assign-to-workforce — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited assign-to-workforce (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
The skill is named `assign-to-workforce`; the product/CLI it reads is the `devague plan waves` command. (The prior leg — turning a spec into a plan — is the sibling `/spec-to-plan` skill.)
assign-to-workforce takes a converged devague plan and fans out its dependency waves to parallel agents (subagents, teammate agents, or generalist agents) — one agent per task per wave — each working in an isolated git worktree. The main agent merges each completed worktree gated by TDD. The human owns exactly three gates: the exported spec, the implementation split plan, and the final PR.
The devague CLI is never orchestrated by devague itself — devague plan waves describes the dependency graph (#20); it does not spawn agents, manage worktrees, mark tasks done, or pick a backend. The fan-out is the operator's job — this skill and the main agent perform it.
The entry point is scripts/assign-to-workforce.sh. Invoke it from the repository whose plan you are implementing (plans persist under .devague/ in the current directory):
bash .claude/skills/assign-to-workforce/scripts/assign-to-workforce.sh split-plan [--plan <slug>]
bash .claude/skills/assign-to-workforce/scripts/assign-to-workforce.sh waves [--plan <slug>] [--json]
bash .claude/skills/assign-to-workforce/scripts/assign-to-workforce.sh helpIt resolves the CLI portably — an installed devague on PATH (the normal case), falling back to uv run devague when you are inside the devague checkout, else an install hint. The split-plan subcommand reads devague plan waves --json and renders the human-facing implementation split plan: task map, proposed per-task agent + model assignment, and the go/no-go question. The waves subcommand forwards to devague plan waves verbatim.
| Subcommand | What it does |
|---|---|
split-plan [--plan S] | Read devague plan waves and print the implementation split plan — task map with per-task agent + model proposal — ready for human go/no-go review. |
waves [--plan S] [--json] | Forward to devague plan waves [--json]. Read-only; lists wave batches. On a converged plan exits 0 listing the waves. |
help | Print usage. |
The flow has three human gates and one automated TDD merge loop.
The plan is seeded from a converged frame (devague plan new --frame <slug>). The human reviewed and approved the spec when it was exported by the /think skill. No re-approval needed here — the spec gate is already closed.
Before any task is assigned, the main agent presents the implementation split plan for human go/no-go. This is the only gate the human owns at the implementation stage (per task, the TDD gate is the main agent's).
The split plan contains:
the wave it belongs to (from devague plan waves).
(subagent / teammate / generalist), the proposed model (e.g. a cheaper/faster model for a well-scoped task), and the scope justification (why this task is safe to delegate).
assign the plan to the workforce, or edit it first?"
The human may edit any row (agent type, model, scope) before approving. The plan is model-agnostic — devague does not pick a backend (#20).
Run split-plan to print the proposed table:
bash .claude/skills/assign-to-workforce/scripts/assign-to-workforce.sh split-planDo not proceed to fan-out until the human approves the split plan.
Once the human approves, the main agent fans out each wave in order:
git worktree add ../worktrees/agent-<task-id> -b agent/<task-id>the split plan), with:
match the acceptance criteria before implementing.
inter-task dependency; the dependency graph guarantees this). Same-file overlap surfaces as a merge conflict at reconcile time, not a live race — isolated worktrees prevent clobbering.
For each completed task worktree, the main agent:
pass (or the relevant tests must be absent — the task adds them).
git merge --no-ff agent/<task-id>merge is reverted and the task agent is given the failure output to fix.
git worktree remove ../worktrees/agent-<task-id>The human does not review individual task merges. Per-task acceptance is the main agent's responsibility — the TDD gate (tests pass before AND after merge) plus the task's acceptance criteria. This mirrors the non-authoritative working state pattern of the Human Review Loop (#17): per-task merge records are uncommitted working state; the authoritative human gate is the final PR.
Advance to the next wave only after all tasks in the current wave are merged and their tests pass.
Once all waves are merged and the full test suite passes, the main agent opens a PR via the cicd skill (devex pr open). The human reviews and merges. This is the last and only remaining human gate.
These protect the human-gate contract and the TDD guarantee.
without prior human approval of the implementation split plan (gate 2). The split plan is the human's only implementation-stage decision.
contention is managed by isolation, not by trust in the dependency graph. The dependency graph guarantees logical independence within a wave, not file disjointness. Conflicts surface at merge time.
both sides. A merge that makes tests pass only after (not before) means the baseline was already broken — fix the baseline first.
human here. Do not pause for human approval between wave tasks.
devague plan waves is read-onlyscheduling metadata (#20). Never run devague plan commands inside a task worktree to "mark a task done" or modify plan state from a subagent.
implementation split plan, (3) the final PR. No silent fourth gate.
adds orchestration convention, not CLI behavior.
The split-plan subcommand prints to stdout and exits 0 when a converged plan is found. On error (no plan, cyclic graph) it exits non-zero with a hint: line on stderr. The waves subcommand forwards the CLI's own output contract (stdout, --json for structured output, exit 0 on success).
Picking up after /spec-to-plan exported a plan for the frame my-feature:
a() { bash .claude/skills/assign-to-workforce/scripts/assign-to-workforce.sh "$@"; }
# 1. Inspect the waves
a waves
# 2. Present the implementation split plan for human review
a split-plan
# --- HUMAN: review the table, edit agent/model assignments if needed,
# then say "approved" to proceed ---
# 3. Fan out wave 1 (t1, t2, t3 are independent — run in parallel)
git worktree add ../worktrees/agent-t1 -b agent/t1
git worktree add ../worktrees/agent-t2 -b agent/t2
git worktree add ../worktrees/agent-t3 -b agent/t3
# ... spawn task agents in each worktree, await completion ...
# 4. TDD-gated merge for each wave-1 task (no human per task)
git merge --no-ff agent/t1 # tests pass before + after
git worktree remove ../worktrees/agent-t1
git merge --no-ff agent/t2
git worktree remove ../worktrees/agent-t2
git merge --no-ff agent/t3
git worktree remove ../worktrees/agent-t3
# 5. Advance to wave 2 (t4 depends on t1–t3 being merged)
git worktree add ../worktrees/agent-t4 -b agent/t4
# ... spawn, await, merge with TDD gate, remove worktree ...
# 6. Open the final PR (human gate 3)
bash .claude/skills/cicd/scripts/workflow.sh openThe exported plan-md from devague plan export is the standing brief for each task agent — its task id, summary, acceptance criteria, and the targets it covers are already in that file.
This is a first-party skill — its origin is agentculture/devague, where the devague agent maintains it alongside the tools it operates (dogfooding), next to its siblings /think and /spec-to-plan. It is the third skill in that outbound family, covering the implementation leg after a plan converges. The flow runs the opposite direction of the vendored steward skills: steward pulls this from devague and broadcasts it to the rest of the AgentCulture mesh. The cite, don't import policy still holds: downstream repos copy it, they don't symlink or depend on it. See docs/skill-sources.md.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.