Delegate bounded coding tasks to isolated Claude sessions

Acts as an orchestrator that delegates one bounded coding task to a separate Claude Code CLI implementer session, then reviews what it produced and lands it itself: the orchestrator writes the brief and owns the judgment, the separate Claude session edits the working tree, and the orchestrator verifies and commits. It only applies after a human explicitly asks for delegation to another Claude Code process, never as a signal for the current Claude to implement the task directly, and it skips the small tasks that don't need delegation, cases where the claude CLI is missing or unauthenticated, and tasks needing a stronger host boundary than Claude Code's tool permissions and shell-only sandbox, which call for an isolated container or VM instead.

Prerequisites: claude --version succeeds; claude auth status reports an authenticated session (on macOS, if the orchestrator's own sandbox blocks Keychain access, claude can fall back to a stale credentials file and falsely report loggedIn: false, so the check and the dispatch itself should be re-run with that sandbox escalated or outside it before concluding the CLI is unauthenticated); the target repository is the directory passed with --cd; and on Linux/WSL2, Claude's sandbox dependencies are installed, since the normal relay profile is configured to fail rather than silently run shell commands unsandboxed.

The workflow runs in five steps. Writing the brief matters because the separate session has no orchestrator chat history and receives only the brief on stdin plus the ability to inspect the target working tree; Claude Code auto-discovers the target project's CLAUDE.md and local configuration since the relay doesn't use --bare, but it does not generically auto-load AGENTS.md, so load-bearing constraints and the real gate commands from AGENTS.md must be copied into the brief by hand, the implementer told not to commit, and one task kept per brief (template in references/writing-the-brief.md). Dispatch runs the relay script:

node "<skill-dir>/scripts/relay.mjs" --brief brief.txt --cd /path/to/repo

with options for read-only review/diagnosis, resuming the latest or a recorded session, turn/budget limits, and a hard timeout; the relay itself runs claude -p --output-format stream-json --verbose, sends the brief through stdin, writes artifacts under the system temp directory by default, and never uses --bg/--bare and never commits (detailed in references/dispatch-and-poll.md). Waiting blocks until Claude exits, either via the orchestrator's background-command facility or by running in the foreground; a pre-run usage error exits 2 with no result.json, a missing claude exits 127 with status: "claude_unavailable", and a timeout or caught signal terminates the whole implementer process tree while preserving an outcome artifact; on completion, finalMessage, touchedFiles, resultSubtype and raw artifact paths are read from result.json.

Review treats the implementer's report and gate outcomes as claims, not facts: edits to existing tests are checked before a green gate means anything, the project's actual gates are re-run independently, the complete diff against the brief is read starting with touchedFiles, untracked and staged content is inspected alongside the ordinary diff, and any installed guard skills are run (full checklist in references/review-and-land.md). Landing is the orchestrator's job alone, committing only after gates pass and the diff holds; rework resumes the same Claude session with a delta brief rather than starting over, reviewed exactly like the first run.

The normal permission profile is deliberately explicit: acceptEdits permission mode; built-in tools restricted to Read, Glob, Grep, Edit, Write and the platform shell; on macOS, Linux and WSL2, Claude's shell sandbox is enabled with startup failure on missing dependencies and no unsandboxed retry, auto-approving sandboxed commands so ordinary gates run headlessly while merged local or managed sandbox settings can still widen the effective boundary; configured MCP discovery and Claude.ai connectors are disabled, all MCP tools denied, and skills, commands and Claude's own Agent tool are unavailable to the child, though project CLAUDE.md, hooks, normal authentication and session persistence still load; and string rules deny common direct shell forms of git commit, git push, nested claude, and any command containing claude-delegate, though aliases, scripts and wrappers can bypass them, making them only a speed bump behind the brief's no-commit instruction and the orchestrator's own review. Native Windows lacks Claude's shell sandbox; the relay restricts the tool surface and pre-approves PowerShell for a non-interactive run, but that shell isn't OS-isolated, and Windows verification is stated as pending.

--read-only switches to plan mode with only Read, Glob and Grep, removing edit, write and shell paths, then compares parsed git porcelain and fingerprints the working-tree identity and index entries of already-dirty Git-visible paths; the resulting readOnlyViolation flag is true when either signal proves a change, false when coverage is complete and finds none, and null when coverage is incomplete, since ignored paths and perfect restores fall outside it, local hooks can still write, and concurrent changes can't be attributed to Claude. --dangerously-skip-permissions is an explicit opt-in to Claude's bypassPermissions mode, keeping the restricted tool surface, deny rules and supported-platform sandbox, but letting direct file tools cross normal permission boundaries, and it's used only with the human's explicit acceptance.

It's complementary to native Claude coordination features like subagents, agent teams and background sessions, which suit the case where the current Claude environment is already the orchestrator; this skill instead provides a cross-orchestrator contract of self-contained brief, dispatch, artifacts, review and land, keeping the commit with the orchestrator throughout. Further references cover writing the brief, dispatch and polling flags/failure recovery, the review-and-land checklist, and sequential multi-task queues with progress tracking and constraint carry-forward.

Use it when a human explicitly asks for delegation of a bounded coding task to a separate Claude Code implementer session that the orchestrator will review and land. Skip it when the human asked the current agent to implement directly, the task is small enough to do inline without a delegation request, the claude CLI is missing or unauthenticated, or the task needs a stronger host boundary than Claude Code's sandbox provides.

Input is a self-contained brief (task, load-bearing constraints, real gate commands) plus the target repository path. Output is a result.json artifact with finalMessage, touchedFiles, and resultSubtype, plus the implementer's diff for the orchestrator to review and, if it holds, commit.

Dispatches to a separate claude CLI session via scripts/relay.mjs, restricted by Claude's shell sandbox and MCP/skill-denial permission profile; references its own references/writing-the-brief.md, references/dispatch-and-poll.md, references/review-and-land.md, and references/multi-task-queues.md.

An orchestrating agent or human that wants to delegate a bounded coding task to an isolated Claude Code implementer while keeping review and the commit itself.