Orchestrating Capability Development

• Develop a complete security capability from concept to tested artifact
• Create VQL capabilities for Velociraptor-based detection
• Write Nuclei templates for vulnerability scanning
• Build Janus tool chains for security scanner orchestration
• Implement Fingerprintx modules for service detection
• Integrate external security scanners into the platform

Symptoms this skill addresses:

• Manual orchestration of capability-specific agents
• Missing architecture approval for security detection logic
• Inconsistent quality checks across capability types
• No structured workflow for VQL/Nuclei/Janus development
• Lost context between development phases

State Tracking (MANDATORY)

MUST use TodoWrite BEFORE starting any orchestration workflow.

Multi-phase orchestration involves coordinating multiple agents. Without external state tracking, context drift causes forgotten phases, repeated spawns, and missed verification steps.

Create TodoWrite items for each phase BEFORE spawning any agents.

Standard Phase Template

G = Compaction Gate - BLOCKING checkpoint requiring compaction-gates.md protocol before next phase.

Work Types: BUGFIX, SMALL, MEDIUM, LARGE (determined in Phase 2: Triage)

Phase Skip Matrix:

Quick Reference

Configuration

This skill uses .claude/config/orchestration-limits.yaml:

No Unilateral Overrides: Agents MUST NOT override config values. To change limits, update the config file or get user approval via AskUserQuestion.

Phase-Specific References

• Phase 1: Setup - Worktree creation, output directory, MANIFEST.yaml
• Phase 2: Triage - Work type classification (BUGFIX/SMALL/MEDIUM/LARGE)
• Phase 3: Codebase Discovery - Explore agent patterns, capability type detection
• Phase 4: Skill Discovery - Technology-to-skill mapping, gap detection, background research orchestration
• Phase 5: Complexity - Technical assessment, execution strategy
• Phase 6: Brainstorming - Design refinement with human-in-loop (LARGE only)
• Phase 7: Architecture Plan - Technical design AND task decomposition
• Phase 8: Implementation - Capability artifact development
• Phase 9: Design Verification - Plan-to-implementation matching
• Phase 10: Domain Compliance - Capability-specific mandatory patterns
• Phase 11: Code Quality - Capability review for detection accuracy
• Phase 12: Test Planning - Test strategy and plan creation
• Phase 13: Testing - Test implementation and execution
• Phase 14: Coverage Verification - Coverage threshold validation
• Phase 15: Test Quality - Assertion quality, no low-value tests
• Phase 16: Completion - Final verification, PR, cleanup

Compaction Gates

BLOCKING checkpoints at phase transitions where context accumulates:

Protocol: See compaction-gates.md for:

• 5-step compaction procedure
• "What to Compact / What to Keep" tables
• Capability-specific content lists
• Rationalization counters

Agent Matrix for Capability Development

Capability Type Matrix

See capability-types.md for complete comparison.

Capability-Specific Domain Compliance (Phase 10)

Capability development has specific P0 requirements by type:

VQL Capabilities

Nuclei Templates

Janus/Fingerprintx/Scanner

See Phase 10: Domain Compliance for full checklist.

Tight Feedback Loop (Phases 8-11-13)

Implementation->Review->Test cycle with automatic iteration when review or tests fail.

• Max iterations: Read from orchestration-limits.yaml
• Tracks iteration history in {OUTPUT_DIR}/feedback-scratchpad.md

Pattern: See tight-feedback-loop.md

Checkpoint Configuration

Human approval required at specific phases based on work type:

For large plans (>5 tasks), add intermediate checkpoints during implementation.

See checkpoint-configuration.md for capability-specific configuration.

Parallel Execution

When tasks are independent, spawn in a SINGLE message:

// Phase 7: Architecture - spawn leads in parallel
Task("capability-lead", "Design capability architecture...");
Task("security-lead", "Security assessment...");

// Phase 13: Testing - spawn testers in parallel
Task("capability-tester", "Unit tests for detection logic...");
Task("capability-tester", "Integration tests for tool chain...");
Task("capability-tester", "Edge case tests for false positives...");

Do NOT spawn sequentially when tasks are independent.

File Scope Boundaries

When spawning parallel agents:

Path locations:

• External (migrated): {CAPABILITIES_ROOT}/modules/{capability}/
• Internal (not yet migrated): modules/{module}/ (all modules in the super-repo, including chariot, janus, tabularium, chariot-aegis-capabilities, msp-definitions, praetorian-cli, etc.)

Internal module scope includes:

• modules/chariot/backend/ - Guard backend capabilities, handlers, and tasks
• modules/tabularium/ - Shared data models and schemas
• modules/janus/ - Security tool orchestration
• modules/chariot-aegis-capabilities/ - VQL capabilities
• Any other modules/ subdirectories required for capability development

See file-scope-boundaries.md for conflict detection protocol.

Rationalization Prevention

Read(.claude/skill-library/development/capabilities/orchestrating-capability-development/references/rationalization-table.md)

This file contains anti-rationalization counters for "Momentum Bias", "Context Seems Fine", and other compaction gate bypass patterns. </EXTREMELY-IMPORTANT>

See rationalization-table.md for capability-specific rationalizations.

Emergency Abort Protocol

Triggers: User request, 3+ escalations in same phase, critical security finding, unrecoverable error, cost/time exceeded.

Flow: Stop work -> Capture state -> Present cleanup options -> Execute cleanup -> Report final state.

See emergency-abort.md for configuration.

Capability Directory Structure

.worktrees/{capability-name}/
├── .capability-development/
│   ├── MANIFEST.yaml              # Capability metadata, status, metrics
│   ├── progress.md                # Session progress tracking
│   ├── skill-manifest.yaml        # Phase 4 output: technology-to-skill mapping
│   ├── discovery.md               # Phase 3 output: codebase patterns
│   ├── architecture.md            # Phase 7 output: technical design
│   ├── plan.md                    # Phase 7 output: implementation tasks
│   ├── feedback-scratchpad.md     # Iteration history for tight feedback loop
│   └── agents/                    # Agent output files
│       ├── capability-lead.md
│       ├── capability-developer.md
│       └── ...
└── [capability artifacts]         # Actual implementation (VQL/Nuclei/Go)

Quality Standards

Each capability type has specific quality targets:

See quality-standards.md for complete metrics.

Exit Criteria

Capability development is complete when:

• All applicable phases marked "complete" in MANIFEST.yaml (based on work type)
• Discovery artifacts generated (discovery.md, skill-manifest.yaml)
• Capability-type quality metrics met (detection accuracy, false positive rate)
• All reviewers returned verdict: APPROVED
• Test plan created and all tests implemented (quality_score >= 70)
• Final verification passed (build, lint, tests)
• Metrics tracked in MANIFEST.yaml (tokens, cost, iterations)
• Worktree cleaned up (merged and removed, OR kept per user request)
• User approves final result
• No rationalization phrases; all gate checklists passed; overrides documented

Integration

Called By

• /capability command - Primary entry point for users
• Parent orchestrators (multi-capability, scanner integration) - Via workflow handoff protocol

Requires (invoke before or at start)

• using-git-worktrees (LIBRARY) - Phase 1

  • Purpose: Create isolated workspace
  • Read(".claude/skill-library/workflow/using-git-worktrees/SKILL.md")

• persisting-agent-outputs (CORE) - Phase 1

  • Purpose: Discover output directory, set up workspace
  • skill: "persisting-agent-outputs"

• discovering-codebases-for-planning (CORE) - Phase 3

  • Purpose: Parallel discovery with dynamic agent count
  • skill: "discovering-codebases-for-planning"

Calls (skill-invocation via Skill tool)

• brainstorming (CORE) - Phase 6

  • Purpose: Design refinement with human-in-loop
  • skill: "brainstorming"

• writing-plans (CORE) - Phase 7

  • Purpose: Create detailed implementation plan
  • skill: "writing-plans"

• selecting-plugin-implementation-pattern (LIBRARY) - Phase 2

  • Purpose: YAML vs Go plugin decision
  • Read(".claude/skill-library/development/capabilities/selecting-plugin-implementation-pattern/SKILL.md")

• finishing-a-development-branch (LIBRARY) - Phase 16

  • Purpose: Verify, PR options, cleanup
  • Read(".claude/skill-library/workflow/finishing-a-development-branch/SKILL.md")

Spawns (agent-dispatch via Task tool)

• capability-lead + security-lead - Phase 7

  • Purpose: Architecture design and security assessment
  • Key mandatory skills: adhering-to-dry, adhering-to-yagni

• capability-developer - Phase 8

  • Purpose: Capability artifact implementation
  • Key mandatory skills: developing-with-tdd, verifying-before-completion

• capability-reviewer - Phase 11

  • Purpose: Code quality review for detection accuracy
  • Key mandatory skills: adhering-to-dry

• test-lead - Phases 12, 15

  • Purpose: Test strategy and quality validation
  • Key mandatory skills: None

• capability-tester ×3 - Phase 13

  • Purpose: Parallel test implementation (unit, integration, edge cases)
  • Key mandatory skills: developing-with-tdd

Pairs With (conditional)

• porting-python-capabilities-to-go (LIBRARY) - Porting Python to Go

  • Purpose: Coordinates idiom translation
  • Read(".claude/skill-library/development/capabilities/porting-python-capabilities-to-go/SKILL.md")

• developing-with-subagents (CORE) - Plan has >3 independent tasks

  • Purpose: Fresh subagent per task + two-stage review
  • skill: "developing-with-subagents"

• dispatching-parallel-agents (CORE) - 3+ independent failures

  • Purpose: Parallel investigation of unrelated issues
  • skill: "dispatching-parallel-agents"

• verifying-before-completion (CORE) - Phase 16 completion

  • Purpose: Final verification checklist
  • skill: "verifying-before-completion"

• debugging-systematically (CORE) - Review/test failures

  • Purpose: Systematic debugging when failures repeat
  • skill: "debugging-systematically"

References

Phase Files

• [Phase 1-16 references listed above]

Supporting Documentation

• Agent Matrix - Agent selection by capability type
• Capability Types - VQL, Nuclei, Janus, Fingerprintx, Scanner comparison
• Checkpoint Configuration - Human approval points
• Compaction Gates - BLOCKING context management
• Directory Structure - Capability workspace organization
• Emergency Abort - Safe workflow termination
• File Scope Boundaries - Parallel agent conflict prevention
• Progress Persistence - Cross-session resume
• Quality Standards - Capability-specific quality metrics
• Rationalization Table - Capability-specific rationalizations
• Tight Feedback Loop - Implementation->Review->Test cycles
• Troubleshooting - Common issues and solutions

Prompt Templates

• prompts/architect-prompt.md - Phase 7 leads
• prompts/developer-prompt.md - Phase 8 developers
• prompts/reviewer-prompt.md - Phase 11 reviewers
• prompts/tester-prompt.md - Phase 13 testers

External Sources

Related Skills

• orchestrating-feature-development - Similar pattern for feature development
• orchestrating-integration-development - Similar pattern for third-party integrations
• orchestrating-nerva-development - Specialized pattern for fingerprintx modules
• persisting-progress-across-sessions - Cross-session persistence for long-running capabilities
• developing-with-subagents - Same-session subagent execution with code review