work-planning — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited work-planning (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Turn "build the feature" into a sequence of small, checkable steps where each one can finish and be verified on its own. A plan exposes hidden dependencies, ordering mistakes, and unknowns before they become mid-build surprises — when changing a paragraph is cheap.
Planning is not bureaucracy — it's the cheapest place to discover that the API must ship before the UI, the migration blocks everything, or nobody owns the open question.
Plan phase chain: [[spec-first]] (what) → work-planning (ordered tasks) → [[incremental-delivery]] (build slice by slice) + [[test-first]] (prove each step). Record lasting decisions in [[decision-docs]]; risky rollouts get [[migration-path]] and [[launch-readiness]] tasks.
Pair with [[context-curation]] — one working set per plan step — and [[git-flow]] for commit/checkpoint rhythm during execution.
Skip for trivial, single-step edits (typo, one-line fix with obvious done state). Skip when [[spec-first]] isn't ready — open must-have questions block a plan that's fiction.
Not a substitute for [[spec-first]] — planning orders the work; it doesn't invent requirements. Not sprint ceremony — Scrum Master facilitates; this skill produces the task breakdown those ceremonies consume.
| Input ready? | Action |
|---|---|
| Vague idea | [[idea-shaping]] → [[spec-first]] first |
| Approved spec / clear ticket | work-planning |
| Plan exists, start coding | [[incremental-delivery]] |
Work in order. Write the plan where others can see it — ticket, doc, PR description, not your head.
Inputs:
If there's only a one-liner, write a one-paragraph goal + 3 bullets of scope before decomposing — or go back to [[spec-first]].
Goal: Sellers can duplicate a listing as a draft in one click.
Done when: R1–R5 in spec pass in staging + flag off by default.
Out of scope: bulk duplicate (v1).Deliverables are nouns, not activities:
Deliverables:
- POST /listings/:id/duplicate endpoint
- Duplicate button on ListingDetail (owner only)
- Migration: drafts.source_listing_id column
- Analytics event listing.duplicated
- Runbook for feature flag enableInclude non-code artifacts when the spec demands them — docs, alerts, dashboards ([[observability]]).
Draw the critical path — what blocks what:
Migration (nullable column) → API can write source_listing_id → UI can call API
Feature flag config → UI button visibility
Open question: copy images sync vs async? → SPIKE before API estimate firm| Type | Plan response |
|---|---|
| Hard dependency | Order tasks — blocker first |
| Soft dependency | Parallel with interface stub ([[interface-design]]) |
| Unknown | Spike task with time box + decision output |
| External dependency | Task + owner + follow-up date |
Schedule riskiest unknowns early — not after easy UI polish ([[incremental-delivery]] walking skeleton).
Each task should be:
Split patterns:
| Too big | Split into |
|---|---|
| "Build checkout" | Cart API → payment redirect → confirmation email |
| "Add auth" | Login endpoint → session cookie → protected route guard |
| "Implement design" | List skeleton → row component → empty/error states ([[ui-craft]]) |
Prefer vertical slices in ordering when using [[incremental-delivery]] — each task should enable something demoable or testable, not "all models" with zero behavior.
Order rules:
Don't front-load easy CSS while API shape is unset.
A spike is time-boxed learning with a written answer, not production code:
Spike (4h): Copy listing images — sync copy vs async job?
Output: Decision + approach sketch in ticket; tasks 4–6 updated.Spike outputs: feasibility yes/no, estimate refinement, chosen approach — or escalate to [[spec-first]].
Every task needs a check — test, command, or observation:
| Task | Done when |
|---|---|
| Duplicate API | Integration test green; POST returns 201 + draft id |
| Duplicate button | Owner sees button; guest doesn't; click creates draft ([[browser-checks]]) |
| Migration | Applied on staging; rollback script noted ([[migration-path]]) |
| Feature flag | Default off in prod config; runbook linked |
Vague "done" = task isn't ready. Link to spec requirement IDs when useful ([[spec-first]]).
Estimates before decomposition are guesses. After:
Bad: "Feature: 2 weeks"
Good: "8 tasks × 0.5–1d + 4h spike + 1d review/deploy buffer = ~6–8 dev-days"Checklist — add tasks if the spec requires them:
Missing rollout tasks is how "code done" ≠ "shipped."
Keep it in the ticket or linked doc — copy-friendly template:
# Plan: [Feature name]
Goal: …
Spec link: …
## Deliverables
- …
## Dependencies / risks
- …
## Tasks (ordered)
| # | Task | Owner | Done when | Est |
|---|------|-------|-----------|-----|
| 1 | Spike: image copy approach | @dev | Decision doc in ticket | 4h |
| 2 | Migration: source_listing_id | @dev | Staging migrated | S |
| 3 | POST …/duplicate API | @dev | Integration test green | M |
| 4 | Duplicate button + flag | @dev | Browser check passed | M |
| 5 | Launch: flag runbook | @dev | Runbook in wiki | S |
## Out of plan / deferred
- Bulk duplicate → v2For agents: one current task in focus ([[context-curation]]); complete its done check before advancing.
During build:
A plan nobody updates becomes fiction; a 5-minute re-plan saves days of wrong order.
When passing to another person or session:
Planning ends when build starts — but the doc lives until all tasks are checked.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.