exec-plan — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited exec-plan (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
State machine that reads an execution plan document and mechanically executes it -- launching worktree agents, enforcing commit gates, merging, running validation, and tracking progress.
/exec-plan [path to execution plan]Examples:
/exec-plan docs/brainstorms/EXECUTION_PLAN.md/exec-plan docs/brainstorms/WEBSOCKET_PLAN.mdMain is a coordinator. It:
Main does NOT:
ALL of that is delegated to specialized agents.
Read the execution plan document. Extract:
If the plan is missing required sections (file conflict table, validation commands, "read these first" lists), STOP and tell the user: "This plan is missing [X]. Run /plan-features to generate a complete plan."
Spawn a pre-flight agent (general-purpose type) to:
Format for docs/KNOWN_FAILURES.md:
# Known Test Failures
> Last updated: [date] by pre-flight check
| Test | File | Reason | Since |
|------|------|--------|-------|
| test_name | path/to/test.py | One-line reason | [date first seen] |Agent returns: READY + known failures count, or BLOCKED + reason.
If BLOCKED, report to user and stop. Known failures are pre-existing, not blockers -- execution proceeds.
For each session group in the plan:
#### Sequential Teams (shared file conflicts)
Process one at a time, in dependency order:
For each team in sequence:
1. LAUNCH -- spawn code agent in worktree
2. VERIFY -- spawn watchdog to check the worktree
3. MERGE -- spawn merge agent to bring changes to main
4. GATE -- spawn test agent to validate1. LAUNCH: Code Agents + Live Watchdog
For each batch of agents (parallel or sequential), spawn:
isolation: "worktree" and their team specsCode agent prompt template:
You are [Team Name].
[Paste the team's spec from the plan: blocked-by, read-these-first,
files-touched, deliverable, validation, agent instructions]
CRITICAL RULES:
- Read `docs/KNOWN_FAILURES.md` first -- do NOT report these as issues
- Read the "Read these files first" list BEFORE writing any code
- Follow existing patterns in those files
- You MUST `git add` and `git commit` all your changes before finishing
- Your commit message must start with "[Team X]:"
- Run the validation commands from your spec before finishing
- If validation fails, fix the issue and re-commit
When done, report: DONE + commit hash + validation results
OR: BLOCKED + what went wrongLive watchdog prompt:
You are the batch watchdog. Your job is to monitor code agents for this session.
Active agents: [list of agent names]
Every 3 minutes, check TaskList for tasks that are in_progress but whose
owner has gone idle. If an agent has gone idle without sending a report
to team-lead, send them a nudge:
"You appear idle without reporting. Please send your status to team-lead:
DONE + commit hash + validation results, or BLOCKED + what went wrong."
When all agents in the batch have reported DONE or BLOCKED, send a summary
to team-lead and wait for shutdown.
Do NOT do any code work. Your only job is monitoring and nudging.Important: The watchdog is spawned WITH the code agents and shut down WITH them. Fresh watchdog per batch -- do not persist across sessions.
2. GATE: Test Agent (per-session, not per-team)
After all teams in a session complete, spawn a test gate agent to run the session's validation:
You are a test gate agent. Run these validation commands on main:
[paste validation commands from the session's team specs]
Read `docs/KNOWN_FAILURES.md` -- do NOT report pre-existing failures as regressions.
Report:
- PASS: all N tests passed, lint clean
- FAIL: [which command failed] + [error output summary] + whether failure is new or pre-existing
Do NOT attempt to fix failures. Just report.If FAIL with NEW failures: report to user. Options:
After all teams in a session complete:
Session N complete.
Teams merged: [list]
Tests: X passed, Y failed
Next session: [teams] -- proceed? (y/n)After all sessions complete:
git worktree prune)docs/KNOWN_FAILURES.md -- remove any failures that were fixed during execution| Agent | When | Isolation | Purpose |
|---|---|---|---|
| Pre-flight | Step 1 | None | Verify codebase ready + generate KNOWN_FAILURES.md |
| Code agent | Step 2.1 | Worktree | Implement team spec |
| Live watchdog | Step 2.1 | None | Monitor batch for idle/silent agents, nudge stragglers |
| Test gate | Step 2.2 | None | Run validation per-session, filter known failures |
| Checkpoint | Step 3 | None | Full test suite + doc update |
| Finalize | Step 4 | None | Final validation + cleanup |
| Doc update | Step 4 | None | Update architecture docs, task tracking, decision records, KNOWN_FAILURES.md |
Main agent spawns all of these. Main never does their work. Watchdog lifecycle: Spawned WITH each batch of code agents, shut down WITH them. Fresh watchdog per batch.
Watchdog catches this. Send message back to code agent: "You have uncommitted changes. Run git add -A && git commit -m '[Team X]: [deliverable]' now."
Merge agent attempts resolution. If it can't:
Report the failure. Ask user:
After 10 minutes with no response from a code agent:
For a 6-team execution plan:
This leaves the vast majority of main's context window available for the user to request follow-up work in the same session.
docs/KNOWN_FAILURES.md. Every agent and gate must read it. If they keep reporting the same pre-existing failures, the system wastes context on noise.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.