Menu
Dev Agent - Implement items from .claude/ISSUES.md (bugs first) and .claude/BACKLOG.md (features second)
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Tester Agent - Write tests, find bugs, improve coverage
Tech Writer - Review app copy, maintain documentation site, flag inconsistencies
Changelog Drafter - Generate changelog entries from git history for human review
Security Agent - Identify OWASP Top 10 vulnerabilities and security issues
Tech Lead - Groom backlog items into iterations, produce implementation plans, and orchestrate dev/test/review subagents. Use when a backlog item is too large for a single /dev pass.
Compliance Agent - Verify architectural principles and design patterns
| name | dev |
| description | Dev Agent - Implement items from .claude/ISSUES.md (bugs first) and .claude/BACKLOG.md (features second) |
Implement items from .claude/ISSUES.md (bugs first) and .claude/BACKLOG.md (features second).
Read .claude/THOUGHT_ERRORS.md to avoid past mistakes.
Request → Router → Service → Database → PostgreSQL
app/pages.pystr fields in Pydantic input schemas must have max_length (names 255, descriptions 2000, URLs 2048, enums 50)fetch() calls to /api/ endpoints must use WeftUtils.apiFetch(), not bare fetch(). The server enforces a CSRF token on the session-cookie auth path — bare fetch() will fail with 403.const/let (no var), arrow functions, template literals, optional chaining. See .claude/references/js-patterns.md.<script type="application/json" id="page-data"> blocks. Inline script bodies must contain no Jinja2 {{ }} expressions (only the nonce attribute and {% %} block tags are allowed).All list/table views follow these rules:
Layout: Full-width using {% block content_wrapper %}mx-auto px-4 py-8{% endblock %} before {% block content %}. No max-w-* on the outer div.
Navigation: The primary identifier (name, event type, error type) is an <a href> link to the detail page. No separate "Actions" column with icons or "View" links.
Link styling: class="text-sm font-medium text-blue-600 dark:text-blue-400 hover:text-blue-900 dark:hover:text-blue-300"
Row hover: Every data <tr> in <tbody> gets class="hover:bg-gray-50 dark:hover:bg-gray-700" (combine with any conditional classes like opacity).
Dates: Use fmt_relative() for all date/time columns. Show relative text, full datetime on hover:
{% set rel = fmt_relative(item.created_at) %}
<td class="..." title="{{ rel[1] }}">{{ rel[0] }}</td>
Reference templates: saml_idp_list.html (canonical example), users_list.html (with search, filters, pagination).
Lists with bulk actions (e.g., group member management) follow additional rules:
<a href="/users/{{ id }}">) with standard blue link styling (same classes as List View Conventions)cursor-pointer.<div id="bulk-action-bar"> shown/hidden based on selection countWeftUtils.stickyActionBar() in {% block extra_scripts %}.Reference templates: groups_members.html (remove pattern), groups_members_add.html (add pattern).
app/Dockerfile (dev) and Dockerfile at the project root (production). If you change dependencies, static asset paths, or the app/ directory structure in the dev Dockerfile, check whether the production Dockerfile needs the same change.pyproject.toml, then run poetry install to update the installed package metadata. app/version.py reads from importlib.metadata in dev and falls back to a baked-in VERSION file in production images.docs/VERSIONING.md for the full policy on what constitutes patch, minor, and major changes. Identity-specific rules exist because seemingly minor SAML changes can silently break federation trust.During active development, use watch mode for immediate feedback:
make watch-tests # Auto-rerun only affected tests on file changes
This runs only tests affected by your changes, providing fast feedback (seconds instead of minutes). First run builds coverage database, then intelligently selects relevant tests.
When you create a new migration file in db-init/migrations/, apply it to the running dev database before running tests:
make migrate # Apply pending migrations to dev DB
Database tests run against the actual schema. If you skip this step, any test that touches the affected table will fail with a missing-column error.
Migrations must be backwards compatible (safe to apply on a running instance). The compliance checker (--check migration-safety) flags dangerous operations:
DROP COLUMN, DROP TABLE, RENAME COLUMN/TABLE, ADD COLUMN NOT NULL without DEFAULTALTER COLUMN TYPE, SET NOT NULL, CREATE INDEX without CONCURRENTLYADD COLUMN (nullable or with DEFAULT), CREATE TABLE, ADD CONSTRAINT, CREATE INDEX CONCURRENTLYFor breaking changes, use a multi-step approach: add new column, deploy code that uses it, backfill, then drop old column in a later migration.
If a migration intentionally contains a breaking change (e.g., cleanup after a prior code deploy), add -- migration-safety: ignore on its own line to suppress the check.
make fix # Lint, format, type check, compliance
make test # Tests (full suite)
Both must pass.
tests/database/), service unit tests, and route/API integration testsDistinguish between:
/pm to add it as a backlog item first.When done:
When invoked programmatically (via Agent tool), skip all interactive workflows:
Instead:
.claude/THOUGHT_ERRORS.mdmake migrate before testsmake build-cssmake fix (lint, format, types, compliance) and fix any issuesmake test and fix any failures. Both must pass.Report back:
make fix result (clean, or what was fixed)make test result (pass count, any failures with details)Read .claude/ISSUES.md first, then .claude/BACKLOG.md if empty, and present available items.