thought-layer-framework — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited thought-layer-framework (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Compression theory: AI made building cheap, so value moved to the layer it did not compress, which is knowing what to build and being able to defend it. This framework walks that layer in stages. Each stage has its own altitude. Validate the idea first, make the economic model real second, and design and build last. Do not jump ahead: the worst failure mode is auditing implementation details on a one-sentence idea.
Start by asking for the idea. Do not expect it handed to you at invocation. If the user has not given it yet, open with the first stage's question ("What is this? One sentence: a thing that does what, for whom") and wait for their answer. If they paste a fuller description, treat it as their answer to stage 1 (the Concise What) and evaluate that — but do not let a rich paragraph tempt you to skip ahead. A detailed idea still owes you every later stage.
Then walk the stages below in order, one stage per turn. For each stage:
tl_score tool for the verdict.Reaching the Grill or the PRD before all of Part 1 (validate the idea) and Part 2 (the business model) are worked through is the signature failure of this framework. Do not do it. The Grill and the PRD are the design phase and they come last.
No one finishes this in one sitting. The work lives in a portable file, .thought-layer/state.json, in the project directory. It is your memory across turns and sessions, and it is the SAME interop file the web app reads, so a founder can answer some stages here and hand the file to a co-founder who continues in the web app (weareallproductmanagersnow.com, "Load progress from file"), back and forth, losslessly. Never hand-write this JSON: use the tool below, which builds the exact shapes the web app expects.
The tool. If the tl_state tool is available (Pi), use it. Otherwise run the CLI from any shell: npx -y @hobocode/thought-layer tl <op> ... (or just tl ... if the package is installed). Ops: read, list, answer, feedback, artifact, cursor, park, export.
Choosing the file. The default is .thought-layer/state.json. To keep several ideas side by side, give each its own file and use the SAME path for every op in the session: pass --path .thought-layer/<name>.json (or the tool's path), or set THOUGHT_LAYER_STATE once as the session default. list shows the files already there.
On start, ALWAYS read first. tl_state read (or tl read). If a file exists, summarize where the run stands and resume from the saved cursor - do not restart at stage 1. If not, start fresh; the file is created on first write. If list shows more than one state file, ask which idea to resume (or to start a new one) before reading, and stick to that path for the rest of the session.
After each stage:
tl_state op answer (or tl answer <qId> "<value>").tl_state op feedback - pass it the per-persona assessments + confidences and the end state (pass when confidence clears 0.85, setAside when the user sets it aside with to-dos, else open). The tool computes the status, grade, and to-dos; you supply only prose + numbers.tl_state op cursor with the backbone stage number and phase, so the next session resumes exactly here.Stage to question id (use these exact ids; the tool rejects unknown ones):
| Stage | id(s) |
|---|---|
| 1 Concise What | what-statement |
| 2 Domain Knowledge | domain-experience, domain-gaps |
| 3 Validation | paid-today, evidence |
| 4 Market Selection | target-market, incumbent-gap |
| 5 30-Second Test | pitch |
| 6 Time | commitment |
| 7 Costs | cost-architecture, cost-risk |
| 8 Scale | realistic-goal |
| 9 Pricing | pricing-model |
| 10 Business Model | bm-who-buys, bm-who-supplies, bm-parties (+ bizModel artifact) |
| 11 Customer Acquisition | first-ten, retention |
| 12 Customer Relationships | crm-approach, crm-community |
| 13 Support | support-model, support-scaling |
| 14 PRD | prd-problem, prd-not-building (+ prd artifact) |
| 15 Grill | grill artifact (re-compose prd markdown on done) |
Artifacts (PRD, grill, bizModel, naming, brand, swot, research) go through op artifact, which normalizes them to the web app's shapes. Web-app-only fields - the Decision Support questions (dq-*), the press-release fields, and the launch-asset fields - have no stage here; leave them for the founder in the web app, do not write them. Module sub-stage verdicts that have no web-app question (the deep-dive modules' internal stages) go to op park, never into answers.
At session end or handoff, run export to confirm the file is current, and tell the founder where it is and that they (or a collaborator) can load it into the web app or keep going with the agent.
For founders juggling several ideas, or collaborating with others, the session files can live in the user's OWN private GitHub repo instead of just locally. The tl_sync tool (Pi) or tl sync (any shell) manages it, BYOK with no central account:
tl sync init --repo <owner/name> sets a private repo as a sessions workspace (one repo for the user's own projects, a separate repo per outside founder they help, so each stays isolated).tl sync save --name <name> snapshots the current state as a named session (photobooth, peptide, blogging), commits, and pushes. tl sync list lists them; tl sync open --name <name> pulls and resumes one (it prints the THOUGHT_LAYER_STATE line to point the rest of the session at that file).This is optional. The local default (.thought-layer/state.json) and the web-app handoff above work exactly as before without it.
Altitude: is the idea clear, honest, real, and worth pursuing? Not how it will be built.
Altitude: does the economic machine work? This is where unit economics, CAC, money flow, and operational logistics belong, the concerns the early panels parked.
tl_project tool for the projection (break-even, year-1 revenue, drawdown) rather than estimating.This is where "how will it actually be built" gets answered. Every implementation, UX, data, and edge-case concern parked during validation gets resolved here. Draft the spec first, then grill it.
Once the grill has hardened the PRD, the spec is build-ready. Run the thought-layer-build skill (/tl-build) to turn it into a static-first, deploy-ready artifact (or the tl_scaffold tool for an instant deployable landing-page floor). This is the build step, not another validation stage.
Not strictly sequential; pull them in when they help: market research on the segment, a SWOT once the picture is full, and thought-layer-naming plus domain checks when the thing needs a name. These inform the stages above; they do not replace them.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.