finishing-a-development-branch — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited finishing-a-development-branch (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Core principle: Verify tests → Verify UML model alignment → Detect environment → Present options → Execute choice → Clean up.
Announce at start: "I'm using the finishing-a-development-branch skill to complete this work."
NO UML MODEL ELEMENTS OR DIAGRAMS THAT DO NOT MATCH THE CODEIf the UML model element or diagram is inconsistent with the code, it must be brought into alignment with the code.
Run the project's full test suite (npm test / cargo test / pytest / go test ./...).
If tests fail, report the failures and stop — the menu comes after a green suite:
Tests failing (<N> failures). Must fix before completing:
[Show failures]If tests pass: continue to Step 2.
First, confirm Astah has this branch's model open. Call get_proj_path and compare it against this working tree:
git rev-parse --show-toplevelget_proj_path returns | Action |
|---|---|
| A path under this working tree | Proceed with verification |
| A path elsewhere — another checkout, another worktree, another project | STOP |
| Empty string (never saved) | STOP |
If it does not match, stop and report both paths to your human partner. The model you are about to verify is not the model this branch carries: Astah keeps one project open for the whole machine and writes back to the path it opened, regardless of anyone's working directory. Verifying against the wrong .asta is worse than not verifying — it produces a green Iron Law check for a pair that was never actually compared, and the merge proceeds on a stale model. Let your human partner decide which copy is authoritative before you verify anything.
Then use Astah Pro MCP tools to verify that the implementation is consistent with the model and diagrams:
If mismatches found:
UML model alignment issues found:
- [list each mismatch with file:code line and model-element/diagram reference]
Cannot proceed until resolved. Update model, then re-run verification.Stop. Don't proceed to Step 3.
If aligned: continue to Step 3.
GIT_DIR=$(cd "$(git rev-parse --git-dir)" 2>/dev/null && pwd -P)
GIT_COMMON=$(cd "$(git rev-parse --git-common-dir)" 2>/dev/null && pwd -P)
# Capture now, while still inside the workspace — Step 6 changes directory
# before cleanup (Step 7) needs this value
WORKTREE_PATH=$(git rev-parse --show-toplevel)This determines which menu to show and how cleanup works:
| State | Menu | Cleanup |
|---|---|---|
GIT_DIR == GIT_COMMON (normal repo) | Standard 3 options | No worktree to clean up |
GIT_DIR != GIT_COMMON, named branch | Standard 3 options | Provenance-based (see Step 7) |
GIT_DIR != GIT_COMMON, detached HEAD | Reduced 2 options (no merge) | Externally managed — leave in place |
The base branch is whatever this work forked from — usually named in the plan, the conversation, or the branch's upstream. If it is not already known, ask: "This branch split from <your best guess> - is that correct?" Confirm before merging: merging into the wrong base is expensive to undo.
Normal repo and named-branch worktree — present exactly these 3 options:
Implementation complete. What would you like to do?
1. Merge back to <base-branch> locally
2. Push and create a Pull Request
3. Keep the branch as-is (I'll handle it later)
Which option?Detached HEAD — present exactly these 2 options:
Implementation complete. You're on a detached HEAD (externally managed workspace).
1. Push as new branch and create a Pull Request
2. Keep as-is (I'll handle it later)
Which option?Present the menu exactly as written — concise, with every option coming from the list above. Discarding the work happens only in response to your human partner explicitly asking for it (see "If your human partner asks to discard the work" below). Wait for their answer; the integration decision is theirs.
# Get main repo root for CWD safety
MAIN_ROOT=$(git -C "$(git rev-parse --git-common-dir)/.." rev-parse --show-toplevel)
cd "$MAIN_ROOT"
# Merge first — verify success before removing anything
git checkout <base-branch>
git pull
git merge <feature-branch>
# Verify tests on merged result
<test command>If tests fail on the merged result: stop, leave the worktree and branch in place, and investigate — nothing has been pushed, so the merge is local and recoverable.
Once the merged result is green: clean up the worktree (Step 7), then delete the branch:
git branch -d <feature-branch>git push -u origin <feature-branch>
# From a detached HEAD, name the new branch on the remote:
# git push origin HEAD:refs/heads/<new-branch>Then create the pull/merge request against <base-branch> with the forge's tooling — its CLI if one is available, or the creation URL most forges print when you push — following the repo's PR template and conventions if present, and report the URL to your human partner.
Keep the worktree — your human partner iterates on PR feedback there.
Report: "Keeping branch <name>. Worktree preserved at <path>."
This path exists only as a response to an explicit request to throw the work away. Confirm first:
This will permanently delete:
- Branch <name>
- All commits: <commit-list>
- Worktree at <path>
Type 'discard' to confirm.Wait for that exact confirmation. When it arrives:
MAIN_ROOT=$(git -C "$(git rev-parse --git-common-dir)/.." rev-parse --show-toplevel)
cd "$MAIN_ROOT"Then clean up the worktree (Step 7) and force-delete the branch:
git branch -D <feature-branch>Runs for Option 1 and confirmed discards. Options 2 and 3 always preserve the worktree. Both callers have already changed directory to the main repo root — worktree removal must run from outside the worktree — and use the GIT_DIR/GIT_COMMON/WORKTREE_PATH values captured in Step 3, from before that directory change.
If `GIT_DIR == GIT_COMMON`: Normal repo, no worktree to clean up. Done.
If `WORKTREE_PATH` is under `.worktrees/` or `worktrees/`: Superpowers created this worktree — we own cleanup:
git worktree remove "$WORKTREE_PATH"
git worktree prune # Self-healing: clean up any stale registrationsOtherwise: The host environment owns this workspace — leave it in place. If your platform provides a workspace-exit tool, use it.
| Option | Merge | Push | Keep Worktree | Cleanup Branch |
|---|---|---|---|---|
| 1. Merge locally | yes | - | - | yes |
| 2. Create PR | - | yes | yes | - |
| 3. Keep as-is | - | - | yes | - |
| Discard (explicit request only) | - | - | - | yes (force) |
| Excuse | Reality |
|---|---|
| "The model is close enough to the code" | The Iron Law is exact alignment. Bring one into line with the other — "close enough" is how a model rots into fiction. |
| "Astah is open, so it must be this branch's model" | Run get_proj_path. Astah holds one project for the whole machine and your human partner can switch it at any time; the path it returns is the only evidence of which model you are checking. |
| "I'll sync the UML model after the merge" | Nobody comes back. A model that ships out of sync stays out of sync. |
| "Tests passed earlier this session" | Run the suite on the tree you are about to integrate. A green run only proves the tree it ran on. |
| "They obviously want it merged" | Integration is your human partner's decision. Present the menu and wait. |
| "They seem done with this feature — I'll offer to discard it" | The menu is complete as written. Discard happens only when your human partner asks for it in so many words. |
| "'Yeah, get rid of it' counts as confirmation" | Only the typed word discard authorizes deletion. |
| "The PR is up, so the worktree is clutter now" | PR feedback gets fixed in that worktree. It stays until the work lands. |
| "This other worktree looks stale — I'll clean it too" | Clean up only worktrees under .worktrees/ or worktrees/. Everything else belongs to the host. |
| "The merged-result failure is probably flaky" | A failing merged result stops everything. Branch and worktree stay put while you investigate. |
| "The base branch is obviously main" | Confirm the fork point or ask. Merging into the wrong base is expensive to undo. |
| "The push was rejected — force-push will fix it" | A rejected push means the remote moved. Investigate; force-push only on your human partner's explicit request. |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.