option C (Fresh Agent) |
| OpenCode | Option B (Stateful) | Option A (MCP) |
Before delegating:
The subagent should read these references itself (the primary does not need to paste content). Recommended references:
plans/<plan>/plan.mdplans/<plan>/phases/phase-N.mdplans/<plan>/implementation/phase-N-impl.mdplans/<plan>/todo.md (optional)(symbols, modules, features) instead of rediscovering everything from scratch:
docs/overview.md (optional)docs/modules/*.md (optional)docs/features/*.md (optional)If not, the subagent proposes exactly one verify command in the BLUEPRINT (to be gated by the primary).
Option A (MCP): Callcreate_handle(project_root), thengenerate_blueprint(handle_id, prompt). Pollget_status(handle_id)until complete, thenget_blueprint(handle_id, format="markdown")to review.
Primary delegates to implementer with a prompt based on tpl-implementer-preflight-prompt.md.
Gate: Primary reviews the step list and either:
#### Invariant: explicit approval token
Primary provides an explicit approval token before execution (primary-internal gate). Example:
APPROVE-WP1If the user requests changes, the step list must be revised and re-approved with a new approval token.
Option A (MCP): Callsubmit_gate(handle_id, decision="accept")thenexecute_handle(handle_id). Pollget_status(handle_id)until complete, thenget_digest(handle_id, format="markdown")for the digest.
Primary spawns a new implementer Agent with a prompt based on tpl-implementer-execute-prompt.md. The prompt includes the full approved step list, all references, and the verify command. Do NOT use SendMessage to resume the BLUEPRINT agent — spawn a fresh Agent instead.
#### Invariant: MODE lock
The execute prompt MUST start with a clear mode indicator:
MODE: EXECUTEand MUST include the approval token.
Option A (MCP): Skip the Agent spawn above. Callsubmit_gate→execute_handle→ pollget_status→get_digestdirectly via MCP tools.
Subagent responds with a compact digest:
Read the digest carefully. The subagent's verification result determines next steps:
git diff --stat to confirm expected changes. Do not re-run the full test suite yourself – the subagent already did.Then:
plans/<plan>/todo.md and phase status via update-planOptional but recommended (Primary):
git status / git diff --name-onlygit diff --statSubagent returns an Execution Blueprint in the format of tpl-execution-blueprint.md.
The blueprint is expected to be concrete (file paths and/or symbol/component targets), not a restatement of plan text.
#### Mode: BLUEPRINT
In BLUEPRINT mode, the subagent must NOT:
Subagent MUST return only:
#### Mode: EXECUTE
In EXECUTE mode, the subagent must:
These apply to all code written during execution – by the implementer subagent or the primary.
If docs/coding-standards.md exists in the target repo, read and follow it as well – project-specific standards take precedence.
tpl-implementer-preflight-prompt.md — Primary -> Subagent (MODE: BLUEPRINT) prompttpl-implementer-execute-prompt.md — Primary -> Subagent (MODE: EXECUTE) prompt (same task_id)tpl-execution-blueprint.md — canonical blueprint format (step list)tpl-execution-digest.md — canonical digest format~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.