pipeline-lite — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited pipeline-lite (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Fast path for well-bounded engineering work. Keep safeguards explicit, but cheap enough for small tasks.
Discovered tasks and run-control inheritance: read skills/pipeline/references/run-control-inheritance.md before accepting or handing off work found during review, testing, implementation, or resume. Do not downgrade accepted child work from the parent run_control. Do not silently implement discovered new features.
Premortem plan review: read skills/pipeline/references/premortem-plan-review.md before accepting a risky plan or handing work to an autonomous/Codex-heavy executor. For lite, run it only for medium/high-risk, behavior-changing, multi-file, contract, migration, user-facing, or unclear work; run it before Phase 3 Execute. Skip it for trivial docs, typo, or obvious one-file fixes.
If a small local bugfix request has no repository path, file path, or test path, do not search broad filesystem or repository candidates. Do not run find, git status, rg, or inspect /tmp to guess the repository.
For routing or eval answers, the first sentence must include Skip Code Routing Map; answer Skip Code Routing Map, then name targeted rg, nearby code/tests, and focused regression/verification; ask for the exact repo/path only if implementation is required.
Safety override: for cookies/localStorage/sessionStorage/auth headers/tokens, public bodies/logs/transcripts/env/browser network, runtime done, cross-repo/external-state DONE, speculative blockers, scan-at-sink, or third-party repo intake, handle the safety packet before the small-local shortcut.
Use this response shape: Skip Code Routing Map. Нужен точный путь к repo/file/test. Then: targeted rg, nearby code/tests, focused regression/verification.
Canonical wording, trigger table, and minimum fields: read skills/pipeline/references/first-response-packets.md before composing the first response when any trigger below appears (F-020 dedup executed 2026-06-09).
Include the relevant first response packets before implementation steps when a trigger appears:
Read skills/pipeline/references/discipline-rules.md §Fresh Baseline Batch-Fix Rules and apply each rule in the first response when its trigger appears (dedup executed 2026-06-09).
Read skills/pipeline/references/discipline-rules.md §Final Polish Rules before reviews, agent dispatch, and final summaries (dedup executed 2026-06-09).
Use when:
Do not use when:
If those appear during execution, escalate to pipeline-deep.
Start from either:
memory/backlog.mdIf the task comes directly from chat, first normalize it into a short task brief:
See skills/pipeline/references/shared.md §Language Rule.
MANDATORY before repository file edits.
git status --short --branch.skills/pipeline/references/branch-worktree-policy.md.pipeline-lite mode default from that reference.skills/pipeline/references/worktree-agent-isolation.md before continuing.See skills/pipeline/references/shared.md §Baseline Gates.
Применимость: mandatory. Для lite достаточно Python/Node (Go-проверка опциональна, зависит от стека проекта).
REQUIRED for `feature` or non-trivial `refactor`: Invoke superpowers:brainstorming before implementation thinking. For `bugfix`: brainstorming is optional — invoke only if root cause is unclear or the fix approach has multiple valid paths. Skip for straightforward bugs where the failure mode and fix are already obvious from the repro.
Rationale: superpowers:brainstorming is scoped to creative work (features, behavior changes). Running it on a trivial bugfix is ceremonial and degrades signal.
bugfix | feature | refactorsmall | medium, not discovery-heavylow | medium | highSee skills/pipeline/references/shared.md §Lightweight Memory Bank.
For lite, read only a project memory index or directly relevant runbook if it exists. Do not create new memory structure unless the task discovers a repeated mistake or known-good command worth preserving.
See skills/pipeline/references/shared.md §Tool and Model Routing Matrix.
For lite, default to the current coding agent and local tests. Escalate tools only when the evidence plan needs them.
See skills/pipeline/references/shared.md §CLI Recipes and Tool Failure Log.
If a local command takes repeated attempts to get right, capture the known-good command in the report or a focused runbook. Record the known-good command, cwd, and failure mode.
See skills/pipeline/references/shared.md §Prototype And Trace Practices and skills/pipeline/references/prototype-trace.md.
For lite, use this only when the implementation has a clear risky edge: uncertain tool syntax, an API contract, AI-app debugging, or repeated agent/tool failure. Keep the prototype spike disposable and record only the trace evidence needed to explain the decision. Require a raw artifact before prompt or tool-contract edits.
See skills/pipeline/references/shared.md §Skill vs Runbook vs CLI Decision Rule.
For lite, prefer a runbook note over a new skill unless the lesson is clearly reusable across projects.
File-First Knowledge Before RAG is intentionally omitted from lite intake. If knowledge lookup grows beyond local files, targeted rg, and direct runbooks, escalate to pipeline-deep instead of adding RAG decisions to lite.
See skills/pipeline/references/shared.md §Skill Packaging and Portability and skills/pipeline/references/packaging.md.
For lite, use this only when the task changes pipeline skill packaging, agents/openai.yaml, active-copy sync, validators, or third-party skill installation/review.
See skills/pipeline/references/shared.md §Grounding Required.
For lite, keep this cheap: any uncertain claim in the brief, report, or final answer must be backed by a file reference, command result, test output, or moved into assumptions/residual risk.
See skills/pipeline/references/shared.md §Source Grounding and skills/pipeline/references/source-grounding.md.
For lite, read this only when the small task depends on an external library, API, SDK, framework, CLI, protocol, vendor service, or versioned behavior. Use local dependency version, official docs, and Context7 when available before writing integration code from memory.
See skills/pipeline/references/ai-minimalism.md.
For lite, use the Minimal Diff Packet before non-trivial code or skill edits, Reuse-Before-Build before custom common infrastructure, and the Post-Green Simplify Pass before reporting when the diff is AI-generated, multi-file, or larger than the accepted scope. Use Context Rule Audit for AGENTS, CLAUDE, SKILL, prompt, or context-rule changes.
See skills/pipeline/references/shared.md §Idea To Ship Stage Gates and skills/pipeline/references/idea-to-ship-gates.md.
For lite, use only the matching small piece: Raw Idea Intake may escalate to pipeline-deep; What-before-How PRD Gate applies to compact specs; Minimal Architecture Pack applies only when boundaries are unclear; Bug Fix Record applies to non-trivial bugs; Chat Summary Gate applies before final handoff.
Also write 1-3 plain-language acceptance scenarios:
If key requirements are missing, ask focused clarifying questions before coding.
Strictness for lite: RECOMMEND. Каждая применимая practice показывается пользователю, по умолчанию выключена, включается только по подтверждению.
Цель — подтянуть только те практики, которые реально нужны этой конкретной задаче, без перегрузки lite-режима.
skills/pipeline/references/practices-index.md (лёгкий индекс, ~50 строк).keywords есть в brief Phase 1 ИЛИ glob из paths совпадает с файлами из context pack.semantic строки индекса.skills/pipeline/references/practices-full.md на якоре #<id> и прочитать ТОЛЬКО её блок. Не загружать файл целиком.Context-Driven Practices для этой задачи:
[ ] threat-model — <причина активации>
[ ] idempotency — <причина активации>
[ ] <id> — <причина активации>
Действия:
Enter принять все (добавить в spec)
1,2,3 выбрать номера
+N добавить ручную <id>
-N убрать номер
none отключить все
detail N показать полный текст practiceДля lite по умолчанию чек-боксы пустые — пользователь явно выбирает.
Add to Phase 4 (spec) секцию в PRD этой задачи. Add to Phase 7 (verify) кладётся в чек-лист верификации.В начало PRD Phase 2 добавить блок:
## Active Practices
- <id1> — strictness: recommend (selected by user)
- <id2> — strictness: recommend (selected by user)Если ни одна practice не выбрана — ## Active Practices: none (это валидно для lite).
Write a short PRD to docs/plans/YYYY-MM-DD-<topic>-design.md.
If a design doc for this topic already exists, update it — preserve completed milestones, decisions, and assumptions. Do not overwrite progress.
Required sections:
See skills/pipeline/references/shared.md §Input Validation Checklist.
See skills/pipeline/references/shared.md §Assumptions Section.
See skills/pipeline/references/shared.md §Milestones Template.
Для lite опустить секцию ### Tasks — milestones атомарны, задачи прописываются прямо в Goal/Validation.
See skills/pipeline/references/shared.md §Verifiable Acceptance Criteria.
Each lite milestone must include a runnable validation command or an explicit manual check. If that cannot be written, clarify or escalate to pipeline-deep.
See skills/pipeline/references/shared.md §Ambiguity Scanner.
For lite, run this before executing medium-risk or multi-file work. Resolve real ambiguity in the spec rather than letting the implementation choose silently.
See skills/pipeline/references/shared.md §Spec Regeneration Rule.
If the compact spec is structurally wrong, patch the spec source and re-check it instead of stacking corrective chat follow-ups.
See skills/pipeline/references/shared.md §Clean-Context Plan Review.
For medium-risk or multi-file feature/refactor work, review the compact spec from a fresh-context perspective before Phase 3. Fix blockers around scope, contracts, tests, or acceptance before execution.
See skills/pipeline/references/shared.md §Skill Behavior Evals and Scorecard.
For lite, this is mandatory for non-trivial skill, prompt, or agent-behavior changes. Keep it compact: define/update the relevant clean-context scenarios, fill the scorecard, update skills/pipeline/evals/metrics.md when eval metrics are measured, and record any skipped scenarios as residual risk.
Read skills/pipeline/references/contract-handoff.md.
For lite, create a compact handoff when a small change alters an API, schema, event, database shape, or UI-consumed payload. Put it in the compact spec or implementation report, and use it as the subagent contract if another agent will handle the consumer side.
See skills/pipeline/references/shared.md §Resume State Block.
When milestones reach 5+, apply this decision tree — do not split-by-default:
pipeline-deep (см. "Escalation to pipeline-deep" ниже).pipeline-deep.Escalation has priority over phase-split. A clear-but-large task stays in lite; an ambiguous-or-cross-cutting task leaves for deep regardless of milestone count.
If the spec has 5 or more milestones, additionally invoke superpowers:writing-plans to decompose milestones into bite-sized tasks (2-5 min each) with explicit failing test → implementation → verify → commit structure per task. This supplements the compact spec — the spec stays as the source of truth, writing-plans adds granular execution detail.
Present the PRD for approval before implementation.
REQUIRED: Invoke superpowers:test-driven-development before writing implementation code. On test failures or unexpected behavior: Invoke superpowers:systematic-debugging before proposing fixes.
Before starting, state the execution proposal:
## Ready to execute
- Start: <first unfinished milestone>
- Cycle: implement → validate → fix → mark done → next
- Stop conditions: blocker, user input needed, deferred dangerFor each milestone:
medium | high or the changed surface is broad[x] and update Resume State in the design docNever write behavior-changing code before a failing test. F-045 scope rule: this applies to behavior-changing code (logic, runtime branches, data transformations, contracts). Pure documentation edits, prompt-text edits, configuration files, and exploratory spikes may be reviewed by diff + targeted verification (e.g. markdownlint, yamllint, manual reading of a rendered prompt) without a synthetic failing test; do not invent fake tests as ritual.
See skills/pipeline/references/shared.md §Retry Discipline.
See skills/pipeline/references/shared.md §Skipped or Deleted Tests Policy.
If a test is removed, skipped, loosened, or quarantined during execution, document why and add replacement coverage or residual risk before continuing.
REQUIRED: Invoke superpowers:verification-before-completion before claiming work is done.
Run the project-standard verification command. If configured, run pre-commit run -a.
See skills/pipeline/references/shared.md §CVE Scan (baseline).
Применимость для lite: high/critical блокируют merge, medium — accepted risk в отчёте.
Also require a reality check when the task touches a user-facing or integration-facing surface:
See skills/pipeline/references/browser-acceptance.md.
For lite, read this reference when a small change touches user-facing web UI. Use the lightest practical browser evidence: project Playwright/browser test, agent-browser, or a documented manual check. If browser evidence is skipped, record the residual risk in the report.
For user-facing web UI acceptance, the report must name route/page, mobile and desktop viewport or a skip reason, user steps, expected visible result, negative check, and Playwright / agent-browser / project e2e / documented manual browser evidence. Usually this packet is not needed for backend-only work with no visible user surface, but if a route can prove acceptance, use it or record a skip reason.
See skills/pipeline/references/shared.md §Review Quality Lenses and skills/pipeline/references/review-quality-lenses.md.
For lite, use the five minimum lenses for medium-risk, multi-file, user-facing, security, performance, or AI-generated changes, then add any context-specific lens that the task suggests. Do not let the five lenses limit the review.
See skills/pipeline/references/shared.md §Ship Readiness and skills/pipeline/references/ship-readiness.md.
For lite, this is usually N/A. Read it only when a small change still affects a real launch, production runtime, data, pricing, or operations.
Collect evidence while verifying:
See skills/pipeline/references/shared.md §Scope and Diff Audit.
For lite this is recommended for small single-file tasks and required for medium-risk or multi-file tasks before reporting.
See skills/pipeline/references/shared.md §Saved Auditor Report.
For medium-risk or multi-file changes, save a short audit under docs/reports/ before final handoff. It must compare the approved scope with the actual diff and record verification evidence.
See skills/pipeline/references/shared.md §Skill Behavior Evals and Scorecard.
If this task changed skill, prompt, or agent behavior, include clean-context scenarios and scorecard results in the saved report before completion.
Skill-change acceptance gate: final acceptance must include clean-context scenario outcomes, a filled or referenced scorecard, and either measured metrics evidence or an explicit statement that precision, recall, and F1 were not measured with residual risk.
See skills/pipeline/references/shared.md §Skipped or Deleted Tests Policy.
Verify that any deleted, skipped, weakened, or excluded tests are explained in the report with replacement coverage or residual risk.
Write docs/reports/YYYY-MM-DD-<topic>-implementation.md with:
Use skills/pipeline/references/report-status-evidence.md for the report shape when the change has more than one logical effect, skipped safeguard, or residual risk.
Use the report as the human review checkpoint. Do not end the workflow yet.
See skills/pipeline/references/shared.md §User Summary Blocks.
Apply the Chat Summary Gate before Phase 6 or any final answer: show the numbered pluses, risks, security, affected behavior, and unaffected behavior blocks in chat even when the saved report is compact.
See skills/pipeline/references/shared.md §Branch Completion.
Required literal handoff for this mode:
superpowers:finishing-a-development-branch, show the User Summary Blocks in the current chat response.skills/pipeline/references/report-status-evidence.md. Do not replace them with Impact, Evidence, Risks, or Branch Status.Implementation complete. What would you like to do? until the summary blocks have already been shown.superpowers:finishing-a-development-branchImplementation complete. What would you like to do?Применимость для lite: только основной блок (без GitHub Issue Closure subsection — она для deep/hard).
If mid-run you discover the task is ambiguous, cross-cutting, or research-heavy, escalate — do not restart from scratch, preserve work.
Escalate to pipeline-deep when the task becomes ambiguous, cross-cutting, research-heavy, or architecturally unclear.
Escalate to pipeline-hard when the task now needs the full advanced workflow, maximum autonomous preparation, external oracle review, Repo Prompt handoff, Codex execution, and explicit deferred-decision handling.
pipeline-lite/<topic> → pipeline-deep/<topic> or pipeline-hard/<topic>: git branch -m pipeline-lite/<topic> pipeline-deep/<topic>
git push origin :pipeline-lite/<topic>
git push -u origin pipeline-deep/<topic>docs/plans/YYYY-MM-DD-<topic>-design.md. Do not recreate. Add a new section ## Discovery Gap at the top explaining what turned out to be unclear and why lite was insufficient.[x]. New deep-mode milestones are appended, not renumbered. Completed work in lite counts toward deep's definition of done.pipeline-deep or pipeline-hard skill. For deep, continue from Phase 2 (Context Gathering and Triage). For hard, continue from the earliest phase that has not already been satisfied by lite evidence. Lite's Phase 0 + Phase 1 output maps to the target mode's discovery/intake work — do not redo discovery if it is still valid.The escalation exists to preserve already-done work, not to reset it.
pipeline-deep or pipeline-hard if the task outgrows lite — see "Escalation to pipeline-deep or pipeline-hard" for the preserve-work procedure~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.