skills/dag-orchestrator/SKILL.md
The intelligence layer of WinDAGs. Decomposes natural language tasks into Hierarchical Task DAGs (HTDAGs), matches subtasks to skills, executes waves in parallel, and dynamically expands nodes when complexity exceeds executor capability. Use for 'orchestrate', 'execute DAG', 'parallel agents', 'decompose task', 'coordinate skills'. NOT for single-skill tasks or simple linear workflows.
npx skillsauth add curiositech/windags-skills dag-orchestratorInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
The beating heart of WinDAGs. Transforms arbitrary natural language tasks into parallelized agent graphs that execute in waves, adapting dynamically to task complexity and executor capabilities.
Task Complexity Assessment:
├─ Single verb, single output file? → Use single-skill task
├─ 2-3 clear sequential steps? → Use linear workflow
├─ Multiple independent components? → Use parallel DAG
├─ Requires research phase? → Use phase orchestration
└─ Unclear requirements? → Start shallow, expand on failure
Subtask Relationship Analysis:
├─ All must succeed for parent success? → AND composition
├─ Any success satisfies parent goal? → OR composition
├─ Primary approach with fallbacks? → Mixed (AND primary, OR fallbacks)
└─ Exploration of multiple options? → OR with confidence weighting
Task Complexity Heuristics:
├─ Simple CRUD operations? → max_depth = 2
├─ Feature development? → max_depth = 3
├─ System architecture? → max_depth = 4
├─ Research + implementation? → max_depth = 5
└─ If >5 levels needed → Use phase orchestration instead
File Conflict Analysis:
├─ Predicted file overlap? → Force sequential execution
├─ Singleton operations (build/test)? → Isolate in separate wave
├─ Independent file modifications? → Safe to parallelize
└─ Database/config changes? → Serialize critical sections
Executor Failure Response:
├─ depth < max_depth? → Decompose failed node into sub-DAG
├─ depth >= max_depth? → Mark dependents as skipped, continue independents
├─ Critical path failure? → Halt DAG, report blocking issue
└─ Low confidence result? → Flag for review, continue with warnings
Symptoms: DAG has >15 nodes in single level, execution takes >10 minutes
Detection: if nodeCount > 15 || estimatedTime > 600s
Fix: Group related subtasks into composite nodes, increase abstraction level
Symptoms: Topological sort fails, "cyclic dependency" error in wave computation
Detection: if waves.length === 0 && nodes.length > 0
Fix: Identify cycle using DFS, break with intermediate artifact or merge conflicting nodes
Symptoms: File conflicts, race conditions, inconsistent final state
Detection: if conflictingFiles.length > 0 || inconsistentOutputs
Fix: Add explicit dependencies, use sequential waves for conflicting operations
Symptoms: Depth keeps increasing, same task fails repeatedly at leaf level
Detection: if depth > max_depth && taskId appears in call stack
Fix: Flag task as requiring human skill creation or use general-purpose fallback
Symptoms: Later waves fail due to missing information from earlier waves
Detection: if waveN.inputs.missing.length > 0
Fix: Ensure explicit context passing between waves, add context aggregation nodes
Initial Assessment: Complex multi-component task → Use parallel DAG with max_depth=4
Wave 0 Decomposition:
// Initial breakdown
subtasks = [
"Design user data schema", // skill: database-architect
"Create login/signup API endpoints", // skill: api-architect
"Build frontend auth components", // skill: react-developer
"Set up JWT token handling", // skill: security-engineer
"Write authentication tests" // skill: test-engineer
]
Dependency Analysis:
Final Wave Structure:
Wave 0: [Design schema]
Wave 1: [Create API endpoints] (depends on schema)
Wave 2: [Build frontend, Set up JWT] (parallel, both depend on API)
Wave 3: [Write tests] (depends on all above)
Execution with Failure:
// Wave 1 executor fails on "Create API endpoints" - too complex
if (executorResult.failed && depth < maxDepth) {
// Decompose the failing node
const apiSubtasks = [
"Define authentication routes",
"Implement password hashing",
"Add session management",
"Create user CRUD operations"
];
// Execute sub-DAG, then continue main DAG
}
Expert vs Novice:
Don't use DAG Orchestrator for:
Delegate instead:
tools
Building resilient distributed systems with circuit breakers, retries with full-jitter exponential backoff, retry budgets (per-request 3-attempt + per-client 10% ratio per Google SRE), deadline propagation, and the cascading-failure math (4 layers × 3 retries = 64x amplification). Grounded in Resilience4j, Microsoft Cloud Patterns, AWS Architecture Blog (Marc Brooker), and Google SRE Book.
testing
Designing HTTP cache headers that work correctly across browsers, CDNs, and shared proxies — `Cache-Control` directives per RFC 9111, `stale-while-revalidate` and `stale-if-error` per RFC 5861, the Vary header for varying responses, and surrogate keys for tag-based purging. Grounded in IETF RFCs and Cloudflare/Fastly docs.
development
Use when designing or fixing a Content Security Policy on a real site, choosing between nonce-based and hash-based CSP, adding strict-dynamic, debugging "Refused to execute inline script" errors, deploying CSP in report-only mode first, configuring report-to / report-uri, or auditing an existing policy for unsafe-inline / unsafe-eval / wildcards. Triggers: "CSP blocks legitimate inline script", strict-dynamic, nonce-{RANDOM}, sha256-{HASH}, object-src none, base-uri none, frame-ancestors, Trusted Types, X-Content-Security-Policy obsolete, report-only vs enforced. NOT for general HTTP security headers (HSTS, COOP/COEP), Trusted Types deep dive, CORS configuration, or building a WAF.
tools
Choosing and operating an HTTP API versioning strategy that doesn't break clients — Stripe's date-based pinned versions, the Deprecation/Sunset header pair (RFC 9745 + RFC 8594), URI vs header vs media-type approaches, and the version-transformer pattern. Grounded in Stripe's published architecture and IETF RFCs.