Delivery Common

Use Worker Dialogue for worker dispatch through the start skill and for each target's shared understanding, design preflight, and implementation: workers draft, and the coordinator asks the user. Use Local Review when a delivery workflow reaches its local reviews or selects focused follow-up, and apply its Assess findings to local and hosted findings. Use Risk Tier to set the tier before preflight and on each reviewed head, and to select the tier's review procedure, including the security reviewer and the recommended human review. Local Review also sets local review escalation, advancement, and round limits. Use Delivery Completion for the progress record, resume, the decision summary shown before publication and at merge, the published-head check and advance after publication, the merge confirmation, bounds, the final report and Complete rule, and follow-up candidates. Apply Missing Prerequisites whenever a phase lacks what it needs, and Foreground Checks to every delegated worker and reviewer and to each result they return.

The calling workflow owns implementation, assessment decisions, how its hosted review runs, publication, and approvals; Delegated Authorization says how those approvals pass to the skills it calls. Where shared text names the calling workflow's additions, the calling workflow lists its provider-specific items next to its link. Return the completed results, review scope, reviewed snapshot, and tier to that caller.

Delegated Authorization

A delegated call carries the user's actual request, the exact target, and the existing approvals. The caller forwards them to each skill it calls; the called skill acts only within them and, before an action they do not cover, prepares the concrete result and asks for the missing approval. A skill reference, automatic selection, or automatic discovery authorizes nothing. Reuse approval already given for the same scope instead of asking again. Each called skill keeps its own approval model: what an explicit request approves and what still needs asking.

The PR, review request, and Codex review cycle skills and the delivery skills of both providers link this section instead of restating it.

Missing Prerequisites

A missing prerequisite, such as a component skill, a required reviewer, or a tool a step runs, stops the phase that needs it for the affected targets. Report it as a blocker, naming what is missing and, for a skill, the profile that installs it, such as base,github. Never install it, substitute another skill or an informal check for it, or skip the phase. Independent work that does not depend on it continues under Delivery Completion's Bounds. The delivery skills of both providers and Local Review link this section instead of restating it.

Foreground Checks

A delegated worker or reviewer runs every command whose result it awaits, including tests, builds, watchers, and review tool runs, in the foreground with a time bound, and never ends its turn waiting on a background job. It ends a turn only with a completed result, a question, or a blocker; a command that reaches its time bound is a failed check to report.

The coordinator acts on each agent's turn-end notice when it arrives instead of deferring it to a later check. An idle agent whose last message says it is waiting has returned no result: check whether the job it names is running, then resume the agent once, telling it to finish the command in the foreground with a time bound and return the result. If it ends its turn waiting again, or the job is hung, report the target as Blocked under Delivery Completion's Bounds. Where the host gives no notice when an agent's turn ends, report that limitation and do not end your own turn while an agent is outstanding.

The start skills' worker rules, Worker Dialogue, and Local Review link this section instead of restating it.

Shared Scripts

scripts/check-branch-name.mjs is the shared safe branch name check. The start, delivery, PR, and cleanup skills of every provider, including Beads, run it from their own step; its header gives the usage and exit codes.

scripts/check-push-target.mjs is the shared push target rule check. The PR publish skills of both providers, and github-pr-create and github-pr-codex-review-cycle, run it to resolve the push remote and to check the upstream before and after the push; its header gives the usage and exit codes.

scripts/check-cleanup-targets.mjs is the shared remote branch deletion check and cleanup target manifest. The worktree cleanup skills of both providers run it to decide whether to delete the remote branch, to build the targets the user confirms or a Caller preview, and to compare them right before any removal; its header gives the usage and exit codes.