fan-out-fork-agents — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited fan-out-fork-agents (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Before applying any fan-out rule below, check your own role. If a ‹fork-boilerplate› block is in your prompt, you were told "you ARE the fork", or your session has fork-context-ref / attributionAgent: fork — you are a fork-worker. The entire fan-out machinery in this skill (dispatch lifecycle, registry, worktree isolation, federation pattern) applies ONLY to the parent/top-level session. As a fork you must execute your task directly with existing tools and not spawn any further agents — the runtime ‹fork-boilerplate› directive forbids any Agent-tool spawn from inside a fork. See prefer-fork-agents → "Self-check: are you the fork?" for the full rationale.
This skill covers the operational layer of multi-fork dispatch — what to do when fanning out to multiple parallel forks. Decision criteria for "fork vs named subagent" live in prefer-fork-agents. This skill assumes that decision is already made, forks have been chosen, and the dispatcher is the parent session.
Fork mode needs CLAUDE_CODE_FORK_SUBAGENT=1 in ~/.claude/settings.json, read at startup. A plugin can't set it. If a fork dispatch errors with this unset, tell the user to run /Claude-Full-Context-Agent:doctor — it runs the bundled installer for their OS (sets the var, installs skills) — then restart Claude Code. One-time; later sessions already have it.
Parallel fork dispatch follows a three-stage sequence. The whole sequence is structured to maximize the prompt-cache-share benefit forks provide: the parent loads phase context once, all forks inherit it via cache, the parent reconciles results. Skipping or compressing stages produces integration failures, redundant per-fork work, and silent regressions.
Before issuing any fork in a fan-out batch, the parent session does the following:
.claude/worktrees/agent-<id>/ is the conventional path. Each isolation: "worktree" dispatch materializes one.Dispatch forks as a single batch, not sequentially. Each fork gets:
Agent(description="<task-3-5-words>",
subagent_type="fork",
isolation="worktree",
prompt="<focused brief with output contract>")`subagent_type: "fork"` is required (verified in Claude Code v2.1.177). Omitting it silently dispatches a general-purpose subagent without inherited context — the fan-out would lose its cache-share advantage and each worker would need a full briefing. The load-bearing verification is the first line of the sidechain JSONL at ~/.claude/projects/<project>/<session>/subagents/agent-<id>.jsonl: if type == "fork-context-ref", it's a real fork. Fork-originated assistant turns also carry "attributionAgent":"fork", but the first transcript line is the cheapest single check.
For read-only fan-outs (research, analysis, reporting) worktree isolation is unnecessary — forks share the parent's working directory in read-only mode and produce no merge conflicts.
When forks return:
prefer-fork-agents (read summaries, diff for overlap, run integration suite, spot-check systematics)The parent is the serialization point for shared files. This is by design: parallel writes to a single canonical file would race or silently overwrite.
When using isolation: "worktree", worktrees materialize as nested directories with their own .git references. These will pollute the parent's git status and index unless excluded.
Before the first fan-out in any project, add this line to the project's `.gitignore`:
.claude/worktrees/Without this entry, every worktree-fork run dirties the parent index with nested repositories. The fix is one line; missing it is a recurring cleanup cost on every fan-out.
If you are dispatching a fan-out in a project that does not yet have this entry, add it first. Treat it as a precondition, not an afterthought.
The scheduler accepts up to ~10 concurrent forks, but the planning-vs-execution gap grows beyond 5-6. At 7+ parallel tracks, retroactive auditing tends to replace actual orchestration — you discover what forks did rather than directing them.
Soft cap at 6 parallel forks. If the task needs more, sequentialize into waves of 4-6.
This is an empirical limit derived from production usage, not architectural. The scheduler does not enforce 6 — your operational discipline does. Reasons the gap grows:
If a task seems to need 10+ parallel workers, the issue is usually decomposition: there are dependencies you haven't surfaced yet, or the slices are too small.
Maintain a markdown table per session that tracks active forks. Update on dispatch and on return.
| Fork ID | Task | Worktree | Status |
|---------|-------------------------------------|-----------------------------------|-------------|
| a1b2c3 | IssueReopenOp + IssueEditOp | .claude/worktrees/agent-a1b2c3/ | completed |
| d4e5f6 | RunRerunOp + WatchPrChecksOp | .claude/worktrees/agent-d4e5f6/ | completed |
| g7h8i9 | query_my_dashboard + notifications | .claude/worktrees/agent-g7h8i9/ | in-progress |Without this, forks become invisible mid-flight, integration becomes guesswork, and "lost forks" (dispatched but never reconciled) become a real failure mode.
The registry is for your own orchestration tracking. The user does not need to see it unless they ask, but you should reference fork-ids consistently in your narration so the user can trace which slice produced which result.
Every fork must end its work product with two things:
Include this requirement in every fork brief:
Your output MUST end with:
result: <one-line summary>
verification: <test command or file path proving the result>Without an enforced contract, fork outputs drift in shape and the parent's verification step becomes manual interpretation rather than structural check. The contract is a small upfront cost that compounds in reliability across many fan-outs.
When a fan-out needs both inherited methodology AND independent unbiased sub-processing per slice, use a two-layer pattern:
Total effective workers = K × N. This is not fork recursion (forks cannot spawn forks); it is forks dispatching named subagents downstream, which is allowed.
Use Federation when:
Do NOT use Federation when:
Example: research project where 5 forks each investigate a domain (databases, search, identity, schema, composability), and each fork dispatches 2 sub-researchers (one for surveying existing solutions, one for evaluating fit). That's 5 × 2 = 10 effective workers, with the K=5 forks inheriting the project's research methodology and the N=2 sub-agents getting unbiased blank briefs.
Whenever you are about to dispatch the second fork in a single turn, this skill applies. Specifically:
.claude/worktrees/ is in .gitignore.Apply silently. Reference fork-ids consistently in narration; surface the registry only on request.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.