plan-implementation — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited plan-implementation (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
find . -maxdepth 1 -name "CLAUDE.md" -type ffind . -maxdepth 3 -name "project-discovery.md" -type fbash "${CLAUDE_PLUGIN_ROOT}/scripts/han-config-dir.sh" 2>/dev/null || echo "$HOME/.claude"cat .han/config.md 2>/dev/null || echo ""As your first action, use the Read tool on .han/config.md inside the personal config directory path above. A read that returns no file is no personal configuration: continue silently. When that file or the project .han/config.md probe supplies content, apply it per config-rule.md, which governs precedence between the two files, relative-path resolution, and what to do with a file that reads but cannot be used.
behavioral decisions the specification already settled; flag contradictions as Open Questions for the user. Scope is the exception, and it is narrow: a specification is an artifact, not a scope authority, so a commitment it carries for a subsystem, integration, or artifact the work item never asks for is cut with the citation rather than planned. The license reaches unrequested subsystems and nothing else. See ../../references/scope-justification-rule.md.
item's stated scope and exclusions, per ../../references/planning-boundary-rule.md. The scope gate at Step 7.5 then reads that record, including commitments the plan inherited from the specification.
never at document-write time, and pass its paths in every dispatched specialist's brief. The boundary rule owns the convention.
what a person who will not read the code would describe, gives named candidate answers, and puts paths and identifiers below the question or leaves them out. Per ../../references/operator-escalation-rule.md. The opening confirmation turn is the one exception, and the one turn that carries more than one ask.
specialist produced, tracks claims and evidence, and commits the decisions the plan records. Specialists own their domains. This skill runs the rounds itself; the synthesizer is dispatched once, at the end.
han-core:junior-developer reframes the issue in plain terms first — that frequently unlocks a resolution without needing the user.
description, the evidence considered, and a recommended answer.
plan is ready to commit, or that only user-input items remain. The user is not asked to keep iterating past that point.
the spec's behavioral commitments but applies the evidence-based YAGNI rule from ../../references/yagni-rule.md independently to abstractions, configuration knobs, observability, runbooks, infrastructure, rollout machinery, test scaffolding, schema columns, indexes, and any other implementation artifact the plan recommends. Items that fail the evidence test get demoted to a ## Deferred (YAGNI) section in feature-implementation-plan.md with the reopening trigger named; items where a strictly simpler implementation satisfies the same evidence get the simpler implementation recorded as the decision and the larger version under Rejected alternatives:. The Sentry-runbook-on-staging-only-Sentry pattern is the named project precedent — operational machinery shipped before the system that drives it actually produces the data, traffic, or failures it covers is YAGNI by default. Every committed implementation item is ongoing maintenance and a pattern future agents will copy.
intention and goals of the work, the touch points (a module, a contract, a boundary), and the decision-bearing values (a flag default, a key name, a threshold). NEVER inline full file contents or prescribe line-level edits, BECAUSE a non-author must be able to read the plan, plans are executed after the codebase has moved on (a prescribed edit list goes stale and misleads), and the implementer — human or coding agent — reads the current code at build time. Deeper detail lives one hop away in the companion artifacts. YAGNI gates whether an item is _included_; this principle gates how _verbose_ an included item is.
layout, a schema, a payload, a signature: each is a decision-bearing value in exactly the sense the altitude rule above already permits, so the plan carries its concrete form rather than the name of a document somebody will author later. This is where the plan stops a writer and a reader from drifting apart, and it is the one thing the altitude rule is most often misread as forbidding. See ../../references/contract-pinning-rule.md.
non-author can follow. Technical detail is minimal references only — a path, a contract name, a decision-bearing value — placed below or after the plain language it illustrates, never mixed into it and never free-standing. When choosing between more plain language and more technical detail, choose more plain language.
before any mechanics. Derive them from behavior the specification already commits to — never invent behavior — and anchor work units to the story each one advances. When the feature has no user-facing behavior, frame stories around the operator or consuming system; skip stories only when no actor benefits in a describable way.
feature-implementation-plan.md is the primary plan and lives atthe root of {folder}/; implementation-decision-log.md records every decision and implementation-iteration-history.md records each round of discussion — both companion artifacts live in {folder}/artifacts/ to keep the planning folder uncluttered. The main plan cites decisions with inline ([D-N](artifacts/implementation-decision-log.md#...)) links for non-obvious claims. The decision log and iteration history cross-link through Driven by rounds: / Decisions produced: fields (they sit as siblings inside artifacts/), and both link back into the plan through Referenced in plan: / Changed in plan: fields using ../feature-implementation-plan.md. Any edit to one file requires updating the matching fields in the others.
Read the user's argument and conversation context to identify the source artifact. The expected input is a feature-specification.md produced by the plan-a-feature skill, but any document describing what the feature should do is acceptable (PRD, design doc, product brief).
Resolve the source path:
feature-specification.md under docs/features/, docs/plans/, or otherdocumentation roots discovered via CLAUDE.md or project-discovery.md. If multiple candidates exist, ask the user which one.
plan-a-featurefirst.
Three files will be written. The primary plan lives at the root of {same-folder-as-source}/; the two companion artifacts live in {same-folder-as-source}/artifacts/ (which may already exist if the source spec came from plan-a-feature — share the same subfolder rather than creating a second one):
{same-folder-as-source}/feature-implementation-plan.md — the primary plan.{same-folder-as-source}/artifacts/implementation-decision-log.md — every committed implementation decision withrationale, evidence, and rejected alternatives.
{same-folder-as-source}/artifacts/implementation-iteration-history.md — round-by-round record of specialistsengaged, questions raised, and how each was resolved.
Each file follows its own template, copied whole: feature-implementation-plan-template.md, implementation-decision-log-template.md, and implementation-iteration-history-template.md. Read a template in full from here rather than through the synthesis directives in Step 8.
Two more artifacts are written by Step 1.5 rather than by this step:
{same-folder-as-source}/artifacts/scope-boundary.md — the boundary record. Always present, whether this run wrote itor an earlier planning skill did.
{same-folder-as-source}/ui-designs/ — visual material the user supplies, when they supply some.Create the artifacts/ subfolder before writing the companion files if it does not already exist.
The three files cross-reference each other. The main plan cites decisions with inline parenthetical links like ([D-3](artifacts/implementation-decision-log.md#d-3-rollout-strategy)); the decision log and iteration history cross-link through Driven by rounds: / Decisions produced: fields (siblings inside artifacts/), and both link back into the plan through Referenced in plan: / Changed in plan: fields via ../feature-implementation-plan.md.
If any of the three files already exist, ask the user whether to overwrite or append iteration notes before proceeding.
Read the full specification into context. If the specification is a feature-specification.md produced by plan-a-feature, also read its companion decision-log.md, team-findings.md, and feature-technical-notes.md if it exists — these live in {same-folder-as-source}/artifacts/ (the same subfolder this skill will write to). Fall back to reading them from {same-folder-as-source}/ directly for spec folders produced before the artifacts layout was introduced. The feature-technical-notes.md file is lazily created by plan-a-feature — its absence means no load-bearing mechanics were captured at spec time, not that the spec is incomplete. Note the decisions already settled, any open items the spec flagged, the review team findings, and any committed technical mechanics the plan must honor.
Detect tech-notes presence once, here. Record whether feature-technical-notes.md exists. If it does NOT exist, omit every T#-related sentence from agent briefs (Step 4), the spec-maturity tag set (Step 5), and the synthesis inputs (Step 8) — do not add boilerplate qualifiers like "if it exists" to those briefs. The T#-contradiction spec-maturity classification simply does not apply when there are no T# notes, so the spec-maturity gate reduces to the spec-level threshold alone.
Read ../../references/planning-boundary-rule.md for the record's name, its sections, and the accepted visual-material file set. Establish the boundary before Step 2 discovery begins.
A record already exists at {same-folder-as-source}/artifacts/scope-boundary.md, which is the common case when plan-a-feature produced the source specification. Read it and use it. Do not re-ask anything it answers, including the direction-of-travel question: a recorded answer of any kind is never re-asked.
No record exists. Identify the work item this work descends from, which is a ticket, an issue, a pull request, or a written request the user typed, and read it. Record its stated scope and its stated exclusions word for word. When no work item exists, record that explicitly along with the statement that the user's request is the only boundary this run has.
The read does not traverse outward. A linked item, a sibling, or a closed item is not scope evidence for the item in hand, and its description is not evidence about the current item's platform, status, or intent.
Then take one confirmation turn before Step 2 begins. It restates the recorded boundary in the user's own terms, names any visual material you kept, and asks the direction-of-travel question with its subjects named from the work item you have already read. This turn is a confirmation rather than an escalation, and the one turn that carries more than one ask.
There is no tool here that reads a tracker, so what you record is often the user's own words rather than the work item's verbatim text. That is expected. Record which it was.
When the user hands you a work item that conflicts with the recorded one, surface the conflict in the confirmation turn and ask which governs. Do not silently overwrite the record and do not silently trust it.
Persist every piece of visual material the user supplies into {same-folder-as-source}/ui-designs/ as it arrives, named for the state each one depicts, and note each item into the record's Visual Material Received section as you keep it. Copy destinations are always the resolved plan folder's ui-designs/. When the host never made an item reachable as a file, name which items you could not keep and ask for them through the single stop, while they are still recoverable.
The specification's Visual Reference table, when it has one, tells you which material the upstream run already persisted. That material is already on disk and is not this run's to re-copy; this step covers what the user supplies to this run.
Source the explanation standard by invoking han-communication:explanation-guidance before you write the confirmation turn, and again before any escalation or stop later in the run.
Before launching the team, gather the context specialists will need to produce evidence-backed recommendations. Use Glob and Grep to find:
docs/adr/ or docs/architecture/decisions/ — architectural decisions the implementation must respect.docs/coding-standards/ or .github/CODING_STANDARDS.md — rules the implementation mustfollow.
plug into.
expects.
git log --since="90 days ago" --name-only --pretty=format:"" on thedirectories the feature will touch to surface churn and recent precedent.
Write the result to `{same-folder-as-source}/artifacts/.discovery-notes.md` as a structured summary: tech stack, ADRs found (paths + one-line summary each), coding standards found (paths + one-line summary each), code touch points (paths + one-line summary), recent-activity churn, measurements, and explicitly enumerated gaps (what was searched for and not found). Missing standards or ADRs are themselves findings the team should note.
Measure the figures the plan will rest on. For each quantity the specification asserts, record the assertion, the command you ran, and what it returned. Three outcomes, and the last two are why this earns its place:
Measurement: spec says "roughly 40 fixture files" | find test/fixtures -type f | 112
Measurement: {figure} | not reachable with granted tools
Measurement: {figure} | {command} | command failed: {exit status}Your grant reaches find, git, Glob, and Grep and no further, so some figures are genuinely unreachable. Recording that is the point: a specialist can weigh an assertion it knows is unmeasured, and cannot weigh one it believes was checked. A command that ran and failed is an assertion too, never a measurement, because a search of a path that moved returns nothing rather than erroring.
The discovery notes file is the single source of truth for project context across the team. Specialists in Step 4 are instructed to read `.discovery-notes.md` first and not to re-grep for what has already been found — they may search further for what their domain specifically needs that the discovery notes do not cover, but they must not duplicate what is already there.
Read team-selection.md. It carries the size bands with their specialist and round caps, the size-override rule, the two seats every team fills, and the roster to draw the rest from.
Default to small and escalate only when the signals clearly require it. State the chosen size, the recommended team, and the reason in one short message before launching agents. If the user disagrees, accept their override of the size, the specialists, or both.
Use domain-scoped briefs — do not hand every agent the full set of artifacts. Brief each selected specialist as team-selection.md specifies: its domain-scoped sections, the discovery notes from Step 2, the visual material, a report-length target matched to the size of the work, the blind-spot directive, and a question framed for its domain. Instruct each to read further on demand only if its domain needs it.
Launch every non-han-core:plan-synthesizer specialist in parallel, in a single message.
No agent is dispatched to facilitate the round. The mechanical work of consolidating specialist findings into a claim ledger, classifying spec-maturity, and choosing a next-step recommendation is performed deterministically by this skill itself. Two agents cover the two exceptions: han-core:plan-synthesizer runs the final synthesis in Step 8, and han-planning:discussion-facilitator runs a single facilitation pass when the spec-maturity gate trips (see below).
Aggregate the verbatim specialist outputs from Step 4 into the round-1 entry of artifacts/implementation-iteration-history.md using these rules.
Three passes run first, in this order. The order matters: merging before the other two is what stops one finding from ending up unverified under one specialist's identifier and blocking under another's.
Pass A: merge by substance. Two specialists often raise the same finding in different words. Merge those into one record carrying every originating specialist's own identifier (for example SEC-2, OCE-5). Do not reconcile the lists by hand during synthesis; that is what loses a finding. Two findings citing the same identifier while asserting different figures are the one exception and do not merge, per round-aggregation.md.
Pass B: strip blocking severity from findings resting on an uninspected input. A specialist that could not inspect something says so on the finding itself, in the form its definition specifies (look for the Unverified: line). Every finding carrying such a disclosure, and every finding depending on that same input, is labeled Unverified in the ledger and cannot carry build-blocking severity. Keep the finding: it may be real, and you can often verify it yourself. What it cannot do is reach the user looking like a blocker on the strength of something nobody read. Findings from a specialist that never received visual material are treated the same way when they turn on that material.
Record a disposition on every finding you label. Exactly one of verified: {what settled it}, not reachable with granted tools, or verification not attempted. The label says a specialist could not check something; the disposition says whether anyone since has. Without it the downgrade is permanent and silent, and it lands on exactly the findings that needed a tool nobody in the round holds.
This pass stays a step you perform rather than a check you run, and that is deliberate. It reads specialist output while that output is still in the conversation, before any of it reaches a file, so an executed check would have nothing to read. Converting it would mean first writing every specialist's raw output to disk. The other checks in this skill that read files already on disk are executed instead.
Pass C: check findings against the material this run holds. For any finding that turns on material on disk, open it and check the finding against it before it becomes an Open Question. A finding the material answers directly is closed with the citation rather than promoted. This is nearly free once the files are on disk. It covers the visual material, and it covers a cited D# in the spec's decision log, whose entry carries the committed option and the declined ones as sibling fields: read which field the figure came from rather than promoting the disagreement.
Record any evidence class no specialist could audit. When decisions rest on material no specialist received, say so in the iteration history, so the coverage gap is visible rather than silent.
Then aggregate the round deterministically, in the order round-aggregation.md specifies: build the claim ledger, tag spec-maturity and compute the gate, build the Open Questions list, pick the next-step recommendation, and write the round entry. That reference also carries the one facilitation call this skill makes, and when the gate trips it.
Repeat this loop until the deterministic next-step recommendation is go to synthesis or blocked pending user input and all blocking questions have been escalated.
For each iteration:
items from prior rounds. If evidence settles the question, record the resolution in the iteration notes and remove it from the Open Questions list.
han-core:junior-developer inconversational mode with the question, the specialist input that raised it, and a directive to restate the issue in plain language and surface the clarifying questions a three-to-five-year generalist would ask. The reframing often exposes an unstated assumption or a simpler question the specialists can answer among themselves.
../../references/operator-escalation-rule.md. Ask one, wait for the answer, then ask the next, and state how many are pending on the first. Lead with the consequence a person who will not read the code would describe. Carry named candidate answers. Put the specialist identifiers, the evidence considered, the reframing, and any paths or line numbers below the question, or leave them out. Capture the user's answer verbatim.
Source the explanation standard by invoking han-communication:explanation-guidance before writing the first one.
Present more than one question in a turn only when the user asks for that. A finding labeled Unverified in the ledger never leads an escalation as a blocker; say what could not be inspected as part of the question.
Never escalate a question the recorded boundary already answers. When the boundary places the question outside scope, cut the item and record why, rather than asking the user to choose between options their own work item already decided between.
specialist to weigh in, or if a Step 5/6 aggregation flagged a handoff, launch the named specialists in parallel with the new context (use domain-scoped briefs from Step 4), and collect their output.
iteration-history entry, the newly resolved Open Questions, the new specialist input from sub-step 2, and any user answers. Recompute the claim ledger, spec-maturity tags, Open Questions, and next-step recommendation. Do not call any agent for this unless the spec-maturity gate trips for the first time in this round (in which case use the same single han-planning:discussion-facilitator call described in Step 5).
write the round's record using the implementation-iteration-history-template.md format. The entry consolidates the deterministic aggregation into the structured fields: R# ID, specialists engaged, new input provided, claim ledger, Open Questions raised, spec-maturity tags, resolution source per question, and the deterministic next-step recommendation. Leave Decisions produced: and Changed in plan: as — for now; both fields are backfilled by the han-core:plan-synthesizer in Step 8 once decisions are committed and the plan is written.
Running collaboratively. When the request asks to review each round as it lands, which is what pairing does when it hands work here, stop at the end of each round and hand control back instead of starting the next. Present the stop in the shape collaborative-stop-rule.md specifies: the round's findings are what the person can check, and the plan edits the round made are what changed. A redirect at such a stop does not consume a round against the cap, BECAUSE a round is a unit of review work and a redirect is not. Absent such a request, continue as below; an ordinary invocation is unchanged.
been escalated to the user with recommendations still awaiting answers.
coordination, unhandled failure mode, or any finding tagged spec-level).
Otherwise, continue with another iteration.
The round cap from Step 3 sets the upper bound: small = 1 round, medium = 2 rounds, large = 3 rounds. Never exceed the size cap. If the team is still iterating at the cap, surface the remaining Open Questions to the user with recommendations and a note that the team has reached a facilitation plateau.
Before synthesis, ensure every Open Question that cannot be resolved by evidence or han-core:junior-developer reframing has been surfaced to the user and answered. Do not guess the user's answers. If any are still pending and the user has indicated they want to defer, record them as open items the plan will ship with.
Every question here goes out one per turn under the same rules Step 6 applies. There is no end-of-run batch: a queue of four questions is four turns, and the pending count on the first one is what tells the user how long the queue is.
Keep an escalation register. Record every question escalated across the whole run, the answer that came back, and where that answer landed in the plan or the decision log. The register goes in artifacts/implementation-iteration-history.md alongside the rounds it came from.
The single stop for a missing input. When an input only the user can supply is missing and its absence degrades the plan, take one stop for it. Gather every input meeting that test into that one stop rather than stopping twice: name what is missing, name in plain language what the plan will be missing without it, name the action that would supply it, and offer to continue anyway. The commonest case here is visual material the plan's work depends on that never reached disk.
Run the three gates in yagni-scope-sweep.md over every committed item in the plan: the evidence test, the simpler-version test, and the scope test. Items that fail land in the plan's ## Deferred (YAGNI) section with a reopening trigger, or in ## Cut for Scope with the boundary citation, never in both and never silently dropped.
Before synthesis, invoke han-communication:readability-guidance to source the shared readability standard into your context, then apply it to the plan's prose — both while directing the han-core:plan-synthesizer's synthesis and when you run the Step 8.5 self-check. Hold the named audience: the engineer who will build the feature. The frame governs how a fact is said, never whether a required fact appears — keep the technical precision the plan depends on.
Launch han-core:plan-synthesizer — this is the one call in this skill that runs on the han-core:plan-synthesizer's default model; pass no model override.
Ask the han-core:plan-synthesizer to reconcile the specialist input against the files and apply any remaining corrections directly. Its input list, what it must do, and the record invariants it preserves are all specified in synthesis-directives.md. Its output is authoritative.
When the synthesizer returns, confirm the plan landed before anything reads it, per synthesis-failure-rule.md. No plan file means the synthesis did not produce its primary artifact: stop with that file's message and do not run Step 8.5.
Once the han-core:plan-synthesizer synthesis in Step 8 is complete and the plan is final, dispatch han-communication:readability-editor (one Agent call) to audit and rewrite the plan's prose against the readability standard. Pass the editor the file path {same-folder-as-source}/feature-implementation-plan.md and the named audience: the engineer who will build the feature; the editor reads han-communication's own canonical rule, so pass no rule path. It must preserve every fact and operate on prose regions only — never inside code fences, tables, or the D-N citation identifiers, which must survive unchanged so they still resolve. Apply its rewrite to the plan file.
It must also leave every plan section heading unchanged, because the decision log and the iteration history name those headings as text in their Referenced in plan: and Changed in plan: fields, and the Step 9 cross-reference check resolves them. The editor is otherwise free to make a heading descriptive, and here that would break a link.
Then read the editor's fact-preservation report. Do not walk the self-check over the text the editor produced. The canonical readability rule says the dedicated editor replaces a skill's own readability pass rather than stacking a second one on top, and a same-model pass over the editor's own fresh output is the ungrounded kind of self-review that corrupts a correct answer about as often as it fixes a wrong one.
The editor's report has three shapes that need no repair, and one that does:
re-editing it.
Insertions names nothing, or names a line whose quoted source= span you find in the plan. Nothing further isneeded.
Insertions names a line whose quoted source= span is not in the plan. The editor wrote that sentence fromsomething the draft does not carry. Name it in the Step 9 summary and record it in artifacts/, quoting the inserted text and the span the editor claimed. Change no text: there is no pre-edit draft on disk to restore, because the rewrite was applied in place. Check nothing else.
When no usable report comes back — the editor could not be reached, returned nothing, or returned something you cannot read as any of those shapes — walk the checklist below yourself over the plan's prose regions only, never inside code fences, tables, or the D-N citation identifiers. Say in the Step 9 summary that you did so and why. With no report, the checklist is the only fidelity guard the output has.
Run the readability rule's standardized self-check, which is already in your context from the readability-guidance invocation above. Correct every failure before presenting. Its fidelity criterion is not optional: the standard governs how the content is said, and drops a required fact only when the reader asked for less and losing it would not change what they do next.
Before you summarize, run the three executed checks in step-9-checks.md and capture each one's exit status and output. That file carries the shared exit-status contract, what each check verifies, how to report a failure, and the note a failed check leaves in the artifacts.
Summarize for the user:
feature-implementation-plan.md, artifacts/implementation-decision-log.md,artifacts/implementation-iteration-history.md, and artifacts/scope-boundary.md. Include ui-designs/ only if visual material was kept.
artifacts/implementation-iteration-history.md for per-round detail.
artifacts/implementation-iteration-history.md.artifacts/implementation-decision-log.md.
that the user can reinstate any of it, and that their saying so is itself a valid justification the reinstated unit records. Show this in the message rather than only pointing at the section, because a cut the user never reads is a cut nobody can reverse.
feature-implementation-plan.md's ## Deferred (YAGNI) section, named in plain language withits reopening trigger (omit this line if the section was not written because nothing qualified). Name them rather than counting them, for the reason the cut list is named above: a deferral the user never reads is a deferral nobody can reverse. Say which list each entry belongs to, because the two sit next to each other and a cut is not a deferral.
Unverified because a specialist could not inspect its input, each with its disposition, andany evidence class no specialist could audit. Neither is presented as build-blocking.
feature-implementation-plan.md. Anon-blocking one is still an unanswered question the builder inherits, so name it rather than counting it.
item).
Ask whether the user wants to iterate on specific sections or consider the plan ready for implementation.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.