openspec-ultra-bridge — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited openspec-ultra-bridge (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Treat OpenSpec as the spec source-of-truth and Ultra-Orchestrator as the execution control plane.
This bridge is part of the mainline strict control plane. It is normally invoked by $ultra-orchestrator; users should not need to call it manually.
Absorb OpenSpec advantages without weakening the existing Ultra-Orchestrator architecture.
Prioritize these four advantages first:
Do not let this bridge replace Ultra's state machine, review, QA, risk vetter, safety guard, or execution ledger ownership.
Use this skill to translate between:
The bridge must not replace OpenSpec. It must map OpenSpec artifacts into Ultra execution objects and map Ultra review and QA feedback back into OpenSpec update suggestions.
Expect one or more of these OpenSpec artifacts:
proposal.mddesign.mdtasks.mdchange-idOptionally consume these Ultra-side artifacts:
TaskManifestWorkPackageAgentResultRunOutputExecutionLedger summaryGenerate these Ultra-side artifacts when possible:
TaskManifestWorkPackagechange-id <-> task-id mapping notesGenerate these OpenSpec-side feedback outputs when possible:
change-id to TaskManifest.id.goal.constraints.dependencies.success_criteria and acceptance_checks.owned_paths.When Git Worktree is used:
When validating this bridge on a real project such as /teammate:
This bridge must preserve a strict division:
change = specification source-of-truth and long-lived progress nodeslice = execution source-of-truth for implementation progress inside a changeDo not collapse them into one concept.
When bridging, always make the current slice explicit for the selected change.
For every newly opened change, initialize at minimum:
proposal.mddesign.mdtasks.mdultra-bridge.mdThe initial bridge status should default to:
slice_0_spec_ready if the change is opened and ready for implementationslice_0_not_opened only for program-level ledgers or unopened planned changesEach ultra-bridge.md should include or imply:
change_idmilestonestatustask_manifest_focuswork_package_scopenext_sliceIf a field is not known yet, write the narrowest truthful placeholder rather than omitting slice status.
After each completed slice, the bridge should push status intent back into OpenSpec-facing artifacts:
ultra-bridge.md statustasks.md task checks when implementation actually landedDo not treat conversation text as an acceptable substitute for status synchronization.
When the run mode is STRICT_OPENSPEC, produce or hand off:
TaskManifestWorkPackage setWhen a program has many unopened planned changes, the bridge may be used to:
opened or unopenedThis is the preferred way to normalize a long-running program before large implementation waves.
When a single change is used as a trial run, the bridge should also emit:
Use this to improve bridge stability over time rather than treating every change as isolated.
references/mapping.md for detailed field mappingreferences/workflow.md for end-to-end fused workflowreferences/archive-gate.md for archive readiness conditionsreferences/adoption-priorities.md for what to absorb first from OpenSpecreferences/teammate-pilot.md for pilot acceptance on /teammate~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.