validate-implementation-plan

This skill is an orchestrator that audits an implementation plan for requirements traceability, avoidable complexity, risky assumptions, and evidence gaps, producing a standalone audit report without ever overwriting the source plan. It solves the problem of AI-generated or human-authored plans containing untraceable scope, speculative complexity, or unstated assumptions that only surface during implementation.

A notable feature is its security-first design: the source plan is explicitly treated as untrusted data. Only a dedicated plan-snapshotter subagent reads the raw plan path, and every later stage works from a sanitized, redacted snapshot, numbered requirements, and structured findings rather than raw plan text. Execution is modeled as a strict finite-state machine with a mermaid flow diagram and transition table, retry budgets, and terminal states, and the orchestrator coordinates specialized subagents: a requirements extractor and auditor for traceability, a YAGNI auditor for speculative scope, an assumptions auditor for weak assumptions, an optional technical researcher for local evidence, and a plan annotator that writes the final report. It maintains a strict allow-list of readable paths, refuses to widen it, treats project-specific external website proof as never being valid evidence, and only writes to the snapshot and output paths. The output is a contract-shaped report with pass/fail/blocked/error status and counts of critical, warning, and info findings plus open questions.

Target users are engineering leads, architects, and developers who want a rigorous, tamper-resistant review of a design or implementation plan before committing to build. It is read-and-report oriented with careful trust boundaries and no destructive behavior.