gareth.photography

Drives technical design decisions, writes proposals before any significant change is implemented, and maintains the proposal index. Thinks in systems — considers module boundaries, data flow, schema strategy, infrastructure topology, and trade-offs before implementation detail.

The full feature development cycle as a numbered checklist — from proposal through implementation, review, infosec sign-off, decision logging, and PR. Defines when each agent handoff happens, the dedicated path for infrastructure changes, and how to handle iteration loops.

Interactively creates or updates OpenCode skills. Asks structured questions about the skill's purpose, responsibilities, workflow, and MCP tool usage, then produces a correctly formatted SKILL.md and registers it in the skills README.

Captures and maintains architectural and technical decisions in docs/decisions/ using the ADR format. Keeps the decision index up to date. Triggered whenever a technology is chosen, a pattern is adopted, a trade-off is made, or a proposal is accepted.

Writes production-quality TypeScript and Infrastructure-as-Code using TDD (red-green-refactor). Follows project conventions exactly — thin controllers, typed API clients, ConfigService-only env access, strict TypeScript, declarative infra with pinned versions and remote state.

Performs security and compliance reviews (ISO27001-aligned by default) on staged changes and pull requests. Audits encryption, access control, audit logging, secrets handling, IAM, network exposure, dependency vulnerabilities, and data lifecycle. Returns an APPROVED / REQUIRES CHANGES / APPROVED WITH EXCEPTION verdict, mapped to the relevant control. Read-only — never edits code.

Interactive MCP server setup — presents a menu of available MCP servers (Context7, GitHub, Filesystem, Memory, Squirrel Notes, Semgrep) and writes the chosen config into opencode.json; invoked automatically by project-bootstrap and project-onboard.

Interactive bootstrap for new projects. Asks the user a structured set of questions and produces a complete, filled-in CLAUDE.md and Project Context block for all skills. Covers application stack, infrastructure-as-code, observability, and security/compliance posture, with sensible defaults for each. Run this once at the start of a new project before using any other skill.

Interactive onboarding for an existing codebase. Investigates the repository to infer the answers that project-bootstrap would normally ask the user, then produces a complete CLAUDE.md and Project Context block. Asks the user only for intent, compliance posture, settled decisions, and to confirm or correct anything ambiguous. Run this once when adopting these skills on an existing project.

Reviews staged changes and pull requests for security, correctness, performance, infrastructure safety, observability, and convention adherence. Returns a PASS / PASS WITH COMMENTS / BLOCK verdict with severity-labelled findings and explicit traceability back to proposal Acceptance Criteria.

Pulls the latest skills from the upstream repository and reports what changed. Run this to keep all skills up to date.

The full feature development cycle as a numbered checklist — from proposal through implementation, review, infosec sign-off, decision logging, and PR. Defines when each agent handoff happens, the dedicated path for infrastructure changes, and how to handle iteration loops.