spec-phase-orchestration — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited spec-phase-orchestration (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
meetings/ directory<repo>/
├── README.md # Project entry point
├── docs/
│ ├── foundations.md # Engineering substrate (language version, modules, CI, L10n, secrets)
│ ├── design.md # Product spec §What + technical design §How (unified)
│ ├── plan.md # TDD-ordered checklist
│ └── methodology.md # Claude agent application practices (living doc)
└── meetings/
└── {YYYY-MM-DD}_{topic}.mdDefault: these live in the same repo as the code. A separate <project>-spec repo is a deviation for teams that need spec review gated independently of the code repo — not the default.
Don't split further:
adr/ directory; major decisions land directly in design.md or foundations.md (open one only if real need arises)foundations.md §1..§N (one section at a time) →
design.md §What (product spec) →
design.md §How (technical design) →
plan.md (TDD-ordered) →
implementation phase beginsRule: don't write §How before design.md §What passes; don't write implementation code before plan.md passes.
subagent-review-cycles).Any proposal depending on external tools / APIs / third-party packages must include a prerequisite checklist:
**Prerequisites**:
- [ ] Package `XYZLib` supports Swift 6 strict concurrency mode — **Unconfirmed** (verified in plan.md step N)
- [x] ~~Xcode Cloud hook naming~~ — **Resolved** (Code Review round N, date): adopt `ci_post_clone.sh`ci_post_clone.sh above is a real Xcode Cloud hook name — see Writing custom build scripts.)meetings/ as a spike; its output doesn't land on main.Every living doc carries a §Backlog; route stray ideas there by topic — see backlog-routing-by-topic.
| Project shape | Keep | Drop |
|---|---|---|
| Tiny utility / 1-day project | README.md + meeting log | foundations.md, design.md, plan.md (design inlined in the README) |
| Adding a feature to an existing codebase | design.md, plan.md | foundations.md (lean on existing conventions instead) |
| Multi-person collaboration | A master plan.md listing dependencies | A single flat plan.md (split into plan/<feature>.md instead) |
| Full outsourcing / contractor | An RFC + tasks split | This skill's 5-doc default (solo / small-team only) |
backlog-routing-by-topic: rules for placing stray ideas.subagent-review-cycles: round structure inside spec sections.leader-developer-handoff-contract: dispatch contract when handing sections to a sub-agent.session-to-meeting-log: persisting each spec session.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.