Post a customer-voice product update to
Pick up a Linear task and execute it on a fresh branch through local validation. Invoked via `/checkout` (no args → pick the highest-priority unblocked issue in the ProductFlash team) or `/checkout <LINEAR-ID>` (e.g. `/checkout PF-12` → work that specific issue). Loads the Linear issue into context, branches from main, executes, validates locally. Stops before PR — use `/open-pr` next to ship. Pairs with CLAUDE.md (Karpathy rules + stack + hard rules — don't restate them here).
Ship the current branch — open a PR, wait for CI, squash-merge into main, and move the Linear issue to Done. Invoked via `/open-pr` (no args; always operates on the current branch). Picks up where `/checkout` left off. Assumes local validation is already done; pairs with CLAUDE.md (Karpathy + hard rules apply).
Create a new Linear task in the ProductFlash team. Invoked via `/task <one-line description>` or `/task` (then ask). Captures title, description, labels, blockers/dependencies, and optionally fast-tracks it (state=Todo + priority=Urgent) so `/checkout` picks it up next. Optimized for low-friction capture — one round of clarifying questions max.
Perform a read-only architecture and code-quality audit of a TypeScript web/SaaS codebase. Covers SOLID (as applicable), DRY/KISS/YAGNI/POLA, file-structure compliance, module coupling & cohesion, colocation, client/server/isomorphism boundaries, abstraction discipline, naming consistency, type-safety hygiene, and error-handling patterns. Produces one ranked report with severity, finding kind (Violation vs Smell), evidence (file:line), and a concrete remediation. Use whenever the user asks for an "arch review", "architecture audit", "code-quality review", "SOLID check", "code smells", "structure review", "DRY/KISS audit", or similar. Never modifies code — read-only by contract.
Perform a comprehensive read-only security audit of a web/SaaS codebase. Covers authentication & tenant isolation, route/endpoint exposure, secret leaks, SQL/ORM injection, XSS/CSRF/SSRF/open redirect, LLM cost-abuse and prompt injection, dependency supply-chain risks, and OWASP basics. Produces a single ranked report with severity, likelihood, impact, evidence (file:line), and remediation. Use whenever the user asks for a "security audit", "security review", "pentest of the code", "look for vulns", "OWASP review", "LLM abuse surface", or similar. Never modifies files — read-only by contract.
Perform a read-only audit of the codebase's test pyramid. Two halves of equal weight: (1) find critical flows lacking coverage; (2) audit *existing* tests for false confidence — shape-only assertions, tautological mocks, skipped/.only blocks, brittle selectors, tests that pass for the wrong reason. A green suite that doesn't exercise behavior is at least as dangerous as a missing one. Assumes Vitest for unit/integration and Playwright for e2e/smoke. Pragmatic by contract: does NOT chase 100% line coverage — focuses on logic, branching, money math, auth/tenant filters, and user-visible flows. Produces one ranked report with severity, finding kind (Gap vs Defect), evidence (file:line), and a concrete suggested fix. Use whenever the user asks for a "test audit", "test coverage review", "test pyramid health check", "audit our tests", "what should we test", or similar. Never modifies test code — read-only by contract.