incremental-implementation — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited incremental-implementation (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Build in thin vertical slices — implement one piece, test it, verify it, then expand. Avoid implementing an entire feature in one pass. Each increment should leave the system in a working, testable state. This is the execution discipline that makes large features manageable.
before editing.
execution result; reduce duplicated wording and speculative structure.
hand-edit generated adapters or copied outputs unless that source owns them.
commands, or explicit blocker records.
When NOT to use: Single-file, single-function changes where the scope is already minimal.
┌──────────────────────────────────────┐
│ │
│ Implement ──→ Test ──→ Verify ──┐ │
│ ▲ │ │
│ └───── Commit ◄─────────────┘ │
│ │ │
│ ▼ │
│ Next slice │
│ │
└──────────────────────────────────────┘For each slice:
<project-name>/.dev-agent/tasks/status.md with changed files and verification evidence..dev-agent/tasks/status.md and.dev-agent/reviews/VERIFICATION.md or .dev-agent/reviews/BLOCKED_BUILD.md with changed areas, commands, and blockers.
Use the project-local workspace layout for all implementation work:
<project-name>/.dev-agent/tasks/<project-name>/src/,<project-name>/app/, <project-name>/apps/, or <project-name>/packages/
example <project-name> or <project-name>/apps/mobile
Build one complete path through the stack:
Slice 1: Create a task (DB + API + basic UI)
→ Tests pass, user can create a task via the UI
Slice 2: List tasks (query + API + UI)
→ Tests pass, user can see their tasks
Slice 3: Edit a task (update + API + UI)
→ Tests pass, user can modify tasks
Slice 4: Delete a task (delete + API + UI + confirmation)
→ Tests pass, full CRUD completeEach slice delivers working end-to-end functionality.
When backend and frontend need to develop in parallel:
Slice 0: Define the API contract (types, interfaces, OpenAPI spec)
Slice 1a: Implement backend against the contract + API tests
Slice 1b: Implement frontend against mock data matching the contract
Slice 2: Integrate and test end-to-endTackle the riskiest or most uncertain piece first:
Slice 1: Prove the WebSocket connection works (highest risk)
Slice 2: Build real-time task updates on the proven connection
Slice 3: Add offline support and reconnectionIf Slice 1 fails, you discover it before investing in Slices 2 and 3.
Before coding, write a compact slice note in the working response, .dev-agent/tasks/status.md, or .dev-agent/tasks/PLAN.md only when the slice is too large to hold in the spec/status. Include the goal, target files, source boundary, proof command, and blocker/escalation path. This replaces a separate planning phase.
For behavior changes, prefer a failing test or executable proof first. If that is not practical, record why and use the smallest manual or smoke proof that can catch the intended behavior.
Before coding, check whether the requirement, spec, design resources, environment, and risk boundary are clear enough for the current slice.
Return the issue to its owner instead of hard-working around it:
If no flow can resolve it, record the blocker in .dev-agent/reviews/BLOCKED_BUILD.md and ask the user for the decision.
Before writing any code, ask: "What is the simplest thing that could work?"
After writing code, review it against these checks:
SIMPLICITY CHECK:
✗ Generic EventBus with middleware pipeline for one notification
✓ Simple function call
✗ Abstract factory pattern for two similar components
✓ Two straightforward components with shared utilities
✗ Config-driven form builder for three forms
✓ Three form componentsThree similar lines of code is better than a premature abstraction. Implement the naive, obviously-correct version first. Optimize only after correctness is proven with tests.
Touch only what the task requires.
Do NOT:
If you notice something worth improving outside your task scope, note it — don't fix it:
NOTICED BUT NOT TOUCHING:
- src/utils/format.ts has an unused import (unrelated to this task)
- The auth middleware could use better error messages (separate task)
→ Want me to create tasks for these?Each increment changes one logical thing. Don't mix concerns:
Bad: One commit that adds a new component, refactors an existing one, and updates the build config.
Good: Three separate commits — one for each change.
If commits are not appropriate in the current environment, use the same atomicity for checkpoints: one status entry per logical change, with files touched and verification output.
After each increment, the project must build and existing tests must pass. Don't leave the codebase in a broken state between slices.
If a feature isn't ready for users but you need to merge increments:
// Feature flag for work-in-progress
const ENABLE_TASK_SHARING = process.env.FEATURE_TASK_SHARING === 'true';
if (ENABLE_TASK_SHARING) {
// New sharing UI
}This lets you merge small increments to the main branch without exposing incomplete work.
New code should default to safe, conservative behavior:
// Safe: disabled by default, opt-in
export function createTask(data: TaskInput, options?: { notify?: boolean }) {
const shouldNotify = options?.notify ?? false;
// ...
}Each increment should be independently revertable:
When directing an agent to implement incrementally:
"Let's implement Task 3 from the plan.
Start with just the database schema change and the API endpoint.
Don't touch the UI yet — we'll do that in the next increment.
After implementing, run `npm test` and `npm run build` to verify
nothing is broken."Be explicit about what's in scope and what's NOT in scope for each increment.
After each increment, verify:
npm test)npm run build)npx tsc --noEmit)npm run lint).dev-agent/tasks/status.md when commits are unavailable or not authorized.dev-agent/tasks/status.md and .dev-agent/reviews/VERIFICATION.md or .dev-agent/reviews/BLOCKED_BUILD.md record changed areas, commands, and blockersNote: Run each verification command after a change that could affect it. After a successful run, don't repeat the same command unless the code has changed since — re-running on unchanged code adds no information.
| Rationalization | Reality |
|---|---|
| "I'll test it all at the end" | Bugs compound. A bug in Slice 1 makes Slices 2-5 wrong. Test each slice. |
| "It's faster to do it all at once" | It feels faster until something breaks and you can't find which of 500 changed lines caused it. |
| "These changes are too small to commit or checkpoint separately" | Small commits/checkpoints are cheap. Large untracked batches hide bugs and make rollbacks painful. |
| "I'll add the feature flag later" | If the feature isn't complete, it shouldn't be user-visible. Add the flag now. |
| "This refactor is small enough to include" | Refactors mixed with features make both harder to review and debug. Separate them. |
| "Let me run the build command again just to be sure" | After a successful run, repeating the same command adds nothing unless the code has changed since. Run it again after subsequent edits, not as reassurance. |
After completing all increments for a task:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.