Turn an empty folder into a working, tested, secured project. Use when the user says "/genesis", "create the project", "start a new project", "scaffold this", or begins greenfield work. Follows a STRICT order: lay the mandatory foundation (constitution, skills, AGENTS.md, docs, hardened sandbox) FIRST, then research the problem, then design the architecture, THEN choose the stack, then plan, then build autonomously under an Opus overlord with specialist workers. Never asks about the stack first. Greenfield only. ALSO RESUMES a paused run — triggers on "resume genesis", "resume the paused genesis build", "continue the genesis build", or the presence of a .scratch/resume.json checkpoint (see Phase R).
Generate a complete pull request from the branch diff and open or update it. Use when the user asks to create/open a PR, fill the PR template, or mentions "/generate-pr". Two modes by where you stand: from a feature branch it targets `dev` (default); from `dev` it targets `main` (promotion PR). Fills EVERY section of .github/pull_request_template.md grounded in the diff, and runs `gh pr create`/`gh pr edit`. Honors DRY_RUN=1 to emit out/pr-body.md instead of touching GitHub.
The project constitution AND the reasoning method. Apply it in ALL planning and execution of non-trivial work: reason like a proof system — hold the axioms fixed, derive each step from them, order work as a topological sort of its dependency DAG, treat every uncertain claim as a conjecture with an attached experiment, and prove the postcondition (observed, not hoped) before declaring done. Universally: make illegal states unrepresentable, keep changes surgical, and verify with a real run. And — where the project has a generative/AI component — keep the deterministic/generative seam typed, give every shown fact provenance, and degrade to a deterministic fallback. If a request or lower document conflicts with an axiom here, the constitution wins — fix the other (or escalate the conflict; do not silently obey).
UI/UX craft standards and a design process to apply BEFORE and DURING any interface work — so genesis output looks and feels high quality, not low-effort. Use whenever the project has a UI: before building screens/components, when styling, choosing a design system, or reviewing UI quality, and on any mention of design, UX, layout, component, screen, styling, theme, responsive, or accessibility. Defines design tokens, the full set of component/screen states (incl. empty/loading/error), responsive + accessibility (WCAG AA) requirements, and a UI definition-of-done. Pairs with the design and a11y specialist workers.
Launch the optional local PWA dashboard for a genesis build, so a less-technical user can set up and watch everything outside Claude Code. Use when the user says "/genesis-dashboard", "open the dashboard", "show me a UI", "I want buttons", or wants to monitor/configure a genesis run visually. Starts a dependency-free localhost server that renders live state (stage, TODO, activity, usage) and lets the user connect integrations with a button. Optional — the terminal flow works without it.
Manage reusable genesis seeds and one-time machine setup. Use when the user says "/genesis-seed", "save this as a seed", "save my setup", "list seeds", "edit the seed", or "set up my machine for genesis". Writes/loads named, AI-authored configuration seeds (so the user never hand-writes config) and performs the once-per-machine bootstrap (optional rtk detection, global plugin install guidance, ccusage check for usage-guard).
Generate images, video, audio, or other media via external AI providers, with Claude authoring the prompts and orchestrating the calls. Use when the user asks to generate/create an image, video, audio, icon, or asset, refine a generation prompt, or wire a media/AI provider. Provider-agnostic: works with any provider that has an adapter + an API key in .env (Google, OpenAI, and others — not a fixed list). Claude writes the prompt, calls the API, saves the asset to assets/, and logs cost. Never prints API keys.
Run a security pass over the project or a change, one concern at a time, and turn findings into TODO tasks. Use before declaring work done, when the user says "/security-audit", "check security", "audit this", "is this safe", or after wiring an integration. Builds the checklist from general application-security concerns plus the per-integration security items from the integrations registry (PCI surface for payments, RLS for Supabase, IAM scope for storage, webhook signatures, secret handling, authz, injection, SSRF). Wraps the bundled security-review where available. Reports findings with severity + evidence; never prints secrets.