ralph-specum — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited ralph-specum (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this as the primary Codex surface for Ralph Specum. It carries the full reusable workflow and can handle the entire command surface directly when helper skills are not installed.
Derive RALPH_CODEX_PLUGIN_ROOT from this loaded skill: take the directory containing SKILL.md, then its parent skills directory, then the next parent. Never derive the plugin root from the project working directory.
"$RALPH_CODEX_PLUGIN_ROOT/references/workflow.md" for the phase flow, branch and worktree behavior, quick mode, and command routing"$RALPH_CODEX_PLUGIN_ROOT/references/state-contract.md" for .ralph-state.json, .progress.md, commit rules, and resume semantics"$RALPH_CODEX_PLUGIN_ROOT/references/path-resolution.md" for specs_dirs, .current-spec, ambiguity handling, and default directory behavior"$RALPH_CODEX_PLUGIN_ROOT/references/parity-matrix.md" for Claude-to-Codex feature translation and command mapping"$RALPH_CODEX_PLUGIN_ROOT/references/prototype-coordinator.md" for direct, suggested, resume, quick, cancel, and prototype handoff behavior"$RALPH_CODEX_PLUGIN_ROOT/skills/interview-framework-codex/SKILL.md" and its required algorithm and domain-modeling references for every normal-mode phase interview"$RALPH_CODEX_PLUGIN_ROOT/scripts/resolve_spec_paths.py" for spec roots, current spec, and unique or ambiguous name resolution"$RALPH_CODEX_PLUGIN_ROOT/scripts/merge_state.py" for safe top-level state merges"$RALPH_CODEX_PLUGIN_ROOT/scripts/count_tasks.py" for task counts and next incomplete task"$RALPH_CODEX_PLUGIN_ROOT/scripts/phase_gate.py" for mode, skill-load, interview, parent-delegation, and artifact-write gates"$RALPH_CODEX_PLUGIN_ROOT/scripts/locked_state.py" for locked state and activePrototypes mutations"$RALPH_CODEX_PLUGIN_ROOT/scripts/prototype_records.py" for reviewed immutable prototype records and downstream selection"$RALPH_CODEX_PLUGIN_ROOT/scripts/prototype_harness.py" for bounded builder control outcomes and retry metadata"$RALPH_CODEX_PLUGIN_ROOT/templates/" for the canonical Ralph markdown file shapes"$RALPH_CODEX_PLUGIN_ROOT/assets/bootstrap/" when the user wants optional project-local Codex guidanceHandle these intents directly:
| Intent | Action |
|---|---|
| Start, new, resume, quick mode | Follow the start flow in ../../references/workflow.md |
| Triage | Delegate to triage-analyst sub-agent to decompose into epic and specs |
| Research | Delegate to research-analyst sub-agent to write research.md |
| Requirements | Delegate to product-manager sub-agent to write requirements.md |
| Prototype | Follow ../../references/prototype-coordinator.md, or route an explicit helper request to $ralph-specum-prototype |
| Design | Delegate to architect-reviewer sub-agent to write design.md |
| Tasks | Delegate to task-planner sub-agent to write tasks.md |
| Implement | Delegate each task to spec-executor sub-agent until complete or blocked |
| Status | Show active spec, backlog state, and per-root listing |
| Switch | Update .current-spec only |
| Cancel | Stop execution and clean up state, confirm before destructive delete |
| Index | Generate specs/.index/ component and external specs |
| Refactor | Delegate to refactor-specialist sub-agent to update spec files |
| Feedback | Open or draft GitHub feedback |
| Help | Summarize the surface and next commands |
If the corresponding helper skill is installed and the user invoked it explicitly, keep behavior aligned with that helper. If not, perform the action here.
research.md, requirements.md, design.md, or tasks.md) yourself. Apply the shared hard-transition invariant to only start, triage, research, requirements, design, and tasks. For only start, triage, research, requirements, design, and tasks, enforce that invariant. For those phases, gather context, discover and preload contracts, run the interview, obtain final approval, pass the gate, delegate, validate the output, and present results for artifact approval. Keep the existing delegation flows for implement and refactor unchanged; the new phase gates do not apply to them..claude/ralph-specum.local.md as the settings source when present../specs when no valid config exists..current-spec in the default specs root.source, name, goal, basePath, phase, taskIndex, totalTasks, taskIteration, maxTaskIterations, globalIteration, maxGlobalIterations, commitSpec, and relatedSpecs.awaitingApproval, quickMode, granularity, epicName, discoveredSkills, and native task sync metadata..progress.md after every phase and after every implementation attempt.Commit line in tasks during implementation unless the user explicitly disables task commits.phase_gate.py mode at entry to every affected phase. Only exact --quick enables quick mode; exact --interactive clears it. Reject both together, -q, variants, and natural-language substitutes. No flags normalize invalid legacy quick state to interactive.bypassed_quick, generate missing artifacts, default task granularity to fine when unset, and continue into implementation in the same session."$RALPH_CODEX_PLUGIN_ROOT/skills/interview-framework-codex/references/algorithm.md" before each delegation.activePrototypes; preserve the main phase and current checkout until the recorded handoff.agentId for internal builders. Never use create_thread or threadId for them.Before delegating any affected phase in normal mode, you MUST:
approve and delegatephase_gate.py check-delegationAfter completing any phase artifact (research, requirements, design, tasks), you MUST:
The ONLY exception is exact --quick mode with a valid bypass receipt. Without it, you MUST NOT auto-continue to the next phase.
research.md, requirements.md, design.md, tasks.md, or refactored spec files outside quick mode:approve current artifactrequest changescontinue to <named next step>continue to <named next step> as approval of the current artifact and permission to enter that phase's discovery and interview path.apply the changes during artifact review as immediate authorization to delegate already-recorded revision feedback through a new unique dispatch. Redisplay and remain at artifact approval. Ask one focused change question only when no feedback is pending.continue, proceed, and go ahead as approval of nothing.start or new setup, run discovery pass 1 and begin the goal grill. Explicit final approval delegates research immediately.specs/.current-epic and per-epic state in specs/_epics/<epic-name>/.[P] markers for safe parallel work and [VERIFY] checkpoints for explicit quality validation.Bootstrap project-local files only when the user wants them.
Suggested bootstrap files:
"$RALPH_CODEX_PLUGIN_ROOT/assets/bootstrap/AGENTS.md" to give a consumer repo local Ralph guidance"$RALPH_CODEX_PLUGIN_ROOT/assets/bootstrap/ralph-specum.local.md" to seed local settingsDo not bootstrap by default. Installation into $CODEX_HOME/skills is enough.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.