genesis

Turn an empty folder into a working, tested, secured project. Use when the user says "/genesis", "create the project", "start a new project", "scaffold this", or begins greenfield work. Follows a STRICT order: lay the mandatory foundation (constitution, skills, AGENTS.md, docs, hardened sandbox) FIRST, then research the problem, then design the architecture, THEN choose the stack, then plan, then build autonomously under an Opus overlord with specialist workers. Never asks about the stack first. Greenfield only. ALSO RESUMES a paused run — triggers on "resume genesis", "resume the paused genesis build", "continue the genesis build", or the presence of a .scratch/resume.json checkpoint (see Phase R).

Generate a complete pull request from the branch diff and open or update it. Use when the user asks to create/open a PR, fill the PR template, or mentions "/generate-pr". Two modes by where you stand: from a feature branch it targets `dev` (default); from `dev` it targets `main` (promotion PR). Fills EVERY section of .github/pull_request_template.md grounded in the diff, and runs `gh pr create`/`gh pr edit`. Honors DRY_RUN=1 to emit out/pr-body.md instead of touching GitHub.

The project constitution AND the reasoning method. Apply it in ALL planning and execution of non-trivial work: reason like a proof system — hold the axioms fixed, derive each step from them, order work as a topological sort of its dependency DAG, treat every uncertain claim as a conjecture with an attached experiment, and prove the postcondition (observed, not hoped) before declaring done. Universally: make illegal states unrepresentable, keep changes surgical, and verify with a real run. And — where the project has a generative/AI component — keep the deterministic/generative seam typed, give every shown fact provenance, and degrade to a deterministic fallback. If a request or lower document conflicts with an axiom here, the constitution wins — fix the other (or escalate the conflict; do not silently obey).

UI/UX craft standards and a design process to apply BEFORE and DURING any interface work — so genesis output looks and feels high quality, not low-effort. Use whenever the project has a UI: before building screens/components, when styling, choosing a design system, or reviewing UI quality, and on any mention of design, UX, layout, component, screen, styling, theme, responsive, or accessibility. Defines design tokens, the full set of component/screen states (incl. empty/loading/error), responsive + accessibility (WCAG AA) requirements, and a UI definition-of-done. Pairs with the design and a11y specialist workers.

Launch the optional local PWA dashboard for a genesis build, so a less-technical user can set up and watch everything outside Claude Code. Use when the user says "/genesis-dashboard", "open the dashboard", "show me a UI", "I want buttons", or wants to monitor/configure a genesis run visually. Starts a dependency-free localhost server that renders live state (stage, TODO, activity, usage) and lets the user connect integrations with a button. Optional — the terminal flow works without it.

Manage reusable genesis seeds and one-time machine setup. Use when the user says "/genesis-seed", "save this as a seed", "save my setup", "list seeds", "edit the seed", or "set up my machine for genesis". Writes/loads named, AI-authored configuration seeds (so the user never hand-writes config) and performs the once-per-machine bootstrap (optional rtk detection, global plugin install guidance, ccusage check for usage-guard).

Generate images, video, audio, or other media via external AI providers, with Claude authoring the prompts and orchestrating the calls. Use when the user asks to generate/create an image, video, audio, icon, or asset, refine a generation prompt, or wire a media/AI provider. Provider-agnostic: works with any provider that has an adapter + an API key in .env (Google, OpenAI, and others — not a fixed list). Claude writes the prompt, calls the API, saves the asset to assets/, and logs cost. Never prints API keys.

Run a security pass over the project or a change, one concern at a time, and turn findings into TODO tasks. Use before declaring work done, when the user says "/security-audit", "check security", "audit this", "is this safe", or after wiring an integration. Builds the checklist from general application-security concerns plus the per-integration security items from the integrations registry (PCI surface for payments, RLS for Supabase, IAM scope for storage, webhook signatures, secret handling, authz, injection, SSRF). Wraps the bundled security-review where available. Reports findings with severity + evidence; never prints secrets.

Consult the project's trusted-sources registry before searching the web or adding a dependency/tool, and ground every shown fact in a verified origin. Use when the user asks to search/research/look something up, find docs or an API signature, choose or add a dependency/library/tool, or mentions "/sources". Reads docs/SOURCES.md, prefers its Tier-1 trusted sources, version-pins to the project stack, vets any new dependency with the both-ends advisory check, records the decision, and flags anything un-corroborated as a conjecture. Never invents a citation, version, or stat; never adds an unvetted/typosquatted package.

Run the full verification battery and block on red before any commit/PR. Use before /git-commit, before claiming a task done, or when the user says "run the tests", "is it green?", "verify before commit", or mentions "/test-gate". Discovers the commands from AGENTS.md §5 and docs/TESTING.md, brings up hermetic Docker infra if a compose file exists, runs lint → typecheck → unit → property → contract → integration (→ e2e) fail-fast, reads the real output, and refuses to proceed on any failure. Never reports passing without having watched it pass; never prints secrets from env or logs.

Maintain the project's master TODO — the internal backlog in docs/TODO.md and its dated archive docs/TODO-done.md. Use when adding/updating/sorting TODO items, marking something in-progress/implemented/verified/done, asking "what should I do next", or mentioning "/todo". Uses explicit status markers ([ ] not started, [~] in progress, [?] implemented-but-unverified), a separate [P] priority marker, verification type (🤖 auto vs 🙋 needs-human), and exposure tags. Orders by priority → ease → dependency count. On done-AND-verified, moves the item into docs/TODO-done.md under today's real date. Never ticks an item done without its verify having actually passed, and never invents a date.

Keep an autonomous run inside Claude Code subscription usage limits and resume it automatically after they reset. Use when the user asks about usage limits, auto-pause, auto-resume, or "don't let it die at 100%", and internally by the genesis overlord between work items. Estimates current 5-hour-window usage from ccusage; at a threshold (default 85%, below 100% on purpose) it stops starting new work/subagents so in-flight workers aren't killed, checkpoints state, and halts cleanly. Ships an external launchd resumer that relaunches Claude after the window resets.