bmad-sprint-run — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited bmad-sprint-run (Agent Skill) and scored it 87/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 3 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 3 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Autonomously execute ALL stories in ALL epics in the current sprint. Runs as a single continuous loop: no pauses between stories, no confirmation prompts, no stopping until every story reaches done or blocked.
After completing ANY action (story done, story blocked, retry exhausted, story created), immediately begin the next story by returning to STEP 0. The only valid exit is STEP 7 (all stories resolved). Every other step unconditionally transitions to another step. Never ask for permission to continue.
Valid story statuses: backlog | ready-for-dev | in-progress | review | done | blocked
backlog --[create-story]--> ready-for-dev
ready-for-dev --[checkpoint]--> in-progress
in-progress --[dev-story]--> review
review --[quality gate pass + review pass]--> done
review --[quality gate fail]--> in-progress (retry)
review --[retry exhausted]--> blocked
review --[decision_needed]--> blocked
ANY --[infrastructure fail]--> STOP (not blocked, sprint halts)Invalid transitions (MUST NOT occur):
backlog -> anything other than ready-for-devdone -> anything (terminal state)blocked -> anything (terminal state for this sprint run)in-progress (every dev cycle must checkpoint first)done unless quality gates pass AND code review reports zero critical findingsblocked, ready-for-dev, or in-progressdone or blockedgit stash (removes untracked bmad artifacts)main or mastergit reset --hard, git checkout -- , git restore, or git clean — these destroy committed or working-tree work. A false-failing quality gate once used git reset --hard to wipe a completed storyrm against the project to "clean up" — failed stories retry by fixing forward, never by deletinggit add -A, git add ., or any bulk-staging form. Enumerate changed files with git status --porcelain and stage each one by explicit path (git add path/to/file)bmad-dev-story commits per logical chunk as it works, each story finalizes at its own STEP 5g, and STEP 7 only sweeps residual state files. Never batch multiple chunks or stories into a single large commitblocked with a reasonFixed values. Do not change unless the user explicitly requests it.
| Setting | Value | Purpose |
|---|---|---|
RETRY_BUDGET | 3 | Max dev-story + code-review cycles per story |
DIGEST_SIZE | 5 | Rolling digest window (number of completed stories) |
SPRINT_STATUS_PATH | docs/_bmad_output/implementation-artifacts/sprint-status.yaml | Sprint state |
STORY_DIR | docs/_bmad_output/implementation-artifacts | Story file location |
RUNNER_STATE_PATH | docs/_bmad_output/implementation-artifacts/.sprint-runner-state.yaml | Retry/checkpoint tracking |
DIGEST_PATH | docs/_bmad_output/implementation-artifacts/.sprint-context-digest.md | Rolling context log |
Before entering the loop, verify:
SPRINT_STATUS_PATH exists. If missing, instruct user to run /bmad-sprint-planning and stop.done. If all done, go to STEP 7.main or master. If on main, instruct user to create a feature branch and stop..sprint-runner.lock check — exact procedure in references/orchestration-steps.md STEP 0. This is advisory only: sprint-runner.py enforces a kernel-level fcntl.flock that the skill cannot hold across tool calls.STEP 0 (Re-read state, discover workspaces)
|
v
STEP 1 (Resolve next action) ---sprint_complete---> STEP 7 (Finalize) --> STOP
|
+-- create_story --> STEP 2 (Invoke bmad-create-story) --> STEP 3
+-- preflight --> STEP 3 (Check infrastructure)
+-- quality_gate --> STEP 5
|
STEP 3 --infra_fail--> STEP 7
|
v
STEP 4 (Snapshot HEAD + invoke bmad-dev-story)
|
v
STEP 5 (Typecheck + Tests + bmad-code-review)
|-- fail (quality) --> STEP 6 (Retry handler)
|-- fail (critical) --> STEP 6
|-- fail (decision) --> mark blocked --> STEP 0
|-- pass --> 5e (digest) --> 5f (epic boundary) --> 5g (commit) --> STEP 0
|
STEP 6 --budget_ok--> STEP 4 (retry)
--exhausted--> mark blocked --> STEP 0Each step below is a summary. Full procedures — exact commands, sub-steps, error conditions — are in references/orchestration-steps.md.
Re-read SPRINT_STATUS_PATH, RUNNER_STATE_PATH, and DIGEST_PATH from disk with the Read tool — never trust cached values. Create RUNNER_STATE_PATH and DIGEST_PATH if absent. Discover project workspaces (typecheck/test/infra commands) from CLAUDE.md, falling back to build-manifest scanning. Print one-line status: "Sprint: [N] done, [M] remaining, [K] blocked. Next story."
Read development_status from SPRINT_STATUS_PATH and pick the next story by priority in-progress -> review -> ready-for-dev -> backlog, lowest (epic, story) number first. Map to action: backlog -> create_story; ready-for-dev/in-progress -> preflight; review -> quality_gate; none left -> sprint_complete (STEP 7). For review stories, verify the Dev Agent Record exists — if missing, reset to ready-for-dev and re-resolve. Record the chosen story as current_story in RUNNER_STATE_PATH.
Invoke Skill(skill: "bmad-create-story"). Verify a story file appeared in STORY_DIR and status is now ready-for-dev. Transition to STEP 3.
Check infrastructure (runtime deps, toolchains, local validators) for the workspaces the story touches. On failure: print what needs starting, transition to STEP 7 (infrastructure-blocked) — do not retry. On pass: transition to STEP 4.
Record current HEAD (git rev-parse --verify HEAD) as checkpoint_hash in RUNNER_STATE_PATH — a diff marker only, not a commit; the bmad skills create all commits. Inject digest + story context, then invoke Skill(skill: "bmad-dev-story"). Verify status is review. Transition to STEP 5.
Diff against checkpoint_hash to find affected workspaces (files matching no workspace -> run ALL checks). Run typecheck then tests per workspace; on failure reset the story to in-progress and transition to STEP 6. Invoke Skill(skill: "bmad-code-review") and verify a findings section exists (missing = failure -> STEP 6). Route on findings:
critical -> STEP 6decision_needed, zero critical -> mark blocked, STEP 0critical and zero decision_needed -> passOn pass: write a digest entry (prune beyond DIGEST_SIZE), run the full-suite epic-boundary gate if the epic is complete, update RUNNER_STATE_PATH, stage each changed file by explicit path (see Git Safety) and commit story [ID]: completed, transition to STEP 0.
Increment retry_count. If retry_count >= RETRY_BUDGET: mark the story blocked, append the reason to stories_blocked, transition to STEP 0. Never roll back — every commit the story produced stays on the branch for a human to inspect or salvage. If retries remain, fix forward on top of existing commits with the prior failure injected into the prompt: attempt 1 = re-invoke dev-story (STEP 4), attempt 2 = bmad-quick-dev with failure context (STEP 5), attempt 3 = dev-story with injected failure history (STEP 4).
Print the sprint summary. Each story's work was already committed at its own STEP 5g, so only residual files (digest, runner state) remain — stage those by explicit path and commit sprint-run: [N] completed, [M] blocked. List blocked stories needing manual intervention, and suggest /bmad-retrospective per epic. STOP — the only valid termination point.
For detailed step procedures with exact commands and error recovery:
Annotated samples of the state files this skill reads and writes:
development_status structure: story/epic/retrospective key shapes and valid status valuesRUNNER_STATE_PATH schema: retry counter, checkpoint hash, blocked-story records, phaseThis skill composes existing bmad skills:
bmad-create-story - Story spec creation from backlogbmad-dev-story - Story implementation with TDDbmad-code-review - 3-layer adversarial reviewbmad-quick-dev - Targeted fix for retry attempts~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.