YoloSAFE
The Agent Harness for AI-Human Collaboration, inspired by the AI-DLC (AI-Driven Development Lifecycle)
Overview
The Agent Harness for AI-Human Collaboration, inspired by the AI-DLC (AI-Driven Development Lifecycle)
3bb5b08404b5OBSERVED · 2026-10-12Host compatibility
What the documentation claims. We have not run a compatibility test.
| Host | Status | Notes |
|---|---|---|
| codex | mentioned |
What it tells the agent
The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.
---
name: yolo
description: Full-auto AI-DLC pipeline — from prompt to done. Automates the entire Idea -> Proposal -> Execute -> Verify lifecycle.
license: AGPL-3.0
metadata:
author: chorus
version: "0.22.1"
category: project-management
mcp_server: chorus
---
# Yolo Skill
Full-auto AI-DLC pipeline. User provides a prompt; agent drives the entire lifecycle: Idea -> Elaboration -> Proposal -> Review -> Execute -> Verify -> Done.
---
## Overview
`$yolo` automates the complete AI-DLC workflow. You provide a natural language description of what you want built, and the agent handles everything:
1. **Planning** -- create project, idea, self-elaboration, proposal with docs & tasks
2. **Proposal Review** -- proposal-reviewer adversarial loop
3. **Execution** -- wave-based parallel task dispatch via `spawn_agent`
4. **Verification** -- task-reviewer adversarial loop + admin verify
5. **Report** -- completion summary
```
$yolo <prompt>
|
v
Project + Idea + Elaboration + Proposal
|
v
Proposal Reviewer (auto, up to maxProposalReviewRounds)
|
v
Admin Approve --> Tasks materialize
|
v
Wave-based spawn_agent parallel execution
| (dev agent + task-reviewer per task)
v
Admin Verify each wave --> unblock next
|
v
Done. Report summary.
```
**Escape hatch:** Ctrl+C at any time. All created entities (project, idea, proposal, tasks) persist in Chorus. Resume manually via `$develop` or `$review`.
---
## Prerequisites
The API key needs write + admin on every resource it touches:
| Needs | Why |
|------|-----|
| `idea: [write]` | Create ideas, run elaboration |
| `proposal: [write, admin]` | Create proposals; approve them |
| `task: [write, admin]` | Create, execute, verify tasks |
| `project: [write]` | Create the project if none is given |
**Check at startup:**
```
perms = chorus_checkin().agent.permissions
need = { idea: ["write"], proposal: ["write","admin"],
task: ["write","admin"], project: ["write"] }
for resource, actions in need:
missing = [a for a in actions if a not in (perms[resource] or [])]
if missing: ABORT "$yolo needs {resource}: {missing}. Use an Admin-preset API key."
```
---
## Input
```
$yolo <natural language prompt>
$yolo <prompt> --project <project-uuid>
```
- `<prompt>` -- what you want built (becomes the Idea content)
- `--project <uuid>` -- optional; use an existing project instead of creating a new one
---
## Research routing
During planning, follow the Idea and Proposal routes to `$research` ([shared rules](../research/SKILL.md)): Idea before formal clarification once focused, Proposal after reusing evidence and only for new gaps or an explicit request. Carry findings and the request context across wakes and brainstorm; do not restart the same investigation on resume. Preserve the existing yolo decision/review gates. A Tracker Research action is research-only even inside a yolo-associated conversation: use the Idea research-only branch, save/report, and return without advancing to elaboration, proposal submission, or development. A yolo request alone does not prove development started; use actual execution facts.
## Workflow
### Phase 1: Planning
#### Step 1.1: Resolve Project
Parse the arguments for `--project <uuid>`.
**If `--project` is provided:**
```
chorus_get_project({ projectUuid: "<uuid>" })
```
Verify it exists and proceed.
**If not provided**, search for a suitable existing project first:
```
# 1. Search for projects matching the prompt topic
chorus_search({ query: "<key terms from prompt>", entityTypes: ["project"] })
# 2. Or list recent projects to find a match
chorus_list_projects()
```
Review the results. If a project clearly matches the user's intent (same topic, active, relevant scope), use it. If no suitable project exists, create a new one:
```
chorus_admin_create_project({
name: "<short title derived from prompt>",
description: "<1-2 sentence summary of the prompt>"
})
```
#### Step 1.2: Create Idea
```
chorus_pm_create_idea({
projectUuid: "<project-uuid>",
title: "<concise title derived from prompt>",
content: "<full user prompt as-is>"
})
```
Then claim it:
```
chorus_claim_idea({ ideaUuid: "<idea-uuid>" })
```
#### Step 1.3: Self-Elaboration
In $yolo mode, the agent generates elaboration questions and answers them itself -- no `AskUserQuestion` calls. This preserves an audit trail without interrupting the user.
> **Self-elaboration is still a loop.** If answering your own questions surfaces a **new question, contradiction, or gap**, loop back to `chorus_pm_start_elaboration` for another self-answered round before resolving — don't force a resolve over unresolved ambiguity. There is no human gate in YOLO, so the loop exits on **your** judgment that nothing material is left open (round cap 10). Steps 1–2 are one round; repeat them as needed, then resolve once in Step 3.
1. **Generate and submit questions:**
```
chorus_pm_start_elaboration({
ideaUuid: "<idea-uuid>",
depth: "standard",
questions: [
{
id: "q1",
text: "<question about scope, architecture, etc.>",
category: "functional",
options: [
{ id: "a", label: "<option A>" },
{ id: "b", label: "<option B>" }
]
}
// ... 5-8 questions covering functional, technical_context, scope aspects
]
})
```
2. **Answer immediately** (agent selects best options based on the prompt):
```
chorus_answer_elaboration({
ideaUuid: "<idea-uuid>",
roundUuid: "<round-uuid>",
answers: [
{ questionId: "q1", selectedOptionId: "a", customText: "Rationale: ..." },
// ...
]
})
```
3. **Resolve** — in YOLO mode the agent resolves elaboration **autonomously, with no human-confirmation gate** (the human-confirmation requirement that applies to the interactive `$idea` flow is explicitly waived under `$yolo` automation):Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | NA |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (1)
.agents/skills
Gates applied: no_behavioural_pass.
3bb5b08404b5full audit observations/trust-audit/skill/chorus-aidlc__yolo.json · Report an issue / request a re-scanAudit history
Every audit this skill has had.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 3bb5b08404b5 | SAFE | B | 89 | first audit |
Questions
What does the Yolo skill do?
The Agent Harness for AI-Human Collaboration, inspired by the AI-DLC (AI-Driven Development Lifecycle)
Is Yolo safe to install?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean skill reads B.
What can Yolo access on my machine?
The audit observed no filesystem, network or shell use at all in its source.
Which assistants does Yolo work with?
Its documentation mentions codex. That is what the text claims, not a compatibility test we ran.
How current is this page?
The grade is for one exact copy of the source (3bb5b08404b5), read on 2026-10-12. The repository is watched, and a new audit runs when it changes — this is the first audit.