garethrhughes

Writes production-quality application code and Infrastructure-as-Code using TDD (red-green-refactor). Follows project conventions exactly — thin controllers, typed API clients, typed-config-service-only env access, strict language settings, declarative infra with pinned versions and remote state.

Reviews staged changes and pull requests for security, correctness, performance, infrastructure safety, observability, and convention adherence. Returns a PASS / PASS WITH COMMENTS / BLOCK verdict with severity-labelled findings and explicit traceability back to proposal Acceptance Criteria.

Upgrades a project from rules v1 (monolithic RULES.md) to v2 (language-agnostic core + per-stack overlay). Detects the active stack, injects the `## Active Skillset` line into CLAUDE.md, updates rule links, flags duplicated v1 rule text, and re-runs the relevant installer scripts. Run once per project after pulling the v2 skills via /update-skills.

Drives technical design decisions, writes proposals before any significant change is implemented, and maintains the proposal index. Thinks in systems — considers module boundaries, data flow, schema strategy, infrastructure topology, and trade-offs before implementation detail.

Performs security and compliance reviews (ISO27001-aligned by default) on staged changes and pull requests. Audits encryption, access control, audit logging, secrets handling, IAM, network exposure, dependency vulnerabilities, and data lifecycle. Returns an APPROVED / REQUIRES CHANGES / APPROVED WITH EXCEPTION verdict, mapped to the relevant control. Read-only — never edits code.

Interactive bootstrap for new projects. Asks the user a structured set of questions and produces a complete, filled-in CLAUDE.md and Project Context block for all skills. Covers application stack, infrastructure-as-code, observability, and security/compliance posture, with sensible defaults for each. Run this once at the start of a new project before using any other skill.

Interactive onboarding for an existing codebase. Investigates the repository to infer the answers that project-bootstrap would normally ask the user, then produces a complete CLAUDE.md and Project Context block. Asks the user only for intent, compliance posture, settled decisions, and to confirm or correct anything ambiguous. Run this once when adopting these skills on an existing project.

Pulls the latest skills from the upstream repository and reports what changed. Run this to keep all skills up to date.

Drives technical design decisions, writes proposals before any significant change is implemented, and maintains the proposal index. Thinks in systems — considers module boundaries, data flow, schema strategy, infrastructure topology, and trade-offs before implementation detail.

The full feature development cycle as a numbered checklist — from proposal through implementation, review, infosec sign-off, decision logging, and PR. Defines when each agent handoff happens, the dedicated path for infrastructure changes, and how to handle iteration loops.

Interactively creates or updates OpenCode skills. Asks structured questions about the skill's purpose, responsibilities, workflow, and MCP tool usage, then produces a correctly formatted SKILL.md and registers it in the skills README.

Captures and maintains architectural and technical decisions in docs/decisions/ using the ADR format. Keeps the decision index up to date. Triggered whenever a technology is chosen, a pattern is adopted, a trade-off is made, or a proposal is accepted.

Writes production-quality TypeScript and Infrastructure-as-Code using TDD (red-green-refactor). Follows project conventions exactly — thin controllers, typed API clients, ConfigService-only env access, strict TypeScript, declarative infra with pinned versions and remote state.

Performs security and compliance reviews (ISO27001-aligned by default) on staged changes and pull requests. Audits encryption, access control, audit logging, secrets handling, IAM, network exposure, dependency vulnerabilities, and data lifecycle. Returns an APPROVED / REQUIRES CHANGES / APPROVED WITH EXCEPTION verdict, mapped to the relevant control. Read-only — never edits code.

Interactive MCP server setup — presents a menu of available MCP servers (Context7, GitHub, Filesystem, Memory, Squirrel Notes, Semgrep) and writes the chosen config into opencode.json; invoked automatically by project-bootstrap and project-onboard.

Interactive bootstrap for new projects. Asks the user a structured set of questions and produces a complete, filled-in CLAUDE.md and Project Context block for all skills. Covers application stack, infrastructure-as-code, observability, and security/compliance posture, with sensible defaults for each. Run this once at the start of a new project before using any other skill.

Writes production-quality application code and Infrastructure-as-Code using TDD (red-green-refactor). Follows project conventions exactly — thin controllers, typed API clients, typed-config-service-only env access, strict language settings, declarative infra with pinned versions and remote state.

Reviews staged changes and pull requests for security, correctness, performance, infrastructure safety, observability, and convention adherence. Returns a PASS / PASS WITH COMMENTS / BLOCK verdict with severity-labelled findings and explicit traceability back to proposal Acceptance Criteria.

Interactive onboarding for an existing codebase. Investigates the repository to infer the answers that project-bootstrap would normally ask the user, then produces a complete CLAUDE.md and Project Context block. Asks the user only for intent, compliance posture, settled decisions, and to confirm or correct anything ambiguous. Run this once when adopting these skills on an existing project.

Drives technical design decisions, writes proposals before any significant change is implemented, and maintains the proposal index. Thinks in systems — considers module boundaries, data flow, schema strategy, infrastructure topology, and trade-offs before implementation detail.

Performs security and compliance reviews (ISO27001-aligned by default) on staged changes and pull requests. Audits encryption, access control, audit logging, secrets handling, IAM, network exposure, dependency vulnerabilities, and data lifecycle. Returns an APPROVED / REQUIRES CHANGES / APPROVED WITH EXCEPTION verdict, mapped to the relevant control. Read-only — never edits code.

Interactive bootstrap for new projects. Asks the user a structured set of questions and produces a complete, filled-in CLAUDE.md and Project Context block for all skills. Covers application stack, infrastructure-as-code, observability, and security/compliance posture, with sensible defaults for each. Run this once at the start of a new project before using any other skill.

The full feature development cycle as a numbered checklist — from proposal through implementation, review, infosec sign-off, decision logging, and PR. Defines when each agent handoff happens, the dedicated path for infrastructure changes, and how to handle iteration loops.

Interactively creates or updates OpenCode skills. Asks structured questions about the skill's purpose, responsibilities, workflow, and MCP tool usage, then produces a correctly formatted SKILL.md and registers it in the skills README.

Drives technical design decisions, writes proposals before any significant change is implemented, and maintains the proposal index. Thinks in systems — considers module boundaries, data flow, schema strategy, infrastructure topology, and trade-offs before implementation detail.

Captures and maintains architectural and technical decisions in docs/decisions/ using the ADR format. Keeps the decision index up to date. Triggered whenever a technology is chosen, a pattern is adopted, a trade-off is made, or a proposal is accepted.

Writes production-quality application code and Infrastructure-as-Code using TDD (red-green-refactor). Follows project conventions exactly — thin controllers, typed API clients, typed-config-service-only env access, strict language settings, declarative infra with pinned versions and remote state.

Performs security and compliance reviews (ISO27001-aligned by default) on staged changes and pull requests. Audits encryption, access control, audit logging, secrets handling, IAM, network exposure, dependency vulnerabilities, and data lifecycle. Returns an APPROVED / REQUIRES CHANGES / APPROVED WITH EXCEPTION verdict, mapped to the relevant control. Read-only — never edits code.

Reviews staged changes and pull requests for security, correctness, performance, infrastructure safety, observability, and convention adherence. Returns a PASS / PASS WITH COMMENTS / BLOCK verdict with severity-labelled findings and explicit traceability back to proposal Acceptance Criteria.

Interactively selects an existing blog post, applies user-directed edits, and stamps the post with a last-modified date at the bottom of the page.

Loads a blog post draft from Squirrel Notes, proofreads and improves it, converts it to the project's markdown post format with the current UTC time as the publish date, writes the file, then marks the note as published.

Interactively configures OpenCode plugins for a project. Presents a menu of available plugins, collects any required credentials, and writes the chosen config into opencode.json. Invoked automatically by project-bootstrap and project-onboard.

Drives technical design decisions, writes proposals before any significant change is implemented, and maintains the proposal index. Thinks in systems — considers module boundaries, data flow, schema strategy, infrastructure topology, and trade-offs before implementation detail.

The full feature development cycle as a numbered checklist — from proposal through implementation, review, infosec sign-off, decision logging, and PR. Defines when each agent handoff happens, the dedicated path for infrastructure changes, and how to handle iteration loops.

Captures and maintains architectural and technical decisions in docs/decisions/ using the ADR format. Keeps the decision index up to date. Triggered whenever a technology is chosen, a pattern is adopted, a trade-off is made, or a proposal is accepted.

Writes production-quality application code and Infrastructure-as-Code using TDD (red-green-refactor). Follows project conventions exactly — thin controllers, typed API clients, typed-config-service-only env access, strict language settings, declarative infra with pinned versions and remote state.

Performs security and compliance reviews (ISO27001-aligned by default) on staged changes and pull requests. Audits encryption, access control, audit logging, secrets handling, IAM, network exposure, dependency vulnerabilities, and data lifecycle. Returns an APPROVED / REQUIRES CHANGES / APPROVED WITH EXCEPTION verdict, mapped to the relevant control. Read-only — never edits code.

Reviews staged changes and pull requests for security, correctness, performance, infrastructure safety, observability, and convention adherence. Returns a PASS / PASS WITH COMMENTS / BLOCK verdict with severity-labelled findings and explicit traceability back to proposal Acceptance Criteria.

Apply the garethrhughes/local dotfiles setup to an existing system without a full reinstall. Symlink configs, install missing tools, and bring a machine up to date with the repo — selectively, non-destructively.

Diagnose and fix issues found by doctor.sh in the garethrhughes/local dotfiles repo. Run the health check, interpret failures and warnings, then repair them by patching install.sh, doctor.sh, or running targeted fix commands.