spec-executor — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited spec-executor (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Keeps spec-graph synchronized with implementation progress. This skill manages graph updates only — implementation approach is the agent's discretion.
STOP. Before proceeding with this skill, you MUST load the `spec-graph` skill.
The spec-graph skill provides the schema knowledge required to operate spec-graph correctly:
delivers, covers, belongs_to, precedes, etc.)(from_type, to_type, relation_type) combinations are allowedspec-graph impact returns and how to act on itWithout `spec-graph` skill loaded, you will hit `INVALID_INPUT` and `INVALID_EDGE` errors and waste tokens guessing at the schema. This is non-negotiable.
To load it, invoke the skill tool with name="spec-graph" before continuing.
spec-graph CLI installed and available in PATH.spec-graph/ with at least one PLN and PHS entities (created by spec-planner)PLN: draft → active → resolved (gated: plan_coverage)
→ deprecated (--force required)
PHS: draft → active → resolved (gated: delivery_completeness + gates)
→ deprecated (--force required)| Transition | Owner | Precondition |
|---|---|---|
| PLN: draft → active | spec-planner | Only one active plan allowed |
| PHS: draft → active | spec-executor (you) | Predecessor phases resolved (soft — warn if not) |
| PHS: active → resolved | spec-verifier | All deliverables verified, gate passes |
| Any → deprecated | User (manual) | --force required |
single_active_plan check enforces this.precedes predecessors should be activated in order.draft, transition to active first. Never work on a draft phase.draft → resolved is invalid. Must pass through active.deprecated.phase next --activate, confirm the response shows "activated": true. If false, manually run entity update PHS-XXX --status active.delivers when implementation is actually complete.impact before modifying entities affected by your changes.task() is available, delegate code work and keep graph updates to yourself.#### Case A: User specifies a PHS
Validate the specified phase:
# Check phase exists and get its metadata
spec-graph entity get PHS-XXX
# Check predecessor phases are resolved
spec-graph query neighbors PHS-XXX --depth 1Verify all precedes predecessors have status resolved. If not:
PHS-XXX cannot proceed optimally.
Reason: PHS-YYY (predecessor) is not yet resolved.
Currently recommended phase: PHS-YYY
Proceed with PHS-XXX anyway?If user confirms, proceed regardless. Do not block.
#### Case B: User does not specify a PHS
Use the phase next shortcut:
spec-graph phase next --activateThis command finds the next eligible phase (predecessors resolved, lowest order) within the active plan, activates it, and returns scope information in one call.
If you need to inspect without activating:
spec-graph phase next#### Activate the Phase (MANDATORY)
A phase MUST be `active` before any work begins. Working on a draft phase is forbidden.
Once phase is selected, transition to active:
# Only if current status is draft
spec-graph entity update PHS-XXX --status activeVerification: After activation, confirm status:
spec-graph entity get PHS-XXX
# Verify: "status": "active"If using phase next --activate, verify the response contains "activated": true.
Query what this phase covers:
spec-graph query scope PHS-XXXParse the output to identify:
covers relations)delivers relations (already done)deliversPresent the work summary:
Phase PHS-XXX scope:
- Total covered: N entities
- Already delivered: M entities
- Remaining: K entities
Remaining work:
- REQ-001: "..."
- REQ-003: "..."
- DEC-002: "..."Before implementing each entity, run impact:
spec-graph impact REQ-001Inform the agent/user of affected entities:
Implementing REQ-001 affects:
- API-005 (high, structural) — direct implementation
- TST-003 (medium, behavioral) — verifies this requirement
Consider these when implementing.This step is informational. It does not block implementation.
As implementation reveals new artifacts, register them:
Note:--idis now optional for single creates (auto-generated, capture from.entity.idviajq -r '.entity.id'). The examples below use explicit--idbecause they cross-reference IDs in the immediately followingrelation addcommands. For one-off creates where you don't need the ID in the same script block, omit--idand capture the returned value.
# Query first — avoid duplicates
spec-graph entity list --type interface --layer arch
# Register discovered API
spec-graph entity add --type interface --id API-001 \
--title "POST /api/auth/login" \
--metadata '{"kind":"http"}'
# Register test
spec-graph entity add --type test --id TST-001 \
--title "Auth login returns JWT on valid credentials" \
--metadata '{"kind":"integration"}'
# Register state transition
spec-graph entity add --type state --id STT-001 \
--title "User: unauthenticated → authenticated" \
--metadata '{"entity":"User","from":"unauthenticated","to":"authenticated"}'
# Register open question (if discovered)
spec-graph entity add --type question --id QST-001 \
--title "Should refresh tokens be stored in Redis or DB?" \
--metadata '{"owner":"backend-team"}'
# Register a change (lightweight work unit — independent of phase)
spec-graph entity add --type change --id CHG-001 \
--title "Fix authentication token expiry bug" \
--metadata '{"changed_entities":["internal/auth/token.go","internal/auth/token_test.go"]}'
# Connect change to arch scope via covers
spec-graph relation add --from CHG-001 --to REQ-001 --type coversNote: CHG entities are independent — they do NOT belong to any phase or plan. Do NOT add belongs_to, precedes, or blocks relations for CHG. CHG uses covers only (not delivers) — it is a scope marker, not a delivery unit.
Add arch-internal relations:
# API implements requirement
spec-graph relation add --from API-001 --to REQ-001 --type implements
# Test verifies requirement
spec-graph relation add --from TST-001 --to REQ-001 --type verifies
# Interface triggers state
spec-graph relation add --from API-001 --to STT-001 --type triggersValidate after each batch of mutations:
spec-graph validate --layer archWhen an arch entity's implementation is confirmed complete, add delivers:
spec-graph relation add --from PHS-XXX --to REQ-001 --type delivers
spec-graph relation add --from PHS-XXX --to API-001 --type deliversRules for delivers:
draft to active on delivers — do NOT manually set status to active after adding deliversValidate after adding delivers:
spec-graph validate --layer mapping --phase PHS-XXXAfter each work session, summarize:
Phase PHS-XXX progress:
- Delivered: M / N entities
- New entities registered: [list]
- Open questions: [list if any]
- Remaining: [list]Git: Commit .spec-graph/ changes after completing the progress report:
git add .spec-graph/ && git commit -m "spec-graph: PHS-XXX progress - delivered M/N entities"When task() is available (orchestration environment):
| Action | Owner | Delegate? |
|---|---|---|
| Code implementation | Delegated agent | Yes — via task() |
| spec-graph entity/relation CRUD | This skill (you) | Never delegate |
| Impact analysis | This skill (you) | Never delegate |
| Validation | This skill (you) | Never delegate |
Workflow with delegation:
task()Without delegation: Do all steps yourself.
| Exit Code | Meaning | Action |
|---|---|---|
| 0 | Success | Proceed |
| 1 | Runtime error | Check stderr, retry |
| 2 | Validation failure | Parse output, fix relations/entities, re-validate |
| 3 | Invalid input | Check arguments/schema, fix, retry |
delivers before implementation is complete.delivers for a phase other than the current one.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.