execution git:20261015.05c65fdA

Immutable. This exact content never changes and is served at /api/v1/blob/8901e92e8ef3951d.

---
name: execution
description: Use when the specialist that requested a T3 operation or COMMAND_SET is resumed after the user granted it
---

# Approved Execution

The approved work runs in the specialist that requested it, resumed by the
orchestrator; the signature belongs to that agent and session. Approval does
not turn the orchestrator into an executor and does not broaden scope.

## Source boundary

For Gaia components, edit only the canonical `gaia/` source tree. Never write,
copy, generate, or stage anything under `.claude/`; installation propagates
source changes. The same prohibition applies to fixtures and bulk operations.

## Ordered execution

1. Read the approval with `gaia approvals show <approval_id>`: its state, its
   commands in order, their directory, and how much of the grant's window is
   left.
2. Run exactly one command per tool call using `command-execution`, byte for
   byte as requested, in its sealed directory. When that directory is not the
   one your Bash runs in, run exactly `cd <sealed directory> && <sealed command>`,
   the only compound accepted. Never join commands otherwise, skip an index,
   substitute an equivalent spelling, or add an unapproved command. A
   still-pending approval is not a reason to stop: attempt the command. If
   Gaia refuses it because the user has not answered yet, end the turn with
   `APPROVAL_REQUEST` and the same approval id; the orchestrator asks the
   user and resumes you after the answer. This is the same in Claude Code and
   OpenCode, and nothing is asked in your session.
3. After every result, checkpoint the exact command, index and exit status.
4. A command that exits with a code its request declared with `--expect-exit`
   has succeeded for the set: continue with the next index. Only a declaration
   made when the set was requested counts; you cannot declare one now. Any other failure
   stops the set; apply `command-execution`'s COMMAND_SET fail-fast rule, then
   use `agent-protocol` to reconcile the result for its consumer.
   An unsigned step of the set (`gaia approvals show` marks it
   `"signed": false`) runs in its position like any other command of yours:
   it holds no index, so it neither spends nor advances the signature.
5. A call the host refused before running it (Claude Code's
   `Permission to use Bash ... has been denied`) spends nothing: the item
   keeps its index and the single-command signature stays usable. Retry the
   same sealed bytes once, as a new call; if the host refuses again, stop and
   report the refusal with the approval id instead of requesting anew. A call
   that never reports back is recorded as no result, not as a failure, and
   does not advance the set. Read its state before deciding anything, and
   request anything still needed as a new request.
   A single-command signature whose command exited non-zero is given back
   once, while its window lasts: retry the same sealed bytes from the same
   directory, and after a second failure investigate and request anew.
6. After successful mutations, verify desired state with separate read-only
   checks. Success exit codes alone are insufficient.
7. Checkpoint verification and emit `NEEDS_VERIFICATION` for a plan-task-bound
   producer; only an eligible unbound turn/verifier may reach `COMPLETE`.

This skill sequences the approved work; it does not duplicate the failure rule
or the consumer reconciliation owned by those two skills.