fragile

Writes production-quality application code and Infrastructure-as-Code using TDD (red-green-refactor). Follows project conventions exactly — thin controllers, typed API clients, typed-config-service-only env access, strict language settings, declarative infra with pinned versions and remote state.

Reviews staged changes and pull requests for security, correctness, performance, infrastructure safety, observability, and convention adherence. Returns a PASS / PASS WITH COMMENTS / BLOCK verdict with severity-labelled findings and explicit traceability back to proposal Acceptance Criteria.

Upgrades a project from rules v1 (monolithic RULES.md) to v2 (language-agnostic core + per-stack overlay). Detects the active stack, injects the `## Active Skillset` line into CLAUDE.md, updates rule links, flags duplicated v1 rule text, and re-runs the relevant installer scripts. Run once per project after pulling the v2 skills via /update-skills.

Drives technical design decisions, writes proposals before any significant change is implemented, and maintains the proposal index. Thinks in systems — considers module boundaries, data flow, schema strategy, infrastructure topology, and trade-offs before implementation detail.

Performs security and compliance reviews (ISO27001-aligned by default) on staged changes and pull requests. Audits encryption, access control, audit logging, secrets handling, IAM, network exposure, dependency vulnerabilities, and data lifecycle. Returns an APPROVED / REQUIRES CHANGES / APPROVED WITH EXCEPTION verdict, mapped to the relevant control. Read-only — never edits code.

Interactive bootstrap for new projects. Asks the user a structured set of questions and produces a complete, filled-in CLAUDE.md and Project Context block for all skills. Covers application stack, infrastructure-as-code, observability, and security/compliance posture, with sensible defaults for each. Run this once at the start of a new project before using any other skill.

Interactive onboarding for an existing codebase. Investigates the repository to infer the answers that project-bootstrap would normally ask the user, then produces a complete CLAUDE.md and Project Context block. Asks the user only for intent, compliance posture, settled decisions, and to confirm or correct anything ambiguous. Run this once when adopting these skills on an existing project.

Pulls the latest skills from the upstream repository and reports what changed. Run this to keep all skills up to date.

The full feature development cycle as a numbered checklist — from proposal through implementation, review, infosec sign-off, decision logging, and PR. Defines when each agent handoff happens, the dedicated path for infrastructure changes, and how to handle iteration loops.

Interactively creates or updates OpenCode skills. Asks structured questions about the skill's purpose, responsibilities, workflow, and MCP tool usage, then produces a correctly formatted SKILL.md and registers it in the skills README.

Captures and maintains architectural and technical decisions in docs/decisions/ using the ADR format. Keeps the decision index up to date. Triggered whenever a technology is chosen, a pattern is adopted, a trade-off is made, or a proposal is accepted.

Interactive MCP server setup — presents a menu of available MCP servers (Context7, GitHub, Filesystem, Memory, Squirrel Notes, Semgrep, Jira) and writes the chosen config into opencode.json; invoked automatically by project-bootstrap and project-onboard.

Loads a Jira ticket by URL or issue key, extracts the description and acceptance criteria, and drives the full create-feature cycle with that ticket as the requirement source.