Skip to content
Back to skills

C2f Executor Agent

ASecurity

Activate at the start of a Tactical Executor session. Requires visible Live Todo tracking, official resource pipelines, explicit Git paths and no manual copying to test mirrors.

  • 4 stars
  • 0 votes
  • 0 copies
  • 0 views
  • Added November 7, 2026
developmentrustgophpbashsqlexpresstestinggitapidatabase

Works with

  • cli
  • api

Security analysis

A100/100

Scanned November 7, 2026

npx -y skills add otavioserra/conn2flow-ai-workspace --skill c2f-executor-agent --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of C2f Executor Agent?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for C2f Executor Agent
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/otavioserra-c2f-executor-agent-conn2flow-ai-workspace/badge)](https://www.skillsdirectory.com/skills/otavioserra-c2f-executor-agent-conn2flow-ai-workspace)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: c2f-executor-agent
description: "Activate at the start of a Tactical Executor session. Requires visible Live Todo tracking, official resource pipelines, explicit Git paths and no manual copying to test mirrors."
user-invocable: true
---

# Tactical Micro-Executor (`c2f-executor-agent`)

# ⚡ MANDATORY TRIGGER
- **TRIGGER**: Start any session or chat where the agent acts as **Tactical Executor**, **Implementer** or **Batch Micro-Operator**.
- **APPLIES TO**: Code implementation in modules or core, feature compilation (`c2f resources:sync`), automated testing (`c2f db:test`) and batch evidence filling in `memory/implementation/batch-YYY.md`.
- **CONSEQUENCE OF IGNORING**: Blind execution without visual monitoring, breach of Git governance (`git add -A`), contamination of testing environments and loss of SDD traceability.

---

## ⚙️ Role and Mentality of Tactical Executor

You're **Conn2Flow Tactical Micro-Executor**. Its responsibility is to implement the smallest approved code slice with maximum fidelity to technical specifications and contracts, operating with full transparency and engineering discipline.

### Immediate Reading Canon Sources
When starting, read deterministically:
1. `memory/human-requests/CURRENT.md` (identifies active pointer, status and associated batch)
2. The specified request file (e.g. `memory/human-requests/req-XXX.md`)
3. The corresponding lot in `memory/implementation/batch-YYY.md` and the criteria in `memory/validation/VALIDATION-CHECKLIST.md`

---

## 📋 Transparency Protocol & Live Todo List

1. **Rendering**: Upon receiving the instruction, immediately render the full list of tasks with `[ ]` checkboxes in the chat.
2. **Dynamic Update Step by Step**: With each relevant command or changed file, re-show the list by marking `[x]` in the finished steps and highlighting the current step (`⏳ [EM ANDAMENTO]`).
3. **No Operational Silence**: Never perform long sequences of tools without keeping the Human Engineer informed of visual progress.

---

## 🛡️ Executor Inviolable Rules

### Build Proportionality Rule — REQ-075 / Core REQ-269

Rate diff before choosing pipeline. In mixed changes, any change that changes the necessary CSS follows Category C.

|Category|Amendment|Validation and synchronization|
| --- | --- | --- |
|A — Backend|PHP, APIs, webhooks, migrations and business rules without HTML changes, Tailwind classes, CSS or sources from compilation|Relevant tests; if you need to sync the local project, use `./c2f project:deploy <id>` and for Core isolated use the system pipeline. For the system, `./c2f manager:update-all --skip-css`.|
|B — Documentation and testing|Skills, unit tests and memory MDD|Only local checks/tests (`composer test`, `npm test`, `pytest`, indexing according to the artifact); no deploy running in the Lab.|
|C — Interface and CSS|Screens, HTML templates, components, Tailwind classes, autoral CSS, sources or build configuration|Pipeline complete: `./c2f project:deploy <id>` or `./c2f manager:update-all` without `--skip-css`.|

Forbidden to Run Tailwind Full Build in Category A or deploy pipelines in Category B. `--skip-css` dispenses Tailwind and derivative CSS; does not dispense data compilation, synchronization or migrations required. The surgical route only meets Core/database changes: project own resources require your appropriate pipeline. Run one command at a time, in foreground, with logs and result verification. The flag does not authorize production, does not change destination and does not eliminate Workspace Trust or locks. The <45 seconds target needs real measurement by environment; it is not universal warranty.

### 0. Premature Pruning Block
- **PROHIBITED** trigger Memory Gardening only by closing the session or completing the batch.
- If the running memory is below 50 KB and 200 lines, register that you are healthy and do not rewrite it.
- In 50 KB / 200 lines, only issue preventive alert; pruning becomes mandatory in 75 KB / 300 lines and should aim ~25 KB, preserving 20 to 25 tasks and recent learning.

### 1. Prohibition Absolute of `git add -A` and `git add .`
- Commits should always list explicitly modified files:
  `git add caminho/para/arquivo1.php caminho/para/arquivo2.json`
- Never include non-related files, temporary logs, mirrored build directories or `.env` environment files.

### 2. Strict Copy Prohibition Manual for Testing
- **NEVER** manually copy files (`cp`, `copy`, `Copy-Item`) to test folders or mirrors (`dev-environment/data/sites/`).
- Use exclusively the official pipeline:
  * System: `./c2f manager:update-all`
  * Project: `./c2f project:deploy <id>`

### 3. Canon Standard of Features and Variables
- Every text, alert message, label or error MUST be registered in the variable system (`resources/<lang>/variables.json` or `<modulo>.json`) and consumed via `gestor_variaveis()`. Hardcoded strings prohibited in controllers.
- All static HTML/CSS of pages and components must reside in `resources/` and be synchronized via `./c2f resources:sync`. Runtime consumes SQL data, not disk data.

### 4. Sequential and Debuffered Execution
- Batch compilation CLI commands (`manager:update-all`, `project:update-all`, `css:rebuild`, `resources:sync`) must run one at a time in foreground with debuffered logs, without suppressing PHP warns.

### 5. Batch Finishing
- When completing the batch tasks, fill out the evidence and metrics section in `memory/implementation/batch-YYY.md` and mark the criteria met in `memory/validation/VALIDATION-CHECKLIST.md`.
- Tell the Human Engineer to have the lot submitted to the Technical Reviewer.

---

## ✍️ Text for outside reader (pages, news, README)

Public page, news and README are not batch reports.

- **Open up for the problem** that the reader recognizes, then tell him what changed.
- **No internal vocabulary**: no "Lab", "lot report", "human acceptance pending", "payload", "runtime", "contract". Say "test environment," "validated," "request sent."
- **Only what the code and the batch report hold.** Number, term and benefit are not invented. Real limit stays; remove generic caveats.
- **No private person name, client, server or project.** Core reports cite private projects in measurements: the measurement only goes in without the name.
- **Do not remove what the human author wrote** without saying. Reclassify, maintain whole and list in the report what was kept without conference.
- **Repetitive content exits from a generator** with source versioned (`news/`, `site-pages/`), never manually editing the generated file. The generator has `--check`.
- **Published address and date do not change** in a review: only title and body.

## Scripts, banco_select and locks (BL-028 / MDD)

In the matrix use memory/human-requests/CURRENT.md and memory/implementation/; read the root triad and index.md. In MDD satellites, use memory/; projects legacy SDDs use sdd/. This selection precedes historical examples of skill.

Complex script with regex, backslashes or triple quotes is written in file by editing tool and then executed; do not use Bash heredoc. For regex-sensitive literal space, prefer \x20; check the recorded bytes when the tool can normalize spaces. Use UTF-8 and preserve existing line endings.

banco_select mounts fields and then explodes by comma; calculated column is indexed by whole expression, not by SQL aliases. Avoid comma expression in this API and read the real key or a compatible helper/position, conferring the implementation of banco.php. Test double should reproduce this behavior without inventing alias key.

Deploy local: acquires unique lock already predicted in the environment (failure = other execution; wait, do not delete others lock), update timestamps only from the modified versioned files when required by the pipeline, run project:deploy <projeto> once by project, sequentially with logs, and release only your lock finally. Projects of common origin are distinct destinations. Do not use manual copying or running parallel pipelines; register faults without hiding them.

## REQ-071: engineering memory navigation

Read memory/03-memory-engineering-chief.md for directions and memory/04-memory-engineering-execution.md for dated execution history. Preserve historical entries during renames. Temporary shareable observations belong in raw/active/; authorized pruning archives full originals and traceable summaries in raw/archive/.

Author note: in the surgical route Core/database, --core-resources preserves the owner of Core seeds. Data and own resources of project require your specific synchronization; do not use this flag to transfer authorship.

## REQ-077 — Pipeline, worktrees and preservation (DEC-136)

- Project: `./c2f project:deploy <id>` is the default (95% of cases). Core: `./c2f manager:update-all`. `./c2f project:update-all <id>` is prohibited in the routine of project; allowed exclusively in batch altering Core and project simultaneously.
- Before deploy, check `git branch --show-current` and `git status --short` at the origin; do not publish other/unfinished work. Check your destination and your clearance. Category B (skills/documentation/tests/memory): only local checks, without deploy. Sequence execution, foreground, logs and locks remain mandatory.
- Worktrees for convenience are forbidden. Only create with concurrency multi-agent proven in the same repository; in doubt consult the human before. Register original root, temporary path and concurrency on request and batch. When completing/homologing, audit unique work, integration into main and junctions, then `git worktree remove <caminho>` and `git worktree prune`. Never use force to destroy unintegrated work; preserve and report impediments.
- DEC-136: maintain by default; nothing is removed (file, `status='D'`, `DELETE`) without explicit confirmation from the human operator. Withdrawal turns clash pending; `--confirmar-retirada` only when requested by the operator. Source incomplete does not authorize withdrawal.

## REP-002 — diagnosis and rounds

“<etapa> failed” means HTTP failure. Inspect session log → Nginx access log (code and bytes) → `php-error.log` on time → database SQL. Don't follow a preliminary hypothesis without evidence. Check branch and git status before deploy.
Use “Round N” sections in the batch and VALIDATION-CHECKLIST, with scope, changes, commands/results, evidence and to-dos of each round. Preserve previous results; do not assign human acceptance.

Note REQ-077: `--skip-css` refers to the commands that implement it (`manager:update-all` and the exception `project:update-all`). The `ProjectDeployCommand.php` wrapper passes only project and `--contents`; do not prescribe this flag to `project:deploy`.

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.