fanout-ship — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited fanout-ship (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
USE when ALL true:
gh CLI authenticatedSKIP when:
main / mobile_main_dev / developtitle — shortscope — files/classes/methods to touchblast_radius — int (line count est, method count, complexity 1-10)acceptance — testable criteriaIf user gives vague request → ASK for the task list before fanout.
cd <repo>
gh auth status # must be logged in
git status # must be clean
git fetch origin
git checkout <base> && git pullAbort on dirty tree or auth fail.
INTEG="issue-${PARENT}-integration"
git checkout -b "$INTEG"
git push -u origin "$INTEG"for task in tasks; do
gh issue create \
--title "Phase N: <ChildTitle>" \
--body "Parent: #<PARENT>. Scope: ...\nAcceptance: ..." \
--label "fanout"
doneCapture issue numbers → write to tasks.json.
Smallest first = least rebase pain. Save canonical merge order.
Use Agent tool with:
isolation: "worktree" — isolated copyrun_in_background: true — fire & forgetsubagent_type: "general-purpose" (or specialized)CRITICAL: all N Agent calls in single assistant message = true parallel.
gh pr list --base "$INTEG" --json number,title,state,headRefName,mergeableFormat as table. Optional: wrap in /loop 60s for live refresh.
For each PR (smallest blast radius first):
gh pr checks <PR> # CI green
gh pr merge <PR> --squash # or --rebaseRemaining PRs auto-need rebase (recipe in their body).
gh pr create \
--base <base> \
--head "$INTEG" \
--title "Parent #<PARENT>: integrated N child PRs" \
--body "Closes #<PARENT>. Merged: <list>"Device-test integration branch BEFORE final merge.
Each spawned agent gets THIS prompt (vars filled in):
You are implementing child task <N>/<TOTAL> of parent issue #<PARENT>.
REPO: <repo_url>
BASE: <base_branch>
TARGET: <integration_branch>
ISSUE: #<CHILD_ISSUE>
SCOPE:
<scope_description>
FILES TO TOUCH:
<file_list>
ACCEPTANCE:
<acceptance_criteria>
PROCEDURE:
1. Branch off <base_branch>: `git checkout -b feat/issue-<CHILD_ISSUE>-<slug>`
2. Implement scope. Touch only listed files.
3. Run tests: `<test_cmd>`
4. Commit: clear message referencing #<CHILD_ISSUE>
5. Push: `git push -u origin <branch>`
6. Open PR: `gh pr create --base <integration_branch> --title "..." --body "<see below>"`
PR BODY MUST INCLUDE:
## Position
<N> of <TOTAL> in merge order (blast radius: <BR>)
## Closes
#<CHILD_ISSUE>
## Rebase recipe (for later PRs in queue)
\`\`\`
git fetch origin
git rebase origin/<integration_branch>
git push --force-with-lease
\`\`\`
## Testing scenarios
- <scenario 1>
- <scenario 2>
## Files changed
<list>
CONSTRAINTS:
- Touch ONLY files in scope. No drift.
- No formatting churn outside touched lines.
- No dependency bumps unless required by scope.
- If blocked → comment on issue #<CHILD_ISSUE>, do NOT touch other PRs.
Report PR URL when done.recipes/agent-prompt.md — full agent prompt template (copy-fill)recipes/decomposition-checklist.md — how to split parent → children safelytemplates/tasks.schema.json — JSON schema for task listscripts/preflight.sh — verify gh + clean tree + base branchscripts/create-integration-branch.sh — branch + pushscripts/create-child-issues.sh — bulk gh issue create from tasks.jsonscripts/spawn-block.md — copy-paste Agent call block (N invocations)scripts/status-table.sh — gh pr list → markdown tablescripts/merge-next.sh — merge next-smallest PR + nudge rebasereferences/blast-radius-heuristics.md — how to estimateBefore fanout, verify each child task:
If shared schema → fan out AFTER schema lands solo.
Break-even: N≥4 AND wall-clock-saved > $$ tokens-extra. Almost always wins for N≥6.
wp-rest-control-system — 20 endpoints × 2 plugins = 40 fanout (batched 10s)sm-dashboard — 7 Supabase tables + 14 RLS = 21 parallel migrationssites-expansion — 140 WXR pages = batched fanout 10×14github-100-repos Tier S — 10 anchor scaffolds parallelaeo-audit-tool — 5 API integrations parallel| Failure | Cause | Fix |
|---|---|---|
| Merge conflicts every PR | Files not disjoint | Re-decompose. Pull conflict file into solo PR first. |
| Agent opens PR to wrong base | Prompt missed --base | Explicit --base <integration> in prompt |
| Stale rebase storm | Slow merge cadence | Merge ≤2 PRs/day or batch-rebase weekly |
| One agent stuck | API timeout / loop | Kill via TaskStop → respawn |
| CI flake on rebased PR | Cache stale | Push empty commit git commit --allow-empty -m "rerun ci" |
| Auth fail mid-run | gh token expired | gh auth refresh then respawn failed agents |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.