shillinq

Reset the OpenRegister development environment (stop, remove volumes, restart, install apps)

Create a Pull Request from the current branch — runs local checks, picks target branch, and opens the PR on GitHub

Analyze a project's OpenSpec from 8 persona perspectives and suggest additional features

Detect admin settings Vue components registered in the vue-router. Admin settings are rendered by Nextcloud's settings framework via `AdminSettings.php`; adding their Vue components to the in-app router exposes them as publicly-accessible frontend routes, bypassing all server-side access checks. ADR-004 hard rule. Observed 2026-04-30 on doriath where `/settings → AdminRoot` was a route in `src/router/index.js` (commit c7c72e9).

Run `composer audit` to check composer.lock dependencies for known CVEs. Invoked by the builder before push and the reviewer's mandatory block. Mirrors the orchestrator's `composer-audit` quality gate.

Scan lib/ for forbidden debug helpers (var_dump / die / error_log / print_r / dd / dump) that should not ship. Invoked by the builder before push, by the reviewer as Mandatory Step 2, and by the fixer during a retry. Mirrors the orchestrator's `forbidden-patterns` quality gate.

Detect DOM data-attribute reads in `.vue`/`.js`/`.ts` files (e.g. `document.getElementById('x').dataset.version`) used to pull server-side data into the frontend. The Nextcloud-idiomatic pattern is `IInitialState::provideInitialState()` in PHP + `loadState()` from `@nextcloud/initial-state` in Vue. DOM data-attributes break on CSP-hardened instances and bypass the canonical pattern documented in ADR-004. Observed 2026-04-30 on doriath where `AdminRoot.vue` read `document.getElementById('doriath-settings').dataset.version`.

Detect `<NcModal>` or `<NcDialog>` markup written inline inside parent components. Every modal/dialog MUST live in its own `.vue` file under `src/modals/` (NcModal-based) or `src/dialogs/` (NcDialog-based) and be imported by the parent. Inline modals couple presentation to the parent's lifecycle, prevent reuse, and bloat the parent component. ADR-004 hard rule. Observed 2026-04-30 on doriath.

Detect `<NcSelect>` usages without an `inputLabel` (or `ariaLabelCombobox`) prop. Manual `<label>` elements paired with NcSelect break the component's internal accessibility wiring (WCAG 2.1 AA Success Criteria 1.3.1 and 4.1.2); the built-in props are required for correct screen-reader association. ADR-004 hard rule. Observed 2026-04-30 on doriath.

Detect controller methods with `#[NoAdminRequired]` / `@NoAdminRequired` that lack a per-object or admin authorization guard in the method body. Without a guard, any authenticated user can invoke the endpoint on arbitrary object IDs — classic IDOR (OWASP A01:2021 / ADR-005 Rule 3). Observed 2026-04-21 on decidesk#44 where 4 MinutesController methods shipped without guards.

Detect authorization/validation service methods that are defined but never called. Observed 2026-04-21 on decidesk#60 — `isTransitionAllowed()`, `requiresChairAuthorization()`, `validateQuorum()` were all implemented but never invoked from the state-change caller, leaving dead auth code while the pipeline reported green. A defined-but-unused auth method is identical to having no check at all (OWASP A01:2021).

Verify every controller method registered in appinfo/routes.php declares its auth posture via a Nextcloud attribute or docblock tag. Missing `#[PublicPage]` / `#[NoAdminRequired]` / `#[NoCSRFRequired]` / `#[AuthorizedAdminSetting(...)]` silently makes an endpoint unreachable — NC middleware rejects the request before the controller runs. Observed 2026-04-21 on decidesk#47.

Detect controller methods where the Nextcloud auth annotation does not match the method's actual authorization requirement. Observed 2026-04-23 on decidesk#44 where the builder satisfied gate-5 (route-auth) by adding `#[NoAdminRequired]` to SettingsController::load() even though the method body calls `requireAdmin()`. Gate-5 accepted any auth attribute; this gate catches the semantic mismatch.

Enforce @license + @copyright PHPDoc tags on every PHP file under lib/. Invoked by the builder before push, by the reviewer as the first Mandatory Step, and by the fixer during a retry cycle. Mirrors the orchestrator's `spdx-headers` quality gate exactly.

Detect stub code — "In a complete implementation" comments, empty `run()` bodies in BackgroundJob files, unused injected dependencies, hardcoded fetch stubs in Vue `fetch*()` methods. Invoked by the builder before push, the reviewer's mandatory block, and the fixer during retry. Mirrors the orchestrator's `stub-scan` quality gate.

Detect `catch (\Throwable) { return null; }` patterns in service methods that resolve auth/authorization/permission/role services. The nullable return shape enables a silent-fail-open pattern where the caller treats "service unavailable" as "check skipped" (OWASP A01:2021 / CWE-863). Observed 2026-04-21 on decidesk#45 where `DecisionApprovalService::getAuthorizationService()` returned null on Throwable and the caller guarded the role check with `if ($auth !== null)`, letting any authed user advance decisions when the service was briefly unavailable.

Run all thirteen Hydra mechanical quality gates (SPDX, forbidden-patterns, stub-scan, composer-audit, route-auth, orphan-auth, no-admin-idor, unsafe-auth-resolver, semantic-auth, initial-state, admin-router, nc-input-labels, modal-isolation) via the shared script and summarise the failures. Invoked by the builder's Rule 0b wrapper (mechanically, on every iteration) and by the reviewer / security reviewer's mandatory first step. Single source of truth lives in scripts/run-hydra-gates.sh.

Append one tutorial story to a journeydoc-bootstrapped Conduction app — drops a markdown page + a capture-spec test block + sidebar entry, all in one PR. See ADR-030.

Bootstrap journeydoc — capture-driven user documentation — into a Conduction app. Drops the 8-artifact scaffold (tutorials/, capture spec, Playwright project, Docusaurus config, domain wiring, screenshot output dir) and opens a PR. See ADR-030.

Add stable `data-testid` attributes to a Vue component so the journeydoc capture spec can target it reliably. Audits one file, proposes the additions, applies after confirmation, runs vitest. See ADR-030.

Run the full Hydra pipeline locally (builder → reviewer → security)

Apply Bucket 1 `@spec` tags from a coverage report — creates a ghost change and opens an annotation-only PR (Experimental)

Iteratively run apply→verify in a loop until verify passes, then auto-archive — runs per-app in Docker context

Implement tasks from an OpenSpec change (Experimental)

Archive a completed change in the experimental workflow

Archive multiple completed changes at once

Continue working on a change - create the next artifact (Experimental)

Audit a legacy app for spec ↔ code coverage — produces a 6-bucket report before retrofit annotation (Experimental)

Enter explore mode - think through ideas, investigate problems, clarify requirements

Create a change and generate all artifacts needed for implementation in one go (Blocks Haiku)

Start a new change using the experimental artifact workflow (OPSX)

Guided onboarding - walk through a complete OpenSpec workflow cycle with narration

Process multiple OpenSpec changes in parallel using subagents — full lifecycle from proposal to merged PR

Convert an OpenSpec change's tasks.md into a plan.json and create a GitHub Issue for progress tracking

Reverse-engineer a spec from observed code — one Bucket 2 cluster per run, creates a ghost change with spec delta + tasks + annotations (Experimental)

Sync delta specs from a change to main specs

Verify implementation matches change artifacts before archiving

Audit a codebase or architecture for post-compromise persistence vectors — OAuth grants, service accounts, CI/CD secrets, IdP trust, audit trails, and endpoint persistence

Daily end-of-day report — scans local repos and the user's GitHub activity today, suggests committing/pushing uncommitted changes, creating PRs for orphan branches, and lifecycle actions on tracking issues (close, follow-up); ends with a copy-paste Dutch Slack report-out message

Review one or more GitHub Pull Requests — detects re-reviews, asks strictness level (Quick/Standard/Thorough/Strict), posts 🔴/🟡/🟢 inline comments per finding, and submits APPROVE or REQUEST_CHANGES via the GitHub API. Accepts multiple PR URLs/numbers for parallel batch review.