القائمة
Go modules dependency management. go.mod/go.sum, versioning, replace directives, vendoring, private modules, workspaces. 100% Go-specific.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Spec-driven development workflow. Main Claude acts as the lead — spawns critic/scout/architect/builder/tester/reviewer as subagents, enforces human-in-the-loop gates at every phase boundary via AskUserQuestion, records every decision in docs/specs/<slug>/group-log.md. Load this skill whenever the user invokes /define, /orchestrate, /plan, /build, or /ship; whenever a task spans multiple files, packages, or concerns; whenever design decisions need review before implementation; whenever an in-progress spec under docs/specs/<slug>/ needs to resume; or whenever you're about to coordinate critic/scout/architect/builder/tester/reviewer in a sequence. This is the correct skill for any multi-step engineering task that benefits from gated, auditable execution — do not try to coordinate specialists ad-hoc.
Artifact contract for docs/specs/<slug>/ — spec.md template, frontmatter schema (task/status/current_group/total_groups/created/updated), spec directory layout, contracts-trigger rules, and parallelization markers ([P]). Load this skill whenever you're creating a new docs/specs/<slug>/ directory, authoring or editing spec.md, checking whether an existing spec matches the template (e.g., during review, resumption, or session-start scan), validating frontmatter values, or deciding whether a task needs contracts.md. Pair with core/orchestration, which owns the workflow that populates these artifacts.
Author and maintain a project constitution at docs/constitution.md — the list of invariants that reviewer and critic enforce on every spec and every diff. Load this skill whenever you're creating a new constitution from scratch or from EXAMPLE_CONSTITUTION.md, proposing candidate invariants via /constitution-propose, adding or editing an invariant, sunsetting an obsolete rule, or promoting a recurring "don't do X" review comment into an enforced invariant. Also use when a post-incident review surfaces a rule that should have been caught mechanically. Reviewer and critic consume the registered invariants automatically via the project_constitution session-start field — you do not need this skill for enforcement, only for authoring.
Ground a task in the existing codebase before specification — grep for prior art, read similar features, surface inherited gotchas, write discovery.md. Load this skill whenever you're running scout during /define or /orchestrate, whenever a task touches an area of the codebase you have not read in this session, whenever the task mentions a feature name that might already exist, or whenever recent_learnings flags a gotcha or pattern near the task. Prevents specs built on phantom assumptions.
Decision tree for routing any task to the right agent and skill set. Loaded on session start and consulted whenever you're unsure which specialist applies, which skill combination to load for a given task, or when main Claude (running core/orchestration) needs to decide which subagent to spawn for a Phase 3 subtask. Also surfaces available CLI tools, MCP servers, and user-installed skills/agents/plugins so you can prefer what's actually on the machine.
Output compression for human-facing responses. Use when responding to users in a terminal, writing end-of-turn summaries, explaining diffs, producing status updates, or any non-artifact output addressed to a human reader. Specifies what to compress (articles, filler, pleasantries, hedging) and what to leave full-fidelity (SPEC files, agent-to-agent reports, commands, code blocks, paths, acceptance criteria, inline docstrings). Triggered automatically by the /compact slash command and loaded by all agents by default.
| name | go/modules |
| description | Go modules dependency management. go.mod/go.sum, versioning, replace directives, vendoring, private modules, workspaces. 100% Go-specific. |
Minimal version selection. Semantic import versioning. Reproducible builds.
module github.com/yourorg/project/v2 // v2+ requires /vN suffix
require github.com/external/pkg/v3 v3.1.0
v0/v1: no suffix. v2+: /v2 in module path and imports.
replace (
github.com/yourorg/shared => ../shared // Local dev
github.com/original/pkg => github.com/fork/pkg v1.2.3 // Fork
)
Remove before releasing. Local development only.
Use vendoring only when: air-gapped CI, hermetic builds required, corporate proxy restrictions. Otherwise use Go module proxy (default).
go mod vendor && go build -mod=vendor
export GOPRIVATE="github.com/yourorg/*"
git config --global url."git@github.com:".insteadOf "https://github.com/"
go work init ./api ./worker ./shared # Creates go.work
go work sync # Sync go.mod files
Never commit go.work or go.work.sum. Add both to .gitignore. Workspace mode is a local development convenience for multi-module repos — it lets you edit a dependency and see the change immediately in the dependents without a replace directive. But CI must build each module from its own go.mod + go.sum, not through go.work, otherwise the build becomes non-reproducible (results depend on which sibling modules happen to be present at build time).
govulncheck ./... # Run before releases and in CI
go get modifies go.mod. go install installs binaries without touching go.mod.
Two checks CI should enforce on every PR:
# Fail if go.mod or go.sum would be modified by `go mod tidy`
go mod tidy -diff || {
echo "go.mod or go.sum out of sync — run 'go mod tidy' locally and commit" >&2
exit 1
}
# Fail on known vulnerabilities in the current dependency graph
govulncheck ./...
The tidy -diff check catches the common failure mode where a developer adds an import but forgets to run go mod tidy, leaving go.sum out of sync. The govulncheck catches transitive-dep CVEs that only surface when the graph is walked.
| Scenario | Action |
|---|---|
| Bug fix | Patch: v1.2.3 -> v1.2.4 |
| New feature (backward compat) | Minor: v1.2.3 -> v1.3.0 |
| Breaking change | Major: v1.2.3 -> v2.0.0 |
go.sum — always commit both go.mod and go.sum; go.sum is what makes builds reproduciblereplace in production — remove before releasing; a replace pointing to a fork or a local path breaks downstream consumersgo mod tidy — run after every dependency change; CI should enforce this via go mod tidy -diff@latest — go get foo@latest resolves at that moment; six months later a different version ships, your build changes, and nobody knows why. Pin to an exact version (go get foo@v1.2.3) and bump deliberately.go.work — workspace mode is local-only; committing it makes CI builds non-reproduciblegovulncheck before release — vulnerabilities in transitive deps are the common case; scan every release buildgo mod tidy -diff produces no output (module files already clean)go.sum is committed alongside go.modgo.work and go.work.sum are in .gitignore (never committed)replace directives in go.mod for production builds@latest)govulncheck ./... passes with no known vulnerabilitiesgo mod tidy -diff and govulncheck on every PR