feat(workbench): agent-portable scaffold and execute skills for Asana and Linear - #5
Merged
Conversation
…e, subtask states, config propagation
…n, sweep idempotency, task ordering
…ce, normalize placeholder
…without shared docs
… section-move gap found
…CPs without section tools
Auto mode skips the draft approval, the handoff, precedence-settleable ties, and unambiguous setup answers. It never skips the safety stops: an unverified MCP, an unfixable test failure, a base-branch conflict, an abandoned PR, a phase with no matching state, an ambiguous setup answer, or an unclear reply.
Add bin/scan-skills.sh, which scans every plugins/*/skills/* skill and fails on any non-suppressed finding, gating on the JSON report because the CLI always exits 0. A per-plugin baseline suppresses reviewed false positives with documented reasons (workbench: RA2 and EA2, both matched benign scaffold SKILL.md phrasing). The workflow runs on main pushes and PRs touching skills, uploads JSON and Markdown reports as artifacts, and enables the LLM semantic stage when the ANTHROPIC_API_KEY secret is configured, falling back to static analysis otherwise.
Drop stackgen from the marketplace, the README, and the plugins tree so the repo ships only workbench. Existing installs keep working from git history, but the marketplace no longer offers stackgen. BREAKING CHANGE: stackgen is no longer installable from this marketplace.
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughThe PR replaces legacy marketplace content with Workbench, adding scaffold and execute skills, tracker and memory contracts, documentation, SkillSpector scanning, CI integration, and end-to-end validation records. ChangesWorkbench plugin migration
Estimated code review effort: 4 (Complex) | ~60 minutes Sequence Diagram(s)sequenceDiagram
participant User
participant ScaffoldSkill
participant TrackerMCP
participant ExecuteSkill
participant MemoryBackend
participant GitHub
User->>ScaffoldSkill: submit requirements
ScaffoldSkill->>TrackerMCP: resolve destination and create issue structure
ScaffoldSkill->>ExecuteSkill: hand off issue reference
ExecuteSkill->>TrackerMCP: fetch issue and update state
ExecuteSkill->>MemoryBackend: claim, execute, and close tasks
ExecuteSkill->>GitHub: commit changes and open pull request
GitHub->>TrackerMCP: expose merge outcome for closure handling
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 9
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/skillspector.yml:
- Around line 31-43: Update the SkillSpector installation command in the
“Install SkillSpector” step to reference a reviewed immutable commit SHA instead
of the repository’s default Git ref. Keep the existing tool installation and
PATH setup unchanged.
In `@bin/scan-skills.sh`:
- Around line 46-50: Update the missing-directory handling in bin/scan-skills.sh
so an explicitly requested plugin whose skills_dir does not exist causes the
scan to fail instead of continuing. Preserve the warning context, but return a
nonzero status or otherwise propagate an error so the script cannot report
success when no requested skills were scanned.
In `@docs/superpowers/specs/2026-07-28-issue-lifecycle-v3-design.md`:
- Line 30: Update the fenced diagram block in the issue lifecycle design
specification to include an explicit language identifier, using text or another
appropriate non-code language, so it satisfies Markdown rule MD040.
- Around line 19-25: Update the design contract throughout the referenced
sections to use the approved Workbench terminology and implementation: replace
issue-lifecycle and issue-intake names and paths with scaffold and execute under
.workbench/, and update related skill names and workflow references. Correct the
Linear merge-closure description to require the adapter’s explicit integration
setup rather than implying it is automatic, while preserving the existing design
scope and tracker support.
In `@plugins/workbench/skills/execute/SKILL.md`:
- Line 94: Update the final closing-commit instructions in the claimNext
completion flow to stage only the allowlisted task-state files: the beads export
file and relevant records under .workbench/. Replace the broad “any changed or
new task-state files under .beads/” wording with explicit path-based staging
guidance, and ensure ignored beads database/runtime files are never included.
In `@plugins/workbench/skills/scaffold/SKILL.md`:
- Around line 40-53: Reorder the workflow so tracker resolution occurs before
Step 1 preflight whenever no profile exists and both Asana and Linear MCPs are
connected. Ask the user once to choose the tracker, then run preflight and the
done-on-merge sweep against that selected tracker; preserve existing behavior
for explicit tracker hints, configured profiles, and single connected MCPs.
In `@plugins/workbench/skills/shared/approval.md`:
- Line 45: Revise the exhaustive-list statement in the approval-mode guidance so
it only claims to cover approval-mode stops, not every possible execute-skill
stop. Preserve the instruction to classify newly added stops explicitly, or
expand the list to include missing shared files, unavailable beads for an
existing beads repository, and task/commit reconciliation failures.
In `@plugins/workbench/skills/shared/memory/checklist.md`:
- Line 43: Replace the self-referential hash workflow in close(taskId) within
plugins/workbench/skills/shared/memory/checklist.md at lines 43-43 with a
non-self-referential approach: use a separate bookkeeping store or commit, or
omit the hash from the task line. Update the corresponding repository-wide rule
in plugins/workbench/skills/shared/conventions.md at lines 63-67 to require the
same mechanism, and remove the amend-based self-hash requirement.
In `@plugins/workbench/skills/shared/trackers/asana.md`:
- Around line 78-85: The Asana sweep must durably persist each recorded “PR
closed unmerged” observation before a cleanup-only run returns: update the Asana
workflow in plugins/workbench/skills/shared/trackers/asana.md lines 78-85 to
commit and push the marker, or define an equivalent durable persistence path.
Apply the same requirement to the Linear abandonment-recording flow in
plugins/workbench/skills/shared/trackers/linear.md lines 42-43; ensure both
adapters do not report the same PR repeatedly after successful persistence.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: e9014c41-e9ca-478d-9930-972ae58b4617
📒 Files selected for processing (43)
.claude-plugin/marketplace.json.github/workflows/skillspector.ymlREADME.mdbin/scan-skills.shdocs/superpowers/plans/2026-07-28-issue-lifecycle-v3.mddocs/superpowers/specs/2026-07-28-issue-lifecycle-v3-design.mddocs/superpowers/testing/2026-07-28-issue-lifecycle-v3-e2e-log.mdplugins/issue-lifecycle/README.mdplugins/issue-lifecycle/commands/commit.mdplugins/issue-lifecycle/commands/issue-finish.mdplugins/issue-lifecycle/commands/issue-start.mdplugins/issue-lifecycle/commands/issue-task.mdplugins/stackgen/.claude-plugin/plugin.jsonplugins/stackgen/README.mdplugins/stackgen/agents/architecture-analyzer.mdplugins/stackgen/agents/backend-analyzer.mdplugins/stackgen/agents/code-quality-analyzer.mdplugins/stackgen/agents/database-analyzer.mdplugins/stackgen/agents/devops-analyzer.mdplugins/stackgen/agents/frontend-analyzer.mdplugins/stackgen/agents/monitoring-analyzer.mdplugins/stackgen/agents/performance-analyzer.mdplugins/stackgen/agents/security-analyzer.mdplugins/stackgen/agents/stack-detector.mdplugins/stackgen/agents/testing-analyzer.mdplugins/stackgen/commands/analyze.mdplugins/stackgen/commands/check.mdplugins/stackgen/commands/quick.mdplugins/stackgen/commands/refresh.mdplugins/workbench/.claude-plugin/plugin.jsonplugins/workbench/.skillspector-baseline.yamlplugins/workbench/README.mdplugins/workbench/skills/execute/SKILL.mdplugins/workbench/skills/scaffold/SKILL.mdplugins/workbench/skills/shared/agents.mdplugins/workbench/skills/shared/approval.mdplugins/workbench/skills/shared/conventions.mdplugins/workbench/skills/shared/memory.mdplugins/workbench/skills/shared/memory/beads.mdplugins/workbench/skills/shared/memory/checklist.mdplugins/workbench/skills/shared/trackers.mdplugins/workbench/skills/shared/trackers/asana.mdplugins/workbench/skills/shared/trackers/linear.md
💤 Files with no reviewable changes (22)
- plugins/stackgen/agents/performance-analyzer.md
- plugins/issue-lifecycle/README.md
- plugins/stackgen/agents/testing-analyzer.md
- plugins/stackgen/agents/security-analyzer.md
- plugins/issue-lifecycle/commands/issue-start.md
- plugins/stackgen/README.md
- plugins/stackgen/agents/frontend-analyzer.md
- plugins/stackgen/agents/database-analyzer.md
- plugins/stackgen/agents/architecture-analyzer.md
- plugins/stackgen/.claude-plugin/plugin.json
- plugins/stackgen/agents/monitoring-analyzer.md
- plugins/stackgen/commands/check.md
- plugins/stackgen/commands/refresh.md
- plugins/stackgen/agents/devops-analyzer.md
- plugins/stackgen/commands/analyze.md
- plugins/stackgen/agents/backend-analyzer.md
- plugins/stackgen/commands/quick.md
- plugins/issue-lifecycle/commands/issue-finish.md
- plugins/issue-lifecycle/commands/commit.md
- plugins/issue-lifecycle/commands/issue-task.md
- plugins/stackgen/agents/stack-detector.md
- plugins/stackgen/agents/code-quality-analyzer.md
- pin SkillSpector install to reviewed commit (v2.5.0) - fail scan-skills.sh when an explicitly requested plugin is missing - mark issue-lifecycle v3 design as implemented under the Workbench names - add fenced-block language for MD040 - restrict the final closing commit to allowlisted task-state paths - resolve an ambiguous tracker before preflight in scaffold - scope the approval stop list to approval-mode stops only - replace the impossible self-hash amend with a deferred hash append - require commit+push of closed-unmerged PR markers in both adapters
Owner
Author
Fixes Applied SuccessfullyFixed 10 file(s) based on 9 CodeRabbit feedback item(s). Files modified:
Commit: The latest autofix changes are on the |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@bin/scan-skills.sh`:
- Around line 48-52: Update the plugin scanning flow in bin/scan-skills.sh to
track whether each requested plugin yields at least one child SKILL.md file, and
exit with an error when a plugin’s skills directory exists but no skills are
scanned. Preserve the existing missing-directory failure and successful scanning
behavior for plugins with at least one skill.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 9faa6f38-13a8-4ee0-b1af-d3c42e2ccdc2
📒 Files selected for processing (10)
.github/workflows/skillspector.ymlbin/scan-skills.shdocs/superpowers/specs/2026-07-28-issue-lifecycle-v3-design.mdplugins/workbench/skills/execute/SKILL.mdplugins/workbench/skills/scaffold/SKILL.mdplugins/workbench/skills/shared/approval.mdplugins/workbench/skills/shared/conventions.mdplugins/workbench/skills/shared/memory/checklist.mdplugins/workbench/skills/shared/trackers/asana.mdplugins/workbench/skills/shared/trackers/linear.md
🚧 Files skipped from review as they are similar to previous changes (2)
- plugins/workbench/skills/shared/trackers/linear.md
- docs/superpowers/specs/2026-07-28-issue-lifecycle-v3-design.md
An existing plugins/<name>/skills/ directory with no child SKILL.md files scanned zero skills and still reached PASS, so deleting or renaming all skill files could bypass the gate. Track the per-plugin scanned count and error when it is zero. Also guards skillspector crashes so a non-zero exit produces a counted failure instead of killing the run, and renders the Markdown report from the same JSON that gated CI.
Owner
Author
Fixes Applied SuccessfullyFixed 1 file based on 1 CodeRabbit feedback item. Files modified:
Commit: The latest autofix changes are on the |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@bin/scan-skills.sh`:
- Around line 100-136: Update the embedded report renderer’s code-snippet output
in the Python heredoc, adding a code_fence helper that chooses a backtick fence
longer than the longest consecutive backtick run in the snippet. Use that
dynamically selected fence for both the opening and closing delimiters around
f["code_snippet"], preserving the existing output for snippets without embedded
fences.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
A snippet containing a triple-backtick run terminated the fixed fence early and corrupted everything after it in the rendered Markdown report, plausibly hiding later findings. Pick a fence one backtick longer than the longest run in the snippet.
Owner
Author
Fixes Applied SuccessfullyFixed 1 file based on 1 CodeRabbit feedback item. Files modified:
Commit: The latest autofix changes are on the |
- move the tracker-agnostic done-on-merge sweep and closed-unmerged rules into shared/trackers.md; adapters keep only their own closure actions - add a hash-based cross-check to commit reconciliation - enumerate all five first-run setup steps in scaffold - fix the broken trackers/asana.md relative link from memory/checklist.md - rewrite the root README Contributing section for the skills architecture - render the scan report from the gating JSON (one scan per skill) and guard skillspector crashes; document the baseline EA2 match scope - correct the beads-vs-checklist dependency claim in the workbench README - fix Kiro install wording, scaffold hand-off ref resolvability, checklist parent-close no-op, and stale intake references - reflow multi-sentence markdown lines to one sentence per line
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
bin/scan-skills.sh (2)
69-77: 🩺 Stability & Availability | 🟡 Minor | ⚡ Quick winDistinguish scan errors from findings in the final verdict.
A SkillSpector crash increments
failures, but the final message says those skills have non-suppressed findings and suggests adding a baseline. Track scan errors separately or make the final message generic so provider/tool failures are not misdiagnosed as suppressible findings.Also applies to: 160-165
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@bin/scan-skills.sh` around lines 69 - 77, Update the scan error handling around the skillspector invocation and the final verdict reporting to distinguish tool/scan failures from detected findings. Track crashes separately from findings, or make the final summary generic enough not to claim scan errors are non-suppressed findings or recommend adding a baseline; preserve the existing handling for actual findings.
100-106: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winPrevent per-skill report filename collisions.
$plugin-$skillis not injective:foo-bar/bazandfoo/bar-bazboth overwritefoo-bar-baz.jsonand.md. Store reports under separate plugin directories or use a collision-proof encoding, otherwise artifacts can hide findings from one scanned skill.Proposed fix
if [ -n "${REPORT_DIR:-}" ]; then - cp "$json" "$REPORT_DIR/$plugin-$skill.json" + mkdir -p "$REPORT_DIR/$plugin" + cp "$json" "$REPORT_DIR/$plugin/$skill.json" ... - python3 - "$json" "$plugin/$skill" > "$REPORT_DIR/$plugin-$skill.md" <<'PY' + python3 - "$json" "$plugin/$skill" > "$REPORT_DIR/$plugin/$skill.md" <<'PY'🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@bin/scan-skills.sh` around lines 100 - 106, Update the report-writing logic in the REPORT_DIR block to generate collision-proof paths for each plugin and skill, such as storing each skill’s JSON and Markdown reports under a separate plugin directory or encoding both components unambiguously. Ensure distinct plugin/skill pairs like foo-bar/baz and foo/bar-baz cannot overwrite one another.
🧹 Nitpick comments (1)
bin/scan-skills.sh (1)
23-25: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winPin the local SkillSpector install hint to the CI revision. The fallback install still points at the moving default branch; use the same
@34f60308522f45447cd343da0aad77bcea308ad4pin so local scans match CI behavior.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@bin/scan-skills.sh` around lines 23 - 25, Update the fallback installation command in bin/scan-skills.sh to pin the skillspector Git URL to revision 34f60308522f45447cd343da0aad77bcea308ad4, matching the CI revision while preserving the existing missing-command message.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@bin/scan-skills.sh`:
- Around line 69-77: Update the scan error handling around the skillspector
invocation and the final verdict reporting to distinguish tool/scan failures
from detected findings. Track crashes separately from findings, or make the
final summary generic enough not to claim scan errors are non-suppressed
findings or recommend adding a baseline; preserve the existing handling for
actual findings.
- Around line 100-106: Update the report-writing logic in the REPORT_DIR block
to generate collision-proof paths for each plugin and skill, such as storing
each skill’s JSON and Markdown reports under a separate plugin directory or
encoding both components unambiguously. Ensure distinct plugin/skill pairs like
foo-bar/baz and foo/bar-baz cannot overwrite one another.
---
Nitpick comments:
In `@bin/scan-skills.sh`:
- Around line 23-25: Update the fallback installation command in
bin/scan-skills.sh to pin the skillspector Git URL to revision
34f60308522f45447cd343da0aad77bcea308ad4, matching the CI revision while
preserving the existing missing-command message.
There was a problem hiding this comment.
Actionable comments posted: 5
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/skillspector.yml:
- Around line 33-36: Update the comment above the skillspector installation in
the workflow to say “Bump the commit SHA deliberately” instead of referring to a
tag, while preserving the existing reproducibility guidance and pinned revision.
In `@plugins/workbench/.skillspector-baseline.yaml`:
- Around line 24-28: Update the EA2 suppression entry in
.skillspector-baseline.yaml to target the specific skill file path rather than
the generic "SKILL.md" basename. Preserve the existing suppression message and
rationale while ensuring unrelated skills under the plugin remain subject to EA2
findings.
In `@plugins/workbench/skills/shared/trackers.md`:
- Around line 98-100: Update the closed-unmerged pull request handling described
in the tracker instructions to require durable persistence of the `PR closed
unmerged` marker in the issue’s `.workbench/` file before the cleanup run
returns. Do not require committing or pushing the change, but ensure an
uncommitted marker is not treated as persisted; preserve deduplication for the
same PR and reporting for later distinct PRs.
- Around line 53-56: The invocation’s tracker must be resolved before preflight
and merge-sweep operations so all layers use the same tracker. In
plugins/workbench/skills/shared/trackers.md lines 53-56, prioritize an explicit
invocation tracker before profile and connected-MCP inference; in
plugins/workbench/skills/scaffold/SKILL.md lines 40-43, preflight the
invocation-selected tracker when supplied; in
plugins/workbench/skills/execute/SKILL.md lines 50-57, determine the issue
reference and tracker before preflight or pass both explicitly into preflight.
In `@README.md`:
- Line 98: Add language identifiers to all three affected fenced blocks: use
text or none for the repository tree in README.md lines 98-98, and use text for
the conversational example in plugins/workbench/README.md lines 168-172 and
approval-mode example at lines 208-211.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 271d593e-f0ee-4729-a0bc-376b6cbd4951
📒 Files selected for processing (16)
.github/workflows/skillspector.ymlREADME.mddocs/superpowers/plans/2026-07-28-issue-lifecycle-v3.mddocs/superpowers/testing/2026-07-28-issue-lifecycle-v3-e2e-log.mdplugins/workbench/.skillspector-baseline.yamlplugins/workbench/README.mdplugins/workbench/skills/execute/SKILL.mdplugins/workbench/skills/scaffold/SKILL.mdplugins/workbench/skills/shared/agents.mdplugins/workbench/skills/shared/approval.mdplugins/workbench/skills/shared/conventions.mdplugins/workbench/skills/shared/memory/beads.mdplugins/workbench/skills/shared/memory/checklist.mdplugins/workbench/skills/shared/trackers.mdplugins/workbench/skills/shared/trackers/asana.mdplugins/workbench/skills/shared/trackers/linear.md
🚧 Files skipped from review as they are similar to previous changes (2)
- plugins/workbench/skills/shared/trackers/linear.md
- plugins/workbench/skills/shared/memory/beads.md
- one shared tracker precedence for preflight: invocation-named tracker, then reference shape, then profile, then single connected MCP; scaffold and execute both point at it so preflight and the run agree - require commit+push of the closed-unmerged marker before the sweep returns, restoring the durability rule lost in the sweep relocation - add language identifiers to three untyped fences (MD040) - refer to the pin as a commit SHA, not a tag
Owner
Author
Fixes Applied SuccessfullyFixed 6 file(s) based on 4 of 5 CodeRabbit feedback item(s); 1 dispositioned in a thread reply. Files modified:
Dispositioned without change:
Commit: The latest autofix changes are on the |
This is a personal skills repo, not one accepting contributions. Also adds language identifiers to the two remaining untyped fences.
Rename skills/shared/ to skills/workbench-shared/ and give it a marker SKILL.md so directory-copying installers (npx skills add) carry the contract files alongside execute and scaffold; the skills CLI names the installed directory after the skill, so the dir name must match the ../workbench-shared/ references. The marker's description tells agents it is not invocable. Scanning the new directory surfaces its documentation text, so the baseline gains reviewed suppressions: prohibition and setup-question phrasings (EA2/PE3), the optional merge-closer Action templates' curl calls (E1), and the unpinned installer command (RP1). Kiro install docs now lead with npx skills@latest add; manual copy and symlink remain as the editable-install path.
Managed Claude Code plugin vs editable skills.sh install for any agent, in collapsible per-agent blocks, followed by the once-per-repo first run. Root README mirrors the same two-path shape in brief.
This was referenced Aug 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replaces the previous plugin with
workbench: two agent skills,scaffoldandexecute, that carry a tracker issue from requirements to an open pull request. Written clean-room rather than ported, so the abstractions are designed for the matrix rather than retrofitted onto one tracker.What it does
scaffoldturns requirements into a parent issue with sub-issues, grounded in the actual codebase rather than the prose alone.executetakes an issue and drives it to an open pull request: plan document, task-by-task commits, tests, push, PR.Portability
Three axes, each behind a contract so the skill bodies never name a tool:
inProgress/inReview/donephases mapped to real tracker states during first-run setup.The core skill bodies contain zero tool names; a grep for
mcp_, the task tools,Glob,Grep, andbdreturns nothing in either. Capability language lives only in the adapter files.Approval modes
askis the default;autoskips preference gates and never skips safety stops. Ten stops fire in both modes, four of which this project's own testing proved necessary: an unverified MCP, an unfixable test failure, a base-branch conflict, and an abandoned pull request. Mode resolves invocation → profile → ask, and carries across a skill handoff.Merge closure
Asana has no native merge-closure, so closure is tiered: native tracker integration where it exists, an optional hardened GitHub Action, a passive sweep as backstop, and on-demand say-so. Both workflow templates pass the branch through
envrather than interpolating it intorun:, since a branch name is attacker-controlled text and a tracker token is in scope.Security boundary
The skills never search the filesystem, environment, config files, or token caches for tracker credentials; never call a tracker's HTTP API directly; and never modify MCP or agent configuration to enable a disabled server. During testing an agent tried all four of those in sequence, including calling Asana's API with a scavenged token. Prose prohibitions failed twice. What worked was a preflight gate that gives the agent a useful action — deliver setup instructions — instead of only forbidding the bypass. This is instructions to a model, not a sandbox, and the README says so.
Verification
Live end-to-end runs against both Asana and Linear, plus Kiro, in throwaway repositories, with every run and finding recorded in
docs/superpowers/testing/. Findings that came out of execution rather than reasoning include an unscoped task claim that could close the wrong sub-issue, an unsatisfiable checklist close rule that made the no-beads path unable to open a pull request, and an Asana GID extraction that failed on the exact URL shape in use.Mechanically: both YAML templates parse, both
run:blocks passbash -n, everybdflag checked against 0.49.0, GID extraction tested against all four Asana URL shapes, and both skills within their line ceilings.Known gaps
Kiro is unverified since the rename; its quota resets Aug 1 and a smoke test is queued. The Linear merge-closer template has not been run end to end, which the file itself states.
Summary by CodeRabbit
New Features
Documentation
Behavior Changes