skills/task-lifecycle/SKILL.md
# Task Lifecycle — Agent PM System Manage the task pipeline. All commands use `$TASKCTL` from the project root. ```bash TASKCTL="node --import tsx scripts/taskctl.ts" ``` --- ## How It Works Agents work in **isolated task folders** — never touching source code directly. Changes flow through automated validation and human approval before landing in the codebase. ``` QUEUED ──→ IN_PROGRESS ──→ REVIEW ──→ DONE │ │ (gate fail) (reject/test fail)
npx skillsauth add aura-industry/aurawallet skills/task-lifecycleInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Manage the task pipeline. All commands use $TASKCTL from the project root.
TASKCTL="node --import tsx scripts/taskctl.ts"
Agents work in isolated task folders — never touching source code directly. Changes flow through automated validation and human approval before landing in the codebase.
QUEUED ──→ IN_PROGRESS ──→ REVIEW ──→ DONE
│ │
(gate fail) (reject/test fail)
│ │
▼ ▼
QUEUED ◄────────────┘ (attempts < 3, retry)
FROZEN ◄────────────┘ (attempts >= 3, human intervenes)
{project_root}/tasks/task-{id}/changes/ and creates /new/| Status | Meaning |
|--------|---------|
| OPEN | Created, not yet queued for agents |
| QUEUED | Ready for agent pickup |
| IN_PROGRESS | Agent working in task folder |
| REVIEW | Gate check passed, awaiting human approval |
| DONE | Approved, swapped into source, archived |
| FROZEN | 3+ failures, needs human investigation |
| HUMAN | Reserved for human-only work |
| CANCELED | Abandoned or superseded |
{project_root}/tasks/task-{id}/
/changes/ ← copies of allowed source files to modify
/new/ ← new files the agent creates
Agents MUST:
changes/ that are listed in allowed_modifynew/ matching allowed_create patternsmax_lines_changed (default: 200)Agents MUST NOT:
allowed_modifyforbidden paths (global or per-project)can_add_dependencies is true| Field | Type | Purpose |
|-------|------|---------|
| allowed_modify | JSON array | Files the agent may edit |
| allowed_create | JSON array | Glob patterns for new files |
| max_lines_changed | integer | Max total line diff |
| can_add_dependencies | boolean | Allow package.json changes |
| module | string | Module this task touches |
| attempts | integer | Rejection count |
| last_error | string | Last rejection reason |
Automated validation that runs before a task reaches REVIEW. Auto-rejects if:
allowed_modifyallowed_create patternsforbidden globs (global + per-project merged)max_lines_changedcan_add_dependencies is false$TASKCTL gate-check --task N [--json] # Exit 0 = pass, Exit 2 = fail
API: POST /api/tasks/{N}/gate-check → { ok, passed, violations[], filesChanged[], filesCreated[], linesChanged }
On rejection (gate fail, test failure, human reject):
attempts increments by 1, last_error records reasonFrozen tasks require human intervention: rewrite spec + reset attempts, or kill.
Applies an approved REVIEW task into the source tree:
changes/ files into sourcenew/ files into projecttest_command config, 120s timeout)$TASKCTL swap --task N [--json] # Execute swap
$TASKCTL swap --task N --dry-run [--json] # Preview without committing
API: POST /api/tasks/{N}/swap (body: { dryRun?: boolean }) → 200 success, 422 test failure, 409 not in REVIEW
Tracks file ownership across concurrent tasks. First task to swap wins — conflicting tasks get invalidated and requeued.
$TASKCTL file-locks --task N [--json] # List active locks
$TASKCTL file-conflicts --task N [--json] # Check for overlapping locks
API: GET /api/tasks/{N}/file-locks, GET /api/tasks/{N}/file-conflicts
Temporarily copy task files into source for visual review. One preview at a time. No git operations — clean restore guaranteed.
$TASKCTL preview-start --task N [--json] # Copy task files to source
$TASKCTL preview-stop [--json] # Restore source to original state
Assembles the agent prompt when a task starts. Total must stay under 4000 lines.
Assembly order:
project_framing config + task description + allowed filesTruncation order if over limit: example first, then adjacent interfaces.
# Pick next task, claim it, and start
$TASKCTL pick-and-claim --owner my-agent [--tag TAG] [--json]
$TASKCTL update-task-status --task N --owner my-agent --status IN_PROGRESS [--json]
# Or use the shortcut
$TASKCTL next --owner my-agent [--json]
# When done
$TASKCTL done --task N --owner my-agent [--json]
# Approve a REVIEW task (swap + cascade-unblock)
$TASKCTL approve --task N [--json]
# On failure
$TASKCTL fail --task N --owner my-agent --error "reason" [--json]
# List and view
$TASKCTL list-tasks [--status S] [--tag TAG] [--json]
$TASKCTL show-task --task N [--json]
$TASKCTL my-tasks --owner O [--json]
$TASKCTL stats [--json]
# Create and edit
$TASKCTL create-task --title "..." --slug "..." [--priority P0|P1|P2] [--json]
$TASKCTL quick-create --title "..." [--json]
$TASKCTL update-task --task N --title "..." [--json]
# Status transitions
$TASKCTL update-task-status --task N --owner O --status S [--json]
$TASKCTL pick-task [--tag TAG] [--json]
$TASKCTL pick-and-claim [--tag TAG] --owner O [--json]
$TASKCTL claim-lock --task N --owner O [--json]
$TASKCTL release-lock --task N --owner O [--json]
$TASKCTL reap-stale-locks [--json]
# Tags
$TASKCTL add-tag --task N --tag T [--json]
$TASKCTL remove-tag --task N --tag T [--json]
$TASKCTL list-tags [--task N] [--json]
# Dependencies
$TASKCTL add-dep --task N --depends-on M [--json]
$TASKCTL remove-dep --task N --depends-on M [--json]
$TASKCTL list-deps --task N [--json]
# Hierarchy
$TASKCTL set-parent --task N --parent M [--json]
$TASKCTL remove-parent --task N [--json]
$TASKCTL list-subtasks --task N [--json]
# Comments
$TASKCTL comment --task N --author A --body "..." [--json]
$TASKCTL list-comments --task N [--json]
# Config (global)
$TASKCTL config-get --key K [--json]
$TASKCTL config-set --key K --value V [--json]
$TASKCTL config-list [--json]
# Templates
$TASKCTL list-templates [--json]
$TASKCTL show-template --name N [--json]
# Gate check
$TASKCTL gate-check --task N [--json]
# Swap
$TASKCTL swap --task N [--dry-run] [--json]
# Approve (swap + cascade-unblock dependents)
$TASKCTL approve --task N [--json]
# File locks
$TASKCTL file-locks --task N [--json]
$TASKCTL file-conflicts --task N [--json]
# Preview
$TASKCTL preview-start --task N [--json]
$TASKCTL preview-stop [--json]
# Backlog
$TASKCTL backlog-status [--json]
Config is layered: per-task spec > per-project config > global config. Per-project can only further restrict, never loosen global rules.
Set once, applies to all projects.
| Key | Default | Purpose |
|-----|---------|---------|
| global_forbidden | ["core/*"] | Glob patterns no agent may touch |
| max_concurrent_tasks | 5 | Max tasks in IN_PROGRESS at once |
| default_max_lines_changed | 200 | Default line limit per task |
| default_can_add_dependencies | false | Default dependency policy |
Stored in project_config table. Overrides global for tasks scoped to that project. Falls back to global when unset.
| Key | Purpose |
|-----|---------|
| global_forbidden | Additional forbidden globs (merged with global) |
| test_command | Test runner command (e.g. npx vitest run, npm test, pytest) |
| project_framing | Context builder framing text for this project |
| source_dir | Source directory name (default: src) |
| dashboard_port | Dev server port for preview |
# Set per-project config
$TASKCTL config-set --project P --key test_command --value "npm test"
$TASKCTL config-set --project P --key global_forbidden --value '["core/*","migrations/*"]'
# View merged config for a project
$TASKCTL config-list --project P
# Register project
$TASKCTL create-project --name "my-app" --root /path/to/my-app
# Set project-specific config
$TASKCTL config-set --project 1 --key test_command --value "npm test"
$TASKCTL config-set --project 1 --key global_forbidden --value '["core/*","db/migrations/*"]'
$TASKCTL config-set --project 1 --key project_framing --value "You are modifying a React dashboard app."
| Method | Endpoint | Purpose |
|--------|----------|---------|
| GET | /api/tasks | List tasks (query: status, q, limit, offset) |
| GET | /api/tasks/pick | Pick next queued task |
| POST | /api/tasks/create | Create task |
| GET | /api/tasks/{N} | Task detail |
| POST | /api/tasks/{N}/claim | Acquire lock |
| POST | /api/tasks/{N}/release | Release lock |
| POST | /api/tasks/{N}/transition | Transition status |
| POST | /api/tasks/{N}/gate-check | Run gate check |
| POST | /api/tasks/{N}/swap | Execute swap |
| GET | /api/tasks/{N}/file-locks | List active file locks |
| GET | /api/tasks/{N}/file-conflicts | Check file conflicts |
| POST | /api/tasks/{N}/tags | Add tag |
| DELETE | /api/tasks/{N}/tags | Remove tag |
| GET | /api/tasks/{N}/comments | List comments |
| POST | /api/tasks/{N}/comments | Add comment |
| GET | /api/config | List global config |
| POST | /api/config | Set global config |
| Service | File | Function |
|---------|------|----------|
| Task Folder | src/core/task-folder-service.ts | provisionTaskFolder(dbFile, taskNum) |
| Gate Check | src/core/gate-check-service.ts | runGateCheck(dbFile, taskNum) |
| Circuit Breaker | src/core/circuit-breaker.ts | handleRejection(dbFile, taskNum, reason) |
| Swap | src/core/swap-service.ts | swapTaskIntoSrc(dbFile, taskNum, opts?) |
| File Locks | src/core/file-lock-service.ts | acquireFileLocks(), releaseFileLocks(), invalidateConflicts() |
| Preview | src/core/preview-service.ts | startPreview(dbFile, taskNum), stopPreview(dbFile) |
| Context Builder | src/core/context-builder.ts | buildAgentContext(dbFile, taskNum) |
| Global Config | src/core/global-config-service.ts | getConfig(), setConfig(), listConfig() |
| Project Config | src/core/project-service.ts | getProjectConfig(), setProjectConfig(), listProjectConfig() |
Full spec: public/agent-project-management.md
tools
AuraWallet — local secrets manager, credential agent, and crypto wallet. TRIGGER when: user mentions secrets, credentials, passwords, API keys, tokens, wallets, sending/swapping/funding crypto, login details, credit card info, sharing secrets, or "auramaxx"/"aura" by name. Also trigger for: "log into my <service>", "what is my <service> password", "run this with my <secret>", injecting env vars from stored credentials, diary/logging entries, or wallet balance/transaction requests. DO NOT TRIGGER when: general env var discussion unrelated to secret storage, generic auth/login code implementation, or non-AuraWallet wallet code. Provides: secret CRUD (list/get/set/inject/share/delete), human-approval auth flows, crypto wallet ops (send/swap/fund/balance), daily diary logging, and MCP tool integration. Prefer MCP tools when available; fall back to CLI.
development
Maintainer-only workflow for handling GitHub Secret Scanning alerts on OpenClaw. Use when Codex needs to triage, redact, clean up, and resolve secret leakage found in issue comments, issue bodies, PR comments, or other GitHub content.
development
Maintainer workflow for OpenClaw releases, prereleases, changelog release notes, and publish validation. Use when Codex needs to prepare or verify stable or beta release steps, align version naming, assemble release notes, check release auth requirements, or validate publish-time commands and artifacts.
development
Run, watch, debug, and extend OpenClaw QA testing with qa-lab and qa-channel. Use when Codex needs to execute the repo-backed QA suite, inspect live QA artifacts, debug failing scenarios, add new QA scenarios, or explain the OpenClaw QA workflow. Prefer the live OpenAI lane with regular openai/gpt-5.4 in fast mode; do not use gpt-5.4-pro or gpt-5.4-mini unless the user explicitly overrides that policy.