plugins/github-copilot-modernization/skills/creating-implementation-plan/SKILL.md
Creates an implementation plan AND task breakdown from a feature spec by consuming design artifacts. Produces plan.md with implementation steps, inline task list with full REQ traceability, and a Requirement Mapping table. This is the single skill for planning + decomposition. Triggers: "create implementation plan", "plan for implementation", "assemble implementation plan", "generate plan from spec", "break down tasks", "generate tasks from plan", "create implementation tasks", "decompose the plan into work items". NOT for: architecture analysis (use analyzing-architecture), implementation (use implementing-code), coordinator task decomposition.
npx skillsauth add microsoft/github-copilot-modernization creating-implementation-planInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
You MUST consider the user input before proceeding (if not empty).
All outputs are written under your task's Artifact path: (from task metadata).
plan.md ← main artifact: plan + task breakdown + requirement mapping table
research.md ← resolved spec-level unknowns (if any)
checkpoints/spec-to-plan.yaml ← REQ-XXX → plan item traceability
checkpoints/plan-to-tasks.yaml ← plan item → task traceability
REQ-XXX requirement IDs.constitution.md for principles and constraints.knowledge-graph.json (if available) for architecture understanding.## Dependency Artifacts metadata. These typically include architecture analysis, data model, API contracts, UX patterns, and feature specs — but filenames follow the <taskId>-<role>.md convention, not fixed names.project-topology.md in the artifacts directory) if it exists. Extract the module group table (G1, G2, ...) and their scope (in-scope / context-only). These G-group labels will be used in Step 3 and Step 4 to tag plan items and tasks.Ownership boundary:
analyzing-architectureproduces codebase research and design artifacts. This step only resolves spec-level unknowns (NEEDS CLARIFICATION items, technology choices not yet decided). If codebase research is missing, escalate.
research.md (only if there were unknowns to resolve):
templates/plan-template.md):
skills/guidelines/ for matching tech patterns. Document under "Applied Guidelines".### Step 3: [G1] Payment gateway integration). Cross-cutting steps that span all groups use [Cross-cutting] instead. This enables downstream DAG generation to extract group membership directly from the plan.plan.md section by section (write each section before moving to the next):
a. Header + Summary
b. Technical Context (from design artifacts)
c. Constitution Check
d. Applied Guidelines
e. Implementation Steps (phases with plan items, each referencing REQ-XXX)
f. Project StructureFor each implementation phase in the plan, expand every plan item into concrete tasks:
Task format (each task on its own line):
- [ ] T001 [G?] [P?] [Story?] [Plan:X.Y] Description with exact file path [Source: path/to/file.java#method] [BL: BL-XXX]
Format components:
- [ ][G1], [G2], [Cross-cutting] etc. REQUIRED when project topology exists — inherited from the plan item's G-group tag (Step 3.5). Omit when no project topology.[US1], [US2] etc. Required for user story phases only; omit for Setup/Foundational/Polish phases[Plan:2.1,2.3][Source: src/.../File.java#method1,method2]Rewrite Mode Source Annotation Rules:
#, comma-separated[Source:] annotations#[Source:]Task organization:
Write tasks inline in plan.md under each phase — do NOT create a separate tasks/ directory. Tasks are embedded in the plan document for coherence.
After writing all tasks, generate checkpoint files using the templates:
checkpoints/spec-to-plan.yaml — using templates/spec-to-plan-checkpoint-template.yamlcheckpoints/plan-to-tasks.yaml — using templates/plan-to-tasks-checkpoint-template.yamlExamples:
- [ ] T001 [Plan:1.1] Create project structure per implementation plan
- [ ] T005 [P] [Plan:2.1] Implement auth middleware in src/middleware/auth.py
- [ ] T012 [P] [US1] [Plan:2.2] Create User model in src/models/user.py
- [ ] T015 [US3] [Plan:3.2] Convert ProductAction to ProductController [Source: src/.../ProductAction.java#list,add]
After all phases and tasks are written, append this section to plan.md:
## Requirement Mapping
| REQ ID | Description | Plan Items | Implementation Evidence |
|--------|-------------|------------|------------------------|
| REQ-001 | [short description] | P2.1, P3.2 | AuthController.java, UserService.java |
| REQ-002 | [short description] | P3.1 | ProductRepository.java |
Rules:
Plan Items lists which plan item IDs address this requirementImplementation Evidence describes what files/classes will prove completion (fill based on the tasks you just wrote)Report completion with:
Before generating the plan, check for applicable guidelines:
skills/guidelines/ for matching patterns.templates/plan-template.md — Implementation plan document templatetemplates/tasks-template.md — Task list structure templatetemplates/spec-to-plan-checkpoint-template.yaml — REQ traceability checkpoint templatetemplates/plan-to-tasks-checkpoint-template.yaml — Plan-to-tasks traceability checkpoint templatereferences/task-format.md — Task checklist format rules: [P], [Plan:X.Y], [Source:] annotations, rewrite mode requirementsdevelopment
Scan dependency manifests against known CVEs and remediate by upgrading vulnerable dependencies to patched versions, then rebuild and re-scan to confirm. Self-contained scan→fix→verify loop for any project with a dependency manifest. Use when: a cve-remediation task is dispatched; dependency set changed (version bump, new framework); assessment flagged vulnerable or EOL dependencies; or user asked to "fix CVEs", "patch vulnerabilities", or "dependency security". Triggers: "cve", "remediate cve", "fix cves", "patch vulnerable dependencies", "vulnerability scanning", "dependency security", "vulnerable dependencies", "security advisories", "npm audit", "pnpm audit", "maven audit", "gradle audit", "dependency scan", "vulnerability remediation". NOT for: security audit of auth/input/secrets/OWASP code paths (use security-review).
development
Generate dependency map diagram from project build files
documentation
Generate data architecture and persistence layer documentation with data model diagram
documentation
Generate core business workflow documentation with sequence diagram