Install
$ agentstack add skill-keithhegit-ultra-orchestration-ultra-orchestrator ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Ultra Orchestrator
Use this skill as the default public entry point for Ultra Orchestration. The user should only need to invoke $ultra-orchestrator .
This is the mainline successor to the vNext protocol. The old stable workflow is preserved as ultra-orchestrator-legacy.
Startup Contract
Recommended invocation:
$ultra-orchestrator
OpenSpec invocation:
$ultra-orchestrator OpenSpec change :
Compatibility invocation:
$ultra-vnext-core
If the client exposes slash aliases, /ultra-orchestrator can be used the same way.
Run Mode Decision
Classify the run before planning or execution:
LIGHT
review-only, QA-only, explanation-only, or user-explicit lightweight work
STANDARD
user-explicit fast orchestration with bounded risk and no full control plane
STRICT
development work where OpenSpec is unavailable but ledger and JSON contracts are still required
STRICT_OPENSPEC
default for development work, bug fixes, multi-file implementation, pilots, full orchestration tests, OpenSpec work, slice DAG work, and control-plane validation
Development tasks must prefer STRICT_OPENSPEC. If that mode is impossible, explain why and downgrade explicitly. Markdown-only artifacts are not enough for STRICT or STRICT_OPENSPEC.
Router Duties
When invoked:
- classify the task and choose
run_mode - create or require OpenSpec change scaffolding when
STRICT_OPENSPECapplies - initialize the run ledger for
STRICTandSTRICT_OPENSPEC - route through the minimal required sibling skills
- validate machine-checkable artifacts before delivery
- produce delivery artifacts or a clear blocker
Do not ask the user to manually name every subskill.
Routing Table
| Task signal | Default mode | Route | |---|---|---| | development, feature, bugfix, multi-file implementation, pilot, full orchestration test | STRICT_OPENSPEC | OpenSpec bootstrap or bridge -> planning -> risk -> dispatch -> review -> QA -> delivery | | existing OpenSpec change path, openspec/changes, proposal/design/tasks, archive workflow | STRICT_OPENSPEC | bridge -> planning -> risk -> dispatch -> review -> QA -> delivery | | development task where OpenSpec cannot be used | STRICT | planning -> risk -> dispatch -> review -> QA -> delivery | | review-only request | LIGHT | review -> delivery | | QA-only request | LIGHT | QA -> delivery | | high-risk command, publishing, destructive write, credentials, external mutation | current mode plus risk gate | risk before execution |
If a task is tiny but still a development task, keep STRICT_OPENSPEC unless the user explicitly asks for lightweight execution.
Strict Control Plane
For STRICT and STRICT_OPENSPEC, the run must use:
scripts/new_run.pyto initialize a run directoryledger.jsonas the execution state record- JSON
TaskManifest - JSON
WorkPackage - JSON or structured
AgentResult scripts/validate_contracts.pyfor core artifact validation- explicit review and QA gates
- final
control_surface_used
If a required script or artifact cannot be used, stop with a blocker instead of silently downgrading to markdown-only orchestration.
OpenSpec Bootstrap
When STRICT_OPENSPEC applies and no existing change is available, create or request this scaffold:
openspec/changes//proposal.md
openspec/changes//design.md
openspec/changes//tasks.md
openspec/changes//ultra-bridge.md
Default to a single bounded change and one current implementation slice. OpenSpec owns durable specification state. Ultra owns execution control.
Slice-Driven Execution
Keep change and slice separate:
- OpenSpec
changeis the specification and progress ledger unit - Ultra
sliceis the implementation, verification, and commit unit
Use this slice status vocabulary:
slice_0_not_openedslice_0_spec_readyslice_1_completedslice_2_in_progressslice_3_qa_pendingslice_4_done
Every active change must name current slice status, next slice, owned paths, and the verification gate required before advancing.
State Machine
Default phases:
Intake -> Plan -> Dispatch -> Execute -> Review -> QA -> Deliver -> Retro
Required loopbacks:
Review -> Executewhen the plan is valid but the work is wrongQA -> Executewhen behavior is wrong but architecture is still validQA -> Planwhen the failure exposes a planning or requirement flaw
Default retry policy:
- transient failures: at most 1 bounded retry per work package
- repeated or hard blockers: escalate with summary, evidence, and next-step ask
Context Firewall
Pass artifacts, not full chat history:
- relevant
TaskManifest - assigned
WorkPackage - file pointers or artifact paths
- failure context for retries or reroutes
Safe Parallelism
Dispatch work in parallel only when:
- dependencies are satisfied in the DAG
owned_pathsdo not intersect with another active write package- inputs are stable enough to avoid speculative design
- acceptance checks are concrete enough for independent verification
If any condition is false, serialize.
Delivery Requirement
Every delivery must include:
final_deliverableorchestration_logvetter_reportcontrol_surface_used
control_surface_used must state:
run_modeused_openspec_changeused_openspec_bridgeused_run_ledgerused_contract_validationused_slice_dagused_dynamic_qa- skipped control surfaces and reasons
Supporting Skills
Route through these siblings as needed:
$openspec-ultra-bridgefor OpenSpec change mapping$decision-complete-plannerfor JSON-ready task graphs$dispatch-and-trackfor ledger and write-lock tracking$risk-vetterand$safety-guardfor risk gates and guardrails$spec-reviewand$code-reviewfor review gates$qa-verifyfor verification$deliver-and-retrofor final packaging
Read Next
- Read [routing](references/routing.md) for strict routing examples.
- Read [contracts](references/contracts.md) for machine-checkable artifacts.
- Read [state-machine](references/state-machine.md) for phase and loopback rules.
- Read [design-tenets](references/design-tenets.md) for governing principles.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: keithhegit
- Source: keithhegit/ultra-orchestration
- License: Apache-2.0
- Homepage: https://keithhegit.github.io/ultra-orchestration/docs.html
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.