exploration-workflow — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited exploration-workflow (Agent Skill) and scored it 83/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 4 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 4 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<example> <commentary>SME starts a brand-new exploration session from scratch.</commentary> user: "Let's explore this idea I have for a staff scheduling tool." agent: [invokes exploration-workflow, bootstraps dashboard, asks for session type, begins Phase 1 discovery-planning] </example>
<example> <commentary>SME resumes an in-progress session after prior work.</commentary> user: "Where did we leave off with the customer portal exploration?" agent: [invokes exploration-workflow, reads dashboard, presents status summary, routes to active phase] </example>
<example> <commentary>Negative — user wants to start a new discovery plan only, not the full workflow.</commentary> user: "Run a discovery planning session for my onboarding redesign." agent: [invokes discovery-planning directly, NOT exploration-workflow] </example>
This skill is the single canonical entry point for the Business Exploration Loop. It manages all session state via exploration-dashboard.md, enforces phase gates, maintains a living task list as the session evolves, and routes work to the correct child skill at each phase. The SME never needs to invoke any other skill directly.
The workflow adapts to four session types, each with different phase requirements:
| Type | When to use | Active Phases |
|---|---|---|
| Greenfield | Building a new app or system from scratch | All 4 phases |
| Brownfield | Adding a feature to an existing codebase | Phase 1 required, Phases 2 & 4 optional, Phase 3 builds into real codebase |
| Analysis/Docs | Non-software output: requirements, process maps, legacy code analysis, policy, strategy, workflow design | Phases 1 & 4 required, Phase 2 optional (structure not layout), Phase 3 skipped |
| Spike | Investigating a question or technology | Phase 1 required (may repeat), all others flexible |
Required dependency: Theorba/superpowersplugin MUST be installed in the current host environment before the full Phase 3 execution discipline is available. Depending on the host, this may be exposed through a marketplace install,.agents, or another host-managed runtime location. Do not assume one fixed install path; determine availability by resolving the required Superpowers skills in the current environment. See the plugin README for installation guidance.
When Phase 3 is active, read references/phase3-execution-discipline.md for the full execution discipline protocol (superpowers availability check, worktree isolation, build delegation, TDD validation, branch finishing).
Summary: The orchestrator sets up isolation (worktrees), then delegates all build work to subagent-driven-prototyping. That skill owns component decomposition, dispatch, two-stage review, and TDD. When it signals complete, the orchestrator invokes finishing-a-development-branch for merge/PR options.
Before any implementation, scaffolding, or documentation-heavy execution slice, the orchestrator must produce a concise logical plan and task list, then keep that task list current as the SME corrects scope, sequence, or priorities. Planning stays in the higher-context orchestrator path; repetitive execution and document production should be delegated to cheaper agents or models whenever the chosen dispatch strategy allows it.
Before any downstream Superpowers design, plan, or implementation request, the orchestrator must inventory the exploration artifacts that define the current scope and treat them as required planning inputs rather than optional context. At minimum this inventory should include the current brief, dashboard, discovery plan, and any captures that define domain findings, architecture boundaries, data contracts, renderer constraints, or other execution-critical evidence.
Maintain a living task list throughout the session so the SME does not need to restate the work:
orba/superpowers is available and the session is heading into build or implementation, use it during planning and decomposition before dispatching worker agents.Dispatch strategy details: references/dispatch-strategies.mdRun the Superpowers availability check silently first. Resolve the required Superpowers skills in the current host environment rather than checking one fixed filesystem path. Only surface results if something is missing or needs a fallback. Do not mention the check to the SME unless action is needed.
For Analysis/Docs sessions: Skip the dispatch strategy question. Default to direct.
If the SME has no Copilot or Gemini CLI (strategy = claude-subagents or direct), apply these practices throughout:
Agent tool with model: "haiku" (currently haiku-4.5) to keep the main context light.haiku to collect structured answers, write to exploration/captures/clarifications-[topic].md, read back once. Never run clarification loops inline in the main orchestrator turn./compact to reduce carry-forward context debt.references/dispatch-strategies.md.For all other session types, ask the SME after session type selection:
"One more thing — how should I handle the heavy lifting when we get to building?
>
1. I have GitHub Copilot Pro — I'll use Copilot CLI. Simple tasks usegpt-5-mini(paid, AI Credits). Complex tasks useclaude-sonnet-4.6orclaude-opus-4.6(1 premium request — all related tasks batched into one dense call). 2. I have Agy CLI — Simple tasks use the cheapest model (seereferences/cheapest_models.md). Complex tasks use the premium tier. Note: standalonegeminiCLI shut down June 18, 2026 — useagyinstead. 3. Claude only — I'll use Claude sub-agents. Simple tasks usehaiku-4.5(cheapest). Complex tasks usesonnet. 4. I'll handle it myself — Everything happens directly in this session."
Record the choice in the dashboard as **Dispatch Strategy:** (copilot-cli, claude-subagents, or direct).
Fallback: If the chosen strategy becomes unavailable during Phase 3, silently fall back to direct mode and inform the SME.
At any point during the exploration, if the SME says something like "this isn't going to work", "kill it", "let's stop", or "the idea is bad", the workflow should exit cleanly:
exploration/handoffs/handoff-package.md with:## Risk Assessment section containing:**Outcome:** Throwaway (Fail Fast) / **Reason:** [one sentence from SME] / **Delivery Path:** Session closed — learning preserved.
[~] (skipped) with note: (Session killed — fail fast)**Status:** to CompleteThis is the "Throwaway Prototype" outcome from the TierGate — it can happen at any phase, not just at handoff. The earlier it happens, the more valuable it is.
exploration/exploration-dashboard.md.exploration/ directory if it does not already exist.exploration/session-brief.md exists.exploration/exploration-dashboard.md using the extracted values. Initialize **Status:** In Progress and set **Current Phase:** Phase 1 — Problem Framing.- [~] (Skipped) based on the Session Type."What are we exploring today? Give it a short name so we can track it — and in a sentence or two, what are you hoping to achieve or solve?"
**Session:** set and **Session Type:** TBD."That sounds like [Type X] — [why]. Does that fit, or would you describe it differently?"
**Session Type:** in the dashboard to the confirmed type.- [~] (Skipped).Match on intent, not keywords. When uncertain, default to the type with more phases (easier to skip phases than to add them back).
| What the SME describes | Suggested type | Key signal |
|---|---|---|
| Net-new app, portal, tool, system from scratch | Type 1 (Greenfield) | Nothing exists yet |
| New website (product site, marketing site, customer portal) | Type 1 (Greenfield) | Treat as greenfield even if using a CMS |
| Automated workflow, approval bot, notification system, integration | Type 1 (Greenfield) | New software, but ask: "Is the current manual process documented?" — if not, open with Analysis/Docs first |
| Add a feature or fix something in an existing app/codebase | Type 2 (Brownfield — feature addition) | Working codebase exists |
| Understand, document, or analyse an existing/legacy system | Type 2 (Brownfield — legacy analysis) | See Legacy Analysis sub-type below |
| Modernise, replatform, or migrate a legacy system | Type 2 (Brownfield — legacy analysis) → handoff to engineering | Start with analysis to understand what exists before planning the rebuild |
| Fix a broken business process, improve a workflow | Type 3 (Analysis/Docs — process) — but run Intervention Check first | Often NOT a software problem |
| Requirements gathering or documenting for an upcoming project | Type 3 (Analysis/Docs — requirements) | Deliverable is documents |
| Strategic planning, market entry, go-to-market, business decision | Type 3 (Analysis/Docs — strategic) | No code output |
| Already built a vibe-coded prototype and need to clean/harden it | Re-route to vibe-orchestrator agent | Vibe-coded app exists (Path 2) |
| Should we build vs. buy? What are our options? | Type 4 (Spike) | Decision support, may not lead to building |
| I'm not sure if we even need software | Type 4 (Spike) or start Phase 1 directly — the Intervention Check will clarify | Do not force a type prematurely |
| Research a technology, validate a hypothesis | Type 4 (Spike) | Exploratory, outcome open |
"Already vibe-coded a prototype" (Path 2) path:
"Since you already have a working vibe-coded prototype, we shouldn't start our clean-sheet pre-build discovery loop (Path 1). Instead, let's trigger our Vibe-to-Enterprise Transition Orchestrator (Path 2). I'll route you to the specialized vibe-orchestrator agent to run visual discovery and construct formal C4/TOGAF architectural specs."
Trigger the vibe-orchestrator agent directly.
"Not sure if software is the answer" path:
"That's actually the most important question — let's not assume software is the answer yet. Let's start with Phase 1 and figure out what kind of solution actually fits. I'll ask a specific question about that during our planning conversation."
Use Type 4 (Spike). The Intervention Check in Phase 1 will resolve this cleanly.
Type 1 — Greenfield (new app, system, or website): All 4 phases enabled.
Phase notes:
Type 2 — Brownfield: Two distinct sub-types with different phase configurations:
Sub-type A — Feature addition or improvement:
Sub-type B — Legacy analysis / modernisation / replatforming:
Record the sub-type in the dashboard under **Session Type:** (e.g., Brownfield — legacy analysis).
Type 3 — Analysis or documentation: Phase 1: enabled. Phase 2: optional — reframed as Structure Mapping (not "Visual Blueprinting"). Offer it proactively: "Before we start capturing, would it help to sketch out what the final document should look like? I can show you a few structure options." If yes, invoke visual-companion in document-structure mode (process flow diagrams, document outlines, decision trees, swimlanes). Output goes to exploration/captures/document-structure.md. Phase 3: disabled. Phase 4: enabled — the handoff IS the primary output.
Sub-types (record in dashboard):
Note: for Process sub-type, flag to discovery-planning that the Intervention Check is especially important — this is the scenario most likely to reveal that software is NOT the right answer.
Type 4 — Spike or investigation: Phase 1: enabled, may repeat. Phases 2–4: flexible — the SME decides as the investigation unfolds. Use when the outcome is unclear, when decision support is needed, or when "I'm not sure if we need software."
For skipped phases, mark them - [~] in the dashboard and add a note: (Skipped — [reason]).
exploration/exploration-dashboard.md.**Status:** Complete, skip directlyto the Completion Block. The session is already finished.
- [x] or - [X] (case-insensitive) → phase is complete- [~] → phase is intentionally skipped (treat as complete for routing purposes, but do not verify outcome files)- [ ] (exactly one space between brackets) → phase is incomplete[~] phases).-[x] with no leading space, * [x] with asterisk,–[ ] with an em-dash) must NOT be silently mis-routed. If you encounter one, pause and tell the user:
"The session dashboard has a formatting issue on one of the phase checkboxes. Let me show you so we can quickly confirm where we are."
Display the raw affected line(s) and ask: "Is this phase complete or still in progress?" Correct the checkbox before continuing.
[~] phases), verify that its listed Outcome file exists on disk."It looks like [Phase N] was marked complete but I can't find the expected output file at [path]. Let's take a quick look before continuing."
Present a brief, friendly status message based on the dashboard state.
For a brand-new session (just bootstrapped):
"Great — we're all set up. We'll work through [N active phases] together, starting with Problem Framing. Ready to begin?"
If any phases were skipped during bootstrap, mention it naturally:
"We've skipped [Phase N] since [reason]. If that changes, we can always add it back."
For a mid-session resume (at least one phase complete):
"Welcome back! Here's where we are: [List each phase with ✅ if[x]complete, ⏭️ if[~]skipped, or 🔵 if it is the active phase]
>
Ready to pick up where we left off with [active phase name]?"
Wait for a soft confirmation before proceeding. Any clear affirmation counts: "Yes", "Let's go", "Go ahead", "Ready", "Sure". Do not proceed until received.
Identify the active phase (first incomplete phase that is not skipped).
Skipped phases (- [~]) are not active — skip over them when finding the next phase to route to.
Route to the child skill for the active phase:
| Active Phase | Child Skill to Invoke |
|---|---|
| Phase 1 — Problem Framing | discovery-planning |
| Phase 2 — Visual Blueprinting | visual-companion |
| Phase 3 — Build | subagent-driven-prototyping |
| Phase 4 — Handoff & Specs (Auto-runs User Stories & Specs) | exploration-handoff |
| All phases complete or skipped | → Completion Block |
When invoking a child skill, pass this structured context block — do NOT bury it in prose:
## Session Context (from orchestrator — read and act on before proceeding)
<ORCHESTRATOR_DISPATCH authorized_skill="[child-skill name, e.g. discovery-planning]" session_id="[session-id-uuid]" phase_number="[N]" phase_name="[phase-name]" strategy="[dispatch-strategy]" expected_output="[path/to/artifact]" return_required="yes">
- Session type: [exact value from **Session Type:** in dashboard]
- Active phase: Phase [N] — [phase name]
- Discovery Plan: [path to most recent discovery-plan-*.md, or "not yet written"]
- Current task slice: [the current planned work items for this phase]
- Return signal: When this phase is complete, announce "PHASE [N] COMPLETE" then invoke the exploration-workflow skill to continue.
</ORCHESTRATOR_DISPATCH>Child skills must read Session type and adapt their question tracks and outputs accordingly before doing anything else.
If the phase involves implementation or dense document production and the dispatch strategy is not direct, decompose the work first, then hand the repetitive or low-context slices to cheaper agents or models. Do not keep all execution in the main orchestrator path unless the SME explicitly chose direct handling.
When the dashboard records **Dispatch Strategy: direct**, you do not have CLI-level subagent spawning capabilities. To prevent role contamination and context pollution:
requirements-doc-agent.md).Read tool. BEGIN AGENT EXECUTION: [Agent Name]
[Paste Agent Prompt Instructions & Rules Here]
---
Task Context: [Provide current files/artifacts]
Task Instruction: [Provide specific task slice]exploration/captures/ or the designated path. END AGENT EXECUTION: [Agent Name]If the sub-agent output contains open questions for the SME (e.g., gaps in requirements, ambiguous instructions), hold the persona open and await the SME response before outputting the cleanup marker. Premature persona purge causes deadlock: the SME's reply is ingested by the Orchestrator, not the sub-agent, breaking the clarification loop.
END AGENT EXECUTION is output, clear the agent persona from your current reasoning thread. Announce: "Execution complete. Returning to Exploration Orchestrator role." Resume the standard orchestrator behavior.If the SME asks to go back and change something in a completed phase (e.g., "Can we revisit the discovery plan?", "I want to change who the users are"), follow this protocol:
"If we change [X], it affects [Y]. Here's what we'd need to redo: [list affected phases/outputs]."
- [x] back to - [↩] (marks it as revised, not just incomplete).TBD).- [x], update the Outcome file path, and log the revision in the Session Log with a note: (revised — [one-sentence reason).The `↩` marker signals that this phase was completed, revised, and re-completed. It is distinct from [x] (complete), [ ] (not started), and [~] (skipped). If your dashboard template does not include this marker, add it manually.
<HARD-GATE> — This block runs when the child skill signals its phase is done.
python3 scripts/validate_phase_gate.py [active_phase_number]"Does everything look right? If you're happy with it, just say the word and I'll mark Phase [N] complete."
Using the Write tool, update exploration/exploration-dashboard.md:
- [ ] to - [x] for the now-completed phase.**Current Phase:** to the name of the next phase, or to Complete if Phase 4 was just finished.**Status:** to In Progress (or Complete if all phases are done).[x], the prior <ORCHESTRATOR_DISPATCH> block for this phase is now stale. Any subsequent child skill invocation will require a new dispatch tag with the updated phase_number. Do not re-use the prior tag.Then loop back to Block 3 to orient the SME for the next phase.
- [x] with no leading space or an asterisk instead of dash will match the wrong phase. Block 2 now explicitly stops on malformed checkboxes — don't skip that check.direct) may not be what the SME wants. Re-ask if the session type changes.[~] to remaining phases but if the write is incomplete (crash, context loss), Block 2 may re-route to a killed phase. Always confirm **Status:** Complete is written before announcing completion.- [↩], the Outcome file path is cleared to TBD. If the SME later asks "where are my files", they may not find them. Always log the prior file path in the Session Log revision note even when clearing the Outcome field.**Session Type:** field first — brownfield self-build completions use the brownfield message, not the tier message.When all phases are either marked [x] (complete) or [~] (skipped):
Spike re-entry check: For spike sessions, before declaring completion, ask the SME: "You've completed this round of investigation. Would you like to loop back to Phase 1 with what you've learned, or are we done?"
If they want to loop:
exploration/discovery-plans/discovery-plan-YYYY-MM-DD.md to discovery-plan-YYYY-MM-DD-v[N].md where N is the iteration number.TBD).- [ ] in the dashboard.(Spike re-entry — iteration [N] — prior plan archived as [filename]).If they're done, proceed with completion below.
"Congratulations — your Exploration Session is complete! All phases are finished and your outputs are ready. Your exploration outputs are in the exploration/ folder."If Phase 4 was skipped (brownfield self-build):
"Since you built this directly, you're already in Engineering mode. Your build documentation is at exploration/prototype/README.md."If Phase 4 produced a handoff package, the completion message depends on the Risk Tier and session type recorded in the handoff:
| Tier | Completion Message |
|---|---|
| Tier 1 (Low Risk) | "Your handoff assessed this as low risk. You're clear to deploy directly — no formal engineering cycle needed. Your build documentation and handoff are in exploration/." |
| Tier 2 (Moderate Risk) | "Your handoff assessed this as moderate risk. Before deploying, this needs a security review and red team assessment. Hand the file at exploration/handoffs/handoff-package.md to your security team." |
| Tier 3 (High Risk) | "Your handoff assessed this as high risk. The next step is a formal engineering cycle. Hand the package at exploration/handoffs/handoff-package.md to your development team — it includes the requirements, user stories, business rules, prototype notes, and risk assessment they need to begin a spec-driven build." |
| Non-software outcome | "The exploration concluded that the right solution here isn't a new system — it's a [process change / policy update / strategic recommendation]. Your recommendation document is at exploration/handoffs/handoff-package.md. Hand it to the team or person responsible for [implementing the change]." |
| Legacy analysis complete | "The analysis is done. Your modernisation plan is at exploration/handoffs/handoff-package.md. This is the input your engineering team needs to scope the replatforming project — hand it to them to begin formal planning." |
| Throwaway / Fail Fast | "The exploration revealed this idea isn't viable — and that's a valuable outcome. You discovered this at near-zero cost instead of months into a build. The session artifacts are preserved in exploration/ for reference." |
If no tier is recorded in the handoff, default to the Tier 3 message (safest path).
Non-software and legacy analysis sessions: check the session type in the dashboard. If **Session Type:** contains "process", "strategic", "risk/compliance", or "legacy analysis", use the matching non-software or legacy analysis completion message above, regardless of tier.
Update **Status:** to Complete in the dashboard.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.