ralph-specum-start — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited ralph-specum-start (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this for the start and new entrypoints.
Derive RALPH_CODEX_PLUGIN_ROOT from this loaded skill by resolving two parent directories from the SKILL.md directory. Never derive it from the project working directory.
.claude/ralph-specum.local.md when present./specs.current-spec in the default specs root.ralph-state.json. Do not replace the full object--quick or exact --interactive, --resume <prototype-id>, commit flags, optional specs root, and optional --tasks-size fine|coarse. Reject both mode flags together, -q, variants, and natural-language substitutes..current-spec. A new-spec request does not inherit or recover the existing current spec.specs/.current-epic when no explicit spec was chosen.new is an alias here. Create the spec directory if needed.source: "spec"namegoal text used by the context gatebasePathphase: "research"taskIndex: 0totalTasks: 0taskIteration: 1maxTaskIterations: settings default or 5globalIteration: 1maxGlobalIterations: 100commitSpec: settings auto_commit_spec or truerelatedSpecs: []awaitingApproval: false while the goal interview is activequickModegranularity when --tasks-size was suppliedepicName when starting from an epic suggestion.current-spec..progress.md with goal, current phase, next step, blockers, learnings, and skill discovery results.tasks.md and present files over stale state when they disagree.phase_gate.py mode through "$RALPH_CODEX_PLUGIN_ROOT/scripts/phase_gate.py" with STATE and the exact supplied mode flag. No flag normalizes invalid legacy quick state to interactive..agents/skills, project .claude/skills, and the current Codex harness catalog. Always select explicitly named skills and record shadowed duplicates."$RALPH_CODEX_PLUGIN_ROOT/skills/interview-framework-codex/SKILL.md", its required algorithm and domain-modeling references, and every selected domain contract in both interactive and quick mode. In interactive mode, follow that algorithm for the start goal territory: outcome and observable success, material scope boundaries, critical constraints, and viable high-level approach. Ask no spec-path, branch, task-size, or discoverable question.approve and delegate; in exact quick mode, record bypassed_quick. In both modes, run phase_gate.py check-delegation with the current loaded-manifest identity before creating a research-analyst child. Apply the shared hard-transition invariant before fresh or resumed research dispatch. A failed check-delegation in either mode stops this invocation before phase transition, child dispatch, or target-artifact write; after a normal-mode failure, only the next explicit invocation creates a fresh manifest/interview identity. After an exact --quick delegation failure, the next explicit invocation reruns discovery, records a fresh phaseSkillLoad and interview identity, and does not reuse a terminal bypassed_quick interview or its discovery revision. Only a matching in-progress collecting or awaiting_confirmation interview is resumable. Exact --quick retains its existing question-and-approval bypass and discovery, manifest, delegation, and writer checks.phaseSkillLoad manifest. The child must record its loads and pass check-agent-write with that unique identity before writing research.md.research.md, merge phase: "research" and awaitingApproval: true in interactive mode or false in exact quick mode, update progress, and present artifact approval when interactive.After resolving the classified target and before normal resume or quick routing. Skip existing-current-spec recovery for new-spec intent:
"$RALPH_CODEX_PLUGIN_ROOT/scripts/resolve_spec_paths.py" and only its resolved basePath. When both basePath and <basePath>/.ralph-state.json exist, run "$RALPH_CODEX_PLUGIN_ROOT/scripts/prototype_records.py" reconcile --base-path "$BASE_PATH" --state "$BASE_PATH/.ralph-state.json", then re-read state.activePrototypes field as an empty map. Sort entries by created, then ID.$ralph-specum-prototype --resume <id> and stop this skill. In normal mode, resume the sole active entry automatically. When several remain, list deterministic IDs with question, status, blocker, returnPhase, and returnTaskIndex, then stop for an explicit ID.created, then ID. At the post-requirements boundary, route through $ralph-specum-prototype --quick; the prototype skill takes over the oldest design blocker and owns every decision. Preserve earlier quick flow and unrelated entries.resume_review candidate as recovery work, not terminal evidence. Parse the exact candidate, verify its ID and hash, and reconstruct a minimal recovery entry from the record and source pointers. Before reviewer dispatch, reserve its ID through create-only locked_state.py upsert-prototype with status: reviewing, the exact candidateHash, null owner and lease fields, a null or absent harnessRun.id, blocker and return fields, source pointers, and recovery timestamps. This is a recovery-only entry: cancellation verifies that owner, leaseToken, and harnessRun.id are all null or absent and that no builder is associated, then skips interrupt and release; inconsistent builder ownership fails closed. On a concurrent reservation, re-read and continue only if its candidateHash matches; never overwrite it. Route the restored entry through deterministic exact-candidate review and publish recovery. If reconstruction or reservation cannot proceed, stop and report the candidate ID and candidate hash. Exclude quarantined or malformed records. If no overlay exists, continue the existing start behavior without extra output.approve and delegate, dispatch research in the same turn.research.md in interactive mode, name the file, summarize it, and end with exactly one artifact approval prompt:approve current artifactrequest changescontinue to requirements--quick, do not show this prompt; continue directly through the remaining phases after the gates succeed.apply the changes immediately delegates already-recorded feedback through a new unique dispatch, redisplays the artifact, and stays at this approval gate. Ask one focused change question only when no feedback is pending. Control-only continue, proceed, and go ahead approve nothing.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.