handoffs-tidy — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited handoffs-tidy (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Keep ~/.claude/handoffs/ focused on live threads. Handoffs go stale three ways, and the common one isn't supersede:
its Jira ticket is Done. These are usually never re-wrapped, so nothing supersedes them — they just sit in the picker looking 🟢 live until you notice the work is long gone.
This command finds all three and archives the ones you confirm. Nothing is deleted — archived files move to ~/.claude/handoffs/archive/ and stay greppable.
Run it ad-hoc whenever the picker feels noisy, or right after a /wrap-up. It is the standalone twin of /handoffs's opt-in archive step (§3b): same list.sh classification, same archive flow — shared verbatim via REFERENCE.md — but with no full table, no picker, and no resume step. It only ever offers candidates; it never touches a live or open-PR row.
Earlier versions only found _superseded_ handoffs (it ran list.sh with no flags and looked at one field). That's why it rarely found anything — supersede is the narrowest signal. From v0.2.0 it runs the full liveness pass, so finished-but-never-re-wrapped handoffs finally surface./wrap-up whose handoff continued an earlier thread, or whose work has now shipped./handoffs shows entries you've moved past — merged PRs, closed beads, dead branches.MUST use the helper scripts. Never construct ad-hocls/grep/git/gh/bdpipelines against~/.claude/handoffs/— they bypass the per-script permission allowlist and miss the repo-matching and liveness logic. Classification and the archive flow are specified once in~/.claude/skills/handoffs/REFERENCE.md; read it rather than re-deriving the rules here.
Read ~/.claude/skills/handoffs/REFERENCE.md. It defines how to read list.sh's output, classify each row, and run the archive flow — the same definitions /handoffs uses, so the two never drift.
~/.claude/skills/handoffs/scripts/list.sh --check-branches--check-branches is what makes this command capable: it fills branch-state and (when gh is present) pr-state, so the script can mark merged PRs, landed branches, and closed PRs. Bead-closure (beads-done, keyed off the **Deliverable:** field when present) and supersede are computed regardless. See REFERENCE §Run and §Fields for the flag semantics and the 21-field line format. Degrades cleanly offline (REFERENCE §Run / the failure modes below).
Parse the ---HANDOFFS--- lines and the ---SUMMARY--- counts. For each current-repo row, derive its Status (REFERENCE §Status) and archive-class (safe / keep / empty — REFERENCE §Fields). Also note rows with needs-review=Y — trunk-parked legacy handoffs the script couldn't auto-classify (step 5b).
Follow REFERENCE §Jira-Done for any still-live current-repo row that names a Jira ticket. This catches handoffs whose only finished signal is a closed ticket (no merged PR, no closed beads). It's gated exactly as REFERENCE describes and degrades silently if the Jira MCP isn't configured — skip it freely if you want to stay network-light; PR/bead/branch/supersede classification still stands.
If current_repo_superseded == 0 and current_repo_stale == 0 (after any §Jira-Done promotions) and no row has needs-review=Y, report nothing and stop at step 6 — the picker is already tidy:
_No archivable handoffs — every handoff for this repo still points at live work._If there are auto-classified candidates, render them as a table, grouped by regret (REFERENCE §Archive-flow defines the groups). (When the only thing flagged is needs-review, skip straight to step 5b.)
## 🗂️ Archive candidates ({count})
| Archive? | Date | Slug | Branch | Status | Group |
|----------|------|------|--------|--------|-------|Superseded / Done / Stale. A row that is both superseded and otherwise archivablegoes in Superseded (the safest reason to archive). Order the table Superseded → Done → Stale.
✅ for safe (Superseded, Done) and leave ☐ for keep (Stale) —Stale rows may be the only record of an abandoned thread.
Run the archive flow exactly as REFERENCE §Archive-flow specifies: prompt with AskUserQuestion (multiSelect, one option per candidate, grouped and described per that section), then archive the selected filenames in one archive.sh call and parse ---ARCHIVED--- / ---SKIPPED---. Pre-check safe candidates; leave keep unchecked. Surface every ---SKIPPED--- line verbatim with its reason. Never offer a 🟢 live, 🟠 PR open, or unknown row. archive.sh only moves — never deletes.
✅ Archived {N} handoff(s) to `~/.claude/handoffs/archive/`.If any current-repo row has needs-review=Y, run the assisted prompt per REFERENCE §Trunk-review — a separate, clearly-labelled prompt (not mixed into the step-5 groups) for legacy trunk-parked handoffs the script couldn't auto-classify: partial bead closure (beads-progress like 1/4), no **Deliverable:** marker, so it can't tell finished own-work from never-closing context. Present the {beads-progress} and bead list per row and let the user decide; archive any they confirm via the same archive.sh call. Skip entirely when no row is flagged. This prompt goes quiet on its own as old handoffs age out and new ones carry **Deliverable:**.
If nothing was archivable (steps 4–5b) or the user selected none, say so plainly and stop. This command never touches live work and never deletes — at worst it's a no-op.
and stop — this command is a thin driver over the handoffs skill's scripts and shared spec.
stop. (Cross-repo tidying isn't supported; cd into the repo and re-run.)
branch-state degrades to local-only (merged still detectedagainst the local default tip; no false gone). The Done/Stale groups just shrink. Don't retry.
pr-state reports unknown and classificationfalls back to branch-state + beads-done. No error, no retry. Squash-merged branches may show as ⚪ branch gone (keep?) rather than ✅ merged (safe) unless a closed bead or Jira-Done marks them done.
beads-done is always empty — finished work then relies onPR/branch/supersede (and §Jira-Done) signals alone.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.