Install
$ agentstack add skill-mapuamap-denys-fast-mskills-m-plan-implement ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
mplanimplement
Follow-up to m_plan. Reads existing artifacts, drives them to completion. No re-planning. Default mode: direct walk. /goal mode: opt-in.
Inputs
$ARGUMENTS: optional task slug. If absent, auto-detect.
Phase A — Load the plan
- List
.m_plan/*/directories.
- None →
No plans found. Run /m_plan first.Stop. - One → use it.
- Many → list with last-modified, ask via
AskUserQuestion(max 4; on overflow, ask user to type the slug; if that tool is unavailable in this harness, ask in chat as a numbered list and wait).
- Read present files. A plan is valid with at minimum
01_architecture.md,04_implementation_requirements.md,05_step_plan.md,09_verification.md. Other files are optional — treat missing as N/A. Read whichever subset exists in parallel.
- Extract:
- Step IDs S01..S + per-step check commands from
05. - Verification rows V-* + current state from
09. - Build / test commands from
07_test_plan.mdif present, else fromCLAUDE.md. - Smoke + e2e IDs from
08_e2e_plan.mdif present. - Deploy steps, real target hosts/services, release commands, rollback commands, and post-deploy smoke probes from
06_deploy_plan.mdif present. - If
06is missing or does not name a real target, inspect repo-local ops docs (AGENTS.md,CLAUDE.md,README,docs/, deploy scripts, compose/k8s/systemd files) for an unambiguous deploy path. If still ambiguous, mark deploy as blocked. Do not silently replace deploy with localhost checks.
- Detect resume state. Summarize:
Already done: . Open: . Blocked: .AskResume / Restart / Stop.
- Readiness check. If
03_infra_requirements.mdexists, list its secrets/access requirements and askReady? (yes / no — name the blocker). Any open[!]in09— including theV-READY-*deploy/e2e go/no-go rows seeded by/m_planPhase 0 — must be resolved (re-probe and flip to[x]) or explicitly converted to[~]before proceeding. Do not start the walk with an unresolved deploy/e2e readiness blocker.
- Deployment reality gate + browser preflight. Before editing code, decide whether this plan has an actual runtime surface and a real deploy target, and whether you can run any browser/UI checks
08requires. Deploy reality invariant: local build / unit / dev-server checks on this workstation are preflight only — they never satisfyV-DEPLOY-*,V-SMOKE-*, orV-E2E-*rows unless06declares this workstation as the target. If this plan deploys anything or has browser checks, readtemplates/deploy_rules.mdnow for the full gate + preflight checklist before proceeding.
Phase B — Execute (default: direct walk)
Walk 05_step_plan.md step by step:
- Respect dependency order. After each step's per-step check passes, flip its
V-STEP-Sxxto[x]viaEdit. - On failing check: diagnose, retry once. Second failure →
[!]blocker, stop, jump to Phase C. - After all steps: local preflight build/test (delegate noisy runs to the
m_code-test-runneragent, keep only the summary) → (if08exists) e2e against the intended target when possible — run browser/UI checks through the available browser MCP (Playwright/Chrome, or macOS computer-use) only after the Phase A §7 access preflight passes → real deploy → post-deploy smoke from outside or on the target host. - Update other
V-*rows as their evidence appears in the transcript.
Deviation logging (mandatory). Any time the run drifts from 01–08, append a one-line entry under ## Deviations in 09_verification.md immediately — do not wait for Phase C. A deviation is any of:
- A file touched that is not in
04's "Files to add / modify / delete". - A different approach taken mid-step (e.g., used a different library than
01named). - A smoke / e2e check skipped or replaced.
- A per-step check replaced with a different command than
05/07declares. - A local check used where the plan expected deploy, remote smoke, or target-environment verification.
Format: - Sxx / V-XXX-YY — plan said: . Did: . Why: .
Deploy walks 06 like steps walk 05, but only against the real target. When every non-deploy V-* is [x]/[~], run 06's "Deploy order" entries in declared order, each followed by its matching smoke check. Stop on first failure; flip the matching V-DEPLOY-XX to [!]. Read templates/deploy_rules.md for the deploy walk + real-environment deploy rules (what counts as observing the running artifact, SSH/CI handling, destructive-action policy, post-deploy smoke) — they all enforce the deploy reality invariant.
**Final V- sweep (before declaring DONE).* After everything above, re-read 09_verification.md from disk and, for every still-[ ] row, attempt a deterministic check from current repo / build state: greps, file existence, signature matches, last build/test output. Flip what passes to [x]. Anything that cannot be deterministically verified stays [ ] and becomes a "Not done" item in Phase C.
Opt-in /goal mode — if user said use /goal or the run will span sessions, emit:
/goal Complete every checkbox in .m_plan//09_verification.md. For each, run the cited command, paste output, flip [ ]→[x]. Stop after turns and explain residual blockers.
Rules during execution
- Never edit
01–08to change scope. Contract from/m_plan. - Never delete a
V-*row. Only flip state. [~]skip needs a one-line reason inline. No confirmation required.[!]blocker needs description + entry under "Blockers".- Commit policy follows
06if present; otherwise one commit per step. - Deploy from
06or the discovered real deploy path runs automatically after every non-deployV-*is[x]/[~]. If no real deploy path can be identified for a deployable runtime, stop withV-DEPLOY-*blocked instead of reporting DONE.
Phase C — Three-section report
Re-read 09_verification.md from disk, then emit the three-section report using the skeleton in templates/report_format.md (all headers mandatory, kept even if empty). If not DONE, name the smallest action that unblocks each open / blocked item.
Rules
- Never regenerates the plan. If
01–08are wrong → stop, tell user to re-run/m_planor edit manually. - Never writes secrets / prod hostnames into artifacts or commits.
- All three report sections are mandatory; empty sections kept (explicit empty = info).
- Trust artifacts: blockers were resolved in
/m_planPhase 0. New blockers mid-flight escalate, never silently bypass.
Files in this skill
SKILL.md— this file (core algorithm)templates/deploy_rules.md— deploy reality gate + browser preflight + real-environment deploy rules (read on deploy)templates/report_format.md— Phase C report skeleton (read at report time)evals/evals.json— test cases
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: mapuamap
- Source: mapuamap/denys-fast-mskills
- License: Apache-2.0
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.