Cook

---
description: "Execute outstanding tasks from a feature spec using a coordinated dev team"
model: "sonnet"
allowed-tools: "Read, Glob, Grep, Write, Edit, Bash, Task, MultiEdit, TodoWrite"
---

# Cook - Execute Feature Tasks

Execute outstanding tasks from a feature spec folder using a coordinated development team.
This command is the execution step after `/create-feature <name>` has scaffolded the feature.

> **CRITICAL: Continuous Execution**
> Cook runs **continuously until ALL tasks are complete** or the user explicitly stops it.
> Do NOT stop after completing a single phase — immediately proceed to the next phase.
> Only provide a summary report when all tasks are done, context is nearly full, or the user stops.

> **Background Agents**: Always use `run_in_background=true`. Results are gathered via a
> **consolidation subagent** to avoid context overflow.

## Where Features Live

All features are under `features/<name>/` and contain:
- `tasks.md` — the execution checklist (this is what Cook reads and updates)
- `requirements.md` — user stories and acceptance criteria from `/refine-requirements`
- `design.md` — technical design from `/spec`
- `spec.md` — full spec output

Invoke as: `/cook features/<name>`

## Context Window Management

Each agent output is 3–10k tokens. Reading outputs from 5 agents directly adds 15–50k tokens
to your context, causing overflow. Never read agent outputs directly.

### The Solution: Consolidation Pattern

1. Record task IDs as agents are launched
2. Launch a tech-lead consolidation agent with all task IDs
3. Receive only the compact summary (~1–2k tokens)

The tech-lead agent reads all outputs and returns only what you need to continue.

### When to Use Consolidation
- 2+ background agents → always use consolidation
- 1 background agent → use consolidation (consistent pattern)

### Graceful Degradation
If the consolidation agent can't read task outputs (stale IDs, timing), it falls back to
code exploration. Accept this and continue.

## Team Structure

PrettyHog agents follow the model defined in `CLAUDE.md §4`:

| Role | Responsibility |
|------|---------------|
| **Tech Lead** | Coordination, decisions, reading agent outputs, consolidation |
| **Hog Runner** | Core scan execution, store, scan orchestration (`internal/scan/`) |
| **Enumerator** | Scanner implementations, target discovery (`internal/scanner/`) |
| **Results** | Normalisation, diff engine, finding status (`internal/scan/diff.go`, `store.go`) |
| **Export/Crypto** | Exporter, vault, encrypted formats (`internal/export/`, `internal/vault/`) |
| **Fullstack** | Server handlers, routes, UI screens (`internal/server/`, `ui/src/`) |
| **QA/Fixtures** | Tests, golden fixtures, offline test coverage |

Each agent must stay within its responsibility. Agents must not collapse architecture layers.

## Execution Process

```mermaid
flowchart TD
    A[Load features/<name>/tasks.md] --> B[Identify Outstanding Tasks]
    B --> C[Group by Phase]
    C --> D[Execute Current Phase Tasks]
    D --> E[Launch Parallel Agents run_in_background=true]
    E --> F[Consolidate via Tech Lead]
    F --> G[Update tasks.md]
    G --> H{Phase Complete?}
    H -->|No| D
    H -->|Yes| I{More Phases?}
    I -->|Yes| C
    I -->|No| J[Run Mandatory Closing Commands]
    J --> K[Final Summary Report]

Your Task

$ARGUMENTS

Execution Steps

Step 1: Load the Feature

features/<name>/tasks.md     → outstanding tasks (- [ ])
features/<name>/requirements.md → acceptance criteria
features/<name>/design.md    → technical decisions

Also load relevant /context/ files — they are the source of truth for architecture, schema, and security requirements. If context contradicts a task, stop and flag it.

Step 2: Execute Tasks

2a. Launch Implementation Agents

For each task or group of independent tasks, launch the appropriate agent type in background:

• Include: task description, files to modify, acceptance criteria, relevant context files
• Record each task ID
• Batch size: 3–5 agents maximum per round

2b. Consolidate via Tech Lead

After agents complete, launch a tech-lead agent with all task IDs:

• Tech-lead reads outputs from /tmp/claude/-workspaces-prettyhog-/tasks/{task_id}.output
• Extracts: status, files changed, issues encountered
• Returns a compact summary

2c. Reviews (After Implementation)

For any task touching findings, credentials, exports, or storage, launch in parallel:

QA/Fixtures agent:

• Verify acceptance criteria met
• Check tests exist and pass offline (go test ./... -short)
• Verify test fixtures use fake secrets only

Security review (inline — not a separate agent): For PrettyHog, security criteria are non-negotiable and checked as part of every task:

• No plaintext secrets logged or stored
• No credentials persisted unexpectedly
• sanitiseConfig() zeroes all new credential fields
• Error messages do not echo user-supplied secrets

DevOps check:

• go build ./... passes
• go vet ./... passes
• No new external dependencies added without justification

Then consolidate review results via tech-lead agent.

2d. Mandatory Closing Commands

After ALL tasks are complete, run these in order (per CLAUDE.md §9):

1. /no-leak-check — required before any merge touching output, storage, or export
2. /context-sync — update /context/ docs to reflect schema changes, new fields, new API endpoints
3. /code-review — final review pass

Step 3: Update Progress

After each task:

1. Mark complete in tasks.md (- [x])
2. Log any blockers
3. Note any deviations from the design

Step 4: Summary Report

## Cook Session Summary

### Feature: [Name]
### Date: [ISO date]

### Tasks Completed
| Task | Agent | QA | Build |
|------|-------|----|-------|
| 1.1  | ✓     | ✓  | ✓     |

### Files Modified
- `path/file.go` — description

### Key Decisions
- Decision: Rationale

### Outstanding Items
- Task 1.3: Blocked on [reas