skills/spec-plan/SKILL.md
Write implementation plans, iterate with human annotations, create structured tasks. Use when there's an approved spec (design.md) and the next step is breaking it into implementable work. Trigger when the user says "write a plan", "plan this out", "break this down", "I added notes" (annotation cycle), or after spec-brainstorm completes. Also trigger for "create tasks" or "add to beads". Do NOT use for research (use spec-brainstorm) or execution (use spec-implement).
npx skillsauth add martinffx/claude-code-atelier spec-planInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Write a plan so clear that any engineer can follow it. Let the human tear it apart through annotation cycles until it's right. Then create structured tasks. This skill does not write code.
docs/specs/YYYY-MM-DD-<feature-name>/
├── design.md ← From spec-brainstorm (approved)
└── plan.json ← This skill's output
The plan starts as a markdown draft for human annotation, then gets converted to structured plan.json when approved.
{
"feature": "user-authentication",
"spec": "docs/specs/2026-03-08-user-auth/design.md",
"goal": "Add email/password authentication with session management",
"phases": [
{
"id": "P1",
"name": "Domain Model",
"tasks": [
{
"id": "T1",
"name": "Implement UserEntity with validation",
"depends_on": [],
"inputs": [
"User schema from design.md",
"Validation rules (email format, password strength)"
],
"description": "Create UserEntity with email and password fields. Implement validation using a Result type. Password must be hashed, never stored plaintext.",
"files": {
"create": ["src/entities/user.ts", "tests/entities/user.test.ts"],
"modify": []
},
"validation": {
"tests": [
"rejects empty email",
"rejects invalid email format",
"rejects weak password",
"accepts valid user input"
],
"acceptance": [
"All validation tests pass",
"User.fromRequest returns Result<User>",
"No direct throws — all errors via Result"
]
}
}
]
}
]
}
| Field | Type | Description | |-------|------|-------------| | feature | string | Kebab-case feature name | | spec | string | Path to the approved design.md | | goal | string | One-sentence goal | | phases | Phase[] | Implementation phases in dependency order |
| Field | Type | Description | |-------|------|-------------| | id | string | Phase identifier (P1, P2...) | | name | string | Phase name (e.g. "Domain Model", "Data Access") | | tasks | Task[] | Tasks within this phase |
| Field | Type | Description | |-------|------|-------------| | id | string | Task identifier (T1, T2...) | | name | string | What this task implements | | depends_on | string[] | Task IDs that must complete first | | inputs | string[] | What you need to know before starting | | description | string | What to build, key decisions, constraints | | files | {create, modify} | Files to create and modify | | validation | {tests, acceptance} | How to verify the task is done |
Read the approved design.md, then write a plan as a markdown section in the same document or as a separate draft.
Write assuming the implementer:
Each task should be self-contained and include:
No exact code snippets. No implementation details. The task says WHAT and HOW TO VERIFY, not HOW to write the code.
Follow bottom-up dependency ordering from oracle-architect:
Entity → Repository → Service → Router/Consumer
Each task should take 15-60 minutes. If larger, decompose into smaller tasks.
Tell the human: "Plan draft is ready for review."
STOP. Wait for human review.
The human annotates the plan draft directly — adding corrections, rejections, domain knowledge, business constraints, or "remove this entirely."
You write plan → Human adds inline notes → You address all notes → Repeat 1-6x
When the human says "I added notes":
The "don't implement yet" guard is sacred. The plan is not ready until the human explicitly approves it.
| Pattern | Example | What to do | |---------|---------|------------| | Correct assumptions | "use PATCH not PUT" | Fix it | | Reject approaches | "remove caching, we don't need it" | Cut cleanly | | Add constraints | "queue consumer already handles retries" | Restructure | | Override choices | "use drizzle:generate, not raw SQL" | Direct override | | Redirect sections | "visibility on the list, not items" | Rethink section | | Trim scope | "remove download, not implementing now" | Remove, no stubs |
When the human approves — "looks good", "approved", "create tasks" — convert the plan into plan.json.
Preferred: Use beads for dependency-aware task tracking:
# Create epic and tasks with dependencies
bd create "Feature: {name}" --label {feature} --type epic
bd create "Task: {name}" --label {feature} --type task --epic {epic-id}
bd dep add --type blocks {task-a} {task-b} # task-a blocks task-b
Fallback: If beads is not available, use the harness's native todo system. The harness provides todo management — use it directly.
depends_on fieldsbd dep add, harness: manual ordering)After creating plan.json, verify:
When plan.json is created and tasks exist, the next step is spec-implement.
Tell the human:
"Plan is approved and tasks are created. Ready to start implementation?"
Autonomous — I'll work through all tasks, only stopping if blocked.
Batched — I'll do 3-5 tasks at a time, then report and wait for feedback.
Do not start implementing. That's spec-implement's job.
If implementation reveals missing tasks, update plan.json. If design is wrong, loop back to research. See spec-orchestrator for iteration patterns.
| Human says | You do | |------------|--------| | "write a plan" / "plan this" | Step 1 → write plan draft, stop | | "I added notes" | Re-read, address all notes, do NOT implement | | "don't implement yet" | Update plan only | | "looks good" / "approved" / "create tasks" | Step 3 → create plan.json + task tracking |
development
Security architecture and threat modeling knowledge. Auto-invokes when designing features that handle untrusted data, authentication, authorization, external integrations, file uploads, or sensitive data. Provides risk assessment frameworks, trust boundary analysis, and security design principles — not implementation code.
testing
Adversarial review of non-trivial decisions using fresh-context scrutiny. Use when correctness matters more than speed, when stakes are high (production, security-sensitive logic, irreversible operations), or before committing significant architectural or implementation choices.
development
Compact the current conversation into a handoff document for another agent to pick up.
testing
Socratic interrogation of plans against the project's domain model and documented decisions. Use when the user wants to stress-test a plan, clarify terminology, or validate assumptions against existing domain language. Updates CONTEXT.md and ADRs inline as decisions crystallise.