incremental-delivery — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited incremental-delivery (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Ship work as a series of small, working steps. Each increment compiles, runs, passes its tests, and could in principle be merged. Big-bang changes hide bugs until the end — when ten moving parts fail together and [[fault-recovery]] becomes a archaeology project.
Incremental delivery is how you keep reviewable diffs, known-good checkpoints, and fast feedback on risky ideas. It's not "move slower" — it's fail fast on small surfaces instead of slow at the finish line.
Default build skill: pair with [[test-first]] to prove each slice, [[work-planning]] to order slices, [[git-flow]] to commit at green, [[browser-checks]] for UI slices, and [[migration-path]] when each slice must stay backward-compatible.
Skip heavy slicing for truly trivial, isolated fixes (typo, single constant) — still run checks before push.
Start from [[spec-first]] or [[work-planning]]. List increments — each independently demonstrable.
Vertical slice (prefer): thin path through all layers that does one real thing end-to-end.
Slice 1: POST /orders with one hardcoded SKU → persists row → returns id (no payment)
Slice 2: Validate cart payload + real SKUs from DB
Slice 3: Payment redirect on successHorizontal slice (avoid as first increments): whole layer with no user-visible outcome.
Bad first slices: "all models", "all API routes", "all CSS" — nothing works until the endWalking skeleton / steel thread: smallest end-to-end path — even ugly — then harden and expand.
| Feature type | First slice example |
|---|---|
| API | One endpoint, happy path, real persistence |
| UI page | One section, real data, one state |
| Background job | Process one message type, log success |
| Migration | Expand schema nullable; deploy before backfill ([[migration-path]]) |
| Refactor | One module moved; all tests green; behavior unchanged |
Each slice should answer: "What can I demo or test after this?" If nothing — slice smaller.
Target increments that:
| Too big | Right size |
|---|---|
| Entire checkout flow | Guest can submit email on checkout step 1 |
| All admin CRUD | List view with pagination |
| "Implement auth" | Login form posts; session cookie set; protected route redirects |
If a slice feels large, split: data path then polish; read path then write path; happy path then error states ([[ui-craft]]).
For each slice, repeat until the spec is satisfied:
1. Define slice outcome — one sentence + how you'll verify
2. Implement minimum to reach outcome (pair with [[test-first]] when logic-heavy)
3. Verify immediately — tests, run app, browser if UI ([[browser-checks]])
4. Commit at green ([[git-flow]]) — one logical change
5. Integrate often — rebase/merge main; don't drift for days
6. Next sliceVerify before the next slice starts. A failure you ignore compounds — you won't know which slice introduced it.
Stop rule: If you've written a lot without running anything — stop, run tests, get back to green, commit or stash. Never stack unverified work.
Verification matches the slice — not always full suite theater:
| Slice type | Verify with |
|---|---|
| Logic / service | Unit/integration test ([[test-first]]) |
| API | Contract test + curl/httpie; check response body |
| UI component | Story or render test + [[browser-checks]] on wired page |
| Migration | Migration up on staging DB; row counts; app still boots |
| Config/deploy | CI green; smoke in staging ([[pipeline-ops]]) |
Demo the slice when possible — 30-second screen share beats "tests pass" for alignment.
For UI, don't wait until the whole page is pretty — prove the wiring early (data shows up, button does something).
Each green increment is:
One logical change per commit — not refactor + feature + lint fix in one blob.
WIP on private branch is fine; before PR, history should tell a story or squash per team convention.
Push slices regularly — laptop loss and silent drift are real risks.
Mixed diffs are unreviewable and unbisectable:
Commit A: extract OrderService (tests green, no behavior change)
Commit B: add tax calculation (tests new behavior)Never "while I'm here" refactor across the feature unless refactor is its own slice first ([[simplify]] can guide cleanup passes).
Use temporary bridges to keep slices vertical without building everything:
Mark stubs clearly — ticket or comment linking to the slice that removes them. Permanent stubs become debt.
Expand-contract migrations: each expand/contract step is its own shippable increment ([[migration-path]]).
Long-lived branches are incremental delivery failure:
If integration hurts, slices may be too wide or branch lived too long — fix process, not blame git.
git log, CI historyTwo broken slices ahead = go back to last green, not forward faster.
New API feature
Slice: schema/migration expand → model + one endpoint happy path → validation/errors → authz → remaining endpoints → contract cleanup.
New UI page ([[design-handoff]])
Slice: route + skeleton layout → one section with real data → remaining sections → states (loading/ empty/error) → responsive/a11y polish → browser-check proof.
Replace legacy module
Slice: adapter calls legacy → move one caller → move next caller → delete legacy when zero callers ([[migration-path]]).
Performance fix ([[perf-budget]])
Measure → one bottleneck fix → measure again → commit. Don't bundle five optimizations.
Bug fix
Repro test ([[test-first]]) → minimal fix green → commit. Not bundled with nearby feature.
Spike / prototype
Time-box; throwaway or harden — if spike code ships, first slice after spike is "make it real" with tests, not more spike on spike.
AI-generated implementation
Treat output as untrusted: slice by slice, run tests each slice, reject 500-line dumps — regenerate in smaller chunks.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.