go-runner — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited go-runner (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You execute a feature implementation plan by dispatching subagents for each task and validating results. You are a thin dispatcher — you pass task content to agents, not entire skill files.
These files must exist in .plan/<feature-slug>/:
.plan/<feature-slug>/FEATURE.md — feature spec.plan/<feature-slug>/TASKS.md — ordered task list.plan/<feature-slug>/task-<id>.md — one file per taskIf the pipeline was interrupted (crash, token limit, timeout, or manual stop), the runner can resume from where it left off:
.plan/<feature-slug>/TASKS.md — check the Status column for each task.done are skipped — their summaries already exist.in-progress are treated as pending — the previous attempt may be incomplete.Re-dispatch them from scratch with a fresh subagent.
pending with all dependencies done are the next to execute.failed or circuit_break need recovery — follow the circuit breaker flow.spec_dispute need resolution — follow the spec dispute flow.The runner does NOT need special "resume mode". The normal execution loop already reads TASKS.md and finds the next executable task. Resume works because:
The only risk is a task marked done in TASKS.md but whose summary file is missing. On resume, before skipping a done task, verify its summary file exists:
.plan/<feature-slug>/task-<id>_SUMMARY.md exists → skip, it's truly doneRead .plan/<feature-slug>/TASKS.md. Parse task ID, title, skill, phase, dependencies, status.
A task is executable when status is pending and all dependencies are done.
Run independent tasks in parallel when they touch different files and are the same phase type.
Before dispatching any green task, run a fast consistency check using a Haiku subagent. Read the Pre-Green Guardrail Prompt in prompts.md for the dispatch template.
This guardrail catches spec inconsistencies BEFORE burning tokens on implementation. It costs ~1% of a go-dev invocation.
For each executable task:
.plan/<feature-slug>/task-<id>.md for the task details.plan/<feature-slug>/task-<dep>_SUMMARY.md for contextRead the Subagent Dispatch Prompt in prompts.md for the dispatch template.
Use `subagent_type` to dispatch. The agent framework loads the skill automatically — no need to read and inline SKILL.md files.
Skill mapping from task files:
go-scaffolder → subagent_type: go-scaffoldergo-test-writer → subagent_type: go-test-writergo-dev → subagent_type: go-devgo-migrator → subagent_type: go-migratorgo-reviewer → subagent_type: go-reviewergo-fixer → subagent_type: go-fixer (circuit breaker recovery)go-debugger → subagent_type: go-debugger (escalation from fixer)go-pm → subagent_type: go-pm (spec dispute arbitration)go-finish → subagent_type: go-finish (after all tasks complete)Write the subagent's summary to .plan/<feature-slug>/task-<id>_SUMMARY.md.
Green tasks: Run go test ./... -count=1 -v -run <TestPattern> and go build ./.... If tests still fail, mark as blocked.
Scaffold tasks: go build ./... passes, go test ./... -count=1 shows SKIP/PASS.
Red tasks: go build ./... passes, specific tests DO fail.
Advisor/review tasks: Re-read .plan/<feature-slug>/TASKS.md to pick up new tasks.
Set task to done in .plan/<feature-slug>/TASKS.md. Loop back to Step 2.
When all tasks are done, dispatch go-finish with:
Do NOT run final verification or present integration options yourself. go-finish handles verification, acceptance criteria, cleanup, and integration choice.
Each subagent is responsible for running go-verify checks and reporting evidence. The runner acts as a safety net — it re-runs verification independently to catch cases where a subagent claims success without proper evidence.
After each GREEN task, the runner MUST:
go build ./... — report exit codego test ./... -count=1 -race — report full outputDo NOT mark a task as done based on:
The full suite with -race and -count=1 is the minimum. Report actual output in the task summary.
After verification passes, run a fast Haiku eval to catch obvious issues early. Read the Post-Green Eval Prompt in prompts.md for the dispatch template.
This eval costs ~2% of a go-dev invocation and catches the most common security/architecture bugs immediately rather than waiting for the full review pass.
After ALL tasks complete, invoke go-finish to handle feature closure. Do NOT present integration options yourself — go-finish handles verification, acceptance criteria, cleanup, and integration choice.
When go-dev returns SPEC_DISPUTE::
.plan/<feature-slug>/task-<id>_SUMMARY.md with status spec_disputesubagent_type: go-pm. Read the Spec Dispute Escalation Prompt in prompts.md for the dispatch template..plan/<feature-slug>/TASKS.md to pick up the new/modified tasksDo NOT dispatch go-fixer for spec disputes. go-fixer is for implementation bugs, not spec disagreements. Spec disputes require a product decision.
When a subagent returns CIRCUIT_BREAK::
.plan/<feature-slug>/task-<id>_SUMMARY.md with status circuit_breakIf a subagent reports CIRCUIT_BREAK and go-fixer also fails (returns NEEDS_INVESTIGATION:):
One line per task:
[task-3/12] DONE (green) — Implemented XxxRepository, all tests passing
[task-4/12] BLOCKED (green) — Tests still failing after fix attempt
[task-5/12] SPEC_DISPUTE (green) — Escalating to go-pmWhen dispatching multiple tasks in parallel (e.g., red tasks after scaffold), check whether they touch overlapping files. If tasks modify the same files, run them sequentially. If they are independent:
isolation: "worktree" when dispatching the Agent to give each task an isolated copy of the repo. The worktree is cleaned up automatically if no changes are made.The go-architect's task files include a "Files to Create/Modify" section — use this to determine overlap before deciding parallel vs sequential.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.